[HaBo]

where=C:\Dokumente und Einstellungen\user\.
dir=C:\Dokumente und Einstellungen\user\.

>SSDT State
NtConnectPort
Actual Address 0xB5C5FEB0
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtCreateFile
Actual Address 0xB5C5C870
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtCreateKey
Actual Address 0xB5C67700
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtCreatePort
Actual Address 0xB5C60270
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtCreateProcess
Actual Address 0xB5C66500
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtCreateProcessEx
Actual Address 0xB5C66730
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtCreateSection
Actual Address 0xB5C6A090
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtCreateWaitablePort
Actual Address 0xB5C60350
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtDeleteFile
Actual Address 0xB5C5CEF0
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtDeleteKey
Actual Address 0xB5C68720
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtDeleteValueKey
Actual Address 0xB5C68360
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtDuplicateObject
Actual Address 0xB5C66270
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtEnumerateKey
Actual Address 0xF7ADD84C
Hooked by: sptd.sys

NtEnumerateValueKey
Actual Address 0xF7ADDBEC
Hooked by: sptd.sys

NtLoadKey
Actual Address 0xB5C68A60
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtOpenFile
Actual Address 0xB5C5CD40
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtOpenKey
Actual Address 0xF7AD8090
Hooked by: sptd.sys

NtOpenProcess
Actual Address 0xB5C65FC0
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtOpenThread
Actual Address 0xB5C65DE0
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtQueryKey
Actual Address 0xF7ADDCC4
Hooked by: sptd.sys

NtQueryValueKey
Actual Address 0xF7ADDB44
Hooked by: sptd.sys

NtRenameKey
Actual Address 0xB5C691D0
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtReplaceKey
Actual Address 0xB5C68D50
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtRequestWaitReplyPort
Actual Address 0xB5C5FB50
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtRestoreKey
Actual Address 0xB5C69000
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtSecureConnectPort
Actual Address 0xB5C60060
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtSetInformationFile
Actual Address 0xB5C5D060
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtSetValueKey
Actual Address 0xB5C67ED7
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtTerminateProcess
Actual Address 0xB5C66960
Hooked by: C:\WINDOWS\System32\vsdatant.sys

>Shadow
NtUserMessageCall
Actual Address 0xB5C5E1A0
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtUserPostMessage
Actual Address 0xB5C5E230
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtUserPostThreadMessage
Actual Address 0xB5C5E2B0
Hooked by: C:\WINDOWS\System32\vsdatant.sys

NtUserSendInput
Actual Address 0xB5C5E470
Hooked by: C:\WINDOWS\System32\vsdatant.sys

>Processes
>Drivers
>Stealth
Unknown page with executable code
Address: 0x8316F9EE
Size: 1554
Unknown page with executable code
Address: 0x8316F706
Size: 2298
Unknown page with executable code
Address: 0x8319D3BD
Size: 3139
Unknown page with executable code
Address: 0x83175DE2
Size: 542
Unknown page with executable code
Address: 0x8319CD92
Size: 622
>Files
>Hooks
ntkrnlpa.exe-->IoCreateDevice, Type: EAT modification at address 0x80662A74 hook handler located in [unknown_code_page]
tcpip.sys-->ntkrnlpa.exe-->IoCreateDevice, Type: IAT modification at address 0xB5DDCF88 hook handler located in [unknown_code_page]
wanarp.sys-->ntkrnlpa.exe-->IoCreateDevice, Type: IAT modification at address 0xF7EA4C08 hook handler located in [unknown_code_page]
[2952]iexplore.exe-->user32.dll-->DialogBoxIndirectParamA, Type: Inline - RelativeJump at address 0x7E3A6B50 hook handler located in [ieframe.dll]
[2952]iexplore.exe-->user32.dll-->DialogBoxIndirectParamW, Type: Inline - RelativeJump at address 0x7E382032 hook handler located in [ieframe.dll]
[2952]iexplore.exe-->user32.dll-->DialogBoxParamA, Type: Inline - RelativeJump at address 0x7E38B10C hook handler located in [ieframe.dll]
[2952]iexplore.exe-->user32.dll-->DialogBoxParamW, Type: Inline - RelativeJump at address 0x7E37555F hook handler located in [ieframe.dll]
[2952]iexplore.exe-->user32.dll-->MessageBoxExA, Type: Inline - RelativeJump at address 0x7E3A05FC hook handler located in [ieframe.dll]
[2952]iexplore.exe-->user32.dll-->MessageBoxExW, Type: Inline - RelativeJump at address 0x7E3A05D8 hook handler located in [ieframe.dll]
[2952]iexplore.exe-->user32.dll-->MessageBoxIndirectA, Type: Inline - RelativeJump at address 0x7E38A04A hook handler located in [ieframe.dll]
[2952]iexplore.exe-->user32.dll-->MessageBoxIndirectW, Type: Inline - RelativeJump at address 0x7E3B62AB hook handler located in [ieframe.dll]
[3432]winamp.exe-->user32.dll-->DialogBoxParamA, Type: IAT modification at address 0x00461464 hook handler located in [gen_jumpex.dll]
[3432]winamp.exe-->user32.dll-->DrawTextA, Type: IAT modification at address 0x004615C8 hook handler located in [gen_jumpex.dll]
[3432]winamp.exe-->user32.dll-->EnableScrollBar, Type: Inline - RelativeJump at address 0x7E3B7DDD hook handler located in [gen_jumpex.dll]
[3432]winamp.exe-->user32.dll-->EnableScrollBar, Type: Inline - SEH at address 0x7E3B7DE2 hook handler located in [unknown_code_page]
[3432]winamp.exe-->user32.dll-->EnableScrollBar, Type: Inline - SEH at address 0x7E3B7DE3 hook handler located in [unknown_code_page]
[3432]winamp.exe-->user32.dll-->GetScrollInfo, Type: Inline - RelativeJump at address 0x7E370DA2 hook handler located in [gen_jumpex.dll]
[3432]winamp.exe-->user32.dll-->GetScrollInfo, Type: Inline - SEH at address 0x7E370DA7 hook handler located in [unknown_code_page]
[3432]winamp.exe-->user32.dll-->GetScrollInfo, Type: Inline - SEH at address 0x7E370DA8 hook handler located in [unknown_code_page]
[3432]winamp.exe-->user32.dll-->GetScrollPos, Type: Inline - RelativeJump at address 0x7E37F6C4 hook handler located in [gen_jumpex.dll]
[3432]winamp.exe-->user32.dll-->GetScrollRange, Type: Inline - RelativeJump at address 0x7E37F747 hook handler located in [gen_jumpex.dll]
[3432]winamp.exe-->user32.dll-->SetScrollInfo, Type: Inline - RelativeJump at address 0x7E369056 hook handler located in [gen_jumpex.dll]
[3432]winamp.exe-->user32.dll-->SetScrollInfo, Type: Inline - SEH at address 0x7E36905B hook handler located in [unknown_code_page]
[3432]winamp.exe-->user32.dll-->SetScrollInfo, Type: Inline - SEH at address 0x7E36905C hook handler located in [unknown_code_page]
[3432]winamp.exe-->user32.dll-->SetScrollPos, Type: Inline - RelativeJump at address 0x7E37F710 hook handler located in [gen_jumpex.dll]
[3432]winamp.exe-->user32.dll-->SetScrollRange, Type: Inline - RelativeJump at address 0x7E37F95B hook handler located in [gen_jumpex.dll]
[3432]winamp.exe-->user32.dll-->ShowScrollBar, Type: Inline - RelativeJump at address 0x7E37F2B3 hook handler located in [gen_jumpex.dll]
!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)