Prośba o zerknięcie w loga combofix wirusy mssmpp.exe

[bombladen (Rafal Bomba)]

http://up.wklej.org/download.php?id=cdf … 9a43d438f9

L

ogfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:33:52, on 2007-09-18 Platform: Windows 2000 SP3 (WinNT 5.00.2195) MSIE: Internet Explorer v5.00 SP3 (5.00.2920.0000) Boot mode: Normal Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\System32\Ati2evxx.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\svchost.exe C:\Program Files\Eset\nod32krn.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\Explorer.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINNT\SOUNDMAN.EXE C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINNT\System32\internat.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM…\Run: [synchronization Manager] mobsync.exe /logon O4 - HKLM…\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [DAEMON Tools] “C:\Program Files\DAEMON Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [Microsft Security Monitor Process] mssmpp.exe O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKLM…\RunServices: [Microsft Security Monitor Process] mssmpp.exe O4 - HKCU…\Run: [internat.exe] internat.exe O4 - HKUS.DEFAULT…\Run: [internat.exe] internat.exe (User ‘Default user’) O4 - HKUS.DEFAULT…\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User ‘Default user’) O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe – End of file - 2736 bytes ComboFix 07-09-18.4 - “outlet” 2007-09-18 17:41:05.1 - NTFSx86 Microsoft Windows 2000 Professional 5.0.2195.3.1250.1.1045.18.282 [GMT 2:00] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINNT\system32\regsvc.exe . ((((((((((((((((((((((((( Files Created from 2007-08-18 to 2007-09-18 ))))))))))))))))))))))))))))))) . 2007-09-18 17:40 51,200 --a------ C:\WINNT\NirCmd.exe 2007-09-18 17:40 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_2bc.dat 2007-09-18 17:33 2007-09-18 17:13 2007-09-18 17:11 307,200 --a------ C:\WINNT\IsUninst.exe 2007-09-18 15:57 2007-09-18 15:53 2007-09-18 15:39 2007-09-18 15:38 2007-09-18 13:53 2007-09-18 13:12 2007-09-18 13:11 2007-09-18 13:10 2007-09-18 12:57 512,096 --a------ C:\WINNT\system32\drivers\amon.sys 2007-09-18 12:57 298,104 --a------ C:\WINNT\system32\imon.dll 2007-09-18 12:57 15,424 --a------ C:\WINNT\system32\drivers\nod32drv.sys 2007-09-18 10:40 2007-09-18 10:40 2007-09-18 10:36 1,156 --a------ C:\WINNT\mozver.dat 2007-09-18 10:32 0 --a------ C:\WINNT\nsreg.dat 2007-09-17 21:30 223,128 --a------ C:\WINNT\system32\drivers\dtscsi.sys 2007-09-17 21:30 2007-09-17 21:29 2,896 --a------ C:\WINNT\system32\drivers\audstub.sys 2007-09-17 21:28 73,328 --a------ C:\WINNT\system32\drivers\sptd0269.sys 2007-09-17 21:28 664,064 --a------ C:\WINNT\system32\drivers\sptd.sys 2007-09-17 21:27 9,552 --a------ C:\WINNT\system32\drivers\gameenum.sys 2007-09-17 21:27 36,272 --a------ C:\WINNT\system32\drivers\redbook.sys 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:22 2,297,552 --a------ C:\WINNT\system32\d3dx9_26.dll 2007-09-17 21:22 2007-09-17 21:22 2007-09-17 21:11 327,168 --a------ C:\WINNT\IsUn0415.exe 2007-09-17 21:11 29,696 --a------ C:\WINNT\system32\Uninst.dll 2007-09-17 21:11 2007-09-17 21:11 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 07-09-18 15:53 --------- d–h----- C:\Program Files\InstallShield Installation Information 07-09-17 20:57 --------- d-------- C:\Program Files\Realtek Sound Manager 07-09-17 20:57 --------- d-------- C:\Program Files\AvRack 07-09-17 20:56 --------- d-------- C:\Program Files\Marvell 07-09-17 20:56 --------- d-------- C:\Program Files\Common Files\InstallShield 07-09-17 20:52 --------- d-------- C:\DOCUME~1\outlet\DANEAP~1\Help 07-09-17 20:50 --------- d-------- C:\Program Files\ATI Technologies 07-09-17 20:45 --------- d-------- C:\Program Files\Intel 07-09-17 20:35 --------- d-------- C:\Program Files\microsoft frontpage 07-09-17 20:34 271 —h----- C:\Program Files\desktop.ini 07-09-17 20:34 22039 —h----- C:\Program Files\folder.htt 07-09-17 20:33 --------- d-------- C:\Program Files\Accessories 02-08-28 02:00 32528 --a------ C:\WINNT\inf\wbfirdma.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Synchronization Manager”=“mobsync.exe” [02-08-28 02:00 C:\WINNT\system32\mobsync.exe] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [05-05-12 21:05] “SoundMan”=“SOUNDMAN.EXE” [05-05-17 12:48 C:\WINNT\SOUNDMAN.EXE] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [05-11-09 00:00] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [07-09-18 12:57] “RemoteControl”=“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [04-11-02 20:24] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “internat.exe”=“internat.exe” [02-08-28 02:00 C:\WINNT\system32\internat.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] “Microsft Security Monitor Process”=mssmpp.exe [HKEY_USERS.default\software\microsoft\windows\currentversion\runonce] “^SetupICWDesktop”=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “internat.exe”=internat.exe [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys] @=“Driver” [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys] @=“Driver” R3 usbhub20;USB 2.0 Root Hub Support;C:\WINNT\System32\DRIVERS\usbhub20.sys R3 yukonw2k;NDIS5 Miniport Driver for Marvell Yukon Gigabit Ethernet Adapter;C:\WINNT\System32\DRIVERS\yukonw2k.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints\F] AutoRun\command- F:\autorun.exe *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-18 17:42:38 Windows 5.0.2195 Service Pack 3 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … ************************************************************************** . Completion time: 2007-09-18 17:45:44 C:\ComboFix-quarantined-files.txt … 07-09-18 17:45 . — E O F —

