GMER 1.0.15.15641 - http://www.gmer.net Rootkit scan 2012-03-06 19:28:51 Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 Maxtor_6G160P0 rev.KA201V00 Running: o7ktz0il.exe; Driver: C:\DOCUME~1\Kucza\USTAWI~1\Temp\fwxoqfog.sys ---- Kernel code sections - GMER 1.0.15 ---- ? RGRCZ@J@ Nazwa pliku, nazwa katalogu lub składnia etykiety woluminu jest niepoprawna. ! ? system32\drivers\xpsec.sys System nie może odnaleźć określonej ścieżki. ! ? system32\drivers\xcpip.sys System nie może odnaleźć określonej ścieżki. ! ---- User code sections - GMER 1.0.15 ---- .text C:\WINDOWS\System32\alg.exe[392] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 00BF9D85 .text C:\WINDOWS\System32\alg.exe[392] WS2_32.dll!send 71A54C27 5 Bytes JMP 00BF98B1 .text C:\WINDOWS\System32\alg.exe[392] WS2_32.dll!WSARecv 71A54CB5 5 Bytes JMP 00BF9C37 .text C:\WINDOWS\System32\alg.exe[392] WS2_32.dll!recv 71A5676F 5 Bytes JMP 00BF9A03 .text C:\WINDOWS\System32\alg.exe[392] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 00BF9AD6 .text C:\Program Files\Canon\CAL\CALMAIN.exe[716] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 00E09D85 .text C:\Program Files\Canon\CAL\CALMAIN.exe[716] WS2_32.dll!send 71A54C27 5 Bytes JMP 00E098B1 .text C:\Program Files\Canon\CAL\CALMAIN.exe[716] WS2_32.dll!WSARecv 71A54CB5 5 Bytes JMP 00E09C37 .text C:\Program Files\Canon\CAL\CALMAIN.exe[716] WS2_32.dll!recv 71A5676F 5 Bytes JMP 00E09A03 .text C:\Program Files\Canon\CAL\CALMAIN.exe[716] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 00E09AD6 .text C:\WINDOWS\system32\winlogon.exe[768] Secur32.dll!LsaLogonUser 77FE33D8 5 Bytes JMP 01442C81 .text C:\WINDOWS\system32\Pen_Tablet.exe[1468] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 01769D85 .text C:\WINDOWS\system32\Pen_Tablet.exe[1468] WS2_32.dll!send 71A54C27 5 Bytes JMP 017698B1 .text C:\WINDOWS\system32\Pen_Tablet.exe[1468] WS2_32.dll!WSARecv 71A54CB5 5 Bytes JMP 01769C37 .text C:\WINDOWS\system32\Pen_Tablet.exe[1468] WS2_32.dll!recv 71A5676F 5 Bytes JMP 01769A03 .text C:\WINDOWS\system32\Pen_Tablet.exe[1468] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 01769AD6 .text C:\WINDOWS\Explorer.EXE[1752] USER32.dll!DisplayExitWindowsWarnings 7E3A9F91 5 Bytes JMP 01AA2A93 .text C:\WINDOWS\Explorer.EXE[1752] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 02599D85 .text C:\WINDOWS\Explorer.EXE[1752] WS2_32.dll!send 71A54C27 5 Bytes JMP 025998B1 .text C:\WINDOWS\Explorer.EXE[1752] WS2_32.dll!WSARecv 71A54CB5 5 Bytes JMP 02599C37 .text C:\WINDOWS\Explorer.EXE[1752] WS2_32.dll!recv 71A5676F 5 Bytes JMP 02599A03 .text C:\WINDOWS\Explorer.EXE[1752] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 02599AD6 .text C:\Program Files\Bonjour\mDNSResponder.exe[1840] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 00A69D85 .text C:\Program Files\Bonjour\mDNSResponder.exe[1840] WS2_32.dll!send 71A54C27 5 Bytes JMP 00A698B1 .text C:\Program Files\Bonjour\mDNSResponder.exe[1840] WS2_32.dll!WSARecv 71A54CB5 5 Bytes JMP 00A69C37 .text C:\Program Files\Bonjour\mDNSResponder.exe[1840] WS2_32.dll!recv 71A5676F 5 Bytes JMP 00A69A03 .text C:\Program Files\Bonjour\mDNSResponder.exe[1840] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 00A69AD6 .text C:\Program Files\Mozilla Firefox\firefox.exe[3028] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 01265B60 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) .text C:\Program Files\Mozilla Firefox\plugin-container.exe[3064] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 04DB9D85 .text C:\Program Files\Mozilla Firefox\plugin-container.exe[3064] WS2_32.dll!send 71A54C27 5 Bytes JMP 