Newsgroup: it.comp.sicurezza.windows
Titolo: Ho dei rootkit anche io?!

Ciao, spulciando il ng ho voluto provare Gmer. Non lo avessi mai
fatto!!!
Ecco un riassunto di quello che ha trovato:
GMER 1.0.10.10122 - 
http://www.gmer.net
Rootkit 2006-08-29 18:09:38
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.10 ----
SSDT      \SystemRoot\system32\drivers\fwdrv.sys
                                                     ZwClose
                       <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\fwdrv.sys
                                                     ZwCreateFile
                       <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\fwdrv.sys
                                                     ZwCreateKey
                       <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\fwdrv.sys
                                                     ZwCreateProcess
                       <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\fwdrv.sys
                                                     ZwCreateProcessEx
                       <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\fwdrv.sys
                                                     ZwCreateThread
                       <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\fwdrv.sys
                                                     ZwDeleteFile
                       <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\fwdrv.sys
                                                     ZwDeleteKey
                       <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\fwdrv.sys
                                                     ZwDeleteValueKey
                       <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\khips.sys
                                                     ZwLoadDriver
                       <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\khips.sys
                                                     ZwMapViewOfSection
                       <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\fwdrv.sys
                                                     ZwOpenFile
                       <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\fwdrv.sys
                                                     ZwOpenKey
                       <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\fwdrv.sys
                                                     ZwResumeThread
                       <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\fwdrv.sys
ZwSetInformationFile                      <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\fwdrv.sys
                                                     ZwSetValueKey
                       <-- ROOTKIT !!!
SSDT      \SystemRoot\system32\drivers\fwdrv.sys
                                                     ZwWriteFile
                       <-- ROOTKIT !!!
[...]
---- Services - GMER 1.0.10 ----
Service
                                                     [DISABLED]
Abiosdsk                       <-- ROOTKIT !!!
Service
                                                     [DISABLED]
abp480n5                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\ACPI.sys
                                                     [BOOT] ACPI
Service   C:\WINDOWS\System32\DRIVERS\ACPIEC.sys
                                                     [BOOT] ACPIEC
Service
                                                     [DISABLED]
adpu160m                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\drivers\aec.sys
                                                     [MANUAL] aec
Service   C:\WINDOWS\System32\drivers\afd.sys
                                                     [SYSTEM] AFD
Service   C:\WINDOWS\system32\DRIVERS\AGRSM.sys
                                                     [MANUAL]
AgereSoftModem
Service
                                                     [DISABLED] Aha154x
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] aic78u2
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] aic78xx
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\drivers\ALCXWDM.SYS
                                                     [MANUAL] ALCXWDM
Service   C:\WINDOWS\System32\svchost.exe
                                                     [DISABLED] Alerter
Service   C:\WINDOWS\System32\alg.exe
                                                     [MANUAL] ALG
Service
                                                     [DISABLED] AliIde
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\amdk7.sys
                                                     [SYSTEM] AmdK7
Service   C:\WINDOWS\system32\drivers\amon.sys
                                                     [AUTO] AMON
Service
                                                     [DISABLED] amsint
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\svchost.exe
                                                     [MANUAL] AppMgmt
Service   C:\WINDOWS\System32\DRIVERS\arp1394.sys
                                                     [MANUAL] Arp1394
Service
                                                     [DISABLED] asc
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED]
asc3350p                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] asc3550
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\asyncmac.sys
                                                     [MANUAL] AsyncMac
Service   C:\WINDOWS\System32\DRIVERS\atapi.sys
                                                     [BOOT] atapi
Service
                                                     [DISABLED] Atdisk
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\Ati2evxx.exe
                                                     [AUTO] Ati HotKey
Poller
Service   C:\WINDOWS\system32\ati2sgag.exe
                                                     [AUTO] ATI Smart
Service   C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
                                                     [MANUAL] ati2mtag
Service   C:\WINDOWS\System32\DRIVERS\atmarpc.sys
                                                     [MANUAL] Atmarpc
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO] AudioSrv
Service   C:\WINDOWS\System32\DRIVERS\audstub.sys
                                                     [MANUAL] audstub
Service
                                                     [SYSTEM] Beep
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\svchost.exe
                                                     [MANUAL] BITS
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO] Browser
Service   C:\WINDOWS\system32\DRIVERS\btport.sys
                                                     [MANUAL] BTDriver
Service   C:\WINDOWS\system32\drivers\btkrnl.sys
                                                     [BOOT] BTKRNL
Service   C:\WINDOWS\system32\drivers\btserial.sys
                                                     [AUTO] BTSERIAL
Service   C:\WINDOWS\system32\drivers\btslbcsp.sys
                                                     [AUTO] BTSLBCSP
Service   C:\WINDOWS\system32\DRIVERS\btwdndis.sys
                                                     [MANUAL] BTWDNDIS
Service
                                                     [DISABLED] cbidf2k
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED]
cd20xrnt                       <-- ROOTKIT !!!
