vermutlich win32-tiny-amb
ola zusammen, bräuchte dringend hilfe. denke das ich den win32-tiny-amb hab, vielleicht auch noch mehr, bin mir net ganz sicher.
habe hier ne aswMBR log und ne gmer log, hoffe das reicht fürs erste, an kaspersky komm ich net dran, wird verweigert.
hier der aswMBR log: Code:
aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-10-30 12:35:50
-----------------------------
12:35:50.453 OS Version: Windows 5.1.2600 Service Pack 2
12:35:50.453 Number of processors: 1 586 0x209
12:35:50.453 ComputerName: ZWONSCH UserName:
12:35:51.718 Initialize success
12:37:02.515 AVAST engine defs: 11103000
12:37:51.375 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
12:37:51.375 Disk 0 Vendor: ST3120022A 3.54 Size: 114473MB BusType: 3
12:37:51.375 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-c
12:37:51.375 Disk 1 Vendor: WDC_WD2500JB-00GVA0 08.02D08 Size: 238475MB BusType: 3
12:37:51.375 Disk 2 \Device\Harddisk2\DR2 -> \Device\Ide\IdeDeviceP1T1L0-20
12:37:51.375 Disk 2 Vendor: ST313032A 3.09 Size: 12419MB BusType: 3
12:37:51.375 Device \Driver\atapi -> MajorFunction 8a1e01f8
12:37:53.406 Disk 0 MBR read successfully
12:37:53.406 Disk 0 MBR scan
12:37:53.484 Disk 0 unknown MBR code
12:37:53.500 Disk 0 scanning sectors +234440704
12:37:53.609 Disk 0 scanning E:\WINDOWS\system32\drivers
12:37:57.125 File: E:\WINDOWS\system32\drivers\afd.sys **INFECTED** Win32:ZAccess-AM [Rtk]
12:38:18.500 Service scanning
12:38:22.296 Service KL1 E:\WINDOWS\system32\DRIVERS\kl1.sys **LOCKED** 5
12:38:22.296 Service kl2 E:\WINDOWS\system32\DRIVERS\kl2.sys **LOCKED** 5
12:38:22.328 Service klim5 E:\WINDOWS\system32\DRIVERS\klim5.sys **LOCKED** 5
12:38:22.328 Service klmouflt E:\WINDOWS\system32\DRIVERS\klmouflt.sys **LOCKED** 5
12:38:22.468 Service sptd E:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32
12:38:23.156 Modules scanning
12:38:33.515 Module: E:\WINDOWS\System32\drivers\afd.sys **SUSPICIOUS**
12:38:42.828 Disk 0 trace - called modules:
12:38:42.843 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x89483ee0]<<
12:38:42.859 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a1c8ab8]
12:38:42.859 3 CLASSPNP.SYS[f74b7fcf] -> nt!IofCallDriver -> [0x89503708]
12:38:42.859 \Driver\00000927[0x894932c0] -> IRP_MJ_CREATE -> 0x89483ee0
12:38:43.375 AVAST engine scan E:\WINDOWS
12:38:43.484 File: E:\WINDOWS\1206932551:3098218424.exe **INFECTED** Win32:Tiny-AMB [Rtk]
12:38:48.859 AVAST engine scan E:\WINDOWS\system32
12:44:33.734 AVAST engine scan E:\WINDOWS\system32\drivers
12:44:37.187 File: E:\WINDOWS\system32\drivers\afd.sys **INFECTED** Win32:ZAccess-AM [Rtk]
12:45:17.656 AVAST engine scan E:\Dokumente und Einstellungen\Administrator
12:48:05.500 File: E:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\4754f047\U\80000000.@ **INFECTED** Win32:Malware-gen
12:48:05.562 File: E:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\4754f047\U\800000cb.@ **INFECTED** Win32:Sirefef-AO [Rtk]
12:48:05.640 File: E:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\4754f047\X **INFECTED** Win32:Sirefef-CK [Trj]
12:56:43.843 AVAST engine scan E:\Dokumente und Einstellungen\All Users
13:01:57.812 Scan finished successfully
13:03:35.015 Disk 0 MBR has been saved successfully to "E:\Dokumente und Einstellungen\Administrator\Desktop\MBR.dat"
13:03:35.046 The log file has been saved successfully to "E:\Dokumente und Einstellungen\Administrator\Desktop\aswMBR.txt"
hier der gmer log: Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-10-30 17:36:13
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST3120022A rev.3.54
Running: z4rsm5tg.exe; Driver: E:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\fwldypow.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwAdjustPrivilegesToken [0xAB7835FA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwClose [0xAB783EFE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwConnectPort [0xAB784D32]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateEvent [0xAB78527C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateFile [0xAB7841DA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateKey [0xAB78246A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateMutant [0xAB785162]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateNamedPipeFile [0xAB7831E8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreatePort [0xAB785036]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSection [0xAB783390]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSemaphore [0xAB78539C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateThread [0xAB783B86]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateWaitablePort [0xAB7850CC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDebugActiveProcess [0xAB786A84]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeleteKey [0xAB782A74]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeleteValueKey [0xAB782E28]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeviceIoControlFile [0xAB78465C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDuplicateObject [0xAB787C90]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateKey [0xAB782F74]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateValueKey [0xAB78300C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwFsControlFile [0xAB78446A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadDriver [0xAB786B76]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey [0xAB782446]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey2 [0xAB782458]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwMapViewOfSection [0xAB7872DE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwNotifyChangeKey [0xAB783138]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenEvent [0xAB785312]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenFile [0xAB783F80]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenKey [0xAB78262A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenMutant [0xAB7851F2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenProcess [0xAB783836]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenSection [0xAB787078]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenSemaphore [0xAB785432]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenThread [0xAB783728]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryKey [0xAB7830A4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryMultipleValueKey [0xAB782CDC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQuerySection [0xAB787618]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryValueKey [0xAB782906]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueueApcThread [0xAB786F0A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRenameKey [0xAB782B96]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplaceKey [0xAB781E80]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplyPort [0xAB785796]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplyWaitReceivePort [0xAB78565C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRequestWaitReplyPort [0xAB78681E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRestoreKey [0xAB7821F8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwResumeThread [0xAB787B32]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSaveKey [0xAB781E18]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSecureConnectPort [0xAB784A78]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetContextThread [0xAB783DA2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetInformationToken [0xAB7860BE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetSecurityObject [0xAB786D14]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetSystemInformation [0xAB787768]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetValueKey [0xAB782780]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendProcess [0xAB78785A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendThread [0xAB787994]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSystemDebugControl [0xAB7869A8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwTerminateProcess [0xAB7839D2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwTerminateThread [0xAB783932]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwUnmapViewOfSection [0xAB7874BC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwWriteVirtualMemory [0xAB783ABC]
INT 0x62 ? 8A1E0BF8
INT 0x63 ? 8A0E0BF8
INT 0x63 ? 8A0E0BF8
INT 0x63 ? 8A0E0BF8
INT 0x63 ? 8A0E0BF8
INT 0x63 ? 8A0E0BF8
INT 0x63 ? 8A0E0BF8
INT 0x82 ? 8A1E0BF8
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) IoIsOperationSynchronous
---- Kernel code sections - GMER 1.0.15 ----
.text ntoskrnl.exe!_abnormal_termination + 1D0 804E282C 12 Bytes [76, 6B, 78, AB, 46, 24, 78, ...] {JBE 0x6d; JS 0xffffffffffffffaf; INC ESI; AND AL, 0x78; STOSD ; POP EAX; AND AL, 0x78; STOSD }
.text ntoskrnl.exe!_abnormal_termination + 34C 804E29A8 16 Bytes [96, 2B, 78, AB, 80, 1E, 78, ...] {XCHG ESI, EAX; SUB EDI, [EAX-0x55]; SBB BYTE [ESI], 0x78; STOSD ; XCHG ESI, EAX; PUSH EDI; JS 0xffffffffffffffb7; POP ESP; PUSH ESI; JS 0xffffffffffffffbb}
.text ntoskrnl.exe!_abnormal_termination + 440 804E2A9C 12 Bytes [5A, 78, 78, AB, 94, 79, 78, ...] {POP EDX; JS 0x7b; STOSD ; XCHG ESP, EAX; JNS 0x7f; STOSD ; TEST AL, 0x69; JS 0xffffffffffffffb7}
.text ntoskrnl.exe!IoIsOperationSynchronous 804E875A 5 Bytes JMP AB7763C8 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)
.text ntoskrnl.exe!FsRtlCheckLockForReadAccess 80503289 5 Bytes JMP AB775FEC \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)
? splj.sys Das System kann die angegebene Datei nicht finden. !
