Done. Here is the log. Please advise on next steps:
GMER 1.0.15.14944 -
http://www.gmer.netRootkit scan 2009-03-24 13:51:19
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.15 ----
Code 81CC9958 ZwEnumerateKey
Code 81D65958 ZwFlushInstructionCache
Code 81D35956 IofCallDriver
Code 8272EE56 IofCompleteRequest
---- Kernel code sections - GMER 1.0.15 ----
.text ntoskrnl.exe!IofCallDriver 804E37C5 5 Bytes JMP 81D3595B
.text ntoskrnl.exe!IofCompleteRequest 804E3BF6 5 Bytes JMP 8272EE5B
PAGE ntoskrnl.exe!ZwEnumerateKey 8056EF30 5 Bytes JMP 81CC995C
PAGE ntoskrnl.exe!ZwFlushInstructionCache 80576A6A 5 Bytes JMP 81D6595C
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\Explorer.EXE[832] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00AB000A
.text C:\WINDOWS\Explorer.EXE[832] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00AC000A
.text C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe[880] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00CE000A
.text C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe[880] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00CF000A
.text C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe[936] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0081000A
.text C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe[936] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0082000A
.text C:\WINDOWS\system32\spoolsv.exe[1208] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0097000A
.text C:\WINDOWS\system32\spoolsv.exe[1208] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0098000A
.text C:\WINDOWS\system32\winlogon.exe[1256] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0064000A
.text C:\WINDOWS\system32\winlogon.exe[1256] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0065000A
.text C:\WINDOWS\system32\services.exe[1300] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0070000A
.text C:\WINDOWS\system32\services.exe[1300] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0071000A
.text C:\WINDOWS\system32\lsass.exe[1312] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006F000A
.text C:\WINDOWS\system32\lsass.exe[1312] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0072000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1536] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006D000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1536] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 006E000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1548] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0071000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[1548] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0072000A
.text C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe[1608] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00B2000A
.text C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe[1608] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00B3000A
.text C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe[1632] ntdll.dll!LdrLoadDll 7C9161CA 3 Bytes JMP 0092000A
.text C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe[1632] ntdll.dll!LdrLoadDll + 4 7C9161CE 1 Byte [84]
.text C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe[1632] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0093000A
.text C:\Program Files\Executive Software\Diskeeper\DkService.exe[1708] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A8000A
.text C:\Program Files\Executive Software\Diskeeper\DkService.exe[1708] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A9000A
.text C:\WINDOWS\ATK0100\ATKOSD.exe[1772] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A5000A
.text C:\WINDOWS\ATK0100\ATKOSD.exe[1772] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A6000A
.text C:\WINDOWS\System32\1XConfig.exe[1852] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00B4000A
.text C:\WINDOWS\System32\1XConfig.exe[1852] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00B5000A
.text C:\WINDOWS\System32\GEARSec.exe[1872] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006A000A
.text C:\WINDOWS\System32\GEARSec.exe[1872] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 006B000A
.text C:\WINDOWS\system32\ZCfgSvc.exe[1972] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0102000A
.text C:\WINDOWS\system32\ZCfgSvc.exe[1972] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0103000A
.text C:\WINDOWS\System32\RegSrvc.exe[2016] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 007F000A
.text C:\WINDOWS\System32\RegSrvc.exe[2016] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0080000A
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2056] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0094000A
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2056] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0095000A
.text C:\WINDOWS\System32\alg.exe[2136] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006F000A
.text C:\WINDOWS\System32\alg.exe[2136] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0070000A
.text C:\WINDOWS\ATK0100\Hcontrol.exe[2176] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00DE000A
.text C:\WINDOWS\ATK0100\Hcontrol.exe[2176] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00DF000A
.text C:\WINDOWS\System32\igfxtray.exe[2184] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009A000A
.text C:\WINDOWS\System32\igfxtray.exe[2184] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009B000A
.text C:\WINDOWS\System32\hkcmd.exe[2192] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0097000A
.text C:\WINDOWS\System32\hkcmd.exe[2192] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0098000A
.text C:\WINDOWS\AGRSMMSG.exe[2200] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009F000A
.text C:\WINDOWS\AGRSMMSG.exe[2200] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A0000A
.text C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe[2224] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A5000A
.text C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe[2224] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A6000A
