problem z komputerem - pozostałości po wirusach?

**Posty:** 115 · przez **EncorE** 12 Lis 2006, 00:22

Witam!

Mam następujący problem : otóż kilka dni temu moj tata "raczył" sciagnąc na kompa jakies wirusy,robaki itp. w kazdym folderze w którym znajdowaly sie pliki exe znajdowały się też ukryte pliki z rozszerzeniem ".t". Nie moglem niczego uruchomić, ani zadnego anty-wira ani programu antispyware. Na tapecie pojawil sie napis w stylu Your computer is infected.Przeistalowalem Windowsa XP i okazalo się że to w sumie nic nie dało :wow:

nie moglem nic zainstalować, nawet sterowników do płyty głownej! Proby instalacji Win Millenium czy 98 tez nic nie daly bo po zbootowaniu plyty pojawial sie jakiś błąd cd-romu :roll:

zainstalowałem więc XP na drugą partycję, którą wcześniej sformatowałem. Później probowałem sformatować partycję C:, na ktorej wczesniej byl zainstalowany Windows, ale pojawiał się napis ze system nie mógł dokończyć formatowania. Niby wszystko jest dobrze, wszystko sie instaluje ale komputer chodzi bardzo wolno! Często sie zawiesza na kilka sekund, programy instalują się bardzo długo. Mam zainstalowane SP2 i Kaspersky Anti Virus 6.0. Czesto defragmentuje dysk, czyszczę rejestr ale komputer zamula

Obawiam się, że to jakieś pozostałości po tych wirusach.

Oto log z Hijackthis:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 22:42:09, on 2006-11-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe D:\Program Files\Executive Software\DiskeeperLite\DKService.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe D:\WINDOWS\system32\WgaTray.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\system32\RunDll32.exe D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe D:\PROGRA~1\NEOSTR~1\CnxMon.exe D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe D:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe D:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe D:\Program Files\Neostrada TP\NeostradaTP.exe D:\Program Files\Neostrada TP\ComComp.exe D:\Program Files\Neostrada TP\Watch.exe D:\Program Files\Winamp\Winamp.exe D:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe C:\Program Files\DAP\DAP.EXE D:\Program Files\Mozilla Firefox\firefox.exe D:\WINDOWS\System32\svchost.exe D:\Documents and Settings\@dmin\Pulpit\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - D:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [WooCnxMon] D:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] D:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] D:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Ochrona WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll O17 - HKLM\System\CCS\Services\Tcpip\..\{D9A72331-6BA0-46A0-9557-7D7B62AFD6D3}: NameServer = 194.204.152.34 217.98.63.164 O20 - Winlogon Notify: klogon - D:\WINDOWS\system32\klogon.dll O20 - Winlogon Notify: WgaLogon - D:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing) O23 - Service: Diskeeper - Executive Software International, Inc. - D:\Program Files\Executive Software\DiskeeperLite\DKService.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

**Posty:** 8694 · przez **Red** 12 Lis 2006, 00:24

Proszę dołaczyć jeszcze jeden log z silent runners:

