Созданные ответы форума
-
Сообщения
-
GMER 1.0.14.14536 — http://www.gmer.net
Rootkit scan 2009-03-12 21:01:39
Windows 5.1.2600 Service Pack 3—- System — GMER 1.0.14 —-
Code 84948588 ZwEnumerateKey
Code 84988290 ZwFlushInstructionCache
Code F3731482 pIofCallDriver—- Kernel IAT/EAT — GMER 1.0.14 —-
IAT SystemRootsystem32DRIVERSarp1394.sys[NDIS.SYS!NdisCloseAdapter] [F36710F0] ??C:PROGRA~1AgnitumOUTPOS~1.0kernel2000FILTNT.SYS (Virtual Firewall driver/Agnitum Ltd.)
IAT SystemRootsystem32DRIVERSarp1394.sys[NDIS.SYS!NdisOpenAdapter] [F3671060] ??C:PROGRA~1AgnitumOUTPOS~1.0kernel2000FILTNT.SYS (Virtual Firewall driver/Agnitum Ltd.)
IAT SystemRootsystem32DRIVERSarp1394.sys[NDIS.SYS!NdisDeregisterProtocol] [F3671010] ??C:PROGRA~1AgnitumOUTPOS~1.0kernel2000FILTNT.SYS (Virtual Firewall driver/Agnitum Ltd.)
IAT SystemRootsystem32DRIVERSarp1394.sys[NDIS.SYS!NdisRegisterProtocol] [F3670FB0] ??C:PROGRA~1AgnitumOUTPOS~1.0kernel2000FILTNT.SYS (Virtual Firewall driver/Agnitum Ltd.)
IAT SystemRootsystem32DRIVERSndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [F3670FB0] ??C:PROGRA~1AgnitumOUTPOS~1.0kernel2000FILTNT.SYS (Virtual Firewall driver/Agnitum Ltd.)
IAT SystemRootsystem32DRIVERSndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [F3671010] ??C:PROGRA~1AgnitumOUTPOS~1.0kernel2000FILTNT.SYS (Virtual Firewall driver/Agnitum Ltd.)
IAT SystemRootsystem32DRIVERSndisuio.sys[NDIS.SYS!NdisCloseAdapter] [F36710F0] ??C:PROGRA~1AgnitumOUTPOS~1.0kernel2000FILTNT.SYS (Virtual Firewall driver/Agnitum Ltd.)
IAT SystemRootsystem32DRIVERSndisuio.sys[NDIS.SYS!NdisOpenAdapter] [F3671060] ??C:PROGRA~1AgnitumOUTPOS~1.0kernel2000FILTNT.SYS (Virtual Firewall driver/Agnitum Ltd.)—- Devices — GMER 1.0.14 —-
AttachedDevice FileSystemNtfs Ntfs spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)
AttachedDevice DriverTcpip DeviceIp FILTNT.SYS (Virtual Firewall driver/Agnitum Ltd.)
AttachedDevice DriverTcpip DeviceTcp FILTNT.SYS (Virtual Firewall driver/Agnitum Ltd.)
AttachedDevice DriverTcpip DeviceUdp FILTNT.SYS (Virtual Firewall driver/Agnitum Ltd.)
AttachedDevice DriverTcpip DeviceRawIp FILTNT.SYS (Virtual Firewall driver/Agnitum Ltd.)
AttachedDevice FileSystemFastfat Fat spider.sys (SpIDer Guard File System Monitor/Doctor Web, Ltd.)—- Modules — GMER 1.0.14 —-
Module systemrootsystem32driverssenekarviqjyeq.sys (*** hidden *** ) F372F000-F3755000 (155648 bytes)
—- Services — GMER 1.0.14 —-
Service C:WINDOWSsystem32driverssenekarviqjyeq.sys (*** hidden *** ) [SYSTEM] seneka <-- ROOTKIT !!!
Service C:WINDOWSsystem32DRIVERSvdrv9000.sys (*** hidden *** ) [SYSTEM] vdrv9000 <-- ROOTKIT !!! —- Registry — GMER 1.0.14 —- Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@! 0454B 045 0424>494 000 044 0404?4B 0454@4 001 003 9 004 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( L 002 T P ) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( P P T P ) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( P P P o E ) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4<4>494 ? 0404@ 0404;4; 0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( I P ) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4; 0404=484@4> 0424I484: 0404 ? 0404: 0454B4> 0424 1?2?3?4?