[jessica]

@DevilJin - to jesteś lepszy ode mnie, bo ja nie widzę już tego wirusa, co najwyżej klucz rejestru po nim.

@bombladen -

O4 - HKLM…\Run: [Microsft Security Monitor Process] mssmpp.exe O4 - HKLM…\RunServices: [Microsft Security Monitor Process] mssmpp.exe

Te w/w wpisy sfiksuj w Hijacku:

>>Hijack>>scan(Do a system scan only)>>zaznacz je >> Fix checked.

Na wszelki wypadek Użyj -->SDFix

Uwaga: Da się go uruchomić tylko w Trybie Awaryjnym.

Pokaż Report.txt znajdujący się w folderze SDFix.

Instrukcja obsługi: Dwuklik na SDFix.exe, program wypakuje się na C:\SDFix (standardowo) Zrestartuj komputer i wejdź do trybu awaryjnego (klawisz F8 przed startem Windowsa) Wejdź do folderu z SDFix, dwuklik na plik RunThis.bat Wciśnij Y, nastąpi proces usuwania. Kiedy usuwanie się ukończy, wciśnij dowolny klawisz (Any Key). Nastąpi restart komputera. Po restarcie SDFix uruchomi się ponownie, żeby dokończyć proces usuwania. Kiedy pojawi się w oknie programu Finished, wciśnij dowolny klawisz do zakończenia scryptu i załadowania ikon na pulpicie. Pokaż Report.txt znajdujący się w folderze SDFix.

jessi

[Gutek]

Widać że masz wirusa, lecz niestety więcej nic nie mogę zrobić, poczekaj na “ekspertów” od logów

daruj sobie takie posty - kosz

[bombladen (Rafal Bomba)]

SDFix: Version 1.105 Run by outlet on Wt 2007-09-18 at 18:39 Microsoft Windows 2000 [Wersja 5.00.2195] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: Trojan Files Found: C:\WINNT\system32\TFTP1068 - Deleted C:\WINNT\system32\TFTP1204 - Deleted C:\WINNT\system32\TFTP1260 - Deleted C:\WINNT\system32\TFTP348 - Deleted C:\WINNT\system32\TFTP616 - Deleted C:\WINNT\system32\TFTP644 - Deleted C:\WINNT\system32\TFTP760 - Deleted C:\WINNT\system32\TFTP848 - Deleted C:\WINNT\system32\TFTP856 - Deleted Removing Temp Files… ADS Check: C:\WINNT No streams found. C:\WINNT\system32 No streams found. C:\WINNT\system32\svchost.exe No streams found. C:\WINNT\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Finished!

[Gutek]

Daj nowy log z Combo

[bombladen (Rafal Bomba)]