http://wiruskill.pl/forum/viewtopic.php?t=80

Autor postu otrzymał pochwałę

**Posty:** 115 · przez **EncorE** 12 Lis 2006, 00:29

Proszę, oto log:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 49, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "D:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "ATIPTA" = "D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."] "WooCnxMon" = "D:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string] "SpeedTouch USB Diagnostics" = ""D:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"] "WOOWATCH" = "D:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"] "WOOTASKBARICON" = "D:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"] "kav" = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"" ["Kaspersky Lab"] "(Default)" = "(empty string)" [file not found] "NeroFilterCheck" = "D:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "SunJavaUpdateSched" = "D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "D:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Ochrona WWW" -> {HKLM...CLSID} = "Ochrona WWW" \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll" ["Kaspersky Lab"] "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = ""D:\Program Files\OpenOffice.org 2.0.3\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = ""D:\Program Files\OpenOffice.org 2.0.3\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = ""D:\Program Files\OpenOffice.org 2.0.3\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer" -> {HKCU...CLSID} = (no title provided) \InProcServer32\(Default) = ""D:\Program Files\OpenOffice.org 2.0.3\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "c:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] <<!>> klogon\DLLName = "D:\WINDOWS\system32\klogon.dll" ["Kaspersky Lab"] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ DAP_ShredMenu\(Default) = "{BED4C38B-F765-45AC-8C56-613F76BBF43E}" -> {HKLM...CLSID} = "DAPMenuShellExt Class" \InProcServer32\(Default) = "C:\PROGRA~1\DAP\PRIVAC~1\DAPCTX~1.DLL" ["Speedbit Ltd."] Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "c:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ DAP_ShredMenu\(Default) = "{BED4C38B-F765-45AC-8C56-613F76BBF43E}" -> {HKLM...CLSID} = "DAPMenuShellExt Class" \InProcServer32\(Default) = "C:\PROGRA~1\DAP\PRIVAC~1\DAPCTX~1.DLL" ["Speedbit Ltd."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "c:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "c:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\(Default) = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "D:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\(Default) = "ToolBand Class" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "D:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\(Default) = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "D:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}\(Default) = "Ochrona WWW" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll" ["Kaspersky Lab"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in" \InProcServer32\(Default) = "D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_06" \InProcServer32\(Default) = "D:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."] {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\ "ButtonText" = "Ochrona WWW" Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided) -> {HKLM...CLSID} = "Search Class" \InProcServer32\(Default) = "D:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Diskeeper, Diskeeper, ""D:\Program Files\Executive Software\DiskeeperLite\DKService.exe"" ["Executive Software International, Inc."] Kaspersky Anti-Virus 6.0, AVP, ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r" ["Kaspersky Lab"] StarWind iSCSI Service, StarWindService, "D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] Windows User Mode Driver Framework, UMWdf, "D:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Canon BJ Language Monitor i250\Driver = "CNMLM50.DLL" ["CANON INC."] ---------- <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 67 seconds, including 14 seconds for message boxes)

**Posty:** 935 · przez **Aqui** 12 Lis 2006, 00:31

Czysto..

Autor postu otrzymał pochwałę

**Posty:** 115 · przez **EncorE** 12 Lis 2006, 00:41

hmmm...co w takim razie jest grane z moim komputerem...

**Posty:** 8694 · przez **Red** 12 Lis 2006, 00:48

To ty nam powiedz co cie niepokoi,co jest nie tak z kompem???Jakies skreny,dowody na obecnosc smieci??

Autor postu otrzymał pochwałę

**Posty:** 115 · przez **EncorE** 12 Lis 2006, 01:01

Komp od samej instalacji Windowsa strasznie muli...Zaraz po zainstalowaniu Windy i Kaspersky'ego ten wykrył mi 44 wirusy...a dyski formatowałem. Usunąłem wszystkie wirusy które wykrył KAV, ale coś jest nie tak. Tych wirusów bylo pelno, a najczesciej sie powtarzaly nazwy typu Email-Worm.Win32.Luder.a lub Email-Worm.Win32.glowa.d, byly tez rozne trojany itp.

**Posty:** 8694 · przez **Red** 12 Lis 2006, 01:04

hie hie podeslij log z gmer:

http://wiruskill.pl/forum/viewtopic.php?t=53

W zakładce Rootkit >>>masz miec zaznaczone wszystko do skanu oprocz> Pokazuj wszystko.Nastepnie >>> Szukaj >>> Kopiuj >>> Ctr + V do posta.

Autor postu otrzymał pochwałę

**Posty:** 115 · przez **EncorE** 12 Lis 2006, 01:43

Cóż, po skończeniu przeszukiwania prze program Gmer komputer sam mi sie zresetował! A podczas drugiego skanowania pojawił się komunikat: "Przeszukiwanie nie zostało ukończone". Wrzuce ten niedokonczony log:

