Code:
Alles auswählen Aufklappen ATTFilter
ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2010/02/11 23:33
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP2
==================================================
Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xB6F32000 Size: 98304 File Visible: No Signed: -
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xBAE20000 Size: 8192 File Visible: No Signed: -
Status: -
Name: PCI_PNP1154
Image Path: \Driver\PCI_PNP1154
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xB50C3000 Size: 49152 File Visible: No Signed: -
Status: -
Name: splo.sys
Image Path: splo.sys
Address: 0xBA6A7000 Size: 1048576 File Visible: No Signed: -
Status: -
Name: sptd
Image Path: \Driver\sptd
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -
Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!
SSDT
-------------------
#: 041 Function Name: NtCreateKey
Status: Hooked by "<unknown>" at address 0xbaf54e66
#: 053 Function Name: NtCreateThread
Status: Hooked by "<unknown>" at address 0xbaf54e5c
#: 063 Function Name: NtDeleteKey
Status: Hooked by "<unknown>" at address 0xbaf54e6b
#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "<unknown>" at address 0xbaf54e75
#: 071 Function Name: NtEnumerateKey
Status: Hooked by "splo.sys" at address 0xba6c6ca2
#: 073 Function Name: NtEnumerateValueKey
Status: Hooked by "splo.sys" at address 0xba6c7030
#: 098 Function Name: NtLoadKey
Status: Hooked by "<unknown>" at address 0xbaf54e7a
#: 119 Function Name: NtOpenKey
Status: Hooked by "splo.sys" at address 0xba6a80c0
#: 122 Function Name: NtOpenProcess
Status: Hooked by "<unknown>" at address 0xbaf54e48
#: 128 Function Name: NtOpenThread
Status: Hooked by "<unknown>" at address 0xbaf54e4d
#: 160 Function Name: NtQueryKey
Status: Hooked by "splo.sys" at address 0xba6c7108
#: 177 Function Name: NtQueryValueKey
Status: Hooked by "splo.sys" at address 0xba6c6f88
#: 193 Function Name: NtReplaceKey
Status: Hooked by "<unknown>" at address 0xbaf54e84
#: 204 Function Name: NtRestoreKey
Status: Hooked by "<unknown>" at address 0xbaf54e7f
#: 247 Function Name: NtSetValueKey
Status: Hooked by "<unknown>" at address 0xbaf54e70
#: 257 Function Name: NtTerminateProcess
Status: Hooked by "<unknown>" at address 0xbaf54e57
Stealth Objects
-------------------
Object: Hidden Module [Name: iebho.dll]
Process: Explorer.EXE (PID: 1776) Address: 0x040f0000 Size: 368640
Object: Hidden Module [Name: iebho.dll]
Process: Explorer.EXE (PID: 1776) Address: 0x04820000 Size: 368640
Object: Hidden Module [Name: iebho.dll]
Process: Explorer.EXE (PID: 1776) Address: 0x04c90000 Size: 368640
Object: Hidden Module [Name: iebho.dll]
Process: Explorer.EXE (PID: 1776) Address: 0x04e50000 Size: 368640
Object: Hidden Module [Name: iebho.dll]
Process: Explorer.EXE (PID: 1776) Address: 0x05030000 Size: 368640
Object: Hidden Module [Name: iebho.dll]
Process: Explorer.EXE (PID: 1776) Address: 0x05e50000 Size: 368640
Object: Hidden Module [Name: iebho.dll]
Process: iexplore.exe (PID: 3588) Address: 0x01ad0000 Size: 368640
Object: Hidden Module [Name: iebho.dll]
Process: iexplore.exe (PID: 3588) Address: 0x06870000 Size: 368640
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP]
Process: System Address: 0x89a661f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_CREATE]
Process: System Address: 0x89a671f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_CLOSE]
Process: System Address: 0x89a671f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x89a671f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x89a671f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_POWER]
Process: System Address: 0x89a671f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x89a671f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_PNP]
Process: System Address: 0x89a671f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE]
Process: System Address: 0x897251f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_CLOSE]
Process: System Address: 0x897251f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_READ]
Process: System Address: 0x897251f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_WRITE]
Process: System Address: 0x897251f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x897251f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x897251f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x897251f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_SHUTDOWN]
Process: System Address: 0x897251f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_POWER]
Process: System Address: 0x897251f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x897251f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_PNP]
Process: System Address: 0x897251f8 Size: 121
Object: Hidden Code [Driver: usbstor, IRP_MJ_CREATE]
Process: System Address: 0x898991f8 Size: 121
Object: Hidden Code [Driver: usbstor, IRP_MJ_CLOSE]
Process: System Address: 0x898991f8 Size: 121
Object: Hidden Code [Driver: usbstor, IRP_MJ_READ]
Process: System Address: 0x898991f8 Size: 121
Object: Hidden Code [Driver: usbstor, IRP_MJ_WRITE]
Process: System Address: 0x898991f8 Size: 121
Object: Hidden Code [Driver: usbstor, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x898991f8 Size: 121
Object: Hidden Code [Driver: usbstor, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x898991f8 Size: 121
Object: Hidden Code [Driver: usbstor, IRP_MJ_POWER]
Process: System Address: 0x898991f8 Size: 121
Object: Hidden Code [Driver: usbstor, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x898991f8 Size: 121
Object: Hidden Code [Driver: usbstor, IRP_MJ_PNP]
Process: System Address: 0x898991f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_CREATE]
