GMER 1.0.15.15641 - http://www.gmer.net Rootkit scan 2012-03-19 15:34:50 Windows 5.1.2600 Dodatek Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 TOSHIBA_MK1234GSX rev.AH001J Running: cplyj3w5.exe; Driver: C:\DOCUME~1\fifi\USTAWI~1\Temp\fwpyypob.sys ---- System - GMER 1.0.15 ---- SSDT 85CF5C90 ZwAssignProcessToJobObject SSDT spbq.sys ZwCreateKey [0xF741F0E0] SSDT 85CF6200 ZwDebugActiveProcess SSDT 85CF62F0 ZwDuplicateObject SSDT spbq.sys ZwEnumerateKey [0xF7437DA4] SSDT spbq.sys ZwEnumerateValueKey [0xF7438132] SSDT spbq.sys ZwOpenKey [0xF741F0C0] SSDT 85CF5590 ZwOpenProcess SSDT 85CF5800 ZwOpenThread SSDT 85CF5FD0 ZwProtectVirtualMemory SSDT spbq.sys ZwQueryKey [0xF743820A] SSDT spbq.sys ZwQueryValueKey [0xF743808A] SSDT 85CF60E0 ZwQueueApcThread SSDT 85CF5EC0 ZwSetContextThread SSDT 85CF5D90 ZwSetInformationThread SSDT 85CF2DA0 ZwSetSecurityObject SSDT spbq.sys ZwSetValueKey [0xF743829C] SSDT 85CF5B90 ZwSuspendProcess SSDT 85CF5A80 ZwSuspendThread SSDT 85CF56E0 ZwTerminateProcess SSDT 85CF5A50 ZwTerminateThread SSDT 85CF66D0 ZwWriteVirtualMemory INT 0x62 ? 86767BF8 INT 0x73 ? 86277BF8 INT 0x82 ? 86767BF8 INT 0x83 ? 86277BF8 INT 0x94 ? 86277BF8 INT 0xB4 ? 86277BF8 ---- Kernel code sections - GMER 1.0.15 ---- ? spbq.sys Nie można odnaleźć określonego pliku. ! .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF69D0360, 0x2255BD, 0xE8000020] .text USBPORT.SYS!DllUnload F698C62C 5 Bytes JMP 862771D8 .text atzc45k2.SYS F68C4386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...] .text atzc45k2.SYS F68C43AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...] .text atzc45k2.SYS F68C43C4 3 Bytes [00, 80, 02] .text atzc45k2.SYS F68C43C9 1 Byte [30] .text atzc45k2.SYS F68C43C9 11 Bytes [30, 00, 00, 00, 5E, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESI; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL} .text ... ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\ESET\ESET Smart Security\ekrn.exe[1484] kernel32.dll!SetUnhandledExceptionFilter 7C8447ED 4 Bytes [C2, 04, 00, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 27, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 27, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 27, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 27, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90FD1A .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 27, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 27, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 27, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90FD8B .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 27, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90FEB9 .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 27, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 27, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 27, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 16, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 16, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 16, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 16, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90EC1A .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 16, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 16, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 16, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90EC8B .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 16, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EDB9 .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 16, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 16, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 16, 00] .text C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2] ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F7420042] spbq.sys IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F742013E] spbq.sys IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F74200C0] spbq.sys IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F7420800] spbq.sys IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F74206D6] spbq.sys IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F742FB90] spbq.sys IAT \SystemRoot\System32\Drivers\atzc45k2.SYS[HAL.dll!KfAcquireSpinLock] 0C8D1C46 IAT \SystemRoot\System32\Drivers\atzc45k2.SYS[HAL.dll!READ_PORT_UCHAR] B48B8932 IAT \SystemRoot\System32\Drivers\atzc45k2.SYS[HAL.dll!KeGetCurrentIrql] 89000001 IAT \SystemRoot\System32\Drivers\atzc45k2.SYS[HAL.dll!KfRaiseIrql] 0001C083 IAT \SystemRoot\System32\Drivers\atzc45k2.SYS[HAL.dll!KfLowerIrql] 24468B00 IAT \SystemRoot\System32\Drivers\atzc45k2.SYS[HAL.dll!HalGetInterruptVector] 89820C8D IAT \SystemRoot\System32\Drivers\atzc45k2.SYS[HAL.dll!HalTranslateBusAddress] D18BF84D IAT \SystemRoot\System32\Drivers\atzc45k2.SYS[HAL.dll!KeStallExecutionProcessor] 860F1639 IAT \SystemRoot\System32\Drivers\atzc45k2.SYS[HAL.dll!KfReleaseSpinLock] 000000BD IAT \SystemRoot\System32\Drivers\atzc45k2.