ComboFix 07-09-18.4 - “outlet” 2007-09-18 18:51:03.2 - NTFSx86 Microsoft Windows 2000 Professional 5.0.2195.3.1250.1.1045.18.345 [GMT 2:00] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINNT\system32\regsvc.exe . ((((((((((((((((((((((((( Files Created from 2007-08-18 to 2007-09-18 ))))))))))))))))))))))))))))))) . 2007-09-18 18:50 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_2b4.dat 2007-09-18 18:38 2007-09-18 17:40 51,200 --a------ C:\WINNT\NirCmd.exe 2007-09-18 17:40 16,384 --a----t- C:\WINNT\system32\Perflib_Perfdata_2bc.dat 2007-09-18 17:33 2007-09-18 17:13 2007-09-18 17:11 307,200 --a------ C:\WINNT\IsUninst.exe 2007-09-18 15:57 2007-09-18 15:53 2007-09-18 15:39 2007-09-18 15:38 2007-09-18 13:53 2007-09-18 13:12 2007-09-18 13:11 2007-09-18 13:10 2007-09-18 12:57 512,096 --a------ C:\WINNT\system32\drivers\amon.sys 2007-09-18 12:57 298,104 --a------ C:\WINNT\system32\imon.dll 2007-09-18 12:57 15,424 --a------ C:\WINNT\system32\drivers\nod32drv.sys 2007-09-18 10:40 2007-09-18 10:40 2007-09-18 10:36 1,156 --a------ C:\WINNT\mozver.dat 2007-09-18 10:32 0 --a------ C:\WINNT\nsreg.dat 2007-09-17 21:30 223,128 --a------ C:\WINNT\system32\drivers\dtscsi.sys 2007-09-17 21:30 2007-09-17 21:29 2,896 --a------ C:\WINNT\system32\drivers\audstub.sys 2007-09-17 21:28 73,328 --a------ C:\WINNT\system32\drivers\sptd0269.sys 2007-09-17 21:28 664,064 --a------ C:\WINNT\system32\drivers\sptd.sys 2007-09-17 21:27 9,552 --a------ C:\WINNT\system32\drivers\gameenum.sys 2007-09-17 21:27 36,272 --a------ C:\WINNT\system32\drivers\redbook.sys 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:26 2007-09-17 21:22 2,297,552 --a------ C:\WINNT\system32\d3dx9_26.dll 2007-09-17 21:22 2007-09-17 21:22 2007-09-17 21:11 327,168 --a------ C:\WINNT\IsUn0415.exe 2007-09-17 21:11 29,696 --a------ C:\WINNT\system32\Uninst.dll 2007-09-17 21:11 2007-09-17 21:11 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 07-09-18 15:53 --------- d–h----- C:\Program Files\InstallShield Installation Information 07-09-17 20:57 --------- d-------- C:\Program Files\Realtek Sound Manager 07-09-17 20:57 --------- d-------- C:\Program Files\AvRack 07-09-17 20:56 --------- d-------- C:\Program Files\Marvell 07-09-17 20:56 --------- d-------- C:\Program Files\Common Files\InstallShield 07-09-17 20:52 --------- d-------- C:\DOCUME~1\outlet\DANEAP~1\Help 07-09-17 20:50 --------- d-------- C:\Program Files\ATI Technologies 07-09-17 20:45 --------- d-------- C:\Program Files\Intel 07-09-17 20:35 --------- d-------- C:\Program Files\microsoft frontpage 07-09-17 20:34 271 —h----- C:\Program Files\desktop.ini 07-09-17 20:34 22039 —h----- C:\Program Files\folder.htt 07-09-17 20:33 --------- d-------- C:\Program Files\Accessories 02-08-28 02:00 32528 --a------ C:\WINNT\inf\wbfirdma.sys . ((((((((((((((((((((((((((((( snapshot_Wt 2007-09-18_174349,15 ))))))))))))))))))))))))))))))))))))))))) . ----a-w 163,328 2007-09-17 13:25:00 C:\WINNT\ERUNT\SDFIX\ERDNT.EXE ----a-w 335,872 2007-09-18 16:38:50 C:\WINNT\ERUNT\SDFIX\Users\00000001\NTUSER.DAT ----a-w 8,192 2007-09-18 16:38:50 C:\WINNT\ERUNT\SDFIX\Users\00000002\UsrClass.dat ----a-w 163,328 2007-09-17 13:25:00 C:\WINNT\ERUNT\SDFIX_First_Run\ERDNT.EXE ----a-w 335,872 2007-09-18 16:38:45 C:\WINNT\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT ----a-w 8,192 2007-09-18 16:38:45 C:\WINNT\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Synchronization Manager”=“mobsync.exe” [02-08-28 02:00 C:\WINNT\system32\mobsync.exe] “ATIPTA”=“C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe” [05-05-12 21:05] “SoundMan”=“SOUNDMAN.EXE” [05-05-17 12:48 C:\WINNT\SOUNDMAN.EXE] “DAEMON Tools”=“C:\Program Files\DAEMON Tools\daemon.exe” [05-11-09 00:00] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [07-09-18 12:57] “RemoteControl”=“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [04-11-02 20:24] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “internat.exe”=“internat.exe” [02-08-28 02:00 C:\WINNT\system32\internat.exe] [HKEY_USERS.default\software\microsoft\windows\currentversion\runonce] “^SetupICWDesktop”=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop [HKEY_USERS.default\software\microsoft\windows\currentversion\run] “internat.exe”=internat.exe [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys] @=“Driver” [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys] @=“Driver” R3 usbhub20;USB 2.0 Root Hub Support;C:\WINNT\System32\DRIVERS\usbhub20.sys R3 yukonw2k;NDIS5 Miniport Driver for Marvell Yukon Gigabit Ethernet Adapter;C:\WINNT\System32\DRIVERS\yukonw2k.sys . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-18 18:51:23 Windows 5.0.2195 Service Pack 3 NTFS scanning hidden processes … \ComboFix\sed.cfexe [1228] 0x81243D60 scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-09-18 18:51:44 C:\ComboFix-quarantined-files.txt … 07-09-18 18:51 C:\ComboFix2.txt … 07-09-18 17:45 . — E O F —

[Gutek]

Zrób jeszcze raz skan SDFix

Dodatkowo:

Pobierz Gmer

1. Rootkit=>szukaj=>bez zaznaczania pokaż wszystko=> Ctrl + V do posta wklej

2. Rootkit => zaznaczone tylko Pokazuj wszystko + Usługi => Szukaj => Kopiuj => Ctrl + V do posta wklej

regsvc.exe - nie powinnien polecieć

[bombladen (Rafal Bomba)]

Nod mi wyrzucił cos takiego:

Plik C:\WINNT\system32\mssmpp.V00exe jest zainfekowany - trojan Win32/Rbot.

log z gmera:

