virusproblem

GMER 1.0.15.15011 [x8dqrkd6.exe] - http://www.gmer.net
Rootkit scan 2009-08-03 22:04:40
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.15 ----

SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwConnectPort [0xB644E040]
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwCreateFile [0xB644A930]
SSDT      BA7B00E6                                                                                                             ZwCreateKey
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwCreatePort [0xB644E510]
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwCreateProcess [0xB6454870]
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwCreateProcessEx [0xB6454AA0]
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwCreateSection [0xB6457FD0]
SSDT      BA7B00DC                                                                                                             ZwCreateThread
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwCreateWaitablePort [0xB644E600]
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwDeleteFile [0xB644AF20]
SSDT      BA7B00EB                                                                                                             ZwDeleteKey
SSDT      BA7B00F5                                                                                                             ZwDeleteValueKey
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwDuplicateObject [0xB6454580]
SSDT      spyp.sys                                                                                                             ZwEnumerateKey [0xB9EC5CA4]
SSDT      spyp.sys                                                                                                             ZwEnumerateValueKey [0xB9EC6032]
SSDT      BA7B00FA                                                                                                             ZwLoadKey
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwOpenFile [0xB644AD70]
SSDT      spyp.sys                                                                                                             ZwOpenKey [0xB9EA70C0]
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwOpenProcess [0xB6454350]
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwOpenThread [0xB6454150]
SSDT      spyp.sys                                                                                                             ZwQueryKey [0xB9EC610A]
SSDT      spyp.sys                                                                                                             ZwQueryValueKey [0xB9EC5F8A]
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwRenameKey [0xB6457250]
SSDT      BA7B0104                                                                                                             ZwReplaceKey
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwRequestWaitReplyPort [0xB644DC00]
SSDT      BA7B00FF                                                                                                             ZwRestoreKey
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwSecureConnectPort [0xB644E220]
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwSetInformationFile [0xB644B120]
SSDT      BA7B00F0                                                                                                             ZwSetValueKey
SSDT      \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                          ZwTerminateProcess [0xB6454CD0]

INT 0x62  ?                                                                                                                    8ADD2BF8
INT 0x73  ?                                                                                                                    8ABC8F00
INT 0x83  ?                                                                                                                    8ADD2BF8
INT 0xB4  ?                                                                                                                    8ABC8F00

---- Kernel code sections - GMER 1.0.15 ----

.text     ntkrnlpa.exe!ZwCallbackReturn + 2C7C                                                                                 80504518 12 Bytes  [10, E5, 44, B6, 70, 48, 45, ...]
?         spyp.sys                                                                                                             Das System kann die angegebene Datei nicht finden. !
?         srescan.sys                                                                                                          Das System kann die angegebene Datei nicht finden. !
.text     USBPORT.SYS!DllUnload                                                                                                B93AF8AC 5 Bytes  JMP 8ABC84E0 
.text     an9snz3h.SYS                                                                                                         B8CC4386 35 Bytes  [00, 00, 00, 00, 00, 00, 20, ...]
.text     an9snz3h.SYS                                                                                                         B8CC43AA 24 Bytes  [00, 00, 00, 00, 00, 00, 00, ...]
.text     an9snz3h.SYS                                                                                                         B8CC43C4 3 Bytes  [00, 70, 02] {ADD [EAX+0x2], DH}
.text     an9snz3h.SYS                                                                                                         B8CC43C9 1 Byte  [30]
.text     an9snz3h.SYS                                                                                                         B8CC43C9 11 Bytes  [30, 00, 00, 00, 5C, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESP; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text     ...                                                                                                                  

---- User code sections - GMER 1.0.15 ----

.text     C:\WINDOWS\system32\winlogon.exe[772] ntdll.dll!NtLockProductActivationKeys                                          7C91D4AE 5 Bytes  JMP 10001000 C:\WINDOWS\system32\antiwpa.dll
.text     C:\WINDOWS\system32\winlogon.exe[772] USER32.dll!GetSystemMetrics                                                    7E368F9C 5 Bytes  JMP 10001018 C:\WINDOWS\system32\antiwpa.dll

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT       atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                                   [B9EA8042] spyp.sys
IAT       atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                                           [B9EA813E] spyp.sys
IAT       atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                                  [B9EA80C0] spyp.sys
IAT       atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                                          [B9EA8800] spyp.sys
IAT       atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                                  [B9EA86D6] spyp.sys
IAT       \SystemRoot\System32\Drivers\an9snz3h.SYS[HAL.dll!KfAcquireSpinLock]                                                 18C4830E
IAT       \SystemRoot\System32\Drivers\an9snz3h.SYS[HAL.dll!READ_PORT_UCHAR]                                                   1C8D9E88
IAT       \SystemRoot\System32\Drivers\an9snz3h.SYS[HAL.dll!KeGetCurrentIrql]                                                  9E880000
IAT       \SystemRoot\System32\Drivers\an9snz3h.SYS[HAL.dll!KfRaiseIrql]                                                       00001CA9
IAT       \SystemRoot\System32\Drivers\an9snz3h.SYS[HAL.dll!KfLowerIrql]                                                       0E798366
IAT       \SystemRoot\System32\Drivers\an9snz3h.SYS[HAL.dll!HalGetInterruptVector]                                             74AAB000
IAT       \SystemRoot\System32\Drivers\an9snz3h.SYS[HAL.dll!HalTranslateBusAddress]                                            8186C636
IAT       \SystemRoot\System32\Drivers\an9snz3h.SYS[HAL.dll!KeStallExecutionProcessor]                                         1A00001C
IAT       \SystemRoot\System32\Drivers\an9snz3h.SYS[HAL.dll!KfReleaseSpinLock]                                                 1C8386C6
IAT       \SystemRoot\System32\Drivers\an9snz3h.SYS[HAL.dll!READ_PORT_BUFFER_USHORT]                                           C6020000
IAT       \SystemRoot\System32\Drivers\an9snz3h.SYS[HAL.dll!READ_PORT_USHORT]                                                  001C8E86
IAT       \SystemRoot\System32\Drivers\an9snz3h.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                          86C60200
IAT       \SystemRoot\System32\Drivers\an9snz3h.SYS[HAL.dll!WRITE_PORT_UCHAR]                                                  00001CAA
IAT       \SystemRoot\System32\Drivers\an9snz3h.SYS[WMILIB.SYS!WmiSystemControl]                                               8800001C
IAT       \SystemRoot\System32\Drivers\an9snz3h.SYS[WMILIB.SYS!WmiCompleteRequest]                                             001CB19E
IAT       \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol]                                             [B6452CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter]                                                  [B64531C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter]                                                 [B6453320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol]                                           [B6452E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol]                                             [B6452E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol]                                               [B6452CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter]                                                    [B64531C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter]                                                   [B6453320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol]                                              [B6452CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol]                                            [B6452E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter]                                                  [B6453320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter]                                                   [B64531C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter]                                                    [B6453320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter]                                                     [B64531C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol]                                                [B6452CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol]                                             [B6452E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol]                                               [B6452CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter]                                                    [B64531C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter]                                                   [B6453320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol]                                              [B6452CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol]                                            [B6452E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter]                                                  [B6453320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT       \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter]                                                   [B64531C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)