.text C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe[2292] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0097000A
.text C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe[2292] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0098000A
.text C:\Program Files\Winamp\winampa.exe[2308] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0096000A
.text C:\Program Files\Winamp\winampa.exe[2308] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0097000A
.text C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe[2316] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00AD000A
.text C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe[2316] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00AE000A
.text C:\PROGRA~1\Dantz\RETROS~1\RetroExpress.exe[2324] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0102000A
.text C:\PROGRA~1\Dantz\RETROS~1\RetroExpress.exe[2324] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0103000A
.text C:\WINDOWS\MXOALDR.EXE[2332] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0096000A
.text C:\WINDOWS\MXOALDR.EXE[2332] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0097000A
.text C:\Program Files\Microsoft IntelliType Pro\type32.exe[2356] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A9000A
.text C:\Program Files\Microsoft IntelliType Pro\type32.exe[2356] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00AA000A
.text C:\Program Files\Microsoft IntelliPoint\point32.exe[2376] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00B6000A
.text C:\Program Files\Microsoft IntelliPoint\point32.exe[2376] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00B7000A
.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9TA.EXE[2412] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0098000A
.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9TA.EXE[2412] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0099000A
.text C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe[2436] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A7000A
.text C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe[2436] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A8000A
.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABA.EXE[2460] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0098000A
.text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABA.EXE[2460] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0099000A
.text C:\Program Files\QuickTime\QTTask.exe[2504] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009D000A
.text C:\Program Files\QuickTime\QTTask.exe[2504] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009E000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2528] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0099000A
.text C:\Program Files\iTunes\iTunesHelper.exe[2528] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009A000A
.text C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[2552] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009A000A
.text C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe[2552] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009B000A
.text C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe[2564] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A0000A
.text C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe[2564] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A1000A
.text C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe[2588] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009E000A
.text C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe[2588] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009F000A
.text C:\Program Files\ADSL\StarModem ADSL USB MODEM\dslmon.exe[2600] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A5000A
.text C:\Program Files\ADSL\StarModem ADSL USB MODEM\dslmon.exe[2600] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A6000A
.text C:\Palm\Hotsync.exe[2612] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00B2000A
.text C:\Palm\Hotsync.exe[2612] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00B3000A
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!??2@YAPAXI@Z 77C29CC5 5 Bytes JMP 0A93C080 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!??3@YAXPAX@Z 77C29CDD 5 Bytes JMP 0A93C0E0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!?set_new_handler@@YAP6AXXZP6AXXZ@Z 77C29D9F 5 Bytes JMP 0A93C110 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!_aligned_offset_malloc 77C29DAF 5 Bytes JMP 0A93BFE0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!_aligned_free 77C29E33 5 Bytes JMP 0A93C0E0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!_aligned_malloc 77C29E52 5 Bytes JMP 0A93BFC0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!_aligned_offset_realloc 77C29E6E 5 Bytes JMP 0A93C020 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!_aligned_realloc 77C29FC6 5 Bytes JMP 0A93C000 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!_expand 77C29FE5 5 Bytes JMP 0A93BFA0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!_heapadd 77C2BC9F 5 Bytes JMP 0A93C160 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!_heapchk 77C2BCB3 5 Bytes JMP 0A93C170 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!_heapset + 1 77C2BD83 4 Bytes JMP 0A93C191 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!_heapmin 77C2BD8C 5 Bytes JMP 0A93C260 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!_heapused 77C2BE3A 5 Bytes JMP 0A93C230 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!_heapwalk 77C2BE4D 5 Bytes JMP 0A93C1A0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!_msize 77C2BF6C 5 Bytes JMP 0A93BEB0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!calloc 77C2C0C3 5 Bytes JMP 0A93BE50 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!free 77C2C21B 5 Bytes JMP 0A93C0E0 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!malloc 77C2C407 5 Bytes JMP 0A93BE10 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Palm\Hotsync.exe[2612] msvcrt.dll!realloc 77C2C437 5 Bytes JMP 0A93BE90 C:\Palm\SHW32.DLL (Memory Management Library for Win32/MicroQuill Software Publishing, Inc.)
