GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-29 16:57:09
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\RICHAR~1\LOCALS~1\Temp\ugnyyfog.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwConnectPort [0xAA15D630]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwCreateFile [0xAA156D80]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwCreateKey [0xAA17B070]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwCreatePort [0xAA15DE40]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwCreateProcess [0xAA174D30]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwCreateProcessEx [0xAA175150]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwCreateSection [0xAA17F240]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwCreateWaitablePort [0xAA15DFB0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwDeleteFile [0xAA157C60]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwDeleteKey [0xAA17C780]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwDeleteValueKey [0xAA17C160]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwDuplicateObject [0xAA173E70]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwLoadKey [0xAA17D080]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwLoadKey2 [0xAA17D2B0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwOpenFile [0xAA157750]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwOpenProcess [0xAA177450]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwOpenThread [0xAA177020]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwRenameKey [0xAA17E430]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwReplaceKey [0xAA17DA40]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwRequestWaitReplyPort [0xAA15D180]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwRestoreKey [0xAA17E0D0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwSecureConnectPort [0xAA15D910]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwSetInformationFile [0xAA158080]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwSetSecurityObject [0xAA17E8E0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwSetValueKey [0xAA17B970]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)             ZwSystemDebugControl [0xAA175D20]
SSDT            \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com)  ZwTerminateProcess [0xAA0EB0B0]

Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   ZwEnumerateKey [0xAA02EAE5]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   ZwEnumerateValueKey [0xAA02EACF]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   ZwMapViewOfSection [0xAA02E9E8]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   ZwNotifyChangeKey [0xAA02EB11]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   ZwOpenKey [0xAA02EA2B]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   ZwProtectVirtualMemory [0xAA02E9BC]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   ZwQueryKey [0xAA02EB4D]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   ZwQueryMultipleValueKey [0xAA02EAB9]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   ZwQueryValueKey [0xAA02EAA3]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   ZwSetContextThread [0xAA02E994]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   ZwSetInformationProcess [0xAA02E980]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   ZwUnloadKey [0xAA02EAFB]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   ZwUnmapViewOfSection [0xAA02E9FE]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   ZwYieldExecution [0xAA02E9D2]
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   NtMapViewOfSection
Code            \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)                   NtSetInformationProcess

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                         mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

Device          \Driver\Tcpip \Device\Ip                                                                                       vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                       Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                        SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                        SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device          \Driver\Tcpip \Device\Tcp                                                                                      vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                      Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

Device          \Driver\Tcpip \Device\Udp                                                                                      vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                      Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

Device          \Driver\Tcpip \Device\RawIp                                                                                    vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                    Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

Device          \Driver\Tcpip \Device\IPMULTICAST                                                                              vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device          \FileSystem\Fastfat \Fat                                                                                       A8BB9D20

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                       mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

Device           -> \Driver\atapi \Device\Harddisk0\DR0                                                                        86AEB856

---- Files - GMER 1.0.15 ----

File            C:\WINDOWS\system32\drivers\atapi.sys                                                                          suspicious modification

---- EOF - GMER 1.0.15 ----