.text E:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xF6886000, 0x1C5D38, 0xE8000020]
.text USBPORT.SYS!DllUnload F66BA7AE 5 Bytes JMP 8A0E01D8
.text asd1apf1.SYS F65F0386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...]
.text asd1apf1.SYS F65F03AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text asd1apf1.SYS F65F03C4 3 Bytes [00, 70, 02] {ADD [EAX+0x2], DH}
.text asd1apf1.SYS F65F03C9 1 Byte [2E]
.text asd1apf1.SYS F65F03C9 11 Bytes [2E, 00, 00, 00, 5C, 02, 00, ...] {ADD CS:[EAX], AL; ADD [EDX+EAX+0x0], BL; ADD [EAX], AL; ADD [EAX], AL}
.text ...
.text afd.sys AB637300 7 Bytes [08, 04, 00, 00, 80, FC, 01]
.text afd.sys AB637308 2 Bytes [80, 04]
.text afd.sys AB63730C 3 Bytes [80, FC, 01] {CMP AH, 0x1}
.text afd.sys AB637311 9 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text afd.sys AB63731C 1 Byte [40]
.text ...
.PAGE E:\WINDOWS\System32\drivers\afd.sys unknown last section [0xAB645700, 0x100, 0xC0000040]
? E:\WINDOWS\System32\drivers\afd.sys suspicious PE modification
? E:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\aswMBR.sys Das System kann die angegebene Datei nicht finden. !
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT \WINDOWS\System32\Drivers\SCSIPORT.SYS[ntoskrnl.exe!DbgBreakPoint] 8A24E2D8
IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F7397D4C] splj.sys
IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F7397DA0] splj.sys
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F7367042] splj.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F736713E] splj.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F73670C0] splj.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F7367800] splj.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F73676D6] splj.sys
IAT \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!DbgBreakPoint] 8A0E02D8
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!RtlInitUnicodeString] 001CC886
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!swprintf] 11E85000
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeSetEvent] 8B000022
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoCreateSymbolicLink] 001CC08E
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoGetConfigurationInformation] C4968B00
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoDeleteSymbolicLink] 8900001C
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!MmFreeMappingAddress] 001CCC8E
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoFreeErrorLogEntry] D0968900
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoDisconnectInterrupt] 8B00001C
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!MmUnmapIoSpace] 016A4047
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!ObReferenceObjectByPointer] D4C68150
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IofCompleteRequest] 5600001C
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!RtlCompareUnicodeString] 0021E7E8
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IofCallDriver] 18C48300
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!MmAllocateMappingAddress] 5D5B5E5F
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoAllocateErrorLogEntry] CCCCCCC3
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoConnectInterrupt] CCCCCCCC
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoDetachDevice] CCCCCCCC
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeWaitForSingleObject] CCCCCCCC
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeInitializeEvent] 8BEC8B55
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeCancelTimer] 00C73445
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!RtlAnsiStringToUnicodeString] 00000000
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!RtlInitAnsiString] 830C458B
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoBuildDeviceIoControlRequest] C0840CEC
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoQueueWorkItem] 053C0D74
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!MmMapIoSpace] 57B80974
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoInvalidateDeviceRelations] 8B000000
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoReportDetectedDevice] 56C35DE5
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoReportResourceForDetection] 8D08758B
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!RtlxAnsiStringToUnicodeSize] 8D51FC4D
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!NlsMbCodePageTag] 8D52FD55
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!PoRequestPowerIrp] 8D51FE4D
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeInsertByKeyDeviceQueue] 8D52FF55
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!PoRegisterDeviceForIdleDetection] 8D51F84D
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!sprintf] 5052F455
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!MmMapLockedPagesSpecifyCache] EACAE856
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!ObfDereferenceObject] C483FFFF
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoGetAttachedDeviceReference] 0FC08520
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoInvalidateDeviceState] 0001AD85
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!ZwClose] 46B70F00
