GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-02-25 21:45:20
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.14 ----

SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwAdjustPrivilegesToken [0xB6EEAA72]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwClose [0xB6EEB01E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwConnectPort [0xB6EECA82]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwCreateFile [0xB6EEC438]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwCreateKey [0xB6EEA1E8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwCreateSymbolicLinkObject [0xB6EEE3E4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwCreateThread [0xB6EEAE1A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwDeleteKey [0xB6EEA62A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwDeleteValueKey [0xB6EEA82A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwDeviceIoControlFile [0xB6EEC744]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwDuplicateObject [0xB6EEE8F0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwEnumerateKey [0xB6EEA940]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwEnumerateValueKey [0xB6EEA9A8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwFsControlFile [0xB6EEC5FA]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwLoadDriver [0xB6EEDEA8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwOpenFile [0xB6EEC294]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwOpenKey [0xB6EEA34A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwOpenProcess [0xB6EEAC40]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwOpenSection [0xB6EEE40E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwOpenThread [0xB6EEAB96]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwQueryKey [0xB6EEAA10]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwQueryMultipleValueKey [0xB6EEA714]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwQueryValueKey [0xB6EEA4F2]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwQueueApcThread [0xB6EEE110]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwReplaceKey [0xB6EE9E6A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwRequestWaitReplyPort [0xB6EED30C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwRestoreKey [0xB6EE9FCC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwResumeThread [0xB6EEE7C0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwSaveKey [0xB6EE9C68]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwSecureConnectPort [0xB6EEC924]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwSetContextThread [0xB6EEAF18]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwSetSecurityObject [0xB6EEDFA2]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwSetSystemInformation [0xB6EEE438]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwSetValueKey [0xB6EEA3A0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwSuspendProcess [0xB6EEE51C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwSuspendThread [0xB6EEE648]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwSystemDebugControl [0xB6EEDDD4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwTerminateProcess [0xB6EEACEA]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             ZwWriteVirtualMemory [0xB6EEAD5C]

Code            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             FsRtlCheckLockForReadAccess
Code            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                             IoIsOperationSynchronous

---- Kernel code sections - GMER 1.0.14 ----

.text           ntkrnlpa.exe!FsRtlCheckLockForReadAccess                                                                        804EAF2E 5 Bytes  JMP B6F011E8 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)
.text           ntkrnlpa.exe!IoIsOperationSynchronous                                                                           804EF718 5 Bytes  JMP B6F015A2 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)
.text           ntkrnlpa.exe!ZwCallbackReturn + 2F80                                                                            80503C64 12 Bytes  [ 1C, E5, EE, B6, 48, E6, EE, ... ]

---- User code sections - GMER 1.0.14 ----

?               C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe[748] C:\WINDOWS\system32\kernel32.dll   time/date stamp mismatch; 
.text           C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe[748] USER32.dll!VRipOutput + FFFA5010   77D42A78 4 Bytes  [ 70, 11, 41, 6D ]
?               C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe[1752] C:\WINDOWS\system32\kernel32.dll  time/date stamp mismatch; 
.text           C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe[1752] USER32.dll!VRipOutput + FFFA5010  77D42A78 4 Bytes  [ 70, 11, 41, 6D ]

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT             \SystemRoot\system32\DRIVERS\tcpip.sys[TDI.SYS!TdiRegisterDeviceObject]                                         [B981E530] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT             \SystemRoot\system32\DRIVERS\netbt.sys[TDI.SYS!TdiRegisterDeviceObject]                                         [B981E530] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

---- Devices - GMER 1.0.14 ----

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                        kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                       kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                       kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                     kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                        fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device          \FileSystem\Cdfs \Cdfs                                                                                          DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions)

---- EOF - GMER 1.0.14 ----