Newsgroup: it.comp.sicurezza.varie
Titolo: [LUNGO, CON LOG] Mi aiutate a capire l'output di Gmer?

Ciao, ho fatto l'ennesima scansione del sistema (XP SP2) con Gmer e
ancora una volta nessun elemento rosso. Solo che non riesco a capirne
l'output:
GMER 1.0.12.12027 - 
http://www.gmer.net
Rootkit scan 2007-03-03 10:20:02
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.12 ----
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwClose
SSDT    \SystemRoot\System32\Drivers
\bcftdi.SYS
ZwConnectPort
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwCreateKey
SSDT    \SystemRoot\System32\Drivers
\bcftdi.SYS
ZwCreatePort
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwCreateProcess
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwCreateProcessEx
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwCreateSection
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwCreateSymbolicLinkObject
SSDT    \SystemRoot\System32\Drivers
\bcftdi.SYS
ZwCreateThread
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwDeleteKey
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwDeleteValueKey
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwDuplicateObject
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwEnumerateKey
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwEnumerateValueKey
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwFlushKey
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwInitializeRegistry
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwLoadKey
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwLoadKey2
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwNotifyChangeKey
SSDT
kl1.sys
ZwOpenFile
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwOpenKey
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwOpenProcess
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwOpenSection
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwQueryKey
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwQueryMultipleValueKey
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwQuerySystemInformation
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwQueryValueKey
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwReplaceKey
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwRestoreKey
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwResumeThread
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwSaveKey
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwSetContextThread
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwSetInformationFile
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwSetInformationKey
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwSetInformationProcess
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwSetSecurityObject
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwSetValueKey
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwSuspendThread
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
ZwTerminateProcess
SSDT    \??\C:\WINDOWS\system32\Drivers
\uphcleanhlp.sys
ZwUnloadKey
SSDT    \SystemRoot\System32\Drivers
\bcftdi.SYS
ZwWriteVirtualMemory
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
SSDT[284]
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
SSDT[285]
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
SSDT[286]
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
SSDT[287]
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
SSDT[288]
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
SSDT[289]
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
SSDT[290]
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
SSDT[291]
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
SSDT[292]
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
SSDT[293]
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
SSDT[294]
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
SSDT[295]
SSDT    \??\C:\WINDOWS\system32\drivers
\klif.sys
SSDT[296]
Code    \??\C:\WINDOWS\system32\drivers
\klif.sys
FsRtlCheckLockForReadAccess
Code    \??\C:\WINDOWS\system32\drivers
\klif.sys
IoIsOperationSynchronous
---- Kernel code sections - GMER 1.0.12 ----
.text   ntoskrnl.exe!KiDispatchInterrupt +
BA
804DB92E 7 Bytes  JMP B2E75CD0 \??\C:\WINDOWS\system32\drivers
\klif.sys
.text   ntoskrnl.exe!_abnormal_termination +
171
804E27CD 3 Bytes  [ BF, 44, F8 ]
.text   ntoskrnl.exe!
IoIsOperationSynchronous
804E875A 5 Bytes  JMP B2E72C50 \??\C:\WINDOWS\system32\drivers
\klif.sys
.text   ntoskrnl.exe!
