Proszę o sprawdzenie loga operator twierdzi iż mam programsp

Operator twierdzi iż komputer “zdrowy” ma w przybliżeniu taką samą ilosc pakietów odebranych i wysłanych , natomast w państwa komputerze wysłanych jest zdecydowanie wiecej co świadczy o pracy jakiegoś niekontrolowanego programu (sprawdzałem Avastem, ad-aware se personal, a-squared,ewido) i nic.Mam p Pakiet 500kbps/128kbps a internet chodzi w granicach od często100 do rzadko 400bps

Złączono Posta : 12.02.2006 (Nie) 12:54

Logfile of HijackThis v1.99.1

Scan saved at 12:50:54, on 2006-02-12

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Sygate\SPF\smc.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\Program Files\ewido\security suite\ewidoctrl.exe

C:\Program Files\Borland\Interbase\bin\ibguard.exe

C:\MATLAB701\webserver\bin\win32\matlabserver.exe

C:\WINDOWS\System32\tcpsvcs.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Borland\Interbase\bin\ibserver.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Pliki pobierane z internetu\Programy\hijackthis_199\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\WINDOWS\Downloaded Program Files\CONFLICT.1\googlenav.dll

O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui

O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm

O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\Downloaded Program Files\CONFLICT.1\googlenav.dll/cmsearch.html

O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\Downloaded Program Files\CONFLICT.1\googlenav.dll/cmbacklinks.html

O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\Downloaded Program Files\CONFLICT.1\googlenav.dll/cmcache.html

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\Downloaded Program Files\CONFLICT.1\googlenav.dll/cmsimilar.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll

O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll

O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll

O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll

O15 - Trusted Zone: http://www.mks.com.pl

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1124543269512

O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} (Google Activate) - http://toolbar.google.com/data/pl/big/1.1.62-big/GoogleNav.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1125169619400

O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab

O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www5.incredimail.com/contents/setup/downloader/imloader.cab

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe

O23 - Service: InterBase Guardian (InterBaseGuardian) - Inprise Corporation - C:\Program Files\Borland\Interbase\bin\ibguard.exe

O23 - Service: InterBase Server (InterBaseServer) - Inprise Corporation - C:\Program Files\Borland\Interbase\bin\ibserver.exe

O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB701\webserver\bin\win32\matlabserver.exe

O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

O23 - Service: Securom User Access for Windows 2000 and Windows XP a technology by Sony DADC (UserAccess) - Unknown owner - C:\Program Files\Boardmaker with SD Pro\Secu2KXP\useraccess.exe (file missing)

Jest Ok log :wink:

Przyczyn szukaj gdzie indziej :slight_smile:

Dzięki serdeczne za spawdzenie loga ale nie mam pojęcia gdzie szukać.? :roll:

Daj log z silenta- Silent opis: http://www.searchengines.pl/phpbb203/in … opic=15989

i zapusć gmera na Rootkita - GMER

logi- tutaj wklej

“Silent Runners.vbs”, revision 43, http://www.silentrunners.org/

Operating System: Windows XP SP2

Output limited to non-default values, except where indicated by “{++}”

Startup items buried in registry:


HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

“ctfmon.exe” = “C:\WINDOWS\system32\ctfmon.exe” [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}

“SmcService” = “C:\PROGRA~1\Sygate\SPF\smc.exe -startgui” [“Sygate Technologies, Inc.”]

“WheelMouse” = “C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe” [“A4Tech Co.,Ltd.”]

“avast!” = “C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [null data]

“Cmaudio” = “RunDll32 cmicnfg.cpl,CMICtrlWnd” [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = “AcroIEHlprObj Class” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”]

{53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided)

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\SPYBOT~1\SDHelper.dll” [“Safer Networking Limited”]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

“{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Rozszerzenie CPL kadrowania wyświetlania”

-> {CLSID}\InProcServer32(Default) = “deskpan.dll” [file not found]

“{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Rozszerzenie ikony HyperTerminalu”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”]

“{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS]

“{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

“{36A21736-36C2-4C11-8ACB-D4136F2B57BD}” = “Ikona obsługi nakładki Podpisów cyfrowych AutoCAD”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\System32\AcSignIcon.dll” [“Autodesk”]

“{AC1DB655-4F9A-4c39-8AD2-A65324A4C446}” = “Autodesk Drawing Preview”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Common Files\Autodesk Shared\Thumbnail\AcThumbnail16.dll” [“Autodesk”]

