 !!!  c   17.10.2011        (/ )
   AVZ  4.37
   18.02.2012 17:52:01
 :  - 294598,  - 2,   - 56,   17.10.2011 16:20
  : 388
  : 9
    : 298865
  :   
 : 
 Windows: 6.1.7600,  ; AVZ    
 : 
1.  RootKit  ,   API
1.1   API,   UserMode
  kernel32.dll,      .text
  ntdll.dll,      .text
  user32.dll,      .text
 user32.dll:DefDlgProcA (1657) ,  ProcAddressHijack.GetProcAddress ->76CF5F5A->7725A887
 user32.dll:DefDlgProcW (1658) ,  ProcAddressHijack.GetProcAddress ->76CF5F75->772440F0
 user32.dll:DefWindowProcA (1664) ,  ProcAddressHijack.GetProcAddress ->76CF5F90->772224F0
 user32.dll:DefWindowProcW (1665) ,  ProcAddressHijack.GetProcAddress ->76CF5FAB->772125FD
  advapi32.dll,      .text
  ws2_32.dll,      .text
  wininet.dll,      .text
  rasapi32.dll,      .text
  urlmon.dll,      .text
  netapi32.dll,      .text
1.2   API,   KernelMode
    -   [C000036B]
1.4     
   ,       AVZPM
1.5   IRP
    -   [C000036B]
2.  
   : 22
   : 248
  
3.  
4.  Winsock Layered Service Provider (SPI/LSP)
  LSP .   
5.    // (Keylogger,  DLL)
C:\Program Files (x86)\SOUNDGRAPH\iMON\SG_ShellMon.dll -->   Keylogger   DLL
C:\Program Files (x86)\SOUNDGRAPH\iMON\SG_ShellMon.dll>>>   
      
 :     ,      (  FAQ), ..    DLL-
6.    TCP/UDP,   
   
7. c  
 
8.   
>> :     TermService (   )
>> :     SSDPSRV ( SSDP)
>> :     Schedule ( )
> :   -           (,     ...)!
>> :     CDROM
>> :       (C$, D$ ...)
>> :      
>> :     
 
9.     
 >>         
 >>         
 >>  ,       ,    ,     
 
 : 179354,   : 95952,    0,  - 0
   18.02.2012 18:17:14
  00:25:14
            ,
      http://forum.kaspersky.com/index.php?showforum=18