Service
                                                     [SYSTEM] Cdaudio
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] Cdfs
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\cdrom.sys
                                                     [SYSTEM] Cdrom
Service
                                                     [SYSTEM] Changer
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\cisvc.exe
                                                     [MANUAL] CiSvc
Service   C:\WINDOWS\system32\clipsrv.exe
                                                     [DISABLED] ClipSrv
Service   C:\WINDOWS\System32\DRIVERS\CmBatt.sys
                                                     [MANUAL] CmBatt
Service
                                                     [DISABLED] CmdIde
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\compbatt.sys
                                                     [BOOT] Compbatt
Service   C:\WINDOWS\System32\dllhost.exe
                                                     [MANUAL] COMSysApp
Service
                                                     [DISABLED]
Cpqarray                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\svchost.exe
                                                     [AUTO] CryptSvc
Service
                                                     [DISABLED] dac2w2k
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED]
dac960nt                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\svchost.exe
                                                     [AUTO] DcomLaunch
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO] Dhcp
Service   C:\WINDOWS\System32\DRIVERS\disk.sys
                                                     [BOOT] Disk
Service   C:\WINDOWS\System32\dmadmin.exe
                                                     [MANUAL] dmadmin
Service   C:\WINDOWS\System32\drivers\dmboot.sys
                                                     [DISABLED] dmboot
Service   C:\WINDOWS\System32\drivers\dmio.sys
                                                     [BOOT] dmio
Service   C:\WINDOWS\System32\drivers\dmload.sys
                                                     [BOOT] dmload
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO] dmserver
Service   C:\WINDOWS\system32\drivers\DMusic.sys
                                                     [MANUAL] DMusic
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO] Dnscache
Service
                                                     [DISABLED] dpti2o
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\drivers\drmkaud.sys
                                                     [MANUAL] drmkaud
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO] ERSvc
Service   C:\WINDOWS\system32\services.exe
                                                     [AUTO] Eventlog
Service   C:\WINDOWS\System32\svchost.exe
                                                     [MANUAL]
EventSystem
Service
                                                     [DISABLED] Fastfat
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\svchost.exe
                                                     [MANUAL]
FastUserSwitchingCompatibility
Service   C:\WINDOWS\System32\DRIVERS\fdc.sys
                                                     [MANUAL] Fdc
Service   C:\WINDOWS\System32\DRIVERS\fetnd5.sys
                                                     [MANUAL] FETNDIS
Service   C:\WINDOWS\system32\DRIVERS\fetnd5b.sys
                                                     [MANUAL] FETNDISB
Service
                                                     [SYSTEM] Fips
                       <-- ROOTKIT !!!