GMER 1.0.12.12010 - http://www.gmer.net Rootkit scan 2007-09-18 19:12:34 Windows 5.0.2195 Service Pack 3 ---- System - GMER 1.0.12 ---- SSDT sptd.sys ZwCreateKey SSDT sptd.sys ZwEnumerateKey SSDT sptd.sys ZwEnumerateValueKey SSDT sptd.sys ZwOpenKey SSDT sptd.sys ZwQueryKey SSDT sptd.sys ZwQueryValueKey SSDT sptd.sys ZwSetValueKey ---- Kernel code sections - GMER 1.0.12 ---- .text ntdll.dll!NtClose 77F83763 5 Bytes JMP 72033FAA .text ntdll.dll!NtCreateSection 77F86AB9 5 Bytes JMP 72033FC8 .text ntdll.dll!NtCreateProcess 77F91432 5 Bytes JMP 72034135 ---- Devices - GMER 1.0.12 ---- Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA 8208CC68 Device \FileSystem\Ntfs \Ntfs IRP_MJ_PNP 8208CC68 Device \Driver\NetBT \Device\NetBT_Tcpip_{DC8FFBB4-3F94-47A6-83E0-2D977AC4D398} IRP_MJ_CREATE 81BBC688 Device \Driver\NetBT \Device\NetBT_Tcpip_{DC8FFBB4-3F94-47A6-83E0-2D977AC4D398} IRP_MJ_CLOSE 81BBC688 Device \Driver\NetBT \Device\NetBT_Tcpip_{DC8FFBB4-3F94-47A6-83E0-2D977AC4D398} IRP_MJ_DEVICE_CONTROL 81BBC688 Device \Driver\NetBT \Device\NetBT_Tcpip_{DC8FFBB4-3F94-47A6-83E0-2D977AC4D398} IRP_MJ_INTERNAL_DEVICE_CONTROL 81BBC688 Device \Driver\NetBT \Device\NetBT_Tcpip_{DC8FFBB4-3F94-47A6-83E0-2D977AC4D398} IRP_MJ_CLEANUP 81BBC688 Device \Driver\NetBT \Device\NetBT_Tcpip_{DC8FFBB4-3F94-47A6-83E0-2D977AC4D398} IRP_MJ_PNP 81BBC688 Device \Driver\00000053 \Device\0000000a IRP_MJ_POWER [bFF39A26] sptd.sys Device \Driver\00000053 \Device\0000000a IRP_MJ_SYSTEM_CONTROL [bFF4DBD8] sptd.sys Device \Driver\00000053 \Device\0000000a IRP_MJ_PNP [bFF4654E] sptd.sys Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CREATE 820BE348 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CLOSE 820BE348 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_READ 820BE348 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_WRITE 820BE348 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_FLUSH_BUFFERS 820BE348 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_DEVICE_CONTROL 820BE348 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_INTERNAL_DEVICE_CONTROL 820BE348 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SHUTDOWN 820BE348 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_POWER 820BE348 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_PNP 820BE348 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CREATE 820BE348 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CLOSE 820BE348 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_READ 820BE348 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_WRITE 820BE348 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_FLUSH_BUFFERS 820BE348 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_DEVICE_CONTROL 820BE348 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_INTERNAL_DEVICE_CONTROL 820BE348 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_SHUTDOWN 820BE348 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_POWER 820BE348 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_PNP 820BE348 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CREATE 820BE348 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CLOSE 820BE348 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_READ 820BE348 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_WRITE 820BE348 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_FLUSH_BUFFERS 820BE348 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_DEVICE_CONTROL 820BE348 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_INTERNAL_DEVICE_CONTROL 820BE348 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_SHUTDOWN 820BE348 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_POWER 820BE348 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_PNP 820BE348 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CREATE 820BE348 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CLOSE 820BE348 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_READ 820BE348 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_WRITE 820BE348 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_FLUSH_BUFFERS 820BE348 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_DEVICE_CONTROL 820BE348 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_INTERNAL_DEVICE_CONTROL 820BE348 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_SHUTDOWN 820BE348 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_POWER 820BE348 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_PNP 820BE348 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_READ 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_WRITE 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_FLUSH_BUFFERS 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_DEVICE_CONTROL 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_INTERNAL_DEVICE_CONTROL 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SHUTDOWN 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CLEANUP 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_POWER 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_PNP 820BE588 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 81F780E8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 81F780E8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 81F780E8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 81F780E8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 81F780E8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 81F780E8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F780E8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 81F780E8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 81F780E8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 81F780E8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 81F780E8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CREATE 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_READ 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_WRITE 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_FLUSH_BUFFERS 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_DEVICE_CONTROL 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_INTERNAL_DEVICE_CONTROL 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SHUTDOWN 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CLEANUP 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_POWER 820BE588 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_PNP 820BE588 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_NAMED_PIPE 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLOSE 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_READ 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_WRITE 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_INFORMATION 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_INFORMATION 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_EA 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_EA 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FLUSH_BUFFERS 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_VOLUME_INFORMATION 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_VOLUME_INFORMATION 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DIRECTORY_CONTROL 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FILE_SYSTEM_CONTROL 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CONTROL 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_INTERNAL_DEVICE_CONTROL 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SHUTDOWN 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_LOCK_CONTROL 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLEANUP 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_MAILSLOT 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_SECURITY 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_SECURITY 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_POWER 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SYSTEM_CONTROL 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CHANGE 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_QUOTA 81BB7AA8 Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_QUOTA 81BB7AA8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 81F780E8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 81F780E8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 81F780E8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 81F780E8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 81F780E8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 81F780E8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F780E8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 81F780E8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 81F780E8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 81F780E8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 81F780E8 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CREATE 81BBC688 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLOSE 81BBC688 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_DEVICE_CONTROL 81BBC688 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_INTERNAL_DEVICE_CONTROL 81BBC688 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLEANUP 81BBC688 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_PNP 81BBC688 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CREATE 81BBC688 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLOSE 81BBC688 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_DEVICE_CONTROL 81BBC688 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_INTERNAL_DEVICE_CONTROL 