Help? (page 2) — What the Tech Forum Archive

Angelfire

Post #16April 7, 2007, 12:02 AM UTC last edited April 7, 2007, 12:09 AM UTC

Hi, looks like we have stubborn ones there.. don't worry we'll get them

*Open HijackThis > choose Scan Only > Place a checkmark in the boxes beside these entries in bold.

O4 - HKLM\..\Run: [Lexmark_X79-55] C:\WINDOWS\system32\lsasss.exe
O4 - HKLM\..\Run: [winctl] winctl.exe /install

Close your browsers and all open windows except for HijackThis, then click "Fix checked". Exit HijackThis.

*Using Windows Explorer, find and delete these files:

C:\WINDOWS\system32\lsasss.exe
C:\WINDOWS\system32\winctl.exe

*Using Windows Explorer, find and delete these folders

C:\Program Files\Messenger\bak
C:\WINDOWS\system32\bak
C:\Program Files\Common Files\Ahead\Lib\bak
C:\Program Files\Alwil Software\Avast4\bak
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak
C:\Program Files\Netropa\Multimedia Keyboard\bak
C:\Program Files\Zone Labs\ZoneAlarm\bak
C:\Program Files\Java\jre1.5.0_11\bin\bak

empty your recycle bin.

Reboot
_______________________

*Download Gmer

Disconnect from internet and close running programs.
There is a small chance this application may crash your computer so save any work you have open.
Double click gmer.exe
Let the gmer.sys driver load if asked.
If it gives you a warning at program start about rootkit activity and asks if you want to run scan…say Ok.
If no warning….
Click "Rootkit" tab and click "Scan"
Once done, click "Copy"
Open Notepad and hit "ctrl+v" to paste the log.
Reconnect to the internet and post the log back to this thread please.

*Run Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then start to download the latest Definition Files.
Once the Scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings.
In the Scan Settings, make that the following are selected:
o Scan using the following Anti-Virus database:
+ Extended (If available otherwise Standard)
o Scan Options:
+ Scan Archives
+ Scan Mail Bases
Click OK.
Now under select a target to scan select My Computer.
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
Save the file to your Desktop.

On your next reply, please include a fresh HijackThis log, gmer scan log and kaspersky scan log.

jennyg

Post #17April 7, 2007, 2:12 AM UTC

i had problems with these…..
C:\Program Files\Common Files\Ahead\Lib\bak—-wouldnt let me delete this

C:\WINDOWS\system32\lsasss.exe—–couldnt find
C:\WINDOWS\system32\winctl.exe—–couldnt find

Logfile of HijackThis v1.99.1
Scan saved at 10:07:36 PM, on 4/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Documents and Settings\chad1\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Belkin Wireless USB Utility.lnk = C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Gmer
GMER 1.0.12.12086 - http://www.gmer.net
Rootkit scan 2007-04-06 20:33:40
Windows 5.1.2600 Service Pack 2

—- System - GMER 1.0.12 —-

SSDT \SystemRoot\system32\drivers\core.sys ZwClose
SSDT \SystemRoot\system32\drivers\core.sys ZwCreateKey
SSDT a347bus.sys ZwCreatePagingFile
SSDT \SystemRoot\system32\drivers\core.sys ZwDeleteKey
SSDT \SystemRoot\system32\drivers\core.sys ZwDeleteValueKey
SSDT a347bus.sys ZwEnumerateKey
SSDT a347bus.sys ZwEnumerateValueKey
SSDT \SystemRoot\system32\drivers\core.sys ZwLoadKey
SSDT a347bus.sys ZwOpenFile
SSDT \SystemRoot\system32\drivers\core.sys ZwOpenKey
SSDT a347bus.sys ZwQueryKey
SSDT a347bus.sys ZwQueryValueKey
SSDT \SystemRoot\system32\drivers\core.sys ZwReplaceKey
SSDT \SystemRoot\system32\drivers\core.sys ZwRestoreKey
SSDT a347bus.sys ZwSetSystemPowerState
SSDT \SystemRoot\system32\drivers\core.sys ZwSetValueKey

—- Kernel code sections - GMER 1.0.12 —-

? C:\WINDOWS\system32\drivers\core.sys The process cannot access the file because it is being used by another process.