Service
                                                     [SYSTEM] Flpydisk
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\drivers\fltmgr.sys
                                                     [BOOT] FltMgr
Service
                                                     [SYSTEM] Fs_Rec
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\ftdisk.sys
                                                     [BOOT] Ftdisk
Service   C:\WINDOWS\system32\drivers\fwdrv.sys
                                                     [SYSTEM] fwdrv
Service   C:\WINDOWS\System32\DRIVERS\gmer.sys
                                                     [MANUAL] Gmer
Service   C:\WINDOWS\System32\DRIVERS\msgpc.sys
                                                     [MANUAL] Gpc
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO] helpsvc
Service   C:\WINDOWS\System32\svchost.exe
                                                     [DISABLED] HidServ
Service   C:\WINDOWS\System32\DRIVERS\hidusb.sys
                                                     [MANUAL] hidusb
Service
                                                     [DISABLED] hpn
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\Drivers\HTTP.sys
                                                     [MANUAL] HTTP
Service   C:\WINDOWS\System32\svchost.exe
                                                     [MANUAL]
HTTPFilter
Service
                                                     [SYSTEM] i2omgmt
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] i2omp
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\i8042prt.sys
                                                     [SYSTEM] i8042prt
Service   C:\WINDOWS\System32\DRIVERS\imapi.sys
                                                     [SYSTEM] Imapi
Service   C:\WINDOWS\System32\imapi.exe
                                                     [MANUAL]
ImapiService
Service
                                                     [DISABLED] ini910u
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED]
IntelIde                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\drivers\ip6fw.sys
                                                     [MANUAL] ip6fw
Service   C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys
                                                     [MANUAL]
IpFilterDriver
Service   C:\WINDOWS\System32\DRIVERS\ipinip.sys
                                                     [MANUAL] IpInIp
Service   C:\WINDOWS\System32\DRIVERS\ipnat.sys
                                                     [MANUAL] IpNat
Service   C:\WINDOWS\System32\DRIVERS\ipsec.sys
                                                     [SYSTEM] IPSec
Service   C:\WINDOWS\System32\DRIVERS\irda.sys
                                                     [AUTO] irda
Service   C:\WINDOWS\System32\DRIVERS\irenum.sys
                                                     [MANUAL] IRENUM
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO] Irmon
Service   C:\WINDOWS\System32\DRIVERS\isapnp.sys
                                                     [BOOT] isapnp
Service   C:\WINDOWS\System32\DRIVERS\kbdclass.sys
                                                     [SYSTEM] Kbdclass
Service   C:\WINDOWS\system32\drivers\khips.sys
                                                     [SYSTEM] khips
Service   C:\WINDOWS\system32\drivers\kmixer.sys
                                                     [MANUAL] kmixer
Service   C:\Programmi\Kerio\Personal Firewall 4\kpf4ss.exe
                                                     [AUTO] KPF4
Service
                                                     [BOOT] KSecDD
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO]
lanmanserver
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO]
lanmanworkstation
Service
                                                     [SYSTEM] lbrtfdc
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\svchost.exe
                                                     [DISABLED] LmHosts
Service   C:\WINDOWS\System32\svchost.exe
                                                     [DISABLED]
Messenger
Service
                                                     [SYSTEM] mnmdd
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\mnmsrvc.exe
                                                     [MANUAL] mnmsrvc
Service
                                                     [MANUAL] Modem
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\mouclass.sys
                                                     [SYSTEM] Mouclass
Service   C:\WINDOWS\System32\DRIVERS\mouhid.sys
                                                     [MANUAL] mouhid
Service
                                                     [BOOT] MountMgr
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED]
mraid35x                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\mrxdav.sys
                                                     [MANUAL] MRxDAV
Service   C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
                                                     [SYSTEM] MRxSmb
Service   C:\WINDOWS\System32\msdtc.exe
                                                     [MANUAL] MSDTC
Service
                                                     [SYSTEM] Msfs
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\msiexec.exe
                                                     [MANUAL] MSIServer
Service   C:\WINDOWS\system32\drivers\MSKSSRV.sys
                                                     [MANUAL] MSKSSRV
Service   C:\WINDOWS\system32\drivers\MSPCLOCK.sys
                                                     [MANUAL] MSPCLOCK
Service   C:\WINDOWS\system32\drivers\MSPQM.sys
                                                     [MANUAL] MSPQM
Service   C:\WINDOWS\System32\DRIVERS\mssmbios.sys
                                                     [MANUAL] mssmbios
Service
                                                     [BOOT] Mup
                       <-- ROOTKIT !!!