FsRtlCheckLockForReadAccess
804FC0F9 5 Bytes  JMP B2E72760 \??\C:\WINDOWS\system32\drivers
\klif.sys
---- Devices - GMER 1.0.12 ----
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_CREATE
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_CLOSE
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_READ
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_WRITE
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_QUERY_INFORMATION
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_SET_INFORMATION
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_QUERY_EA
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_SET_EA
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_FLUSH_BUFFERS
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_QUERY_VOLUME_INFORMATION
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_SET_VOLUME_INFORMATION
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_DIRECTORY_CONTROL
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_FILE_SYSTEM_CONTROL
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_DEVICE_CONTROL
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_SHUTDOWN
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_LOCK_CONTROL
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_CLEANUP
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_QUERY_SECURITY
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_SET_SECURITY
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_QUERY_QUOTA
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_SET_QUOTA
8238E5D0
Device  \FileSystem\Ntfs \Ntfs
IRP_MJ_PNP
8238E5D0
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_CREATE
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_CLOSE
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_READ
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_WRITE
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_QUERY_INFORMATION
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_SET_INFORMATION
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_QUERY_EA
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_SET_EA
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_FLUSH_BUFFERS
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_QUERY_VOLUME_INFORMATION
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_SET_VOLUME_INFORMATION
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_DIRECTORY_CONTROL
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_FILE_SYSTEM_CONTROL
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_DEVICE_CONTROL
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_SHUTDOWN
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_LOCK_CONTROL
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_CLEANUP
81EBD6B8
Device  \FileSystem\Fastfat \FatCdrom
IRP_MJ_PNP
81EBD6B8
Device  \Driver\NetBT \Device
\NetBT_Tcpip_{97B554F0-7AB6-48B4-8A21-3D6DC4193108}
IRP_MJ_CREATE                   81E750E8
Device  \Driver\NetBT \Device
\NetBT_Tcpip_{97B554F0-7AB6-48B4-8A21-3D6DC4193108}
IRP_MJ_CLOSE                    81E750E8
Device  \Driver\NetBT \Device
\NetBT_Tcpip_{97B554F0-7AB6-48B4-8A21-3D6DC4193108}
IRP_MJ_DEVICE_CONTROL           81E750E8
Device  \Driver\NetBT \Device
\NetBT_Tcpip_{97B554F0-7AB6-48B4-8A21-3D6DC4193108}
IRP_MJ_INTERNAL_DEVICE_CONTROL  81E750E8
Device  \Driver\NetBT \Device
\NetBT_Tcpip_{97B554F0-7AB6-48B4-8A21-3D6DC4193108}
IRP_MJ_CLEANUP                  81E750E8
Device  \Driver\NetBT \Device
\NetBT_Tcpip_{97B554F0-7AB6-48B4-8A21-3D6DC4193108}
IRP_MJ_PNP                      81E750E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{AAE53DF0-F690-4080-
A2E7-1A701132B4C8} IRP_MJ_CREATE                   81E750E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{AAE53DF0-F690-4080-
A2E7-1A701132B4C8} IRP_MJ_CLOSE                    81E750E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{AAE53DF0-F690-4080-
A2E7-1A701132B4C8} IRP_MJ_DEVICE_CONTROL           81E750E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{AAE53DF0-F690-4080-