—- Devices - GMER 1.0.12 —-

Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 8237EFB0
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_READ 82026B40
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_NAMED_PIPE 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_INFORMATION 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_INFORMATION 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_EA 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_EA 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_VOLUME_INFORMATION 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_VOLUME_INFORMATION 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DIRECTORY_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FILE_SYSTEM_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_LOCK_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLEANUP 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_MAILSLOT 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_SECURITY 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_SECURITY 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CHANGE 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_QUOTA 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_QUOTA 81F60F00
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 81F60F00
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_READ 820917B0
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_NAMED_PIPE 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_INFORMATION 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_INFORMATION 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_EA 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_EA 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_VOLUME_INFORMATION 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_VOLUME_INFORMATION 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DIRECTORY_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FILE_SYSTEM_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_LOCK_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLEANUP 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_MAILSLOT 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_SECURITY 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_SECURITY 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CHANGE 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_QUOTA 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_QUOTA 81F60F00
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 81F60F00
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_NAMED_PIPE 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLOSE 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_READ 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_WRITE 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_EA 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_EA 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FLUSH_BUFFERS 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_VOLUME_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_VOLUME_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DIRECTORY_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FILE_SYSTEM_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SHUTDOWN 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_LOCK_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLEANUP 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_MAILSLOT 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_SECURITY 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_SECURITY 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_POWER 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SYSTEM_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CHANGE 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_QUOTA 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_QUOTA 81F73290
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_PNP 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CREATE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CREATE_NAMED_PIPE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CLOSE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_READ 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_WRITE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_EA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_EA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_FLUSH_BUFFERS 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_VOLUME_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_VOLUME_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_DIRECTORY_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_FILE_SYSTEM_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_DEVICE_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SHUTDOWN 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_LOCK_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CLEANUP 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CREATE_MAILSLOT 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_SECURITY 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_SECURITY 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_POWER 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SYSTEM_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_DEVICE_CHANGE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_QUOTA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_QUOTA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_PNP 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_NAMED_PIPE 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLOSE 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_READ 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_WRITE 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_EA 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_EA 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FLUSH_BUFFERS 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_VOLUME_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_VOLUME_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DIRECTORY_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FILE_SYSTEM_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SHUTDOWN 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_LOCK_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLEANUP 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_MAILSLOT 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_SECURITY 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_SECURITY 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_POWER 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SYSTEM_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CHANGE 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_QUOTA 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_QUOTA 81F73290
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_PNP 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CREATE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CREATE_NAMED_PIPE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CLOSE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_READ 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_WRITE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_EA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_EA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_FLUSH_BUFFERS 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_VOLUME_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_VOLUME_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_DIRECTORY_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_FILE_SYSTEM_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_DEVICE_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_INTERNAL_DEVICE_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SHUTDOWN 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_LOCK_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CLEANUP 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CREATE_MAILSLOT 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_SECURITY 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_SECURITY 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_POWER 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SYSTEM_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_DEVICE_CHANGE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_QUOTA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_QUOTA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_PNP 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_CREATE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_CREATE_NAMED_PIPE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_CLOSE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_READ 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_WRITE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_QUERY_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_SET_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_QUERY_EA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_SET_EA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_FLUSH_BUFFERS 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_QUERY_VOLUME_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_SET_VOLUME_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_DIRECTORY_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_FILE_SYSTEM_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_DEVICE_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_SHUTDOWN 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_LOCK_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_CLEANUP 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_CREATE_MAILSLOT 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_QUERY_SECURITY 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_SET_SECURITY 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_POWER 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_SYSTEM_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_DEVICE_CHANGE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_QUERY_QUOTA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_SET_QUOTA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_PNP 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_CREATE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_CREATE_NAMED_PIPE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_CLOSE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_READ 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_WRITE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_QUERY_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_SET_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_QUERY_EA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_SET_EA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_FLUSH_BUFFERS 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_QUERY_VOLUME_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_SET_VOLUME_INFORMATION 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_DIRECTORY_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_FILE_SYSTEM_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_DEVICE_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_SHUTDOWN 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_LOCK_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_CLEANUP 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_CREATE_MAILSLOT 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_QUERY_SECURITY 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_SET_SECURITY 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_POWER 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_SYSTEM_CONTROL 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_DEVICE_CHANGE 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_QUERY_QUOTA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_SET_QUOTA 81F73290
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_PNP 81F73290
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE_NAMED_PIPE 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLOSE 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_READ 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_WRITE 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_INFORMATION 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_INFORMATION 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_EA 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_EA 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FLUSH_BUFFERS 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_VOLUME_INFORMATION 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_VOLUME_INFORMATION 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DIRECTORY_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FILE_SYSTEM_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SHUTDOWN 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_LOCK_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLEANUP 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE_MAILSLOT 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_SECURITY 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_SECURITY 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_POWER 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SYSTEM_CONTROL 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CHANGE 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_QUOTA 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_QUOTA 81F60F00
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_PNP 81F60F00
Device \FileSystem\Srv \Device\LanmanServer IRP_MJ_READ 820006F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_READ 8208ED20
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_READ 8208ED20
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_READ 82170650
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_READ 82154678
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_CREATE 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_CREATE_NAMED_PIPE 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_CLOSE 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_READ 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_WRITE 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_QUERY_INFORMATION 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_SET_INFORMATION 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_QUERY_EA 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_SET_EA 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_FLUSH_BUFFERS 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_QUERY_VOLUME_INFORMATION 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_SET_VOLUME_INFORMATION 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_DIRECTORY_CONTROL 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_FILE_SYSTEM_CONTROL 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_SHUTDOWN 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_LOCK_CONTROL 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_CLEANUP 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_CREATE_MAILSLOT 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_QUERY_SECURITY 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_SET_SECURITY 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_POWER 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_DEVICE_CHANGE 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_QUERY_QUOTA 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_SET_QUOTA 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_PNP 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CREATE 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CREATE_NAMED_PIPE 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CLOSE 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_READ 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_WRITE 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_INFORMATION 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_INFORMATION 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_EA 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_EA 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_FLUSH_BUFFERS 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_VOLUME_INFORMATION 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_VOLUME_INFORMATION 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_DIRECTORY_CONTROL 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_FILE_SYSTEM_CONTROL 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_DEVICE_CONTROL 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_INTERNAL_DEVICE_CONTROL 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SHUTDOWN 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_LOCK_CONTROL 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CLEANUP 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CREATE_MAILSLOT 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_SECURITY 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_SECURITY 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_POWER 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SYSTEM_CONTROL 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_DEVICE_CHANGE 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_QUOTA 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_QUOTA 820EC470
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_PNP 820EC470
Device \FileSystem\Fastfat \Fat IRP_MJ_READ 82026B40
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer IRP_MJ_READ 820EB220
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer IRP_MJ_READ 820EB220
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer IRP_MJ_READ 820EB220
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer IRP_MJ_READ 820EB220
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer IRP_MJ_READ 820EB220
Device \FileSystem\Cdfs \Cdfs IRP_MJ_READ 821BFEE0