Service
                                                     [BOOT] NDIS
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\ndistapi.sys
                                                     [MANUAL] NdisTapi
Service   C:\WINDOWS\System32\DRIVERS\ndisuio.sys
                                                     [MANUAL] Ndisuio
Service   C:\WINDOWS\System32\DRIVERS\ndiswan.sys
                                                     [MANUAL] NdisWan
Service
                                                     [MANUAL] NDProxy
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\netbios.sys
                                                     [SYSTEM] NetBIOS
Service   C:\WINDOWS\System32\DRIVERS\netbt.sys
                                                     [SYSTEM] NetBT
Service   C:\WINDOWS\system32\netdde.exe
                                                     [DISABLED] NetDDE
Service   C:\WINDOWS\system32\netdde.exe
                                                     [DISABLED]
NetDDEdsdm
Service   C:\WINDOWS\System32\lsass.exe
                                                     [MANUAL] Netlogon
Service   C:\WINDOWS\System32\svchost.exe
                                                     [MANUAL] Netman
Service   C:\WINDOWS\System32\DRIVERS\nic1394.sys
                                                     [MANUAL] NIC1394
Service   C:\WINDOWS\System32\svchost.exe
                                                     [MANUAL] Nla
Service   C:\Programmi\Eset\nod32krn.exe
                                                     [AUTO] NOD32krn
Service   C:\WINDOWS\system32\drivers\nmwcdc.sys
                                                     [MANUAL] Nokia USB
Generic
Service   C:\WINDOWS\system32\drivers\nmwcdcm.sys
                                                     [MANUAL] Nokia USB
Modem
Service   C:\WINDOWS\system32\drivers\nmwcd.sys
                                                     [MANUAL] Nokia USB
Phone Parent
Service
                                                     [SYSTEM] Npfs
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\nscirda.sys
                                                     [MANUAL] NSCIRDA
Service
                                                     [DISABLED] Ntfs
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\lsass.exe
                                                     [MANUAL] NtLmSsp
Service   C:\WINDOWS\system32\svchost.exe
                                                     [MANUAL] NtmsSvc
Service   C:\WINDOWS\system32\ntsim.sys
                                                     [MANUAL] NTSIM
Service
                                                     [SYSTEM] Null
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys
                                                     [MANUAL] NwlnkFlt
Service   C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys
                                                     [MANUAL] NwlnkFwd
Service   C:\WINDOWS\System32\DRIVERS\ohci1394.sys
                                                     [BOOT] ohci1394
Service   C:\WINDOWS\System32\DRIVERS\parport.sys
                                                     [MANUAL] Parport
Service
                                                     [BOOT] PartMgr
                       <-- ROOTKIT !!!
Service
                                                     [AUTO] ParVdm
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\pci.sys
                                                     [BOOT] PCI
Service
                                                     [SYSTEM] PCIDump
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] PCIIde
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\pcmcia.sys
                                                     [BOOT] Pcmcia
Service
                                                     [MANUAL] PDCOMP
                       <-- ROOTKIT !!!
Service
                                                     [MANUAL] PDFRAME
                       <-- ROOTKIT !!!
Service
                                                     [MANUAL] PDRELI
                       <-- ROOTKIT !!!
Service
                                                     [MANUAL] PDRFRAME
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] perc2
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED]
perc2hib                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\services.exe
                                                     [AUTO] PlugPlay
Service   C:\WINDOWS\System32\lsass.exe
                                                     [AUTO] PolicyAgent
Service   C:\WINDOWS\System32\DRIVERS\raspptp.sys
                                                     [MANUAL]
PptpMiniport
Service
                                                     [SYSTEM] PQNTDrv
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\processr.sys
                                                     [SYSTEM] Processor
Service   C:\WINDOWS\system32\lsass.exe
                                                     [AUTO]
ProtectedStorage
Service   C:\WINDOWS\System32\DRIVERS\psched.sys
                                                     [MANUAL] PSched
Service   C:\WINDOWS\System32\DRIVERS\ptilink.sys
                                                     [MANUAL] Ptilink
Service
                                                     [DISABLED] ql1080
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] Ql10wnt
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] ql12160
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] ql1240
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] ql1280
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\rasacd.sys
                                                     [SYSTEM] RasAcd
Service   C:\WINDOWS\System32\svchost.exe
                                                     [MANUAL] RasAuto
Service   C:\WINDOWS\System32\DRIVERS\rasirda.sys
                                                     [MANUAL] Rasirda