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!ObReferenceObjectByHandle] F44D8B48
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!ZwCreateDirectoryObject] C1815753
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoBuildSynchronousFsdRequest] 00011D98
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!PoStartNextPowerIrp] 467C8D51
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoCreateDevice] 69E8E84A
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!RtlCopyUnicodeString] D88BFFFF
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoAllocateDriverObjectExtension] 8504C483
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!RtlQueryRegistryValues] 5F0A75DB
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!ZwOpenKey] 5B08438D
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!RtlFreeUnicodeString] 5DE58B5E
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoStartTimer] 1D9868C3
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeInitializeTimer] 006A0001
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoInitializeTimer] 88AEE853
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeInitializeDpc] 558DFFFF
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeInitializeSpinLock] 98838DF8
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoInitializeIrp] 5200011D
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!ZwCreateKey] 03895750
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!RtlAppendUnicodeStringToString] FFF363E8
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!RtlIntegerToUnicodeString] 0C458AFF
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!ZwSetValueKey] 8B104D8B
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeInsertQueueDpc] 43881855
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KefAcquireSpinLockAtDpcLevel] 1C458B08
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoStartPacket] 0F544389
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KefReleaseSpinLockFromDpcLevel] 89FF45B6
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoBuildAsynchronousFsdRequest] 4D8B0C4B
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoFreeMdl] 50538920
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!MmUnlockPages] 8824558B
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoWriteErrorLogEntry] 4B890A43
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeRemoveByKeyDeviceQueue] 5C538958
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!MmMapLockedPagesWithReservedMapping] 8306468A
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!MmUnmapReservedMapping] 3F2418C4
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeSynchronizeExecution] 74FF4588
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoStartNextPacket] F8B60F79
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeBugCheckEx] 1A948B8D
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeRemoveDeviceQueue] 8D510000
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeSetTimer] 50572846
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!_allmul] 00D4E7E8
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!MmProbeAndLockPages] 88938D00
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!_except_handler3] 5200001B
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!PoSetPowerState] 5728468D
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoOpenDeviceRegistryKey] EEE6E850
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!RtlWriteRegistryValue] B60F0000
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!RtlDeleteRegistryValue] 938DFF45
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!_aulldiv] 00000273
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!strstr] B908C683
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!_strupr] 00000008
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeQuerySystemTime] A5F3FA8B
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoWMIRegistrationControl] 8808758B
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!KeTickCount] 00027083
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoAttachDeviceToDeviceStack] 06468A00
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoDeleteDevice] 8306E8C0
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!ExAllocatePoolWithTag] 023C18C4
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoAllocateWorkItem] 02718388
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoAllocateIrp] 19750000
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoAllocateMdl] 02948B8D
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!MmBuildMdlForNonPagedPool] 52510000
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!MmLockPagableDataSection] 00C477E8
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoGetDriverObjectExtension] 08C48300
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!MmUnlockPagableImageSection] 0575C085
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!ExFreePoolWithTag] EB08708D
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoFreeIrp] 07568A54
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!IoFreeWorkItem] 02729388
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!InitSafeBootMode] 83660000
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!RtlCompareMemory] 7601487E
