ppeterson / 8 lat, 2 miesiące temu | Download | Plaintext | Odpowiedz |

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2009-12-19 19:32:47
Windows 5.1.2600 Dodatek Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Peterson\USTAWI~1\Temp\uwtdapow.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                          ZwClose [0xB5A186B8]                                                                               <-- ROOTKIT !!!
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                          ZwCreateKey [0xB5A18574]                                                                           <-- ROOTKIT !!!
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                          ZwDeleteValueKey [0xB5A18A52]                                                                      <-- ROOTKIT !!!
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                          ZwDuplicateObject [0xB5A1814C]                                                                     <-- ROOTKIT !!!
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                          ZwOpenKey [0xB5A1864E]                                                                             <-- ROOTKIT !!!
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                          ZwOpenProcess [0xB5A1808C]                                                                         <-- ROOTKIT !!!
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                          ZwOpenThread [0xB5A180F0]                                                                          <-- ROOTKIT !!!
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                          ZwQueryValueKey [0xB5A1876E]                                                                       <-- ROOTKIT !!!
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                          ZwRestoreKey [0xB5A1872E]                                                                          <-- ROOTKIT !!!
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                          ZwSetValueKey [0xB5A188AE]                                                                         <-- ROOTKIT !!!

---- Kernel code sections - GMER 1.0.15 ----

.pak2           C:\WINDOWS\system32\drivers\gvibmod.sys                                                                        entry point in ".pak2" section [0xF765E560]
?               C:\WINDOWS\system32\drivers\gvibmod.sys                                                                        Urządzenie podłączone do komputera nie działa.
PAGE            Ntfs.sys                                                                                                       F74A3E55 4 Bytes  CALL 83B561F9 
init            C:\WINDOWS\system32\drivers\nvax.sys                                                                           entry point in "init" section [0xF78F7B8D]
.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                       section is writeable [0xF62B6340, 0xFFF3F, 0xF8000020]
.text           C:\WINDOWS\System32\nv4_disp.dll                                                                               section is writeable [0xBF012300, 0x234A20, 0xF8000020]

---- User code sections - GMER 1.0.15 ----

.text           C:\WINDOWS\system32\SearchIndexer.exe[2280] kernel32.dll!WriteFile                                             7C810E27 7 Bytes  JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\WINDOWS\system32\services.exe[1152] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW]  003D0002
IAT             C:\WINDOWS\system32\services.exe[1152] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW]        003D0000

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                         83B951E8

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                         SiWinAcc.sys (Windows Accelerator Driver/Silicon Image, Inc.)
AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                         aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                       aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                      aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                      aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                    aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                       SiWinAcc.sys (Windows Accelerator Driver/Silicon Image, Inc.)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                       fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                       aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

---- Services - GMER 1.0.15 ----

Service          (*** hidden *** )                                                                                             [BOOT] gvibmod                                                                                     <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\gvibmod@Type                                                            1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\gvibmod@Start                                                           0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\gvibmod@ErrorControl                                                    0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\gvibmod@Group                                                           Boot Bus Extender
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                               
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                            0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                         0x69 0x28 0x1E 0x85 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\gvibmod@Type                                                                1
Reg             HKLM\SYSTEM\ControlSet003\Services\gvibmod@Start                                                               0
Reg             HKLM\SYSTEM\ControlSet003\Services\gvibmod@ErrorControl                                                        0
Reg             HKLM\SYSTEM\ControlSet003\Services\gvibmod@Group                                                               Boot Bus Extender
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)           
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                0
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                             0x69 0x28 0x1E 0x85 ...

---- EOF - GMER 1.0.15 ----