Service   C:\WINDOWS\System32\DRIVERS\rasl2tp.sys
                                                     [MANUAL] Rasl2tp
Service   C:\WINDOWS\System32\svchost.exe
                                                     [MANUAL] RasMan
Service   C:\WINDOWS\System32\DRIVERS\raspppoe.sys
                                                     [MANUAL] RasPppoe
Service   C:\WINDOWS\System32\DRIVERS\raspti.sys
                                                     [MANUAL] Raspti
Service   C:\WINDOWS\System32\DRIVERS\rdbss.sys
                                                     [SYSTEM] Rdbss
Service   C:\WINDOWS\System32\DRIVERS\RDPCDD.sys
                                                     [SYSTEM] RDPCDD
Service   C:\WINDOWS\System32\DRIVERS\rdpdr.sys
                                                     [MANUAL] rdpdr
Service
                                                     [MANUAL] RDPWD
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\sessmgr.exe
                                                     [MANUAL] RDSessMgr
Service   C:\WINDOWS\System32\DRIVERS\redbook.sys
                                                     [SYSTEM] redbook
Service   C:\WINDOWS\System32\svchost.exe
                                                     [DISABLED]
RemoteAccess
Service   C:\WINDOWS\system32\svchost.exe
                                                     [DISABLED]
RemoteRegistry
Service   C:\WINDOWS\System32\Drivers\RootMdm.sys
                                                     [MANUAL] ROOTMODEM
Service   C:\WINDOWS\System32\locator.exe
                                                     [MANUAL]
RpcLocator
Service   C:\WINDOWS\system32\svchost.exe
                                                     [AUTO] RpcSs
Service   C:\WINDOWS\System32\rsvp.exe
                                                     [MANUAL] RSVP
Service   C:\WINDOWS\system32\DRIVERS\RTL8180.SYS
                                                     [MANUAL] rtl8180
Service   C:\WINDOWS\system32\lsass.exe
                                                     [AUTO] SamSs
Service   C:\WINDOWS\System32\SCardSvr.exe
                                                     [MANUAL] SCardSvr
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO] Schedule
Service   C:\WINDOWS\System32\DRIVERS\secdrv.sys
                                                     [MANUAL] Secdrv
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO] seclogon
Service   C:\WINDOWS\system32\svchost.exe
                                                     [AUTO] SENS
Service
                                                     [AUTO] Serial
                       <-- ROOTKIT !!!
Service
                                                     [SYSTEM] Sfloppy
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\svchost.exe
                                                     [DISABLED]
SharedAccess
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO]
ShellHWDetection
Service
                                                     [DISABLED] Simbad
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] Sparrow
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\drivers\splitter.sys
                                                     [MANUAL] splitter
Service   C:\WINDOWS\system32\spoolsv.exe
                                                     [AUTO] Spooler
Service   C:\WINDOWS\System32\DRIVERS\sr.sys
                                                     [DISABLED] sr
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO] srservice
Service   C:\WINDOWS\System32\DRIVERS\srv.sys
                                                     [MANUAL] Srv
Service   C:\WINDOWS\System32\svchost.exe
                                                     [DISABLED] SSDPSRV
Service   C:\WINDOWS\System32\svchost.exe
                                                     [MANUAL] stisvc
Service   C:\WINDOWS\System32\DRIVERS\swenum.sys
                                                     [MANUAL] swenum
Service   C:\WINDOWS\system32\drivers\swmidi.sys
                                                     [MANUAL] swmidi
Service   C:\WINDOWS\System32\dllhost.exe
                                                     [MANUAL] SwPrv
Service
                                                     [DISABLED] symc810
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] symc8xx
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] sym_hi
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] sym_u3
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\DRIVERS\SynTP.sys
                                                     [MANUAL] SynTP
Service   C:\WINDOWS\system32\drivers\sysaudio.sys
                                                     [MANUAL] sysaudio
Service   C:\WINDOWS\system32\smlogsvc.exe
                                                     [MANUAL] SysmonLog
Service   C:\WINDOWS\System32\svchost.exe
                                                     [MANUAL] TapiSrv
Service   C:\WINDOWS\System32\DRIVERS\tcpip.sys
                                                     [SYSTEM] Tcpip
Service
                                                     [MANUAL] TDPIPE
                       <-- ROOTKIT !!!
Service
                                                     [MANUAL] TDTCP
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\termdd.sys
                                                     [SYSTEM] TermDD
Service   C:\WINDOWS\System32\svchost.exe
                                                     [MANUAL]
TermService
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO] Themes
Service   C:\WINDOWS\System32\tlntsvr.exe
                                                     [DISABLED] TlntSvr
Service
                                                     [DISABLED] TosIde
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\svchost.exe
                                                     [AUTO] TrkWks
Service
                                                     [DISABLED] Udfs
                       <-- ROOTKIT !!!
