[ConanTheLibrarian]

Routine RK, nothing to get excited about:

Can anyone identify this a little better than Virustotal? The driver was preventing copying of itself and a dll file (attached) while the driver was enabled. Simple disable took it to its knees however, so I could scan it.

vbasepnp.sys
http://www.virustotal.com/file-scan/rep ... 1282317044

w32ewbit.dll
http://www.virustotal.com/file-scan/rep ... 1282317131

Thanks in advance.

[EP_X0FF]

from driver

x:\code-6z\specto~1\driver\objsp\i386\drvspector.pdb

C:\windows\system32\autofpnp.dll

could be kernel mode APC dll injector (imports contains all required routines).

dll contains a lot of stuff related to emails. SPECTORSOFT found. hxxp://www.spectorsoft.com/?

very likely http://en.wikipedia.org/wiki/SpectorSoft

from dll

Application not recording, skipping initialization

[ConanTheLibrarian]

Very interesting, thank you for that peek. I especially am interested in the malware uses on that wiki page. ;)