Reg HKLMSYSTEMCurrentControlSetServicesLanmanServerShares@374@484=4B 0454@4 CSCFlags=0?MaxUses=4294967295?Path=Presenter-to-Go,LocalsplOnly?Permissions=0?Remark=Presenter-to-Go?Type=1?
Reg HKLMSYSTEMCurrentControlSetServicesLanmanServerShares@36 0414< 0454=4 CSCFlags=0?MaxUses=4294967295?Path=C:Documents and SettingsAll Users???????????????Permissions=0?Remark=?Type=0?
Reg HKLMSYSTEMCurrentControlSetServicesLanmanServerShares@374@484=4B 0454@ 042 CSCFlags=0?MaxUses=4294967295?Path=PageManager PDF Writer,LocalsplOnly?Permissions=0?Remark=PageManager PDF Writer?Type=1?
Reg HKLMSYSTEMCurrentControlSetServicesLanmanServerShares@374@484=4B 0454@ 043 CSCFlags=0?MaxUses=4294967295?Path=EPSON Stylus Photo 925,LocalsplOnly?Permissions=0?Remark=EPSON Stylus Photo 925?Type=1?
Reg HKLMSYSTEMCurrentControlSetServicesseneka
Reg HKLMSYSTEMCurrentControlSetServicesseneka@start 1
Reg HKLMSYSTEMCurrentControlSetServicesseneka@type 1
Reg HKLMSYSTEMCurrentControlSetServicesseneka@imagepath systemrootsystem32driverssenekarviqjyeq.sys
Reg HKLMSYSTEMCurrentControlSetServicesseneka@group file system
Reg HKLMSYSTEMCurrentControlSetServicessenekamodules
Reg HKLMSYSTEMCurrentControlSetServicessenekamodules@seneka.dll systemrootsystem32senekamndwwqbr.dll
Reg HKLMSYSTEMCurrentControlSetServicessenekamodules@seneka.sys systemrootsystem32driverssenekarviqjyeq.sys
Reg HKLMSYSTEMCurrentControlSetServicessenekamodules@senekalog.dat systemrootsystem32senekahhlsmpyq.dat
Reg HKLMSYSTEMCurrentControlSetServicessenekamodules@senekawi.dll systemrootsystem32senekaoobomylf.dll
Reg HKLMSYSTEMCurrentControlSetServicessenekamodules@senekaff.dll systemrootsystem32senekatkmnqttv.dll
Reg HKLMSYSTEMCurrentControlSetServicessenekamodules@seneka.dat systemrootsystem32senekasdivjbje.dat
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000@ServiceBinary C:WINDOWSsystem32driversVDRV9000.SYS
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000@Group SCSI Miniport
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000@ImagePath system32DRIVERSvdrv9000.sys
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000@ErrorControl 1
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000@Start 1
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000@Type 1
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000@Tag 33
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000Enum
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000Enum@Count 1
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000Enum@NextInstance 1
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000Enum@INITSTARTFAILED 1
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000Enum@0 RootSCSIADAPTER 000
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000parameters
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000parameterspnpinterface
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000parameterspnpinterface@1 1
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000security
Reg HKLMSYSTEMCurrentControlSetServicesvdrv9000security@Security 0x01 0x00 0x14 0x80 …
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@! 0454B 045 0424>494 000 044 0404?4B 0454@4 001 003 9 004 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( L 002 T P ) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( P P T P ) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( P P P o E ) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@374@4O4<4>494 ? 0404@ 0404;4; 0454;4L4=4K494 ?4>4@4B4 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 W A N ( I P ) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@34484=484?4>4@4B4 ?4; 0404=484@4> 0424I484: 0404 ? 0404: 0454B4> 0424 1?2?3?4?
Reg HKLMSYSTEMControlSet002ServicesLanmanServerShares@374@484=4B 0454@4 CSCFlags=0?MaxUses=4294967295?Path=Presenter-to-Go,LocalsplOnly?Permissions=0?Remark=Presenter-to-Go?Type=1?