81BBC688 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLEANUP 81BBC688 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_PNP 81BBC688 Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_CREATE 8208CEA8 Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_CLOSE 8208CEA8 Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_READ 8208CEA8 Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_WRITE 8208CEA8 Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_FLUSH_BUFFERS 8208CEA8 Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_DEVICE_CONTROL 8208CEA8 Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_INTERNAL_DEVICE_CONTROL 8208CEA8 Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_SHUTDOWN 8208CEA8 Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_POWER 8208CEA8 Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_SYSTEM_CONTROL 8208CEA8 Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_PNP 8208CEA8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_NAMED_PIPE 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLOSE 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_READ 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_WRITE 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_INFORMATION 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_INFORMATION 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_EA 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_EA 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FLUSH_BUFFERS 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_VOLUME_INFORMATION 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_VOLUME_INFORMATION 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DIRECTORY_CONTROL 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FILE_SYSTEM_CONTROL 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CONTROL 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_INTERNAL_DEVICE_CONTROL 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SHUTDOWN 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_LOCK_CONTROL 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLEANUP 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_MAILSLOT 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_SECURITY 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_SECURITY 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_POWER 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SYSTEM_CONTROL 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CHANGE 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_QUOTA 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_QUOTA 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_PNP 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_NAMED_PIPE 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLOSE 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_READ 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_WRITE 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_INFORMATION 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_INFORMATION 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_EA 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_EA 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FLUSH_BUFFERS 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_VOLUME_INFORMATION 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_VOLUME_INFORMATION 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DIRECTORY_CONTROL 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FILE_SYSTEM_CONTROL 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CONTROL 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_INTERNAL_DEVICE_CONTROL 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SHUTDOWN 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_LOCK_CONTROL 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLEANUP 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_MAILSLOT 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_SECURITY 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_SECURITY 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_POWER 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SYSTEM_CONTROL 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CHANGE 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_QUOTA 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_QUOTA 81BBBDE8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_PNP 81BBBDE8 Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CREATE 81C0F0E8 Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CREATE_NAMED_PIPE 81C0F0E8 Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CLOSE 81C0F0E8 Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_READ 81C0F0E8 Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_WRITE 81C0F0E8 Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_QUERY_INFORMATION 81C0F0E8 Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_SET_INFORMATION 81C0F0E8 Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_FLUSH_BUFFERS 81C0F0E8 Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_QUERY_VOLUME_INFORMATION 81C0F0E8 Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_DIRECTORY_CONTROL 81C0F0E8 Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_FILE_SYSTEM_CONTROL 81C0F0E8 Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CLEANUP 81C0F0E8 Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_QUERY_SECURITY 81C0F0E8 Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_SET_SECURITY 81C0F0E8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_CREATE 820BE588 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_READ 820BE588 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_WRITE 820BE588 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_FLUSH_BUFFERS 820BE588 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_DEVICE_CONTROL 820BE588 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_INTERNAL_DEVICE_CONTROL 820BE588 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_SHUTDOWN 820BE588 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_CLEANUP 820BE588 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_POWER 820BE588 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_PNP 820BE588 Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_CREATE 81C0DD08 Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_CLOSE 81C0DD08 Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_READ 81C0DD08 Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_WRITE 81C0DD08 Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_QUERY_INFORMATION 81C0DD08 Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_SET_INFORMATION 81C0DD08 Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_QUERY_VOLUME_INFORMATION 81C0DD08 Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_DIRECTORY_CONTROL 81C0DD08 Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_FILE_SYSTEM_CONTROL 81C0DD08 Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_CLEANUP 81C0DD08 Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_CREATE_MAILSLOT 81C0DD08 Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_QUERY_SECURITY 81C0DD08 Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_SET_SECURITY 81C0DD08 Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target0Lun0 IRP_MJ_CREATE 81F64868 Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target0Lun0 IRP_MJ_CLOSE 81F64868 Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 81F64868 Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F64868 Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target0Lun0 IRP_MJ_POWER 81F64868 Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 81F64868 Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target0Lun0 IRP_MJ_PNP 81F64868 Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_CREATE 81F64868 Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_CLOSE 81F64868 Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_DEVICE_CONTROL 81F64868 Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F64868 Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_POWER 81F64868 Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_SYSTEM_CONTROL 81F64868 Device \Driver\dtscsi \Device\Scsi\dtscsi1 IRP_MJ_PNP 81F64868 Device \FileSystem\Fastfat \Fat IRP_MJ_CREATE 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_CLOSE 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_READ 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_WRITE 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_SET_EA 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP 815C6368 Device \FileSystem\Fastfat \Fat IRP_MJ_PNP 815C6368 Device \FileSystem\Cdfs \Cdfs IRP_MJ_CREATE 81FD0468 Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLOSE 81FD0468 Device \FileSystem\Cdfs \Cdfs IRP_MJ_READ 81FD0468 Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_INFORMATION 81FD0468 Device \FileSystem\Cdfs \Cdfs IRP_MJ_SET_INFORMATION 81FD0468 Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_VOLUME_INFORMATION 81FD0468 Device \FileSystem\Cdfs \Cdfs IRP_MJ_DIRECTORY_CONTROL 81FD0468 Device \FileSystem\Cdfs \Cdfs IRP_MJ_FILE_SYSTEM_CONTROL 81FD0468 Device \FileSystem\Cdfs \Cdfs IRP_MJ_DEVICE_CONTROL 81FD0468 Device \FileSystem\Cdfs \Cdfs IRP_MJ_LOCK_CONTROL 81FD0468 Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLEANUP 81FD0468 Device \FileSystem\Cdfs \Cdfs IRP_MJ_PNP 81FD0468 ---- EOF - GMER 1.0.12 ----

