after reboot spwd.sys HOOKED do I wipe?
AVG malware both run clean
here is the log lots of strange win32k.sys in shadowSSDT not sure if it's related
ROOTREPEAL (c) AD, 2007-2009 ================================================== Scan Start Time: 2010/01/22 01:12 Program Version: Version 1.3.2.0 Windows Version: Windows XP SP3 ================================================== Drivers ------------------- Name: asddsafsd.sys Image Path: C:\WINDOWS\system32\drivers\asddsafsd.sys Address: 0xA4D42000 Size: 49152 File Visible: No Signed: - Status: - Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xA8508000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xBA614000 Size: 8192 File Visible: No Signed: - Status: - Name: PCI_PNP3886 Image Path: \Driver\PCI_PNP3886 Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: sptd Image Path: \Driver\sptd Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: spwb.sys Image Path: spwb.sys Address: 0xB9EA6000 Size: 1052672 File Visible: No Signed: - Status: - Hidden/Locked Files ------------------- Path: C:\Documents and Settings\zb\Application Data\SecuROM\UserData\ЃϵϳЅЂϿϽϯІχϯπρϴϱЄϱЃϵϳЅ Status: Locked to the Windows API! Path: C:\Documents and Settings\zb\Application Data\SecuROM\UserData\ЃϵϳЅЂϿϽϯІχϯπρЂϻϵЉЃϵϳЅ Status: Locked to the Windows API! SSDT ------------------- #: 041 Function Name: NtCreateKey Status: Hooked by "spwb.sys" at address 0xb9ea70e0 #: 071 Function Name: NtEnumerateKey Status: Hooked by "spwb.sys" at address 0xb9ec5da4 #: 073 Function Name: NtEnumerateValueKey Status: Hooked by "spwb.sys" at address 0xb9ec6132 #: 119 Function Name: NtOpenKey Status: Hooked by "spwb.sys" at address 0xb9ea70c0 #: 160 Function Name: NtQueryKey Status: Hooked by "spwb.sys" at address 0xb9ec620a #: 177 Function Name: NtQueryValueKey Status: Hooked by "spwb.sys" at address 0xb9ec608a #: 247 Function Name: NtSetValueKey Status: Hooked by "spwb.sys" at address 0xb9ec629c Stealth Objects ------------------- Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP] Process: System Address: 0x8a5611f8 Address: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE] Process: System Address: 0x8a1e5500 Address: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_CLOSE] Process: System Address: 0x8a1e5500 Address: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_READ] Process: System Address: 0x8a1e5500 Address: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_WRITE] Process: System Address: 0x8a1e5500 Address: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x8a1e5500 Address: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a1e5500 Address: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x8a1e5500 Address: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_SHUTDOWN] Process: System Address: 0x8a1e5500 Address: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_POWER] Process: System Address: 0x8a1e5500 Address: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x8a1e5500 Address: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_PNP] Process: System Address: 0x8a1e5500 Address: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_CREATE] Process: System Address: 0x8a5631f8 Address: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_CLOSE] Process: System Address: 0x8a5631f8 Address: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_READ] Process: System Address: 0x8a5631f8 Address: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_WRITE] Process: System Address: 0x8a5631f8 Address: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x8a5631f8 Address: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a5631f8 Address: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x8a5631f8 Address: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_SHUTDOWN] Process: System Address: 0x8a5631f8 Address: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_POWER] Process: System Address: 0x8a5631f8 Address: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x8a5631f8 Address: 121 Object: Hidden Code [Driver: dmio, IRP_MJ_PNP] Process: System Address: 0x8a5631f8 Address: 121 Object: Hidden Code [Driver: usbohci, IRP_MJ_CREATE] Process: System Address: 0x8a22f500 Address: 121 Object: Hidden Code [Driver: usbohci, IRP_MJ_CLOSE] Process: System Address: 0x8a22f500 Address: 121 Object: Hidden Code [Driver: usbohci, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a22f500 Address: 121 Object: Hidden Code [Driver: usbohci, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x8a22f500 Address: 121 Object: Hidden Code [Driver: usbohci, IRP_MJ_POWER] Process: System Address: 0x8a22f500 Address: 121 Object: Hidden Code [Driver: usbohci, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x8a22f500 Address: 121 Object: Hidden Code [Driver: usbohci, IRP_MJ_PNP] Process: System Address: 0x8a22f500 Address: 121 Object: Hidden Code [Driver: a81270k3ࠅఖ扏济ACPI#Authent, IRP_MJ_CREATE] Process: System Address: 0x8a1a7500 Address: 121 Object: Hidden Code [Driver: a81270k3ࠅఖ扏济ACPI#Authent, IRP_MJ_CLOSE] Process: System Address: 0x8a1a7500 Address: 121 Object: Hidden Code [Driver: a81270k3ࠅఖ扏济ACPI#Authent, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a1a7500 Address: 121 