A2E7-1A701132B4C8} IRP_MJ_INTERNAL_DEVICE_CONTROL  81E750E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{AAE53DF0-F690-4080-
A2E7-1A701132B4C8} IRP_MJ_CLEANUP                  81E750E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{AAE53DF0-F690-4080-
A2E7-1A701132B4C8} IRP_MJ_PNP                      81E750E8
Device  \Driver\dmio \Device\DmControl\DmIoDaemon
IRP_MJ_CREATE
8238EC78
Device  \Driver\dmio \Device\DmControl\DmIoDaemon
IRP_MJ_CLOSE
8238EC78
Device  \Driver\dmio \Device\DmControl\DmIoDaemon
IRP_MJ_READ
8238EC78
Device  \Driver\dmio \Device\DmControl\DmIoDaemon
IRP_MJ_WRITE
8238EC78
Device  \Driver\dmio \Device\DmControl\DmIoDaemon
IRP_MJ_FLUSH_BUFFERS
8238EC78
Device  \Driver\dmio \Device\DmControl\DmIoDaemon
IRP_MJ_DEVICE_CONTROL
8238EC78
Device  \Driver\dmio \Device\DmControl\DmIoDaemon
IRP_MJ_INTERNAL_DEVICE_CONTROL
8238EC78
Device  \Driver\dmio \Device\DmControl\DmIoDaemon
IRP_MJ_SHUTDOWN
8238EC78
Device  \Driver\dmio \Device\DmControl\DmIoDaemon
IRP_MJ_POWER
8238EC78
Device  \Driver\dmio \Device\DmControl\DmIoDaemon
IRP_MJ_SYSTEM_CONTROL
8238EC78
Device  \Driver\dmio \Device\DmControl\DmIoDaemon
IRP_MJ_PNP
8238EC78
Device  \Driver\dmio \Device\DmControl\DmConfig
IRP_MJ_CREATE
8238EC78
Device  \Driver\dmio \Device\DmControl\DmConfig
IRP_MJ_CLOSE
8238EC78
Device  \Driver\dmio \Device\DmControl\DmConfig
IRP_MJ_READ
8238EC78
Device  \Driver\dmio \Device\DmControl\DmConfig
IRP_MJ_WRITE
8238EC78
Device  \Driver\dmio \Device\DmControl\DmConfig
IRP_MJ_FLUSH_BUFFERS
8238EC78
Device  \Driver\dmio \Device\DmControl\DmConfig
IRP_MJ_DEVICE_CONTROL
8238EC78
Device  \Driver\dmio \Device\DmControl\DmConfig
IRP_MJ_INTERNAL_DEVICE_CONTROL
8238EC78
Device  \Driver\dmio \Device\DmControl\DmConfig
IRP_MJ_SHUTDOWN
8238EC78
Device  \Driver\dmio \Device\DmControl\DmConfig
IRP_MJ_POWER
8238EC78
Device  \Driver\dmio \Device\DmControl\DmConfig
IRP_MJ_SYSTEM_CONTROL
8238EC78
Device  \Driver\dmio \Device\DmControl\DmConfig
IRP_MJ_PNP
8238EC78
Device  \Driver\dmio \Device\DmControl\DmPnP
IRP_MJ_CREATE
8238EC78
Device  \Driver\dmio \Device\DmControl\DmPnP
IRP_MJ_CLOSE
8238EC78
Device  \Driver\dmio \Device\DmControl\DmPnP
IRP_MJ_READ
8238EC78
Device  \Driver\dmio \Device\DmControl\DmPnP
IRP_MJ_WRITE
8238EC78
Device  \Driver\dmio \Device\DmControl\DmPnP
IRP_MJ_FLUSH_BUFFERS
8238EC78
Device  \Driver\dmio \Device\DmControl\DmPnP
IRP_MJ_DEVICE_CONTROL
8238EC78
Device  \Driver\dmio \Device\DmControl\DmPnP
IRP_MJ_INTERNAL_DEVICE_CONTROL
8238EC78
Device  \Driver\dmio \Device\DmControl\DmPnP
IRP_MJ_SHUTDOWN
8238EC78
Device  \Driver\dmio \Device\DmControl\DmPnP
IRP_MJ_POWER
8238EC78
Device  \Driver\dmio \Device\DmControl\DmPnP
IRP_MJ_SYSTEM_CONTROL
8238EC78
Device  \Driver\dmio \Device\DmControl\DmPnP
IRP_MJ_PNP
8238EC78
Device  \Driver\dmio \Device\DmControl\DmInfo
IRP_MJ_CREATE
8238EC78
Device  \Driver\dmio \Device\DmControl\DmInfo
IRP_MJ_CLOSE
8238EC78
Device  \Driver\dmio \Device\DmControl\DmInfo
IRP_MJ_READ
8238EC78
Device  \Driver\dmio \Device\DmControl\DmInfo
IRP_MJ_WRITE
8238EC78
Device  \Driver\dmio \Device\DmControl\DmInfo
IRP_MJ_FLUSH_BUFFERS
8238EC78
Device  \Driver\dmio \Device\DmControl\DmInfo
IRP_MJ_DEVICE_CONTROL
8238EC78
Device  \Driver\dmio \Device\DmControl\DmInfo
IRP_MJ_INTERNAL_DEVICE_CONTROL
8238EC78
Device  \Driver\dmio \Device\DmControl\DmInfo
IRP_MJ_SHUTDOWN
8238EC78
Device  \Driver\dmio \Device\DmControl\DmInfo
IRP_MJ_POWER
8238EC78
Device  \Driver\dmio \Device\DmControl\DmInfo
IRP_MJ_SYSTEM_CONTROL
8238EC78
Device  \Driver\dmio \Device\DmControl\DmInfo
IRP_MJ_PNP
8238EC78
Device  \Driver\Ftdisk \Device\HarddiskVolume1
IRP_MJ_CREATE
8238EEB0
Device  \Driver\Ftdisk \Device\HarddiskVolume1
IRP_MJ_READ
8238EEB0
Device  \Driver\Ftdisk \Device\HarddiskVolume1
IRP_MJ_WRITE
8238EEB0
Device  \Driver\Ftdisk \Device\HarddiskVolume1
IRP_MJ_FLUSH_BUFFERS
8238EEB0
Device  \Driver\Ftdisk \Device\HarddiskVolume1
IRP_MJ_DEVICE_CONTROL
8238EEB0
Device  \Driver\Ftdisk \Device\HarddiskVolume1
IRP_MJ_INTERNAL_DEVICE_CONTROL
8238EEB0
Device  \Driver\Ftdisk \Device\HarddiskVolume1
IRP_MJ_SHUTDOWN
8238EEB0
Device  \Driver\Ftdisk \Device\HarddiskVolume1