—- Modules - GMER 1.0.12 —-

Module _________ F8450000

—- EOF - GMER 1.0.12 —-

Kaspersky

Friday, April 06, 2007 10:05:56 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 7/04/2007
Kaspersky Anti-Virus database records: 292220

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\
F:\
G:\
H:\

Scan Statistics
Total number of scanned objects 59469
Number of viruses found 18
Number of infected objects 94
Number of suspicious objects 0
Duration of the scan process 01:21:10

Infected Object Name Virus Name Last Action
C:\Documents and Settings\chad1\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\chad1\DoctorWeb\Quarantine\A0029770.dll Infected: not-a-virus:AdWare.Win32.NewDotNet skipped

C:\Documents and Settings\chad1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\chad1\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\chad1\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\chad1\Local Settings\History\History.IE5\MSHist012007040620070407\index.dat Object is locked skipped

C:\Documents and Settings\chad1\Local Settings\Temp\~DFB978.tmp Object is locked skipped

C:\Documents and Settings\chad1\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\chad1\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\chad1\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped

C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped

C:\SDFix\SDFix\backups\backups.zip/backups/adirka.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped

C:\SDFix\SDFix\backups\backups.zip/backups/lcass.exe Infected: Trojan-Downloader.Win32.VB.att skipped

C:\SDFix\SDFix\backups\backups.zip/backups/ma.exe.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped

C:\SDFix\SDFix\backups\backups.zip/backups/pep.exe.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped

C:\SDFix\SDFix\backups\backups.zip/backups/stdrun1.exe/data0001 Infected: Trojan-Downloader.NSIS.Agent.ac skipped

C:\SDFix\SDFix\backups\backups.zip/backups/stdrun1.exe Infected: Trojan-Downloader.NSIS.Agent.ac skipped

