spcw.sys/sprr.sys/etc.

[avok]

Hello,

I found out that I have this driver that installs same hooks everytime, the driver always has a different name after reboot. I have no idea what it is but I remember not seeing this before. I found out that there was one thread about this but I can't speak Russian so..

Thank you

[drongo]

spcw.sys/sprr.sys/etc. they are the kids of the sptd.sys form disk emulator. It using rootkit technology to emulate disks You can check it by yourself by uninstalling all disk emulator programs that you have.

begin
 QuarantineFile('E:\WINDOWS\system32\2.tmp','');
 SetAVZPMStatus(false);
RebootWindows(true);
end.

Please upload quarantine according to appendix#3 of the rules by http://virusinfo.info/upload_virus_eng.php?tid=39927
Make an another virusinfo_syscure.zip after system will reboot.