IRP_MJ_CLEANUP
8238EEB0
Device  \Driver\Ftdisk \Device\HarddiskVolume1
IRP_MJ_POWER
8238EEB0
Device  \Driver\Ftdisk \Device\HarddiskVolume1
IRP_MJ_SYSTEM_CONTROL
8238EEB0
Device  \Driver\Ftdisk \Device\HarddiskVolume1
IRP_MJ_PNP
8238EEB0
Device  \Driver\Cdrom \Device\CdRom0
IRP_MJ_CREATE
82008B70
Device  \Driver\Cdrom \Device\CdRom0
IRP_MJ_CLOSE
82008B70
Device  \Driver\Cdrom \Device\CdRom0
IRP_MJ_READ
82008B70
Device  \Driver\Cdrom \Device\CdRom0
IRP_MJ_WRITE
82008B70
Device  \Driver\Cdrom \Device\CdRom0
IRP_MJ_FLUSH_BUFFERS
82008B70
Device  \Driver\Cdrom \Device\CdRom0
IRP_MJ_DEVICE_CONTROL
82008B70
Device  \Driver\Cdrom \Device\CdRom0
IRP_MJ_INTERNAL_DEVICE_CONTROL
82008B70
Device  \Driver\Cdrom \Device\CdRom0
IRP_MJ_SHUTDOWN
82008B70
Device  \Driver\Cdrom \Device\CdRom0
IRP_MJ_POWER
82008B70
Device  \Driver\Cdrom \Device\CdRom0
IRP_MJ_SYSTEM_CONTROL
82008B70
Device  \Driver\Cdrom \Device\CdRom0
IRP_MJ_PNP
82008B70
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_CREATE
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_CREATE_NAMED_PIPE
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_CLOSE
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_READ
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_WRITE
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_QUERY_INFORMATION
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_SET_INFORMATION
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_QUERY_EA
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_SET_EA
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_FLUSH_BUFFERS
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_QUERY_VOLUME_INFORMATION
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_SET_VOLUME_INFORMATION
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_DIRECTORY_CONTROL
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_FILE_SYSTEM_CONTROL
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_DEVICE_CONTROL
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_INTERNAL_DEVICE_CONTROL
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_SHUTDOWN
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_LOCK_CONTROL
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_CLEANUP
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_CREATE_MAILSLOT
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_QUERY_SECURITY
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_SET_SECURITY
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_POWER
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_SYSTEM_CONTROL
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_DEVICE_CHANGE
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_QUERY_QUOTA
820BECA8
Device  \FileSystem\Rdbss \Device\FsWrap
IRP_MJ_SET_QUOTA
820BECA8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{0A77D8AE-49DC-4841-
B8FF-0F855DC98DB6} IRP_MJ_CREATE                   81E750E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{0A77D8AE-49DC-4841-
B8FF-0F855DC98DB6} IRP_MJ_CLOSE                    81E750E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{0A77D8AE-49DC-4841-
B8FF-0F855DC98DB6} IRP_MJ_DEVICE_CONTROL           81E750E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{0A77D8AE-49DC-4841-
B8FF-0F855DC98DB6} IRP_MJ_INTERNAL_DEVICE_CONTROL  81E750E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{0A77D8AE-49DC-4841-
B8FF-0F855DC98DB6} IRP_MJ_CLEANUP                  81E750E8
Device  \Driver\NetBT \Device\NetBT_Tcpip_{0A77D8AE-49DC-4841-
B8FF-0F855DC98DB6} IRP_MJ_PNP                      81E750E8
Device  \Driver\NetBT \Device\NetBt_Wins_Export
IRP_MJ_CREATE
81E750E8
Device  \Driver\NetBT \Device\NetBt_Wins_Export
IRP_MJ_CLOSE
81E750E8
Device  \Driver\NetBT \Device\NetBt_Wins_Export
IRP_MJ_DEVICE_CONTROL
81E750E8
Device  \Driver\NetBT \Device\NetBt_Wins_Export
IRP_MJ_INTERNAL_DEVICE_CONTROL
81E750E8
Device  \Driver\NetBT \Device\NetBt_Wins_Export
IRP_MJ_CLEANUP
81E750E8
Device  \Driver\NetBT \Device\NetBt_Wins_Export
IRP_MJ_PNP
81E750E8
Device  \Driver\Disk \Device\Harddisk0\DR0
IRP_MJ_CREATE