C:\SDFix\SDFix\backups\backups.zip/backups/stdrun4.exe/data0002/stream/data0006 Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped

C:\SDFix\SDFix\backups\backups.zip/backups/stdrun4.exe/data0002/stream Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped

C:\SDFix\SDFix\backups\backups.zip/backups/stdrun4.exe/data0002 Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped

C:\SDFix\SDFix\backups\backups.zip/backups/stdrun4.exe/data0003 Infected: not-a-virus:AdWare.Win32.BookedSpace.h skipped

C:\SDFix\SDFix\backups\backups.zip/backups/stdrun4.exe Infected: not-a-virus:AdWare.Win32.BookedSpace.h skipped

C:\SDFix\SDFix\backups\backups.zip/backups/stdrun7.exe/data0002/stream/data0006 Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped

C:\SDFix\SDFix\backups\backups.zip/backups/stdrun7.exe/data0002/stream Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped

C:\SDFix\SDFix\backups\backups.zip/backups/stdrun7.exe/data0002 Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped

C:\SDFix\SDFix\backups\backups.zip/backups/stdrun7.exe/data0003 Infected: not-a-virus:AdWare.Win32.BookedSpace.h skipped

C:\SDFix\SDFix\backups\backups.zip/backups/stdrun7.exe Infected: not-a-virus:AdWare.Win32.BookedSpace.h skipped

C:\SDFix\SDFix\backups\backups.zip/backups/svhost.exe Infected: Trojan.Win32.Crypt.y skipped

C:\SDFix\SDFix\backups\backups.zip/backups/tmp12.tmp.exe Infected: Trojan-Downloader.Win32.Agent.bjk skipped

C:\SDFix\SDFix\backups\backups.zip/backups/tmp13.tmp.exe Infected: Trojan-Downloader.Win32.Agent.bjk skipped

C:\SDFix\SDFix\backups\backups.zip/backups/tmp17.tmp.exe Infected: Trojan-Downloader.Win32.Agent.bjk skipped

C:\SDFix\SDFix\backups\backups.zip/backups/tmp1C.tmp.exe Infected: Trojan-Downloader.Win32.Agent.bjk skipped

C:\SDFix\SDFix\backups\backups.zip/backups/tmp2.tmp.exe Infected: Trojan-Downloader.Win32.Agent.bjk skipped

C:\SDFix\SDFix\backups\backups.zip/backups/tmp25.tmp.exe Infected: Trojan-Downloader.Win32.Agent.bjk skipped

C:\SDFix\SDFix\backups\backups.zip/backups/tmp2E.tmp.exe Infected: Trojan-Downloader.Win32.Agent.bjk skipped

C:\SDFix\SDFix\backups\backups.zip/backups/tmp4A.tmp.exe Infected: Trojan-Downloader.Win32.Agent.bjk skipped

C:\SDFix\SDFix\backups\backups.zip/backups/tmp64.tmp.exe Infected: Trojan-Downloader.Win32.Agent.bjk skipped

C:\SDFix\SDFix\backups\backups.zip/backups/tmp8.tmp.exe Infected: Trojan-Downloader.Win32.Agent.bjk skipped

C:\SDFix\SDFix\backups\backups.zip/backups/tmpA.tmp.exe Infected: Trojan-Downloader.Win32.Agent.bjk skipped

C:\SDFix\SDFix\backups\backups.zip/backups/tmpD83.tmp.exe Infected: Trojan-Downloader.Win32.Agent.bjk skipped

C:\SDFix\SDFix\backups\backups.zip/backups/tmpD84.tmp.exe Infected: Trojan.Win32.Agent.agv skipped

C:\SDFix\SDFix\backups\backups.zip/backups/tmpD86.tmp.exe Infected: Trojan.Win32.Agent.agv skipped

C:\SDFix\SDFix\backups\backups.zip/backups/unsvchosts.exe Infected: Trojan.Win32.Small.mf skipped

C:\SDFix\SDFix\backups\backups.zip ZIP: infected - 32 skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP15\A0001875.dll Infected: Trojan.Win32.Agent.agv skipped

C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP21\A0004736.dll Infected: Trojan.Win32.Agent.agv skipped

C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP23\A0004833.dll Infected: Trojan.Win32.Agent.agv skipped

C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP24\A0006846.dll Infected: Trojan.Win32.Agent.agv skipped