Reg HKLMSYSTEMControlSet002ServicesLanmanServerShares@36 0414< 0454=4 CSCFlags=0?MaxUses=4294967295?Path=C:Documents and SettingsAll Users???????????????Permissions=0?Remark=?Type=0?
Reg HKLMSYSTEMControlSet002ServicesLanmanServerShares@374@484=4B 0454@ 042 CSCFlags=0?MaxUses=4294967295?Path=PageManager PDF Writer,LocalsplOnly?Permissions=0?Remark=PageManager PDF Writer?Type=1?
Reg HKLMSYSTEMControlSet002ServicesLanmanServerShares@374@484=4B 0454@ 043 CSCFlags=0?MaxUses=4294967295?Path=EPSON Stylus Photo 925,LocalsplOnly?Permissions=0?Remark=EPSON Stylus Photo 925?Type=1?
Reg HKLMSYSTEMControlSet002Servicesseneka
Reg HKLMSYSTEMControlSet002Servicesseneka@start 1
Reg HKLMSYSTEMControlSet002Servicesseneka@type 1
Reg HKLMSYSTEMControlSet002Servicesseneka@imagepath systemrootsystem32driverssenekarviqjyeq.sys
Reg HKLMSYSTEMControlSet002Servicesseneka@group file system
Reg HKLMSYSTEMControlSet002Servicessenekamodules
Reg HKLMSYSTEMControlSet002Servicessenekamodules@seneka.dll systemrootsystem32senekamndwwqbr.dll
Reg HKLMSYSTEMControlSet002Servicessenekamodules@seneka.sys systemrootsystem32driverssenekarviqjyeq.sys
Reg HKLMSYSTEMControlSet002Servicessenekamodules@senekalog.dat systemrootsystem32senekahhlsmpyq.dat
Reg HKLMSYSTEMControlSet002Servicessenekamodules@senekawi.dll systemrootsystem32senekaoobomylf.dll
Reg HKLMSYSTEMControlSet002Servicessenekamodules@senekaff.dll systemrootsystem32senekatkmnqttv.dll
Reg HKLMSYSTEMControlSet002Servicessenekamodules@seneka.dat systemrootsystem32senekasdivjbje.dat
Reg HKLMSYSTEMControlSet002Servicesvdrv9000@ServiceBinary C:WINDOWSsystem32driversVDRV9000.SYS
Reg HKLMSYSTEMControlSet002Servicesvdrv9000@Group SCSI Miniport
Reg HKLMSYSTEMControlSet002Servicesvdrv9000@ImagePath system32DRIVERSvdrv9000.sys
Reg HKLMSYSTEMControlSet002Servicesvdrv9000@ErrorControl 1
Reg HKLMSYSTEMControlSet002Servicesvdrv9000@Start 1
Reg HKLMSYSTEMControlSet002Servicesvdrv9000@Type 1
Reg HKLMSYSTEMControlSet002Servicesvdrv9000@Tag 33
Reg HKLMSYSTEMControlSet002Servicesvdrv9000Enum
Reg HKLMSYSTEMControlSet002Servicesvdrv9000Enum@Count 1
Reg HKLMSYSTEMControlSet002Servicesvdrv9000Enum@NextInstance 1
Reg HKLMSYSTEMControlSet002Servicesvdrv9000Enum@INITSTARTFAILED 1
Reg HKLMSYSTEMControlSet002Servicesvdrv9000Enum@0 RootSCSIADAPTER 000
Reg HKLMSYSTEMControlSet002Servicesvdrv9000parameters
Reg HKLMSYSTEMControlSet002Servicesvdrv9000parameterspnpinterface
Reg HKLMSYSTEMControlSet002Servicesvdrv9000parameterspnpinterface@1 1
Reg HKLMSYSTEMControlSet002Servicesvdrv9000security
Reg HKLMSYSTEMControlSet002Servicesvdrv9000security@Security 0x01 0x00 0x14 0x80 …—- EOF — GMER 1.0.14 —-
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.comPlatform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.Backups directory opened successfully at C:Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!Completed script processing.
*******************
Finished! Terminate.
