GMER 1.0.15.15530 - http://www.gmer.net Rootkit quick scan 2011-02-09 18:00:40 Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e FUJITSU_MHZ2160BH_G2 rev.00000009 Running: gmer.exe; Driver: C:\DOCUME~1\slawek\USTAWI~1\Temp\awpyraoc.sys ---- System - GMER 1.0.15 ---- SSDT sptd.sys ZwEnumerateKey [0xF740FFB2] SSDT sptd.sys ZwEnumerateValueKey [0xF7410340] SSDT \SystemRoot\system32\DRIVERS\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwQueryDirectoryFile [0xA815DCE0] ---- Devices - GMER 1.0.15 ---- Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [F735DB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device \Driver\atapi \Device\Ide\IdePort0 [F735DB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device \Driver\atapi \Device\Ide\IdePort1 [F735DB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device \Driver\atapi \Device\Ide\IdePort2 [F735DB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e [F735DB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX} Device \Driver\a6uq3a3n \Device\Scsi\a6uq3a3n1 82EE01E8 Device \Driver\a6uq3a3n \Device\Scsi\a6uq3a3n1Port3Path0Target0Lun0 82EE01E8 Device \FileSystem\Ntfs \Ntfs 831D21E8 Device \Driver\Tcpip \Device\Ip afw.sys (Agnitum Firewall Driver/Agnitum Ltd.) Device \Driver\Tcpip \Device\Tcp afw.sys (Agnitum Firewall Driver/Agnitum Ltd.) Device \Driver\Tcpip \Device\Udp afw.sys (Agnitum Firewall Driver/Agnitum Ltd.) Device \Driver\Tcpip \Device\RawIp afw.sys (Agnitum Firewall Driver/Agnitum Ltd.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) ---- EOF - GMER 1.0.15 ----