C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP25\A0008846.dll

jennyg

Post #18April 7, 2007, 2:13 AM UTC

C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP28\A0014121.dll Infected: Trojan.Win32.Agent.agv skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP28\A0014122.dll Infected: Trojan.Win32.Agent.agv skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP28\A0015174.dll Infected: Trojan.Win32.Agent.agv skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP29\A0018228.dll Infected: Trojan.Win32.Agent.agv skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP29\A0018229.dll Infected: Trojan.Win32.Agent.agv skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP31\A0025341.dll Infected: Trojan.Win32.Agent.agv skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP31\A0025342.dll Infected: Trojan.Win32.Agent.agv skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP32\A0026356.dll Infected: Trojan.Win32.Agent.agv skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP32\A0027356.dll Infected: Trojan.Win32.Agent.agv skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028556.exe Infected: Trojan.Win32.Crypt.y skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028557.exe Infected: Trojan-Downloader.Win32.VB.att skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028569.exe Infected: Trojan.Win32.Small.mf skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028584.exe Infected: Trojan-Downloader.Win32.VB.att skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028597.exe/data0001 Infected: Trojan-Downloader.NSIS.Agent.ac skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028597.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028603.exe/data0002/stream/data0006 Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028603.exe/data0002/stream Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028603.exe/data0002 Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028603.exe/data0003 Infected: not-a-virus:AdWare.Win32.BookedSpace.h skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028603.exe NSIS: infected - 4 skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028606.exe/data0002/stream/data0006 Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028606.exe/data0002/stream Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028606.exe/data0002 Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028606.exe/data0003 Infected: not-a-virus:AdWare.Win32.BookedSpace.h skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028606.exe NSIS: infected - 4 skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028607.exe/data0002/stream/data0006 Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028607.exe/data0002/stream Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028607.exe/data0002 Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028607.exe/data0003 Infected: not-a-virus:AdWare.Win32.BookedSpace.h skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028607.exe NSIS: infected - 4 skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028610.exe Infected: Trojan.Win32.Crypt.y skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0028646.exe Infected: Trojan.Win32.Small.mf skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0029780.dll Infected: Trojan.Win32.Agent.agv skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0029781.exe Infected: Trojan-Downloader.Win32.Agent.es skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0029791.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0029792.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0029793.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0029797.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\A0029798.exe Infected: Email-Worm.Win32.Zhelatin.cl skipped C:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\funnies.exe/stream/data0006 Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped C:\WINDOWS\funnies.exe/stream Infected: not-a-virus:AdWare.Win32.Softomate.ai skipped C:\WINDOWS\funnies.exe NSIS: infected - 2 skipped C:\WINDOWS\gedeeb.dll Infected: Trojan.Win32.Agent.agv skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\bund1\ClientBundle1.exe/data0002 Infected: not-a-virus:AdWare.Win32.NewDotNet skipped C:\WINDOWS\system32\bund1\ClientBundle1.exe/data0005 Infected: not-a-virus:AdWare.Win32.SurfSide.ax skipped C:\WINDOWS\system32\bund1\ClientBundle1.exe/data0006/unknown2.bin Infected: not-a-virus:AdWare.Win32.Ucmore.e skipped C:\WINDOWS\system32\bund1\ClientBundle1.exe/data0006/UCMTSAIE.DLL Infected: not-a-virus:AdWare.Win32.Ucmore.a skipped C:\WINDOWS\system32\bund1\ClientBundle1.exe/data0006/IUCMORE.DLL Infected: not-a-virus:AdWare.Win32.Ucmore skipped C:\WINDOWS\system32\bund1\ClientBundle1.exe/data0006 Infected: not-a-virus:AdWare.Win32.Ucmore skipped C:\WINDOWS\system32\bund1\ClientBundle1.exe NSIS: infected - 6 skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\cscentfy.dll Infected: Trojan.Win32.Small.md skipped C:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped C:\WINDOWS\system32\drivers\core.cache.dsk Object is locked skipped C:\WINDOWS\system32\drivers\core.sys Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_668.dat Object is locked skipped C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\WINDOWS\wvwvwx.dll Infected: Trojan.Win32.Agent.agv skipped D:\Programs\mIRC6.12Invision2.0.rar/mIRC6.12Invision2.0/mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.612 skipped D:\Programs\mIRC6.12Invision2.0.rar RAR: infected - 1 skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped D:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\change.log Object is locked skipped G:\System Volume Information\_restore{EA372515-CBAD-4C88-8FD4-199CE8FC42A0}\RP33\change.log Object is locked skipped Scan process completed.