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!PoCallDriver] 4AC68305
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!memmove] F63302EB
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[ntoskrnl.exe!MmHighestUserAddress] 5614458B
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[HAL.dll!KfAcquireSpinLock] F6317300
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[HAL.dll!READ_PORT_UCHAR] 74070647
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[HAL.dll!KeGetCurrentIrql] 75C0841A
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[HAL.dll!KfRaiseIrql] 05578A0B
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[HAL.dll!KfLowerIrql] 968801B0
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[HAL.dll!HalGetInterruptVector] 00001CC5
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[HAL.dll!HalTranslateBusAddress] 57B60F66
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[HAL.dll!KeStallExecutionProcessor] 533B6604
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[HAL.dll!KfReleaseSpinLock] 03087408
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 72F93B3F
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[HAL.dll!READ_PORT_USHORT] 8A09EBDA
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 86880547
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[HAL.dll!WRITE_PORT_UCHAR] 00001CC5
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[WMILIB.SYS!WmiSystemControl] 001CC68E
IAT \SystemRoot\System32\Drivers\asd1apf1.SYS[WMILIB.SYS!WmiCompleteRequest] 40578B00
IAT \SystemRoot\system32\DRIVERS\ipsec.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\msgpc.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[TDI.SYS!TdiRegisterDeviceObject] [F6CC5DA0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\netbt.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\netbt.sys[TDI.SYS!TdiRegisterDeviceObject] [F6CC5DA0] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\ipnat.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\System32\drivers\ws2ifsl.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\usbccgp.sys[NTOSKRNL.EXE!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!READ_REGISTER_USHORT] 6383AC15
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!ZwClose] B0458BAB
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!ZwQueryValueKey] F03BF003
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!ZwOpenKey] A8A10972
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!RtlInitUnicodeString] 3BAB6383
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!KeQuerySystemTime] FF067630
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!KeSaveFloatingPointState] 6383A415
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!KeInitializeSpinLock] 89C033AB
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoAllocateWorkItem] 4589E045
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoFreeWorkItem] C44589CC
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoQueueWorkItem] 89D84589
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!KefReleaseSpinLockFromDpcLevel] 45892843
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!KefAcquireSpinLockAtDpcLevel] 244389DC
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoFreeMdl] 39B4458B
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!MmUnlockPages] 830F2443
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!MmProbeAndLockPages] 00000291
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoAllocateMdl] 8D24438B
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!_except_handler3] E0C14004
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!KeTickCount] 1C738B03
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!KeBugCheckEx] 7589F003
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!ExAllocatePoolWithTag] B04D8B80
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!MmMapLockedPagesSpecifyCache] 8908048B
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!ExFreePool] FFF8A906
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!InterlockedDecrement] 850FFFFF
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!InterlockedIncrement] 00000176
IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!RtlRaiseException] 8303E083
IAT \SystemRoot\System32\drivers\afd.sys[HAL.dll!KfAcquireSpinLock] 0000016A
IAT \SystemRoot\System32\drivers\afd.sys[HAL.dll!KfReleaseSpinLock] 840FC085
IAT \SystemRoot\system32\DRIVERS\netbios.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\rdbss.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\System32\Drivers\Fips.SYS[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\HIDCLASS.SYS[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\System32\Drivers\Fastfat.SYS[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\kbdhid.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\mouhid.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\usbprint.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\rspndr.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\drivers\wdmaud.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\drivers\sysaudio.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\System32\Drivers\ParVdm.SYS[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateDevice] [F6CC5C50] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 8A1DF1F8