8238E808
Device  \Driver\Disk \Device\Harddisk0\DR0
IRP_MJ_CLOSE
8238E808
Device  \Driver\Disk \Device\Harddisk0\DR0
IRP_MJ_READ
8238E808
Device  \Driver\Disk \Device\Harddisk0\DR0
IRP_MJ_WRITE
8238E808
Device  \Driver\Disk \Device\Harddisk0\DR0
IRP_MJ_FLUSH_BUFFERS
8238E808
Device  \Driver\Disk \Device\Harddisk0\DR0
IRP_MJ_DEVICE_CONTROL
8238E808
Device  \Driver\Disk \Device\Harddisk0\DR0
IRP_MJ_INTERNAL_DEVICE_CONTROL
8238E808
Device  \Driver\Disk \Device\Harddisk0\DR0
IRP_MJ_SHUTDOWN
8238E808
Device  \Driver\Disk \Device\Harddisk0\DR0
IRP_MJ_POWER
8238E808
Device  \Driver\Disk \Device\Harddisk0\DR0
IRP_MJ_SYSTEM_CONTROL
8238E808
Device  \Driver\Disk \Device\Harddisk0\DR0
IRP_MJ_PNP
8238E808
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_CREATE                                          820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_CREATE_NAMED_PIPE                               820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_CLOSE                                           820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_READ                                            820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_WRITE                                           820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_QUERY_INFORMATION                               820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_SET_INFORMATION                                 820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_QUERY_EA                                        820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_SET_EA                                          820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_FLUSH_BUFFERS                                   820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_QUERY_VOLUME_INFORMATION                        820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_SET_VOLUME_INFORMATION                          820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_DIRECTORY_CONTROL                               820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_FILE_SYSTEM_CONTROL                             820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_DEVICE_CONTROL                                  820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_INTERNAL_DEVICE_CONTROL                         820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_SHUTDOWN                                        820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_LOCK_CONTROL                                    820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_CLEANUP                                         820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_CREATE_MAILSLOT                                 820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_QUERY_SECURITY                                  820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_SET_SECURITY                                    820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_POWER                                           820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_SYSTEM_CONTROL                                  820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_DEVICE_CHANGE                                   820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_QUERY_QUOTA                                     820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_SET_QUOTA                                       820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanDatagramReceiver
IRP_MJ_PNP                                             820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_CREATE                                                820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_CREATE_NAMED_PIPE                                     820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_CLOSE                                                 820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_READ                                                  820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_WRITE                                                 820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_QUERY_INFORMATION                                     820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_SET_INFORMATION                                       820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_QUERY_EA                                              820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_SET_EA                                                820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_FLUSH_BUFFERS                                         820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_QUERY_VOLUME_INFORMATION                              820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_SET_VOLUME_INFORMATION                                820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_DIRECTORY_CONTROL                                     820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_FILE_SYSTEM_CONTROL                                   820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_DEVICE_CONTROL                                        820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_INTERNAL_DEVICE_CONTROL                               820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_SHUTDOWN                                              820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_LOCK_CONTROL                                          820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_CLEANUP                                               820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_CREATE_MAILSLOT                                       820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_QUERY_SECURITY                                        820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_SET_SECURITY                                          820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_POWER                                                 820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_SYSTEM_CONTROL                                        820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_DEVICE_CHANGE                                         820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_QUERY_QUOTA                                           820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_SET_QUOTA                                             820DFC78
Device  \FileSystem\MRxSmb \Device\LanmanRedirector
IRP_MJ_PNP                                                   820DFC78
Device  \FileSystem\Npfs \Device\NamedPipe
IRP_MJ_CREATE
820980E8
Device  \FileSystem\Npfs \Device\NamedPipe
IRP_MJ_CREATE_NAMED_PIPE
820980E8
Device  \FileSystem\Npfs \Device\NamedPipe
IRP_MJ_CLOSE
820980E8
Device  \FileSystem\Npfs \Device\NamedPipe
IRP_MJ_READ
820980E8
Device  \FileSystem\Npfs \Device\NamedPipe
IRP_MJ_WRITE
820980E8
Device  \FileSystem\Npfs \Device\NamedPipe
IRP_MJ_QUERY_INFORMATION
820980E8
Device  \FileSystem\Npfs \Device\NamedPipe
IRP_MJ_SET_INFORMATION
820980E8
Device  \FileSystem\Npfs \Device\NamedPipe
IRP_MJ_FLUSH_BUFFERS
820980E8
Device  \FileSystem\Npfs \Device\NamedPipe
IRP_MJ_QUERY_VOLUME_INFORMATION
820980E8
Device  \FileSystem\Npfs \Device\NamedPipe
IRP_MJ_DIRECTORY_CONTROL
820980E8
Device  \FileSystem\Npfs \Device\NamedPipe
IRP_MJ_FILE_SYSTEM_CONTROL
820980E8
Device  \FileSystem\Npfs \Device\NamedPipe
IRP_MJ_CLEANUP
820980E8
Device  \FileSystem\Npfs \Device\NamedPipe
IRP_MJ_QUERY_SECURITY
820980E8
Device  \FileSystem\Npfs \Device\NamedPipe
IRP_MJ_SET_SECURITY
820980E8
Device  \Driver\Ftdisk \Device\FtControl
IRP_MJ_CREATE
8238EEB0
Device  \Driver\Ftdisk \Device\FtControl
IRP_MJ_READ
8238EEB0
Device  \Driver\Ftdisk \Device\FtControl
IRP_MJ_WRITE
8238EEB0
Device  \Driver\Ftdisk \Device\FtControl
IRP_MJ_FLUSH_BUFFERS
8238EEB0
Device  \Driver\Ftdisk \Device\FtControl