Process: System Address: 0x898be1f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_CLOSE]
Process: System Address: 0x898be1f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x898be1f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x898be1f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_POWER]
Process: System Address: 0x898be1f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x898be1f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_PNP]
Process: System Address: 0x898be1f8 Size: 121
Object: Hidden Code [Driver: avuehqn0Ѕ扏煓Ёం浍瑓, IRP_MJ_CREATE]
Process: System Address: 0x897371f8 Size: 121
Object: Hidden Code [Driver: avuehqn0Ѕ扏煓Ёం浍瑓, IRP_MJ_CLOSE]
Process: System Address: 0x897371f8 Size: 121
Object: Hidden Code [Driver: avuehqn0Ѕ扏煓Ёం浍瑓, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x897371f8 Size: 121
Object: Hidden Code [Driver: avuehqn0Ѕ扏煓Ёం浍瑓, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x897371f8 Size: 121
Object: Hidden Code [Driver: avuehqn0Ѕ扏煓Ёం浍瑓, IRP_MJ_POWER]
Process: System Address: 0x897371f8 Size: 121
Object: Hidden Code [Driver: avuehqn0Ѕ扏煓Ёం浍瑓, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x897371f8 Size: 121
Object: Hidden Code [Driver: avuehqn0Ѕ扏煓Ёం浍瑓, IRP_MJ_PNP]
Process: System Address: 0x897371f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CREATE]
Process: System Address: 0x89ad51f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_READ]
Process: System Address: 0x89ad51f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_WRITE]
Process: System Address: 0x89ad51f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x89ad51f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x89ad51f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x89ad51f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SHUTDOWN]
Process: System Address: 0x89ad51f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CLEANUP]
Process: System Address: 0x89ad51f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_POWER]
Process: System Address: 0x89ad51f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x89ad51f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_PNP]
Process: System Address: 0x89ad51f8 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_CREATE]
Process: System Address: 0x891b9500 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_CLOSE]
Process: System Address: 0x891b9500 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x891b9500 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x891b9500 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_CLEANUP]
Process: System Address: 0x891b9500 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_PNP]
Process: System Address: 0x891b9500 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE]
Process: System Address: 0x898bd3d0 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE]
Process: System Address: 0x898bd3d0 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x898bd3d0 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x898bd3d0 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER]
Process: System Address: 0x898bd3d0 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x898bd3d0 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP]
Process: System Address: 0x898bd3d0 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_NAMED_PIPE]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLOSE]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_READ]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_WRITE]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_EA]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_EA]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SHUTDOWN]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLEANUP]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_MAILSLOT]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_SECURITY]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_POWER]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CHANGE]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_QUOTA]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_PNP]
Process: System Address: 0x88c7b1f8 Size: 121
Object: Hidden Code [Driver: Cdfsఅ瑁䅭䣠 쀠ࠁDDEMLM, IRP_MJ_CREATE]
Process: System Address: 0x894cc500 Size: 121
Object: Hidden Code [Driver: Cdfsఅ瑁䅭䣠 쀠ࠁDDEMLM, IRP_MJ_CLOSE]
Process: System Address: 0x894cc500 Size: 121
Object: Hidden Code [Driver: Cdfsఅ瑁䅭䣠 쀠ࠁDDEMLM, IRP_MJ_READ]
Process: System Address: 0x894cc500 Size: 121
Object: Hidden Code [Driver: Cdfsఅ瑁䅭䣠 쀠ࠁDDEMLM, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x894cc500 Size: 121
Object: Hidden Code [Driver: Cdfsఅ瑁䅭䣠 쀠ࠁDDEMLM, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x894cc500 Size: 121
Object: Hidden Code [Driver: Cdfsఅ瑁䅭䣠 쀠ࠁDDEMLM, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x894cc500 Size: 121
Object: Hidden Code [Driver: Cdfsఅ瑁䅭䣠 쀠ࠁDDEMLM, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x894cc500 Size: 121
Object: Hidden Code [Driver: Cdfsఅ瑁䅭䣠 쀠ࠁDDEMLM, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x894cc500 Size: 121
Object: Hidden Code [Driver: Cdfsఅ瑁䅭䣠 쀠ࠁDDEMLM, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x894cc500 Size: 121
Object: Hidden Code [Driver: Cdfsఅ瑁䅭䣠 쀠ࠁDDEMLM, IRP_MJ_SHUTDOWN]
Process: System Address: 0x894cc500 Size: 121
Object: Hidden Code [Driver: Cdfsఅ瑁䅭䣠 쀠ࠁDDEMLM, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x894cc500 Size: 121
Object: Hidden Code [Driver: Cdfsఅ瑁䅭䣠 쀠ࠁDDEMLM, IRP_MJ_CLEANUP]
Process: System Address: 0x894cc500 Size: 121
Object: Hidden Code [Driver: Cdfsఅ瑁䅭䣠 쀠ࠁDDEMLM, IRP_MJ_PNP]
Process: System Address: 0x894cc500 Size: 121
==EOF==