“{32020A01-506E-484D-A2A8-BE3CF17601C3}” = “AlcoholShellEx”

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll” [“Alcohol Soft Development Team”]

“{640167b4-59b0-47a6-b335-a6b3c0695aea}” = “Portable Media Devices”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\System32\Audiodev.dll” [MS]

“{cc86590a-b60a-48e6-996b-41d25ed39a1e}” = “Portable Media Devices Menu”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\System32\Audiodev.dll” [MS]

“{6E3C607A-B99C-4FA8-98F5-1AC1ADF7F5B9}” = “MediaFace extension”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Fellowes\MediaFACE 4.0\MFShlExt.dll” [“Fellowes, Inc.”]

“{e57ce731-33e8-4c51-8354-bb4de9d215d1}” = “Uniwersalne urządzenia Plug and Play”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\upnpui.dll” [MS]

“{21569614-B795-46b1-85F4-E737A8DC09AD}” = “Shell Search Band”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\browseui.dll” [MS]

“{472083B0-C522-11CF-8763-00608CC02F24}” = “avast”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”]

“{AB77609F-2178-4E6F-9C4B-44AC179D937A}” = “a˛ Context Menu Shell Extension”

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\A-SQUA~1\A2CONT~1.DLL” [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\

INFECTION WARNING! “{93994DE8-8239-4655-B1D1-5F4E91300429}” = “DVDIdleShell Class” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\DVDREG~1\DVDShell.dll” [“Fengtao Software Inc.”]

INFECTION WARNING! “{54D9498B-CF93-414F-8984-8CE7FDE0D391}” = “ewido shell guard”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\ewido\security suite\shellhook.dll” ["TODO: "]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\

INFECTION WARNING! AtiExtEvent\DLLName = “Ati2evxx.dll” [“ATI Technologies Inc.”]

HKLM\Software\Classes*\shellex\ContextMenuHandlers\

avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”]

ewido(Default) = “{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\ewido\security suite\context.dll” [“ewido networks”]

IMMenuShellExt(Default) = “{F8984111-38B6-11D5-8725-0050DA2761C4}”

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\INCRED~1\bin\ImShExt.dll” [“IncrediMail, Ltd.”]

MediaFaceExtension(Default) = “{6E3C607A-B99C-4FA8-98F5-1AC1ADF7F5B9}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Fellowes\MediaFACE 4.0\MFShlExt.dll” [“Fellowes, Inc.”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\

ewido(Default) = “{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\ewido\security suite\context.dll” [“ewido networks”]

MediaFaceExtension(Default) = “{6E3C607A-B99C-4FA8-98F5-1AC1ADF7F5B9}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Fellowes\MediaFACE 4.0\MFShlExt.dll” [“Fellowes, Inc.”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\

a2ContMenu(Default) = “{AB77609F-2178-4E6F-9C4B-44AC179D937A}”

-> {CLSID}\InProcServer32(Default) = “C:\PROGRA~1\A-SQUA~1\A2CONT~1.DLL” [null data]

avast(Default) = “{472083B0-C522-11CF-8763-00608CC02F24}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\Alwil Software\Avast4\ashShell.dll” [“ALWIL Software”]

WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”

-> {CLSID}\InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data]

Active Desktop and Wallpaper:


Active Desktop is enabled at this entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Active Desktop web content:

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\6\

“FriendlyName” = “”

“Source” = “file:///C:/DOCUME~1/tata/USTAWI~1/Temp/msohtml1/01/clip_image002.jpg”

“SubscribedURL” = “file:///C:/DOCUME~1/tata/USTAWI~1/Temp/msohtml1/01/clip_image002.jpg”

Winsock2 Service Provider DLLs:


Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}

000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS]

000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}

0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:

%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 19

%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:


Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\

“{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = “&Google” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\Downloaded Program Files\CONFLICT.1\googlenav.dll” [“Google Inc.”]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

“{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = “&Google” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\Downloaded Program Files\CONFLICT.1\googlenav.dll” [“Google Inc.”]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\

“{2318C2B1-4965-11D4-9B18-009027A5CD4F}” = “&Google” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\Downloaded Program Files\CONFLICT.1\googlenav.dll” [“Google Inc.”]