Device \FileSystem\Fastfat \FatCdrom 89469500
Device \Driver\NetBT \Device\NetBT_Tcpip_{D52EFCD6-8CC7-4C7A-9771-5A1C82975DF4} 894E51F8
AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
Device \Driver\usbuhci \Device\USBPDO-0 8A0DE1F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{0DE90AD1-63D2-4024-8CF9-207A93C14410} 894E51F8
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8A24C1F8
Device \Driver\dmio \Device\DmControl\DmConfig 8A24C1F8
Device \Driver\dmio \Device\DmControl\DmPnP 8A24C1F8
Device \Driver\dmio \Device\DmControl\DmInfo 8A24C1F8
Device \Driver\usbuhci \Device\USBPDO-1 8A0DE1F8
Device \Driver\usbuhci \Device\USBPDO-2 8A0DE1F8
Device \Driver\PCI_PNP2024 \Device\00000046 splj.sys
Device \Driver\usbuhci \Device\USBPDO-3 8A0DE1F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{8926DE34-764E-423C-9A93-42E649AD7CA5} 894E51F8
Device \Driver\usbehci \Device\USBPDO-4 8A0CA1F8
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A1E11F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A1E11F8
Device \Driver\Cdrom \Device\CdRom0 8A0E11F8
Device \Driver\atapi \Device\Ide\IdePort0 8A1E01F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 8A1E01F8
Device \Driver\atapi \Device\Ide\IdePort1 8A1E01F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c 8A1E01F8
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 8A1E01F8
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 8A1E01F8
Device \Driver\Cdrom \Device\CdRom1 8A0E11F8
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A1E11F8
Device \Driver\Ftdisk \Device\HarddiskVolume4 8A1E11F8
Device \Driver\Ftdisk \Device\HarddiskVolume5 8A1E11F8
Device \Driver\Ftdisk \Device\HarddiskVolume6 8A1E11F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 894E51F8
Device \Driver\NetBT \Device\NetbiosSmb 894E51F8
AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
Device \Driver\usbuhci \Device\USBFDO-0 8A0DE1F8
Device \Driver\usbuhci \Device\USBFDO-0 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbuhci \Device\USBFDO-1 8A0DE1F8
Device \Driver\usbuhci \Device\USBFDO-1 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbuhci \Device\USBFDO-2 8A0DE1F8
Device \Driver\usbuhci \Device\USBFDO-2 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 894A01F8
Device \Driver\usbuhci \Device\USBFDO-3 8A0DE1F8
Device \Driver\usbuhci \Device\USBFDO-3 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \FileSystem\MRxSmb \Device\LanmanRedirector 894A01F8
Device \Driver\usbehci \Device\USBFDO-4 8A0CA1F8
Device \Driver\usbehci \Device\USBFDO-4 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\Ftdisk \Device\FtControl 8A1E11F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{86F7FF47-9092-4065-A056-B490EE875797} 894E51F8
Device \Driver\sptd \Device\3419477024 splj.sys
Device \Driver\asd1apf1 \Device\Scsi\asd1apf11Port2Path0Target0Lun0 8A0451F8
Device \Driver\asd1apf1 \Device\Scsi\asd1apf11 8A0451F8
Device \FileSystem\Fastfat \Fat 89469500
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
Device \FileSystem\Cdfs \Cdfs 893E81F8
Device \FileSystem\Cdfs \Cdfs A89F8BCE
---- Modules - GMER 1.0.15 ----
Module (noname) (*** hidden *** ) F7537000-F7546000 (61440 bytes)
Module (noname) (*** hidden *** ) F653D000-F6546000 (36864 bytes)
---- Threads - GMER 1.0.15 ----
Thread System [4:760] F65413E0
Thread System [4:764] 894848C5
---- Processes - GMER 1.0.15 ----
Library E:\WINDOWS\1206932551:3098218424.exe (*** hidden *** ) @ E:\WINDOWS\1206932551:3098218424.exe [1000] 0x00400000
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 E:\Programme\Alcohol Soft\Alcohol 120\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xB5 0x63 0x08 0xE4 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x3C 0xA2 0x4D 0xF3 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xC8 0x6E 0x44 0x1F ...
---- Files - GMER 1.0.15 ----
File E:\WINDOWS\$NtUninstallKB18668$\1196748871 0 bytes
File E:\WINDOWS\$NtUninstallKB18668$\1196748871\@ 2048 bytes
File E:\WINDOWS\$NtUninstallKB18668$\1196748871\L 0 bytes
File E:\WINDOWS\$NtUninstallKB18668$\1196748871\L\dqnsjgbk 138496 bytes
File E:\WINDOWS\$NtUninstallKB18668$\1196748871\loader.tlb 2540 bytes
File E:\WINDOWS\$NtUninstallKB18668$\1196748871\U 0 bytes
File E:\WINDOWS\$NtUninstallKB18668$\1196748871\U\@00000001 45968 bytes
File E:\WINDOWS\$NtUninstallKB18668$\1196748871\U\@000000c0 3584 bytes
File E:\WINDOWS\$NtUninstallKB18668$\1196748871\U\@000000cb 3072 bytes
File E:\WINDOWS\$NtUninstallKB18668$\1196748871\U\@000000cf 1536 bytes
File E:\WINDOWS\$NtUninstallKB18668$\1196748871\U\@80000000 23040 bytes
File E:\WINDOWS\$NtUninstallKB18668$\1196748871\U\@800000c0 35840 bytes
File E:\WINDOWS\$NtUninstallKB18668$\1196748871\U\@800000cb 23552 bytes
File E:\WINDOWS\$NtUninstallKB18668$\1196748871\U\@800000cf 27648 bytes
File E:\WINDOWS\$NtUninstallKB18668$\662527287 0 bytes
ADS E:\WINDOWS\1206932551:3098218424.exe 816 bytes executable <-- ROOTKIT !!!
---- Services - GMER 1.0.15 ----
Service E:\WINDOWS\1206932551:3098218424.exe [MANUAL] 4754f047 <-- ROOTKIT !!!
---- EOF - GMER 1.0.15 ----
|