GMER 1.0.12.12010 - http://www.gmer.net Rootkit scan 2007-09-18 19:14:34 Windows 5.0.2195 Service Pack 3 ---- Services - GMER 1.0.12 ---- Service [DISABLED] Abiosdsk Service [DISABLED] abp480n5 Service C:\WINNT\System32\DRIVERS\ACPI.sys [bOOT] ACPI Service [DISABLED] ACPIEC Service [DISABLED] adpu160m Service C:\WINNT\System32\drivers\afd.sys [AUTO] AFD Service C:\WINNT\System32\DRIVERS\agp440.sys [bOOT] agp440 Service [DISABLED] Aha154x Service [DISABLED] aic116x Service [DISABLED] aic78u2 Service [DISABLED] aic78xx Service C:\WINNT\system32\drivers\ALCXWDM.SYS [MANUAL] ALCXWDM Service C:\WINNT\System32\services.exe [MANUAL] Alerter Service ALG Service [DISABLED] ami0nt Service C:\WINNT\system32\drivers\amon.sys [AUTO] AMON Service [DISABLED] amsint Service C:\WINNT\system32\services.exe [MANUAL] AppMgmt Service [DISABLED] asc Service [DISABLED] asc3350p Service [DISABLED] asc3550 Service Aspi32 Service C:\WINNT\System32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac Service C:\WINNT\System32\DRIVERS\atapi.sys [bOOT] atapi Service [DISABLED] Atdisk Service C:\WINNT\System32\Ati2evxx.exe [AUTO] Ati HotKey Poller Service C:\WINNT\system32\ati2sgag.exe [AUTO] ATI Smart Service C:\WINNT\System32\DRIVERS\ati2mtag.sys [MANUAL] ati2mtag Service Atierecord Service C:\WINNT\System32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc Service C:\WINNT\System32\DRIVERS\audstub.sys [MANUAL] audstub Service [sYSTEM] Beep Service C:\WINNT\system32\svchost.exe [MANUAL] BITS Service C:\WINNT\System32\services.exe [AUTO] Browser Service [DISABLED] BusLogic Service C:\DOCUME~1\outlet\USTAWI~1\Temp\catchme.sys [MANUAL] catchme Service C:\WINNT\System32\DRIVERS\CCDECODE.sys [MANUAL] CCDECODE Service [DISABLED] cd20xrnt Service [sYSTEM] Cdaudio Service [DISABLED] Cdfs Service C:\WINNT\System32\DRIVERS\cdrom.sys [sYSTEM] Cdrom Service [sYSTEM] Changer Service C:\WINNT\System32\cisvc.exe [MANUAL] cisvc Service C:\WINNT\system32\clipsrv.exe [MANUAL] ClipSrv Service ContentFilter Service ContentIndex Service [DISABLED] Cpqarray Service [DISABLED] cpqarry2 Service [DISABLED] cpqfcalm Service [DISABLED] cpqfws2e Service [DISABLED] dac960nt Service [DISABLED] deckzpsx Service C:\WINNT\System32\services.exe [AUTO] Dhcp Service C:\WINNT\System32\DRIVERS\disk.sys [bOOT] Disk Service [bOOT] Diskperf Service C:\WINNT\System32\dmadmin.exe [MANUAL] dmadmin Service C:\WINNT\System32\drivers\dmboot.sys [DISABLED] dmboot Service C:\WINNT\System32\drivers\dmio.sys [bOOT] dmio Service C:\WINNT\System32\drivers\dmload.sys [bOOT] dmload Service C:\WINNT\System32\services.exe [AUTO] dmserver Service C:\WINNT\system32\drivers\DMusic.sys [MANUAL] DMusic Service C:\WINNT\System32\services.exe [AUTO] Dnscache Service C:\WINNT\System32\Drivers\dtscsi.sys [MANUAL] dtscsi Service [DISABLED] EFS Service C:\WINNT\system32\services.exe [AUTO] Eventlog Service C:\WINNT\System32\svchost.exe [MANUAL] EventSystem Service [DISABLED] Fastfat Service C:\WINNT\system32\faxsvc.exe [MANUAL] Fax Service [DISABLED] Fd16_700 Service C:\WINNT\System32\DRIVERS\fdc.sys [MANUAL] Fdc Service [AUTO] Fips Service [DISABLED] fireport Service [DISABLED] flashpnt Service C:\WINNT\System32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk Service [sYSTEM] Fs_Rec Service C:\WINNT\System32\DRIVERS\ftdisk.sys [bOOT] Ftdisk Service C:\WINNT\System32\DRIVERS\gameenum.sys [MANUAL] gameenum Service C:\WINNT\System32\DRIVERS\gmer.sys [MANUAL] gmer Service C:\WINNT\System32\DRIVERS\msgpc.sys [MANUAL] Gpc Service C:\WINNT\System32\DRIVERS\hidusb.sys [AUTO] hidusb Service C:\WINNT\System32\DRIVERS\i8042prt.sys [sYSTEM] i8042prt Service IAS Service inetaccs Service [DISABLED] ini910u Service Inport Service [DISABLED] IntelIde Service C:\WINNT\System32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver Service C:\WINNT\System32\DRIVERS\ipinip.sys [MANUAL] IpInIp Service C:\WINNT\System32\DRIVERS\ipnat.sys [MANUAL] IpNat Service C:\WINNT\System32\DRIVERS\ipsec.sys [MANUAL] IPSEC Service [DISABLED] ipsraidn Service C:\WINNT\System32\DRIVERS\irenum.sys [MANUAL] IRENUM Service ISAPISearch Service C:\WINNT\System32\DRIVERS\isapnp.sys [bOOT] isapnp Service C:\WINNT\System32\DRIVERS\kbdclass.sys [sYSTEM] Kbdclass Service C:\WINNT\system32\drivers\kmixer.sys [MANUAL] kmixer Service [bOOT] KSecDD Service C:\WINNT\System32\services.exe [AUTO] lanmanserver Service C:\WINNT\System32\services.exe [AUTO] lanmanworkstation Service [sYSTEM] lbrtfdc Service C:\WINNT\System32\services.exe [AUTO] LmHosts Service [DISABLED] lp6nds35 Service C:\WINNT\System32\services.exe [AUTO] Messenger Service [sYSTEM] mnmdd Service C:\WINNT\System32\mnmsrvc.exe [MANUAL] mnmsrvc Service [MANUAL] Modem Service C:\WINNT\System32\DRIVERS\mouclass.sys [sYSTEM] Mouclass Service C:\WINNT\System32\DRIVERS\mouhid.sys [MANUAL] mouhid Service [bOOT] MountMgr Service C:\WINNT\System32\DRIVERS\MPE.sys [MANUAL] MPE Service [DISABLED] mraid35x Service C:\WINNT\System32\DRIVERS\mrxsmb.sys [sYSTEM] MRxSmb Service C:\WINNT\System32\msdtc.exe [MANUAL] MSDTC Service [sYSTEM] Msfs Service C:\WINNT\system32\msiexec.exe [MANUAL] MSIServer Service C:\WINNT\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV Service C:\WINNT\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK Service C:\WINNT\system32\drivers\MSPQM.sys [MANUAL] MSPQM Service C:\WINNT\system32\drivers\MSTEE.sys [MANUAL] MSTEE Service [bOOT] Mup Service C:\WINNT\System32\DRIVERS\NABTSFEC.sys [MANUAL] NABTSFEC Service [DISABLED] Ncrc710 Service [bOOT] NDIS Service C:\WINNT\System32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi Service C:\WINNT\System32\DRIVERS\ndiswan.sys [MANUAL] NdisWan Service [MANUAL] NDProxy Service C:\WINNT\System32\DRIVERS\netbios.sys [sYSTEM] NetBIOS Service C:\WINNT\System32\DRIVERS\netbt.sys [sYSTEM] NetBT Service C:\WINNT\system32\netdde.exe [MANUAL] NetDDE Service C:\WINNT\system32\netdde.exe [MANUAL] NetDDEdsdm Service C:\WINNT\system32\drivers\netdtect.sys [MANUAL] NetDetect Service C:\WINNT\System32\lsass.exe [MANUAL] Netlogon Service C:\WINNT\System32\svchost.exe [MANUAL] Netman Service C:\WINNT\system32\drivers\nod32drv.sys [sYSTEM] nod32drv Service C:\Program Files\Eset\nod32krn.exe [AUTO] NOD32krn Service [sYSTEM] Npfs Service [DISABLED] Ntfs Service C:\WINNT\System32\lsass.exe [MANUAL] NtLmSsp Service C:\WINNT\System32\svchost.exe [AUTO] NtmsSvc Service [sYSTEM] Null Service C:\WINNT\System32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt Service C:\WINNT\System32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd Service C:\WINNT\System32\DRIVERS\parallel.sys [MANUAL] Parallel Service C:\WINNT\System32\DRIVERS\parport.sys [sYSTEM] Parport Service [bOOT] PartMgr Service [AUTO] ParVdm Service C:\WINNT\System32\DRIVERS\pci.sys [bOOT] PCI Service [sYSTEM] PCIDump Service C:\WINNT\System32\DRIVERS\pciide.sys [bOOT] PCIIde Service [DISABLED] Pcmcia Service PerfDisk Service PerfNet Service PerfOS Service PerfProc Service C:\WINNT\system32\services.exe [AUTO] PlugPlay Service C:\WINNT\System32\lsass.exe [AUTO] PolicyAgent Service C:\WINNT\System32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport Service C:\WINNT\system32\services.exe [AUTO] ProtectedStorage Service C:\WINNT\System32\DRIVERS\ptilink.sys [MANUAL] Ptilink Service [DISABLED] ql1080 Service [DISABLED] Ql10wnt Service [DISABLED] ql1240 Service [DISABLED] ql2100 Service C:\WINNT\System32\DRIVERS\rasacd.sys [sYSTEM] RasAcd Service C:\WINNT\System32\svchost.exe [MANUAL] RasAuto Service C:\WINNT\System32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp Service C:\WINNT\System32\svchost.exe [MANUAL] RasMan Service C:\WINNT\System32\DRIVERS\raspti.sys [MANUAL] Raspti