.text C:\Program Files\Common Files\Skyscape\SmartUpdate.exe[2628] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0156000A
.text C:\Program Files\Common Files\Skyscape\SmartUpdate.exe[2628] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0157000A
.text C:\PROGRA~1\Webshots\webshots.scr[2652] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00B6000A
.text C:\PROGRA~1\Webshots\webshots.scr[2652] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00B7000A
.text C:\Program Files\Skyscape\Desktop\smARTalerts\smARTalerts.exe[2968] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009C000A
.text C:\Program Files\Skyscape\Desktop\smARTalerts\smARTalerts.exe[2968] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009D000A
.text C:\Documents and Settings\Ryan Duke\Desktop\test.exe[3340] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009E000A
.text C:\Documents and Settings\Ryan Duke\Desktop\test.exe[3340] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 009F000A
.text C:\WINDOWS\System32\wbem\wmiapsrv.exe[3444] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 007F000A
.text C:\WINDOWS\System32\wbem\wmiapsrv.exe[3444] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0080000A
.text C:\Program Files\iPod\bin\iPodService.exe[3556] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0073000A
.text C:\Program Files\iPod\bin\iPodService.exe[3556] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0074000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[3760] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A8000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[3760] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 00A9000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[3760] WININET.dll!HttpAddRequestHeadersA 771C4092 5 Bytes JMP 00B4000C
.text C:\Program Files\Internet Explorer\Iexplore.exe[3760] WININET.dll!HttpAddRequestHeadersW 771CEECC 5 Bytes JMP 00BC000A
.text C:\Program Files\Internet Explorer\Iexplore.exe[3760] WS2_32.dll!getaddrinfo 71AB2A6F 5 Bytes JMP 00BDFC50 \\?\globalroot\systemroot\system32\UACkoehbdpk.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[3760] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00BE0B00 \\?\globalroot\systemroot\system32\UACkoehbdpk.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[3760] WS2_32.dll!send 71AB428A 5 Bytes JMP 00BE09E0 \\?\globalroot\systemroot\system32\UACkoehbdpk.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[3760] WS2_32.dll!gethostbyname 71AB4FD4 5 Bytes JMP 00BE0000 \\?\globalroot\systemroot\system32\UACkoehbdpk.dll
.text C:\Program Files\Internet Explorer\Iexplore.exe[3760] WS2_32.dll!closesocket 71AB9639 5 Bytes JMP 00BE0CC0 \\?\globalroot\systemroot\system32\UACkoehbdpk.dll
.text C:\WINDOWS\system32\wuauclt.exe[3960] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 0097000A
.text C:\WINDOWS\system32\wuauclt.exe[3960] ntdll.dll!LdrUnloadDll 7C91718B 5 Bytes JMP 0098000A
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Ntfs \Ntfs PQV2i.sys (StorageCraft Volume Snap-Shot/StorageCraft)
AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 PQV2i.sys (StorageCraft Volume Snap-Shot/StorageCraft)
---- Modules - GMER 1.0.15 ----
Module \systemroot\system32\drivers\UACqvrorudo.sys (*** hidden *** ) EE843000-EE856000 (77824 bytes)
---- Processes - GMER 1.0.15 ----
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [404] 0x008A0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [508] 0x008A0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [552] 0x008A0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\Explorer.EXE [832] 0x00BB0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe [880] 0x00EA0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [900] 0x008A0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe [936] 0x009E0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\system32\spoolsv.exe [1208] 0x00B30000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\system32\winlogon.exe [1256] 0x00710000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\system32\services.exe [1300] 0x008C0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\system32\lsass.exe [1312] 0x008D0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [1536] 0x008A0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Bonjour\mDNSResponder.exe [1548] 0x008E0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1608] 0x00CF0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe [1632] 0x00AF0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Executive Software\Diskeeper\DkService.exe [1708] 0x00C40000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\ATK0100\ATKOSD.exe [1772] 0x00C20000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\System32\1XConfig.exe [1852] 0x00D10000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\System32\GEARSec.exe [1872] 0x00870000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\system32\ZCfgSvc.exe [1972] 0x010E0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1992] 0x008A0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\System32\RegSrvc.exe [2016] 0x009B0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2056] 0x00B10000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\System32\alg.exe [2136] 0x008B0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\ATK0100\Hcontrol.exe [2176] 0x00FB0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\System32\igfxtray.exe [2184] 0x00B60000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\System32\hkcmd.exe [2192] 0x00B40000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\AGRSMMSG.exe [2200] 0x00BB0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe [2224] 0x00C10000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe [2292] 0x00B30000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Winamp\winampa.exe [2308] 0x00B20000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe [2316] 0x00C90000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\PROGRA~1\Dantz\RETROS~1\RetroExpress.exe [2324] 0x011F0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\MXOALDR.EXE [2332] 0x00B30000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Microsoft IntelliType Pro\type32.exe [2356] 0x00C50000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Microsoft IntelliPoint\point32.exe [2376] 0x00D20000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9TA.EXE [2412] 0x00B40000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Symantec\Norton Ghost\Agent\GhostTray.exe [2436] 0x00C30000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABA.EXE [2460] 0x00B40000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\QuickTime\QTTask.exe [2504] 0x00B90000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\iTunes\iTunesHelper.exe [2528] 0x00B50000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2552] 0x00B60000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe [2564] 0x00BC0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe [2588] 0x00BA0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\ADSL\StarModem ADSL USB MODEM\dslmon.exe [2600] 0x00C10000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Palm\Hotsync.exe [2612] 0x00CE0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Common Files\Skyscape\SmartUpdate.exe [2628] 0x01720000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\PROGRA~1\Webshots\webshots.scr [2652] 0x00D20000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Skyscape\Desktop\smARTalerts\smARTalerts.exe [2968] 0x00B80000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Documents and Settings\Ryan Duke\Desktop\test.exe [3340] 0x00BB0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\System32\wbem\wmiapsrv.exe [3444] 0x009B0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\iPod\bin\iPodService.exe [3556] 0x00900000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [3760] 0x00BD0000
Library \\?\globalroot\systemroot\system32\UACkoehbdpk.dll (*** hidden *** ) @ C:\WINDOWS\system32\wuauclt.exe [3960] 0x00B30000
---- Services - GMER 1.0.15 ----
Service C:\WINDOWS\system32\drivers\UACqvrorudo.sys (*** hidden *** ) [SYSTEM] UACd.sys <-- ROOTKIT !!!
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACqvrorudo.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACqvrorudo.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACwjkdabiq.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UACxabrrpix.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uaclog \\?\globalroot\systemroot\system32\UACnstjixmp.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACjorwbuyk.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACetoqxmla.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACkoehbdpk.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@UACproc \\?\globalroot\systemroot\system32\UACkyjkwnyr.log
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacurls \\?\globalroot\systemroot\system32\UACwolvhjrw.log
Reg HKLM\SYSTEM\CurrentControlSet\Services\UACd.sys\modules@uacerrors \\?\globalroot\systemroot\system32\UACnvpeaatk.log
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACqvrorudo.sys
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACqvrorudo.sys
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACwjkdabiq.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UACxabrrpix.dat
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uaclog \\?\globalroot\systemroot\system32\UACnstjixmp.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACjorwbuyk.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACetoqxmla.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACkoehbdpk.dll
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACproc \\?\globalroot\systemroot\system32\UACkyjkwnyr.log
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacurls \\?\globalroot\systemroot\system32\UACwolvhjrw.log
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacerrors \\?\globalroot\systemroot\system32\UACnvpeaatk.log
---- Files - GMER 1.0.15 ----
File C:\Documents and Settings\Ryan Duke\Local Settings\Temp\UAC1ca1.tmp 343040 bytes executable
File C:\Program Files\Corel\Suite8\Shared\Help\uacc8en.hlp 15586 bytes
File C:\Program Files\Corel\Suite8\Shared\Help\UACC8EN.NLI 5905 bytes
File C:\Program Files\Corel\Suite8\Template\UACC8EN.AST 19078 bytes
File C:\Program Files\Corel\Suite8\Template\UACC8EN.DLL 125952 bytes executable
File C:\WINDOWS\system32\drivers\UACqvrorudo.sys 65536 bytes executable <-- ROOTKIT !!!
File C:\WINDOWS\system32\UACetoqxmla.dll 18944 bytes executable
File C:\WINDOWS\system32\uacinit.dll 5497 bytes
File C:\WINDOWS\system32\UACjorwbuyk.dll 24576 bytes executable
File C:\WINDOWS\system32\UACkoehbdpk.dll 66048 bytes
File C:\WINDOWS\system32\UACkyjkwnyr.log 26546 bytes
File C:\WINDOWS\system32\UACnstjixmp.dll 27136 bytes executable
File C:\WINDOWS\system32\UACwjkdabiq.dll 31232 bytes executable
File C:\WINDOWS\system32\UACxabrrpix.dat 127 bytes
File C:\WINDOWS\Temp\UAC6fcc.tmp 66048 bytes
---- EOF - GMER 1.0.15 ----