Hi guys I have a question about DT's drivers

[jeff0000]

I'm using DAEMON Tools Lite 4.30.1 on Windows XP Professional SP 2. In addition to sptd.sys there is a kernel module named sp**.sys installed on my system. The modules name changes every time I reboot my computer. (i.e. spck.sys, spjk.sys, sple.sys, spsf.sys). The file does not seem to be present in my filesystem and the computer reboots whenever I search for the name in the registry. It also hooks all the registry functions in the SSDT. I dumped the modules memory, which I've uploaded here. Is this a legitimate part of DAEMON Tools? Something else I've installed? Or should I assume it's malware and format my machine?

Any insight would be appreciated
-Jeff

[Terramex]

Is this a legitimate part of DAEMON Tools?

Yes, it is.
Please have a look at these threads (there are also others dealing with that topic):

http://forum.daemon-tools.cc/f19/daemon-tools-rootkit-21853/

http://forum.daemon-tools.cc/f19/secure-tested-18838/

http://forum.daemon-tools.cc/f23/daemon-tools-rootkit-9581/

Also:
DuplexSecure - FAQ
Plague in (security) software drivers - www.matousec.com

[jeff0000]

Thanks Terramex.