IRP_MJ_DEVICE_CONTROL
8238EEB0
Device  \Driver\Ftdisk \Device\FtControl
IRP_MJ_INTERNAL_DEVICE_CONTROL
8238EEB0
Device  \Driver\Ftdisk \Device\FtControl
IRP_MJ_SHUTDOWN
8238EEB0
Device  \Driver\Ftdisk \Device\FtControl
IRP_MJ_CLEANUP
8238EEB0
Device  \Driver\Ftdisk \Device\FtControl
IRP_MJ_POWER
8238EEB0
Device  \Driver\Ftdisk \Device\FtControl
IRP_MJ_SYSTEM_CONTROL
8238EEB0
Device  \Driver\Ftdisk \Device\FtControl
IRP_MJ_PNP
8238EEB0
Device  \FileSystem\Msfs \Device\Mailslot
IRP_MJ_CREATE
821C4538
Device  \FileSystem\Msfs \Device\Mailslot
IRP_MJ_CLOSE
821C4538
Device  \FileSystem\Msfs \Device\Mailslot
IRP_MJ_READ
821C4538
Device  \FileSystem\Msfs \Device\Mailslot
IRP_MJ_WRITE
821C4538
Device  \FileSystem\Msfs \Device\Mailslot
IRP_MJ_QUERY_INFORMATION
821C4538
Device  \FileSystem\Msfs \Device\Mailslot
IRP_MJ_SET_INFORMATION
821C4538
Device  \FileSystem\Msfs \Device\Mailslot
IRP_MJ_QUERY_VOLUME_INFORMATION
821C4538
Device  \FileSystem\Msfs \Device\Mailslot
IRP_MJ_DIRECTORY_CONTROL
821C4538
Device  \FileSystem\Msfs \Device\Mailslot
IRP_MJ_FILE_SYSTEM_CONTROL
821C4538
Device  \FileSystem\Msfs \Device\Mailslot
IRP_MJ_CLEANUP
821C4538
Device  \FileSystem\Msfs \Device\Mailslot
IRP_MJ_CREATE_MAILSLOT
821C4538
Device  \FileSystem\Msfs \Device\Mailslot
IRP_MJ_QUERY_SECURITY
821C4538
Device  \FileSystem\Msfs \Device\Mailslot
IRP_MJ_SET_SECURITY
821C4538
Device  \FileSystem\Fastfat \Fat
IRP_MJ_CREATE
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_CLOSE
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_READ
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_WRITE
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_QUERY_INFORMATION
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_SET_INFORMATION
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_QUERY_EA
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_SET_EA
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_FLUSH_BUFFERS
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_QUERY_VOLUME_INFORMATION
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_SET_VOLUME_INFORMATION
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_DIRECTORY_CONTROL
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_FILE_SYSTEM_CONTROL
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_DEVICE_CONTROL
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_SHUTDOWN
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_LOCK_CONTROL
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_CLEANUP
81EBD6B8
Device  \FileSystem\Fastfat \Fat
IRP_MJ_PNP
81EBD6B8
Device  \FileSystem\Cdfs \Cdfs
IRP_MJ_CREATE
820BA0E8
Device  \FileSystem\Cdfs \Cdfs
IRP_MJ_CLOSE
820BA0E8
Device  \FileSystem\Cdfs \Cdfs
IRP_MJ_READ
820BA0E8
Device  \FileSystem\Cdfs \Cdfs
IRP_MJ_QUERY_INFORMATION
820BA0E8
Device  \FileSystem\Cdfs \Cdfs
IRP_MJ_SET_INFORMATION
820BA0E8
Device  \FileSystem\Cdfs \Cdfs
IRP_MJ_QUERY_VOLUME_INFORMATION
820BA0E8
Device  \FileSystem\Cdfs \Cdfs
IRP_MJ_DIRECTORY_CONTROL
820BA0E8
Device  \FileSystem\Cdfs \Cdfs
IRP_MJ_FILE_SYSTEM_CONTROL
820BA0E8
Device  \FileSystem\Cdfs \Cdfs
IRP_MJ_DEVICE_CONTROL
820BA0E8
Device  \FileSystem\Cdfs \Cdfs
IRP_MJ_SHUTDOWN
820BA0E8
Device  \FileSystem\Cdfs \Cdfs
IRP_MJ_LOCK_CONTROL
820BA0E8
Device  \FileSystem\Cdfs \Cdfs
IRP_MJ_CLEANUP
820BA0E8
Device  \FileSystem\Cdfs \Cdfs
IRP_MJ_PNP
820BA0E8
---- Threads - GMER 1.0.12 ----
Thread
4:168
820838E0
Thread
4:172
820838E0
Thread
4:176
8205C8D0
Thread
4:180
8205C8D0
Thread
4:184
8205C8D0
Thread
4:404
820838E0
Thread
4:408
820838E0
Thread
4:440
820838E0
Thread
4:512
820838E0
---- EOF - GMER 1.0.12 ----
Questo è l'output che mi appare nella finestra Rootkit. Ma non penso
siano voci pericolose, no?!
Grazie.

Scusate, ma nel subject avevo messo la stringa "[LUNGO - CON LOG] -"
per avvisare ma Google l'ha tagliata. Ma cos'è un bug di Google
questo? Lo fa sempre. Un subject del tipo "[STRINGA] - Testo" diventa
"Testo".

Giulio Severini ha scritto:

Io la vedo benissimo sul news server di Tiscali

> Io la vedo benissimo sul news server di Tiscali
Io con Google Gruppi no. Boh.