Service
                                                     [DISABLED] ultra
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\DRIVERS\update.sys
                                                     [MANUAL] Update
Service   C:\WINDOWS\System32\svchost.exe
                                                     [MANUAL] upnphost
Service   C:\WINDOWS\System32\ups.exe
                                                     [MANUAL] UPS
Service   C:\WINDOWS\system32\DRIVERS\usbccgp.sys
                                                     [MANUAL] usbccgp
Service   C:\WINDOWS\System32\DRIVERS\usbehci.sys
                                                     [MANUAL] usbehci
Service   C:\WINDOWS\System32\DRIVERS\usbhub.sys
                                                     [MANUAL] usbhub
Service   C:\WINDOWS\system32\DRIVERS\usbohci.sys
                                                     [MANUAL] usbohci
Service   C:\WINDOWS\system32\DRIVERS\usbprint.sys
                                                     [MANUAL] usbprint
Service   C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS
                                                     [MANUAL] USBSTOR
Service   C:\WINDOWS\System32\DRIVERS\usbuhci.sys
                                                     [MANUAL] usbuhci
Service   C:\WINDOWS\System32\drivers\vga.sys
                                                     [SYSTEM] VgaSave
Service   C:\WINDOWS\system32\DRIVERS\viaagp1.sys
                                                     [BOOT] viaagp1
Service   C:\WINDOWS\System32\DRIVERS\viaide.sys
                                                     [BOOT] ViaIde
Service
                                                     [BOOT] VolSnap
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\vssvc.exe
                                                     [MANUAL] VSS
Service   C:\WINDOWS\System32\svchost.exe
                                                     [DISABLED] W32Time
Service   C:\WINDOWS\System32\DRIVERS\wanarp.sys
                                                     [MANUAL] Wanarp
Service   C:\WINDOWS\system32\DRIVERS\gwausb.sys
                                                     [MANUAL] wanusb
Service
                                                     [MANUAL] WDICA
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\system32\drivers\wdmaud.sys
                                                     [MANUAL] wdmaud
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO] WebClient
Service   C:\WINDOWS\system32\svchost.exe
                                                     [AUTO] winmgmt
Service
                                                     [MANUAL] Winsock
                       <-- ROOTKIT !!!
Service   C:\WINDOWS\System32\svchost.exe
                                                     [MANUAL] WmdmPmSN
Service   C:\WINDOWS\System32\svchost.exe
                                                     [MANUAL] Wmi
Service   C:\WINDOWS\System32\wbem\wmiapsrv.exe
                                                     [MANUAL] WmiApSrv
Service   C:\WINDOWS\System32\drivers\ws2ifsl.sys
                                                     [SYSTEM] WS2IFSL
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO] wscsvc
Service   C:\WINDOWS\System32\svchost.exe
                                                     [DISABLED]
wuauserv
Service   C:\WINDOWS\System32\svchost.exe
                                                     [AUTO] WZCSVC
Service   C:\WINDOWS\System32\svchost.exe
                                                     [MANUAL] xmlprov
Service   C:\WINDOWS\system32\DRIVERS\ondausbmdm6k.sys
                                                     [MANUAL]
ZTEusbmdm6k
Service   C:\WINDOWS\system32\DRIVERS\ondausbnmea.sys
                                                     [MANUAL]
ZTEusbnmea
Service   C:\WINDOWS\system32\DRIVERS\ondausbser6k.sys
                                                     [MANUAL]
ZTEusbser6k
Ho allora fatto il Restore SSDT ma Windows mi è andato in crash subito
dopo, pare per un errore del servizio Windows Logon...
Ho riavviato, e ho fatto una scansione con RootkitReveleaer, che mi ha
trovato questo:
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed	29/08/2006 18.16	80
bytes	Data mismatch between Windows API and raw hive data.
C:\Documents and Settings\Giulio\Impostazioni locali\Temporary Internet
Files\Content.IE5\YUGSEWUK\CAC9MR4H.HTM	29/08/2006 18.17	1.15 KB	Hidden
from Windows API.
Cioè...come mai ho un file .htm nascosto alle API di Windows?!?!
Ho veramente dei rootkit anche io, o sono dei falsi positivi?!
Grazie.

 Ho veramente dei rootkit anche io, o sono dei falsi positivi?!
hai installato un rootkit che ti impedisce di leggere le FAQ?
#
Question:  	Do I have the rootkit  ?
Answer: 	You can scan the system for rootkits using GMER. Run
gmer.exe, select Rootkit tab and click the "Scan" button.
If you don't know how to interpret the output, please copy it using Copy
button and send it using the feedback form.
Warning ! Please, do not select the "Show all" checkbox during the scan.

 Warning ! Please, do not select the "Show all" checkbox during the scan.
Hai ragione. Scusa, però come mai avevo quel file htm nascosto alle
API di Windows?! E' normale?!
Grazie.