Service C:\WINNT\system32\drivers\RCA.sys [MANUAL] RCA Service C:\WINNT\System32\DRIVERS\rdbss.sys [sYSTEM] Rdbss Service C:\WINNT\System32\DRIVERS\redbook.sys [sYSTEM] redbook Service C:\WINNT\System32\svchost.exe [DISABLED] RemoteAccess Service C:\WINNT\system32\regsvc.exe [AUTO] RemoteRegistry Service C:\WINNT\System32\Drivers\RootMdm.sys [MANUAL] ROOTMODEM Service C:\WINNT\System32\locator.exe [MANUAL] RpcLocator Service C:\WINNT\system32\svchost.exe [AUTO] RpcSs Service C:\WINNT\System32\rsvp.exe [MANUAL] RSVP Service C:\WINNT\system32\lsass.exe [AUTO] SamSs Service C:\WINNT\System32\SCardSvr.exe [MANUAL] SCardDrv Service C:\WINNT\System32\SCardSvr.exe [MANUAL] SCardSvr Service C:\WINNT\system32\MSTask.exe [AUTO] Schedule Service [AUTO] SchedulingAgent Service C:\WINNT\system32\services.exe [AUTO] seclogon Service C:\WINNT\system32\svchost.exe [AUTO] SENS Service C:\WINNT\System32\DRIVERS\serenum.sys [MANUAL] serenum Service C:\WINNT\System32\DRIVERS\serial.sys [sYSTEM] Serial Service [sYSTEM] Sfloppy Service [sYSTEM] sglfb Service C:\WINNT\System32\svchost.exe [AUTO] SharedAccess Service [DISABLED] Simbad Service C:\WINNT\System32\DRIVERS\SLIP.sys [MANUAL] SLIP Service [DISABLED] Sparrow Service C:\WINNT\system32\spoolsv.exe [AUTO] Spooler Service C:\WINNT\System32\Drivers\sptd.sys [bOOT] sptd Service [bOOT] sr Service C:\WINNT\System32\DRIVERS\srv.sys [MANUAL] Srv Service C:\WINNT\System32\DRIVERS\StreamIP.sys [MANUAL] streamip Service C:\WINNT\System32\DRIVERS\swenum.sys [MANUAL] swenum Service C:\WINNT\system32\drivers\swmidi.sys [MANUAL] swmidi Service [DISABLED] symc810 Service [DISABLED] symc8xx Service [DISABLED] sym_hi Service C:\WINNT\system32\drivers\sysaudio.sys [MANUAL] sysaudio Service C:\WINNT\system32\smlogsvc.exe [MANUAL] SysmonLog Service C:\WINNT\System32\svchost.exe [MANUAL] TapiSrv Service C:\WINNT\System32\DRIVERS\tcpip.sys [sYSTEM] Tcpip Service [sYSTEM] tga Service C:\WINNT\system32\tlntsvr.exe [MANUAL] TlntSvr Service C:\WINNT\system32\services.exe [AUTO] TrkWks Service [DISABLED] Udfs Service C:\WINNT\System32\DRIVERS\uhcd.sys [MANUAL] uhcd Service [DISABLED] ultra66 Service C:\WINNT\System32\DRIVERS\update.sys [MANUAL] Update Service C:\WINNT\System32\ups.exe [MANUAL] UPS Service C:\WINNT\System32\DRIVERS\usbehci.sys [MANUAL] usbehci Service C:\WINNT\System32\DRIVERS\usbhub.sys [MANUAL] usbhub Service C:\WINNT\System32\DRIVERS\usbhub20.sys [MANUAL] usbhub20 Service C:\WINNT\System32\UtilMan.exe [MANUAL] UtilMan Service C:\WINNT\System32\drivers\vga.sys [sYSTEM] VgaSave Service VxD Service C:\WINNT\System32\services.exe [MANUAL] W32Time Service W3SVC Service C:\WINNT\System32\DRIVERS\wanarp.sys [MANUAL] Wanarp Service C:\WINNT\system32\drivers\wdmaud.sys [MANUAL] wdmaud Service C:\WINNT\System32\WBEM\WinMgmt.exe [AUTO] WinMgmt Service [MANUAL] Winsock Service WinSock2 Service WinTrust Service C:\WINNT\system32\Services.exe [MANUAL] Wmi Service C:\WINNT\System32\drivers\ws2ifsl.sys [AUTO] WS2IFSL Service [AUTO] wscsvc Service C:\WINNT\System32\DRIVERS\WSTCODEC.SYS [MANUAL] WSTCODEC Service C:\WINNT\system32\svchost.exe [AUTO] wuauserv Service C:\WINNT\System32\DRIVERS\yukonw2k.sys [MANUAL] yukonw2k Service {DC8FFBB4-3F94-47A6-83E0-2D977AC4D398} ---- EOF - GMER 1.0.12 ----

Złączono Posta : 18.09.2007 (Wto) 19:18

Poklikałem trochę w nodzie “usuń plik”( a z 10 ich było)…

Złączono Posta : 18.09.2007 (Wto) 19:29

SDFix: Version 1.105 Run by outlet on Wt 2007-09-18 at 19:23 Microsoft Windows 2000 [Wersja 5.00.2195] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINNT No streams found. C:\WINNT\system32 No streams found. C:\WINNT\system32\svchost.exe No streams found. C:\WINNT\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Remaining Files: --------------- Files with Hidden Attributes: Finished!

[Gutek]

Powinno być już Ok