Explorer Bars

HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\

{21569614-B795-46B1-85F4-E737A8DC09AD}\ = “Shell Search Band” [from CLSID]

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\system32\browseui.dll” [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\

{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\

“MenuText” = “Sun Java Console”

“CLSIDExtension” = “{08B0E5C0-4FCB-11CF-AAA5-00401C608501}”

-> {CLSID}\InProcServer32(Default) = “C:\WINDOWS\System32\msjava.dll” [MS]

Running Services (Display Name, Service Name, Path {Service DLL}):


Ati HotKey Poller, Ati HotKey Poller, “C:\WINDOWS\system32\Ati2evxx.exe” [“ATI Technologies Inc.”]

avast! Antivirus, avast! Antivirus, ““C:\Program Files\Alwil Software\Avast4\ashServ.exe”” [null data]

avast! iAVS4 Control Service, aswUpdSv, ““C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe”” [null data]

avast! Mail Scanner, avast! Mail Scanner, ““C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe” /service” [“ALWIL Software”]

avast! Web Scanner, avast! Web Scanner, ““C:\Program Files\Alwil Software\Avast4\ashWebSv.exe” /service” [“ALWIL Software”]

ewido security suite control, ewido security suite control, “C:\Program Files\ewido\security suite\ewidoctrl.exe” [“ewido networks”]

InterBase Guardian, InterBaseGuardian, “C:\Program Files\Borland\Interbase\bin\ibguard.exe” [“Inprise Corporation”]

InterBase Server, InterBaseServer, “C:\Program Files\Borland\Interbase\bin\ibserver.exe” [“Inprise Corporation”]

MATLAB Server, matlabserver, “C:\MATLAB701\webserver\bin\win32\matlabserver.exe” [null data]

Sygate Personal Firewall Pro, SmcService, “C:\Program Files\Sygate\SPF\smc.exe” [“Sygate Technologies, Inc.”]

Usługi Simple TCP/IP, SimpTcp, “C:\WINDOWS\System32\tcpsvcs.exe” [MS]

Windows User Mode Driver Framework, UMWdf, “C:\WINDOWS\System32\wdfmgr.exe” [MS]

Print Monitors:


HKLM\System\CurrentControlSet\Control\Print\Monitors\

PDFCreator\Driver = “pdfcmnnt.dll” [null data]


  • This report excludes default entries except where indicated.

  • To see *everywhere* the script checks and *everything* it finds,

launch it from a command prompt or a shortcut with the -all parameter.

  • The search for DESKTOP.INI DLL launch points on all local fixed drives

took 231 seconds.

  • The search for all Registry CLSIDs containing dormant Explorer Bars

took 26 seconds.

---------- (total run time: 303 seconds)

Chyba dobrze zrobiłem??? gmera na Rootkita

---- System - GMER 1.0.6 ----

SSDT ??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys ZwAllocateVirtualMemory

SSDT a347bus.sys ZwClose

SSDT a347bus.sys ZwCreateKey

SSDT a347bus.sys ZwCreatePagingFile

SSDT ??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys ZwCreateThread

SSDT a347bus.sys ZwEnumerateKey

SSDT a347bus.sys ZwEnumerateValueKey

SSDT ??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys ZwMapViewOfSection

SSDT a347bus.sys ZwOpenFile

SSDT a347bus.sys ZwOpenKey

SSDT ??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys ZwProtectVirtualMemory

SSDT a347bus.sys ZwQueryKey

SSDT a347bus.sys ZwQueryValueKey

SSDT a347bus.sys ZwSetSystemPowerState

SSDT ??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys ZwShutdownSystem

SSDT ??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys ZwTerminateProcess

SSDT ??\C:\WINDOWS\System32\drivers\wpsdrvnt.sys ZwWriteVirtualMemory

---- Devices - GMER 1.0.6 ----

Device \Driver\aswTdi IRP_MJ_CREATE wpsdrvnt.sys

Device \Driver\aswTdi IRP_MJ_CLOSEIRP_MJ_READ wpsdrvnt.sys

Device \Driver\aswTdi IRP_MJ_INTERNAL_DEVICE_CONTROL wpsdrvnt.sys

Device \Driver\aswTdi IRP_MJ_SHUTDOWN wpsdrvnt.sys

---- Modules - GMER 1.0.6 ----

Module F8590000

Jest czysto hm… i nawet nie chodzi że z gmera nie cały log