Angelfire

Post #19April 7, 2007, 2:09 PM UTC last edited April 7, 2007, 2:10 PM UTC

*Reboot to safe mode

*Open notepad.
Copy and paste the text inside the Code Box below into Notepad
Choose File > Save As and under "Save as type", choose "All Files".
Type gmer.bat in the File name and save it to your desktop.

gmer.exe -del file "C:\WINDOWS\system32\drivers\core.sys"
gmer.exe -del file "C:\WINDOWS\funnies.exe"
gmer.exe -del file "C:\WINDOWS\gedeeb.dll"
gmer.exe -del file "C:\WINDOWS\system32\cscentfy.dll "
gmer.exe -del file "C:\WINDOWS\wvwvwx.dll"

Locate gmer.bat on your Desktop and double-click on it.

*Please empty all the contents of this folder:

C:\Documents and Settings\chad1\DoctorWeb\Quarantine

*Delete the following folders:

C:\WINDOWS\system32\bund1
C:\Program Files\Common Files\Ahead\Lib\bak

Empty your recycle bin.

Reboot to normal mode then run a new GMER scan again.

On your next reply, please include a fresh HijackThis log, GMER scan log and description n how's your machine running.

jennyg

Post #20April 7, 2007, 4:39 PM UTC

it said it couldnt delete this…
gmer.exe -del file "C:\WINDOWS\system32\cscentfy.dll

GMER 1.0.12.12086 - http://www.gmer.net
Rootkit scan 2007-04-07 12:35:48
Windows 5.1.2600 Service Pack 2

—- System - GMER 1.0.12 —-

SSDT a347bus.sys ZwClose
SSDT a347bus.sys ZwCreateKey
SSDT a347bus.sys ZwCreatePagingFile
SSDT a347bus.sys ZwEnumerateKey
SSDT a347bus.sys ZwEnumerateValueKey
SSDT a347bus.sys ZwOpenFile
SSDT a347bus.sys ZwOpenKey
SSDT a347bus.sys ZwQueryKey
SSDT a347bus.sys ZwQueryValueKey
SSDT a347bus.sys ZwSetSystemPowerState

