GMER 1.0.15.14972 - http://www.gmer.net Rootkit scan 2009-07-19 00:03:17 Windows 5.1.2600 Service Pack 3 ---- System - GMER 1.0.15 ---- SSDT splh.sys ZwCreateKey [0xB9EAA0E0] SSDT splh.sys ZwEnumerateKey [0xB9EC7CA2] SSDT splh.sys ZwEnumerateValueKey [0xB9EC8030] SSDT splh.sys ZwOpenKey [0xB9EAA0C0] SSDT splh.sys ZwQueryKey [0xB9EC8108] SSDT splh.sys ZwQueryValueKey [0xB9EC7F88] SSDT splh.sys ZwSetValueKey [0xB9EC819A] INT 0x62 ? 8B045BF8 INT 0x63 ? 8ADDABF8 INT 0x73 ? 8B045BF8 INT 0x73 ? 8B045BF8 INT 0x73 ? 8B045BF8 INT 0x73 ? 8B045BF8 INT 0x73 ? 8ADDABF8 INT 0x73 ? 8B045BF8 INT 0x82 ? 8B045BF8 INT 0x83 ? 8ADDABF8 INT 0x94 ? 8ADDABF8 INT 0xB4 ? 8ADDABF8 INT 0xB4 ? 8ADDABF8 INT 0xB4 ? 8ADDABF8 INT 0xB4 ? 8ADDABF8 ---- Kernel code sections - GMER 1.0.15 ---- ? splh.sys The system cannot find the file specified. ! .text USBPORT.SYS!DllUnload B8B318AC 5 Bytes JMP 8ADDA1D8 ? System32\Drivers\aq46nzsk.SYS The system cannot find the path specified. ! ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [B9EAB046] splh.sys IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [B9EAB142] splh.sys IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [B9EAB0C4] splh.sys IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [B9EAB7CE] splh.sys IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [B9EAB6A4] splh.sys ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs 8B0441F8 Device \FileSystem\Fastfat \FatCdrom 8A2B5500 Device \Driver\usbuhci \Device\USBPDO-0 8ADB11F8 Device \Driver\usbuhci \Device\USBPDO-1 8ADB11F8 Device \Driver\dmio \Device\DmControl\DmIoDaemon 8AFD61F8 Device \Driver\dmio \Device\DmControl\DmConfig 8AFD61F8 Device \Driver\dmio \Device\DmControl\DmPnP 8AFD61F8 Device \Driver\dmio \Device\DmControl\DmInfo 8AFD61F8 Device \Driver\usbuhci \Device\USBPDO-2 8ADB11F8 Device \Driver\usbehci \Device\USBPDO-3 8AE431F8 Device \Driver\PCI_PNP5824 \Device\00000055 splh.sys Device \Driver\usbuhci \Device\USBPDO-4 8ADB11F8 Device \Driver\usbuhci \Device\USBPDO-5 8ADB11F8 Device \Driver\usbuhci \Device\USBPDO-6 8ADB11F8 Device \Driver\Ftdisk \Device\HarddiskVolume1 8B0461F8 Device \Driver\usbehci \Device\USBPDO-7 8AE431F8 Device \Driver\Ftdisk \Device\HarddiskVolume2 8B0461F8 Device \Driver\Cdrom \Device\CdRom0 8AD6F1F8 Device \Driver\Ftdisk \Device\HarddiskVolume3 8B0461F8 Device \Driver\Cdrom \Device\CdRom1 8AD6F1F8 Device \Driver\Ftdisk \Device\HarddiskVolume4 8B0461F8 Device \Driver\NetBT \Device\NetBT_Tcpip_{C2E68322-0935-460A-B6BC-02B6F85B35D2} 8AB6B500 Device \Driver\NetBT \Device\NetBt_Wins_Export 8AB6B500 Device \Driver\sptd \Device\1605183324 splh.sys Device \Driver\NetBT \Device\NetbiosSmb 8AB6B500 Device \Driver\usbuhci \Device\USBFDO-0 8ADB11F8 Device \Driver\usbuhci \Device\USBFDO-1 8ADB11F8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8AB67500 Device \Driver\usbuhci \Device\USBFDO-2 8ADB11F8 Device \FileSystem\MRxSmb \Device\LanmanRedirector 8AB67500 Device \Driver\usbehci \Device\USBFDO-3 8AE431F8 Device \Driver\Ftdisk \Device\FtControl 8B0461F8 Device \Driver\usbuhci \Device\USBFDO-4 8ADB11F8 Device \Driver\usbuhci \Device\USBFDO-5 8ADB11F8 Device \Driver\usbuhci \Device\USBFDO-6 8ADB11F8 Device \Driver\usbehci \Device\USBFDO-7 8AE431F8 Device \Driver\aq46nzsk \Device\Scsi\aq46nzsk1Port6Path0Target0Lun0 8AD6E500 Device \Driver\aq46nzsk \Device\Scsi\aq46nzsk1 8AD6E500 Device \FileSystem\Fastfat \Fat 8A2B5500 AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) Device \FileSystem\Cdfs \Cdfs 8ABD3500 ---- Services - GMER 1.0.15 ---- Service system32\drivers\msqpdxmxweoitu.sys (*** hidden *** ) [SYSTEM] msqpdxserv.sys <-- ROOTKIT !!! ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys@start 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys@type 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys@imagepath \systemroot\system32\drivers\msqpdxmxweoitu.sys Reg HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys@group file system Reg HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys\modules Reg HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys\modules@msqpdxserv Reg HKLM\SYSTEM\CurrentControlSet\Services\msqpdxserv.sys\modules@msqpdxl Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x02 0x2C 0xBB 0xFD ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x90 0x32 0xEC 0xE3 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0x12 0x9B 0xEE 0xF3 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x79 0xF8 0xC6 0x77 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x90 0x32 0xEC 0xE3 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xE0 0x9C 0xF7 0xAB ... Reg HKLM\SYSTEM\ControlSet003\Services\msqpdxserv.sys@start 1 Reg HKLM\SYSTEM\ControlSet003\Services\msqpdxserv.sys@type 1 Reg HKLM\SYSTEM\ControlSet003\Services\msqpdxserv.sys@imagepath \systemroot\system32\drivers\msqpdxmxweoitu.sys Reg HKLM\SYSTEM\ControlSet003\Services\msqpdxserv.sys@group file system Reg HKLM\SYSTEM\ControlSet003\Services\msqpdxserv.sys\modules Reg HKLM\SYSTEM\ControlSet003\Services\msqpdxserv.sys\modules@msqpdxserv Reg HKLM\SYSTEM\ControlSet003\Services\msqpdxserv.sys\modules@msqpdxl Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x02 0x2C 0xBB 0xFD ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x90 0x32 0xEC 0xE3 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0x12 0x9B 0xEE 0xF3 ... Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG10.00.00.01WORKSTATION D1E087E81D2D08DBF6E11D9970482DED79D931F7543177B7009A7B54EA4FC84E011997E7E6EC218702A9D7D60F9FF8DE6D042DF5DF72AEA572A01EEDB26B090DF8DE4CA5755744F6A4798AFB7C6F2C1BE55707D556C2D17D1C1FFAFB387F46AD4B1EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC79338EDD5E5BE2F6E6675D575E7D6A3B98082FBF015F203214AEC4954E28CAEB5CFAC9C056EC83467AF924602342003E0995FDE6A29FA1E7BA79F5718E1D302A0A08E7726F08ABDC840847319D4126228FB6FD16626B3BA659986945226F031B40A55C8D8E4C2911D941BA23FCB2881B078299ACBAFE59C3914DFA9F766F704F66BA92ED3DBB8C524D4F9A0005F13615C6873E83C4292EC966AD0A862201EB8E49027AE529F0A9441533098699EB063190AB5DE43F4D3275BEA278715B9BADD3190985B92319983EC841A968C623104204286B118DE11C39666BAD4BFE4D30CB6A34AEA19F76364CE72125CA392E32D22988E4393674EBB90C9892758C3532DBB53BEE4B375CA22D51CDA84943370D1E692F448564A1E4CFC39018C22887B6975726C6D8A7B5C0D4CC17E3EF5AFC0695944E8E90E61E8B0A850D2FFC990D074B8F543BDD527F39EA03218C4398D1475D5CF0C6E9B0312AAA2B9B4E5E4C212BF Reg HKLM\SOFTWARE\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}@scansk 0x24 0xC1 0x34 0xFE ... Reg HKLM\SOFTWARE\Classes\CLSID\{a44af87b-f71a-4162-92b0-0710bbd521e5}@Model 172 Reg HKLM\SOFTWARE\Classes\CLSID\{a44af87b-f71a-4162-92b0-0710bbd521e5}@Therad 10 Reg HKLM\SOFTWARE\Classes\CLSID\{a44af87b-f71a-4162-92b0-0710bbd521e5}@MData 0xCB 0x9B 0xAD 0xEF ... Reg HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared\1076248649\Groups@\xf892\5Õ\5â\5\x5c3\5ä\5\xf88d\5\xf891\5 1 Reg HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared\1076248649\Groups@ç\5\x5c1\5Õ\5æ\5Õ\5ê\5 1 Reg HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared\1076248649\Groups@\x5f3\5\x5c1\5è\5\xf88d\5\xf891\5 0 Reg HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared\1076248649\Groups@\x5c0\5à\5é\5\xf88d\5 \0ç\5é\5è\5 \0à\5Õ\5á\5ä\5\xf88d\5\xf891\5 1 ---- EOF - GMER 1.0.15 ----