GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-17 15:07:42
Windows 6.0.6002 Service Pack 2
Running: 2cgk3m1x.exe; Driver: C:\Users\Buddy77\AppData\Local\Temp\fgldyfob.sys


---- System - GMER 1.0.15 ----

SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys ZwTerminateProcess [0x807CB0B0]

INT 0x51 ? 84CF4BF8
INT 0x62 ? 860A9E30
INT 0x72 ? 860A9E30
INT 0x72 ? 860A9E30
INT 0x82 ? 84CF3BF8
INT 0x92 ? 84CF4BF8

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!KeSetEvent + 621 820B2D84 4 Bytes [B0, B0, 7C, 80] {MOV AL, 0xb0; JL 0xffffffffffffff84}
? System32\Drivers\spfc.sys The system cannot find the path specified. !
PAGE ataport.SYS!DllUnload 8268BB2E 5 Bytes JMP 84CF41D8
.text USBPORT.SYS!DllUnload 87B9541B 5 Bytes JMP 860A9410
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8BC03340, 0x3DA8C7, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Mozilla Firefox\firefox.exe[4088] ntdll.dll!LdrLoadDll 76FF9390 5 Bytes JMP 002F13F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [806026D2] \SystemRoot\System32\Drivers\spfc.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [80602040] \SystemRoot\System32\Drivers\spfc.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [806027FC] \SystemRoot\System32\Drivers\spfc.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [806020BE] \SystemRoot\System32\Drivers\spfc.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8060213C] \SystemRoot\System32\Drivers\spfc.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [80612048] \SystemRoot\System32\Drivers\spfc.sys

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73F77817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [73FCA86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [73F7BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [73F6F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73F775E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [73F6E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [73FA8395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [73F7DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [73F6FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73F6FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [73F671CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [73FFCAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [73F9C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [73F6D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [73F66853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73F6687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[456] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73F72AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 84CFA1F8
Device \Driver\volmgr \Device\VolMgrControl 84CF61F8
Device \Driver\usbohci \Device\USBPDO-0 860AC1F8
Device \Driver\usbehci \Device\USBPDO-1 860AD1F8

AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\volmgr \Device\HarddiskVolume1 84CF61F8
Device \Driver\nvstor32 \Device\00000058 84CF91F8
Device \Driver\volmgr \Device\HarddiskVolume2 84CF61F8
Device \Driver\cdrom \Device\CdRom0 860D81F8
Device \Driver\nvstor32 \Device\00000059 84CF91F8
Device \Driver\USBSTOR \Device\00000065 8720D500
Device \Driver\atapi \Device\Ide\IdePort0 84CF81F8
Device \Driver\atapi \Device\Ide\IdePort1 84CF81F8
Device \Driver\volmgr \Device\HarddiskVolume3 84CF61F8
Device \Driver\USBSTOR \Device\00000068 8720D500
Device \Driver\netbt \Device\NetBt_Wins_Export 872501F8
Device \Driver\Smb \Device\NetbiosSmb 870E41F8
Device \Driver\nvstor32 \Device\RaidPort0 84CF91F8

AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\netbt \Device\NetBT_Tcpip_{3385129C-3A9D-4FF2-92B7-9FE238683929} 872501F8
Device \Driver\iScsiPrt \Device\RaidPort1 8615C1F8

AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\netbt \Device\NetBT_Tcpip_{829ED9AA-D38C-4958-AF86-9D3458FF2184} 872501F8
Device \Driver\usbohci \Device\USBFDO-0 860AC1F8
Device \Driver\usbehci \Device\USBFDO-1 860AD1F8
Device \FileSystem\cdfs \Cdfs 872571F8

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP Officejet 6500 E709n Series@ChangeID 2275789
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP Officejet 6500 E709n Series (Copy 1)@ChangeID 2275789

---- EOF - GMER 1.0.15 ----