—- Devices - GMER 1.0.12 —-

Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 822882B0
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_READ 823D2718
Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_READ 8204F890
Device \FileSystem\Udfs \UdfsDisk IRP_MJ_READ 8204F890
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_NAMED_PIPE 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_INFORMATION 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_INFORMATION 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_EA 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_EA 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_VOLUME_INFORMATION 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_VOLUME_INFORMATION 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DIRECTORY_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FILE_SYSTEM_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_LOCK_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLEANUP 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_MAILSLOT 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_SECURITY 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_SECURITY 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CHANGE 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_QUOTA 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_QUOTA 82066008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 82066008
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_READ 8205BC28
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_NAMED_PIPE 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_INFORMATION 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_INFORMATION 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_EA 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_EA 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_VOLUME_INFORMATION 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_VOLUME_INFORMATION 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DIRECTORY_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FILE_SYSTEM_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_LOCK_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLEANUP 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_MAILSLOT 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_SECURITY 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_SECURITY 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CHANGE 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_QUOTA 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_QUOTA 82066008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 82066008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_NAMED_PIPE 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLOSE 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_READ 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_WRITE 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_EA 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_EA 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FLUSH_BUFFERS 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_VOLUME_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_VOLUME_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DIRECTORY_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FILE_SYSTEM_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SHUTDOWN 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_LOCK_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLEANUP 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_MAILSLOT 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_SECURITY 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_SECURITY 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_POWER 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SYSTEM_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CHANGE 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_QUOTA 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_QUOTA 82187008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_PNP 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CREATE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CREATE_NAMED_PIPE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CLOSE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_READ 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_WRITE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_EA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_EA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_FLUSH_BUFFERS 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_VOLUME_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_VOLUME_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_DIRECTORY_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_FILE_SYSTEM_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_DEVICE_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_INTERNAL_DEVICE_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SHUTDOWN 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_LOCK_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CLEANUP 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CREATE_MAILSLOT 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_SECURITY 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_SECURITY 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_POWER 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SYSTEM_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_DEVICE_CHANGE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_QUOTA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_QUOTA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_PNP 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_NAMED_PIPE 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLOSE 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_READ 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_WRITE 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_EA 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_EA 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FLUSH_BUFFERS 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_VOLUME_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_VOLUME_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DIRECTORY_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FILE_SYSTEM_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SHUTDOWN 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_LOCK_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLEANUP 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_MAILSLOT 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_SECURITY 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_SECURITY 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_POWER 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SYSTEM_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CHANGE 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_QUOTA 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_QUOTA 82187008
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_PNP 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CREATE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CREATE_NAMED_PIPE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CLOSE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_READ 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_WRITE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_EA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_EA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_FLUSH_BUFFERS 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_VOLUME_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_VOLUME_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_DIRECTORY_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_FILE_SYSTEM_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_DEVICE_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_INTERNAL_DEVICE_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SHUTDOWN 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_LOCK_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CLEANUP 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CREATE_MAILSLOT 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_SECURITY 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_SECURITY 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_POWER 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SYSTEM_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_DEVICE_CHANGE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_QUOTA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_QUOTA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_PNP 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_CREATE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_CREATE_NAMED_PIPE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_CLOSE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_READ 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_WRITE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_QUERY_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_SET_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_QUERY_EA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_SET_EA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_FLUSH_BUFFERS 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_QUERY_VOLUME_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_SET_VOLUME_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_DIRECTORY_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_FILE_SYSTEM_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_DEVICE_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_INTERNAL_DEVICE_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_SHUTDOWN 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_LOCK_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_CLEANUP 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_CREATE_MAILSLOT 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_QUERY_SECURITY 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_SET_SECURITY 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_POWER 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_SYSTEM_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_DEVICE_CHANGE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_QUERY_QUOTA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_SET_QUOTA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-18 IRP_MJ_PNP 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_CREATE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_CREATE_NAMED_PIPE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_CLOSE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_READ 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_WRITE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_QUERY_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_SET_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_QUERY_EA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_SET_EA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_FLUSH_BUFFERS 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_QUERY_VOLUME_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_SET_VOLUME_INFORMATION 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_DIRECTORY_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_FILE_SYSTEM_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_DEVICE_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_INTERNAL_DEVICE_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_SHUTDOWN 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_LOCK_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_CLEANUP 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_CREATE_MAILSLOT 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_QUERY_SECURITY 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_SET_SECURITY 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_POWER 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_SYSTEM_CONTROL 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_DEVICE_CHANGE 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_QUERY_QUOTA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_SET_QUOTA 82187008
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-20 IRP_MJ_PNP 82187008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE_NAMED_PIPE 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLOSE 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_READ 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_WRITE 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_INFORMATION 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_INFORMATION 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_EA 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_EA 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FLUSH_BUFFERS 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_VOLUME_INFORMATION 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_VOLUME_INFORMATION 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DIRECTORY_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FILE_SYSTEM_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_INTERNAL_DEVICE_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SHUTDOWN 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_LOCK_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLEANUP 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE_MAILSLOT 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_SECURITY 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_SECURITY 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_POWER 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SYSTEM_CONTROL 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CHANGE 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_QUOTA 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_QUOTA 82066008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_PNP 82066008
Device \FileSystem\Srv \Device\LanmanServer IRP_MJ_READ 81DB81B0
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_READ 8215B3C0
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_READ 8215B3C0
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_READ 820B85A0
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_READ 8206C1A0
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_CREATE 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_CREATE_NAMED_PIPE 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_CLOSE 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_READ 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_WRITE 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_QUERY_INFORMATION 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_SET_INFORMATION 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_QUERY_EA 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_SET_EA 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_FLUSH_BUFFERS 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_QUERY_VOLUME_INFORMATION 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_SET_VOLUME_INFORMATION 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_DIRECTORY_CONTROL 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_FILE_SYSTEM_CONTROL 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_SHUTDOWN 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_LOCK_CONTROL 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_CLEANUP 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_CREATE_MAILSLOT 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_QUERY_SECURITY 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_SET_SECURITY 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_POWER 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_DEVICE_CHANGE 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_QUERY_QUOTA 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_SET_QUOTA 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port2Path0Target0Lun0 IRP_MJ_PNP 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CREATE 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CREATE_NAMED_PIPE 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CLOSE 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_READ 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_WRITE 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_INFORMATION 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_INFORMATION 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_EA 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_EA 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_FLUSH_BUFFERS 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_VOLUME_INFORMATION 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_VOLUME_INFORMATION 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_DIRECTORY_CONTROL 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_FILE_SYSTEM_CONTROL 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_DEVICE_CONTROL 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_INTERNAL_DEVICE_CONTROL 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SHUTDOWN 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_LOCK_CONTROL 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CLEANUP 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CREATE_MAILSLOT 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_SECURITY 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_SECURITY 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_POWER 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SYSTEM_CONTROL 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_DEVICE_CHANGE 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_QUOTA 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_QUOTA 820B03F8
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_PNP 820B03F8
Device \FileSystem\Fastfat \Fat IRP_MJ_READ 823D2718
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer IRP_MJ_READ 8202E578
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer IRP_MJ_READ 8202E578
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer IRP_MJ_READ 8202E578
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer IRP_MJ_READ 8202E578
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer IRP_MJ_READ 8202E578
Device \FileSystem\Cdfs \Cdfs IRP_MJ_READ 82167968

