gmer
GMER 1.0.15.15641 -
http://www.gmer.net
Rootkit scan 2011-08-15 21:28:28
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GJ00
Running: lwpvgume.exe; Driver: C:\Users\Soyoung\AppData\Local\Temp\kgrirfog.sys
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwSaveKey + 13D1 82E5A349 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82E93D52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
? System32\drivers\bnglsbfa.sys 지정된 경로를 찾을 수 없습니다. !
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1956] @ C:\windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [753FFFF6] C:\windows\system32\apphelp.dll (응용 프로그램 호환성 클라이언트 라이브러리/Microsoft Corporation)
IAT C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1956] @ C:\windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [753FFFF6] C:\windows\system32\apphelp.dll (응용 프로그램 호환성 클라이언트 라이브러리/Microsoft Corporation)
IAT C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1956] @ C:\windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [753FFFF6] C:\windows\system32\apphelp.dll (응용 프로그램 호환성 클라이언트 라이브러리/Microsoft Corporation)
IAT C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1956] @ C:\windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [753FFFF6] C:\windows\system32\apphelp.dll (응용 프로그램 호환성 클라이언트 라이브러리/Microsoft Corporation)
IAT C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1956] @ C:\windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [753FFFF6] C:\windows\system32\apphelp.dll (응용 프로그램 호환성 클라이언트 라이브러리/Microsoft Corporation)
IAT C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1956] @ C:\windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [753FFFF6] C:\windows\system32\apphelp.dll (응용 프로그램 호환성 클라이언트 라이브러리/Microsoft Corporation)
IAT C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1956] @ C:\windows\system32\secur32.dll [KERNEL32.dll!GetProcAddress] [753FFFF6] C:\windows\system32\apphelp.dll (응용 프로그램 호환성 클라이언트 라이브러리/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (커널 모드 드라이버 프레임워크 런타임/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (커널 모드 드라이버 프레임워크 런타임/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
Device \Driver\ACPI_HAL \Device\0000004b halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----