Object: Hidden Code [Driver: a81270k3ࠅఖ扏济ACPI#Authent, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x8a1a7500 Address: 121 Object: Hidden Code [Driver: a81270k3ࠅఖ扏济ACPI#Authent, IRP_MJ_POWER] Process: System Address: 0x8a1a7500 Address: 121 Object: Hidden Code [Driver: a81270k3ࠅఖ扏济ACPI#Authent, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x8a1a7500 Address: 121 Object: Hidden Code [Driver: a81270k3ࠅఖ扏济ACPI#Authent, IRP_MJ_PNP] Process: System Address: 0x8a1a7500 Address: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CREATE] Process: System Address: 0x8a5d71f8 Address: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_READ] Process: System Address: 0x8a5d71f8 Address: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_WRITE] Process: System Address: 0x8a5d71f8 Address: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x8a5d71f8 Address: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a5d71f8 Address: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x8a5d71f8 Address: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SHUTDOWN] Process: System Address: 0x8a5d71f8 Address: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CLEANUP] Process: System Address: 0x8a5d71f8 Address: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_POWER] Process: System Address: 0x8a5d71f8 Address: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x8a5d71f8 Address: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_PNP] Process: System Address: 0x8a5d71f8 Address: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_CREATE] Process: System Address: 0x8a198500 Address: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_CLOSE] Process: System Address: 0x8a198500 Address: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a198500 Address: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x8a198500 Address: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_CLEANUP] Process: System Address: 0x8a198500 Address: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_PNP] Process: System Address: 0x8a198500 Address: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE] Process: System Address: 0x8a1dc500 Address: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE] Process: System Address: 0x8a1dc500 Address: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a1dc500 Address: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x8a1dc500 Address: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER] Process: System Address: 0x8a1dc500 Address: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x8a1dc500 Address: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP] Process: System Address: 0x8a1dc500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_NAMED_PIPE] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLOSE] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_READ] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_WRITE] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_INFORMATION] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_EA] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_EA] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SHUTDOWN] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLEANUP] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_MAILSLOT] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_SECURITY] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_SECURITY] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_POWER] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CHANGE] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_QUOTA] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_QUOTA] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_PNP] Process: System Address: 0x8a248500 Address: 121 Object: Hidden Code [Driver: CdfsЅ౨瑎晦܂Èੈ, IRP_MJ_CREATE] Process: System Address: 0x8a204500 Address: 121 Object: Hidden Code [Driver: CdfsЅ౨瑎晦܂Èੈ, IRP_MJ_CLOSE] Process: System Address: 0x8a204500 Address: 121 Object: Hidden Code [Driver: CdfsЅ౨瑎晦܂Èੈ, IRP_MJ_READ] Process: System Address: 0x8a204500 Address: 121 Object: Hidden Code [Driver: CdfsЅ౨瑎晦܂Èੈ, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x8a204500 Address: 121 Object: Hidden Code [Driver: CdfsЅ౨瑎晦܂Èੈ, IRP_MJ_SET_INFORMATION] Process: System Address: 0x8a204500 Address: 121 Object: Hidden Code [Driver: CdfsЅ౨瑎晦܂Èੈ, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x8a204500 Address: 121 Object: Hidden Code [Driver: CdfsЅ౨瑎晦܂Èੈ, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x8a204500 Address: 121 Object: Hidden Code [Driver: CdfsЅ౨瑎晦܂Èੈ, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x8a204500 Address: 121 Object: Hidden Code [Driver: CdfsЅ౨瑎晦܂Èੈ, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a204500 Address: 121 Object: Hidden Code [Driver: CdfsЅ౨瑎晦܂Èੈ, IRP_MJ_SHUTDOWN] Process: System Address: 0x8a204500 Address: 121 Object: Hidden Code [Driver: CdfsЅ౨瑎晦܂Èੈ, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x8a204500 Address: 121 Object: Hidden Code [Driver: CdfsЅ౨瑎晦܂Èੈ, IRP_MJ_CLEANUP] Process: System Address: 0x8a204500 Address: 121 Object: Hidden Code [Driver: CdfsЅ౨瑎晦܂Èੈ, IRP_MJ_PNP] Process: System Address: 0x8a204500 Address: 121 ==EOF==