—- Modules - GMER 1.0.12 —-

Module _________ F8450000

—- EOF - GMER 1.0.12 —-

Logfile of HijackThis v1.99.1
Scan saved at 12:36:05 PM, on 4/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\chad1\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Belkin Wireless USB Utility.lnk = C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

right now the pc seems to be running ok

Angelfire

Post #21April 8, 2007, 2:23 AM UTC

Click start > run > copy and paste the following command in the box:

gmer.exe -del file "C:\WINDOWS\system32\cscentfy.dll"

Reboot.
__________

*Your Java is out of date….
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components.

Click Start > Control Panel
Click Add/Remove Programs
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove button.
Repeat as many times as necessary to remove all versions of Java.
Reboot your computer once all Java components are removed.

Then download Java Runtime Environment 6u1, and install it to your computer.

Reboot, post a fresh HijackThis log and tell me if gmer still gave the same error.

jennyg

Post #22April 9, 2007, 12:08 AM UTC

Logfile of HijackThis v1.99.1
Scan saved at 8:04:30 PM, on 4/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Documents and Settings\chad1\Desktop\hijackthis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Belkin Wireless USB Utility.lnk = C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

i looked and couldnt find the file so i guess it worked alright. now the programs and that i installed and all that is it ok if i remove them and all the other stuff?

Angelfire

Post #23April 9, 2007, 4:56 AM UTC

i looked and couldnt find the file so i guess it worked alright. now the programs and that i installed and all that is it ok if i remove them and all the other stuff?

Yup, it's ok now

Congratulations! Your log looks clean!

Configure Windows Xp to hide system files:

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading, select Do not show hidden files and folders.
Check the Hide protected operating system files option.
Click Yes to confirm.
Click OK.

_______________________
This is a good time to clear your existing system restore points and establish a new clean restore point:

Go to Start > All Programs > Accessories > System Tools > System Restore
Select Create a restore point, and Ok it.
Next, go to Start > Run and type in cleanmgr
Select the More options tab
Choose the option to clean up system restore and OK it.

This will remove all restore points except the new one you just created.

______________________
Here are some free programs I recommend that could help you improve your pc's security.

Firewall Application - Although Windows Xp comes with a firewall, you should not rely on it because the Windows Firewall can only filter incoming data; outgoing traffic is not controlled, meaning that malware/viruses that are present in your computer can access the internet with no restrictions. There are several other Firewall that can protect you better by filtering incoming and outgoing data. Make sure you get only one of these.

» ZoneAlarm
» Kerio

Install SpyWare Blaster
~You can download it from here
~You can read the tutorial on how to use Spyware Blaster here

Install WinPatrol
~You can download it from here
~You can get some information about how WinPatrol works here

IESpyAds
~You can download it from here
~If you want to know how IEspyads work you can take a look at it here
~Please note that IESpyAds only works with Internet Explorer.

Note: Make sure you update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"

Happy safe surfing!

jennyg

Post #24April 9, 2007, 12:56 PM UTC

thank you very very much!

Angelfire

Post #25April 9, 2007, 5:05 PM UTC

Hi,

One of the infections you had was quite new but recently, some experts at other antimalware forums have looked into the infection a little and they discovered that C:\WINDOWS\system32\drivers\core.cache.dsk is part of the same infection.

So, I want you to please delete C:\WINDOWS\system32\drivers\core.cache.dsk

Cheers

LDTate

Post #26April 16, 2007, 4:30 PM UTC

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Help?

✨ Ask AI

Ask AI