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 020CB389 IAT \SystemRoot\System32\Drivers\atzc45k2.SYS[HAL.dll!READ_PORT_USHORT] 83660000 IAT \SystemRoot\System32\Drivers\atzc45k2.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 7400067E IAT \SystemRoot\System32\Drivers\atzc45k2.SYS[HAL.dll!WRITE_PORT_UCHAR] 89D60320 IAT \SystemRoot\System32\Drivers\atzc45k2.SYS[WMILIB.SYS!WmiSystemControl] 8D168B00 IAT \SystemRoot\System32\Drivers\atzc45k2.SYS[WMILIB.SYS!WmiCompleteRequest] F0003284 ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[2184] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 003E0010 IAT C:\Documents and Settings\fifi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe[3368] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateNamedPipeW] 002D0010 ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs 867661F8 AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET) Device \FileSystem\Udfs \UdfsCdRom 85F801F8 Device \FileSystem\Udfs \UdfsDisk 85F801F8 AttachedDevice \Driver\Tcpip \Device\Ip epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) Device \Driver\PCI_PNP1570 \Device\00000050 spbq.sys Device \Driver\usbuhci \Device\USBPDO-0 862761F8 Device \Driver\dmio \Device\DmControl\DmIoDaemon 867D61F8 Device \Driver\dmio \Device\DmControl\DmConfig 867D61F8 Device \Driver\dmio \Device\DmControl\DmPnP 867D61F8 Device \Driver\dmio \Device\DmControl\DmInfo 867D61F8 Device \Driver\usbuhci \Device\USBPDO-1 862761F8 Device \Driver\NetBT \Device\NetBT_Tcpip_{CB3F61FE-9B3E-4097-8424-865685EC8150} 85FF11F8 Device \Driver\usbuhci \Device\USBPDO-2 862761F8 Device \Driver\usbuhci \Device\USBPDO-3 862761F8 Device \Driver\usbehci \Device\USBPDO-4 862491F8 AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) Device \Driver\prodrv06 \Device\ProDrv06 E1B76C30 Device \Driver\Ftdisk \Device\HarddiskVolume1 867681F8 Device \Driver\Ftdisk \Device\HarddiskVolume2 867681F8 Device \Driver\Cdrom \Device\CdRom0 8620B1F8 Device \Driver\sptd \Device\2249607820 spbq.sys Device \Driver\Ftdisk \Device\HarddiskVolume3 867681F8 Device \Driver\Cdrom \Device\CdRom1 8620B1F8 Device \Driver\Cdrom \Device\CdRom2 8620B1F8 Device \Driver\USBSTOR \Device\000000a6 85E761F8 Device \Driver\USBSTOR \Device\000000a7 85E761F8 Device \Driver\prohlp02 \Device\ProHlp02 E100A398 Device \Driver\USBSTOR \Device\000000a9 85E761F8 Device \Driver\NetBT \Device\NetBt_Wins_Export 85FF11F8 Device \Driver\NetBT \Device\NetbiosSmb 85FF11F8 AttachedDevice \Driver\Tcpip \Device\Udp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) AttachedDevice \Driver\Tcpip \Device\RawIp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) Device \Driver\USBSTOR \Device\000000aa 85E761F8 Device \Driver\usbuhci \Device\USBFDO-0 862761F8 Device \Driver\usbuhci \Device\USBFDO-1 862761F8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 85FA21F8 Device \Driver\usbuhci \Device\USBFDO-2 862761F8 Device \FileSystem\MRxSmb \Device\LanmanRedirector 85FA21F8 Device \Driver\usbuhci \Device\USBFDO-3 862761F8 Device \Driver\usbehci \Device\USBFDO-4 862491F8 Device \Driver\Ftdisk \Device\FtControl 867681F8 Device \Driver\atzc45k2 \Device\Scsi\atzc45k21 8653C300 Device \Driver\atzc45k2 \Device\Scsi\atzc45k21Port2Path0Target0Lun0 8653C300 Device \FileSystem\Cdfs \Cdfs 85E161F8 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x08 0xE4 0xD8 0xC4 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xDA 0x34 0x4E 0x0B ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x05 0xFC 0x78 0x9B ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x28 0x8E 0x13 0x10 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xDA 0x34 0x4E 0x0B ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x05 0xFC 0x78 0x9B ... ---- EOF - GMER 1.0.15 ----