04DB98B1 .text C:\Program Files\Mozilla Firefox\plugin-container.exe[3064] WS2_32.dll!WSARecv 71A54CB5 5 Bytes JMP 04DB9C37 .text C:\Program Files\Mozilla Firefox\plugin-container.exe[3064] WS2_32.dll!recv 71A5676F 5 Bytes JMP 04DB9A03 .text C:\Program Files\Mozilla Firefox\plugin-container.exe[3064] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 04DB9AD6 .text C:\Program Files\Mozilla Firefox\plugin-container.exe[3064] USER32.dll!SetWindowLongA 7E37C29D 5 Bytes JMP 106C01A3 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) .text C:\Program Files\Mozilla Firefox\plugin-container.exe[3064] USER32.dll!SetWindowLongW 7E37C2BB 5 Bytes JMP 106C0135 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) .text C:\Program Files\Mozilla Firefox\plugin-container.exe[3064] USER32.dll!GetWindowInfo 7E37C49C 5 Bytes JMP 10450924 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) .text C:\Program Files\Mozilla Firefox\plugin-container.exe[3064] USER32.dll!TrackPopupMenu 7E3B531E 5 Bytes JMP 10450ECF C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) .text C:\Program Files\Skype\Phone\Skype.exe[3104] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 05A89D85 .text C:\Program Files\Skype\Phone\Skype.exe[3104] WS2_32.dll!send 71A54C27 5 Bytes JMP 05A898B1 .text C:\Program Files\Skype\Phone\Skype.exe[3104] WS2_32.dll!WSARecv 71A54CB5 5 Bytes JMP 05A89C37 .text C:\Program Files\Skype\Phone\Skype.exe[3104] WS2_32.dll!recv 71A5676F 5 Bytes JMP 05A89A03 .text C:\Program Files\Skype\Phone\Skype.exe[3104] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 05A89AD6 .text D:\Programy\Tlen.pl\tlen.exe[3560] WS2_32.dll!closesocket 71A53E2B 5 Bytes JMP 02899D85 .text D:\Programy\Tlen.pl\tlen.exe[3560] WS2_32.dll!send 71A54C27 5 Bytes JMP 028998B1 .text D:\Programy\Tlen.pl\tlen.exe[3560] WS2_32.dll!WSARecv 71A54CB5 5 Bytes JMP 02899C37 .text D:\Programy\Tlen.pl\tlen.exe[3560] WS2_32.dll!recv 71A5676F 5 Bytes JMP 02899A03 .text D:\Programy\Tlen.pl\tlen.exe[3560] WS2_32.dll!WSASend 71A568FA 5 Bytes JMP 02899AD6 ---- Devices - GMER 1.0.15 ---- Device owAZEVAoRGRCZ \Device\Ide\IdePort0 RGRCZ@J@ Device owAZEVAoRGRCZ \Device\Ide\IdeDeviceP0T0L0-4 RGRCZ@J@ Device owAZEVAoRGRCZ \Device\Ide\IdePort1 RGRCZ@J@ Device owAZEVAoRGRCZ \Device\Ide\IdeDeviceP0T1L0-c RGRCZ@J@ ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xD6 0x86 0x57 0xA1 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xAA 0xEE 0xB3 0xBD ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xDE 0x02 0x8F 0xF9 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xB5 0x65 0xC3 0x91 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0xB5 0x65 0xC3 0x91 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43@khjeh 0xB5 0x65 0xC3 0x91 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xD6 0x86 0x57 0xA1 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xAA 0xEE 0xB3 0xBD ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xDE 0x02 0x8F 0xF9 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xB5 0x65 0xC3 0x91 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0xB5 0x65 0xC3 0x91 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43@khjeh 0xB5 0x65 0xC3 0x91 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xD6 0x86 0x57 0xA1 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xAA 0xEE 0xB3 0xBD ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xDE 0x02 0x8F 0xF9 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0xB5 0x65 0xC3 0x91 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0xB5 0x65 0xC3 0x91 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43@khjeh 0xB5 0x65 0xC3 0x91 ...