Kod: Zaznacz wszystko: GMER 1.0.12.11889 - http://www.gmer.net Rootkit scan 2006-11-12 00:14:08 Windows 5.1.2600 Dodatek Service Pack 2 ---- System - GMER 1.0.12 ---- SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwClose SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwCreateKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwCreateProcess SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwCreateProcessEx SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwCreateSection SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwCreateSymbolicLinkObject SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwCreateThread SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwDeleteKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwDeleteValueKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwDuplicateObject SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwEnumerateKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwEnumerateValueKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwFlushKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwInitializeRegistry SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwLoadKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwLoadKey2 SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwNotifyChangeKey SSDT kl1.sys ZwOpenFile SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwOpenKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwOpenProcess SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwOpenSection SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwQueryKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwQueryMultipleValueKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwQuerySystemInformation SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwQueryValueKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwReplaceKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwRestoreKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwResumeThread SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwSaveKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwSetContextThread SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwSetInformationFile SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwSetInformationKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwSetInformationProcess SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwSetValueKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwSuspendThread SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwTerminateProcess SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwUnloadKey SSDT \??\D:\WINDOWS\system32\drivers\klif.sys ZwWriteVirtualMemory SSDT \??\D:\WINDOWS\system32\drivers\klif.sys SSDT[284] SSDT \??\D:\WINDOWS\system32\drivers\klif.sys SSDT[285] SSDT \??\D:\WINDOWS\system32\drivers\klif.sys SSDT[286] SSDT \??\D:\WINDOWS\system32\drivers\klif.sys SSDT[287] SSDT \??\D:\WINDOWS\system32\drivers\klif.sys SSDT[288] SSDT \??\D:\WINDOWS\system32\drivers\klif.sys SSDT[289] SSDT \??\D:\WINDOWS\system32\drivers\klif.sys SSDT[290] SSDT \??\D:\WINDOWS\system32\drivers\klif.sys SSDT[291] SSDT \??\D:\WINDOWS\system32\drivers\klif.sys SSDT[292] SSDT \??\D:\WINDOWS\system32\drivers\klif.sys SSDT[293] SSDT \??\D:\WINDOWS\system32\drivers\klif.sys SSDT[294] SSDT \??\D:\WINDOWS\system32\drivers\klif.sys SSDT[295] SSDT \??\D:\WINDOWS\system32\drivers\klif.sys SSDT[296] Code \??\D:\WINDOWS\system32\drivers\klif.sys FsRtlCheckLockForReadAccess Code \??\D:\WINDOWS\system32\drivers\klif.sys IoIsOperationSynchronous ---- Kernel code sections - GMER 1.0.12 ---- .text ntoskrnl.exe!KiDispatchInterrupt + BA 804DB92E 7 Bytes JMP B2E4EE10 \??\D:\WINDOWS\system32\drivers\klif.sys .text ntoskrnl.exe!IoIsOperationSynchronous 804E8752 5 Bytes JMP B2E4CB50 \??\D:\WINDOWS\system32\drivers\klif.sys .text ntoskrnl.exe!FsRtlCheckLockForReadAccess 804FBE09 5 Bytes JMP B2E4C6C0 \??\D:\WINDOWS\system32\drivers\klif.sys .text USBPORT.SYS!DllUnload F6C5562C 5 Bytes JMP 82D481B8 .text USBPORT.SYS!DllUnload F6C5562C 5 Bytes JMP 82D481B8 ---- User code sections - GMER 1.0.12 ---- .text D:\WINDOWS\system32\WgaTray.exe[616] WININET.dll!InternetErrorDlg 7721C2ED 5 Bytes JMP 01012136 D:\WINDOWS\system32\WgaTray.exe .text D:\WINDOWS\system32\WgaTray.exe[616] WININET.dll!InternetErrorDlg 7721C2ED 5 Bytes JMP 01012136 D:\WINDOWS\system32\WgaTray.exe ---- Devices - GMER 1.0.12 ---- Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [805031BE] ntoskrnl.exe Device \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [805031BE] ntoskrnl.exe Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [805031BE] ntoskrnl.exe Device \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [805031BE] ntoskrnl.exe Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [805031BE] ntoskrnl.exe Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA 82FD61D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_PNP 82FD61D8 Device \FileSystem\Ntfs \Ntfs MdlReadComplete [8052B470] ntoskrnl.exe Device \FileSystem\Ntfs \Ntfs MdlWriteComplete [806109FF] ntoskrnl.exe Device \Driver\NetBT \Device\NetBT_Tcpip_{E471DAD1-2072-4444-8EB7-B33019989FAA} IRP_MJ_CREATE 82CC7980 Device \Driver\NetBT \Device\NetBT_Tcpip_{E471DAD1-2072-4444-8EB7-B33019989FAA} IRP_MJ_CLOSE 82CC7980 Device \Driver\NetBT \Device\NetBT_Tcpip_{E471DAD1-2072-4444-8EB7-B33019989FAA} IRP_MJ_DEVICE_CONTROL 82CC7980 Device \Driver\NetBT \Device\NetBT_Tcpip_{E471DAD1-2072-4444-8EB7-B33019989FAA} IRP_MJ_INTERNAL_DEVICE_CONTROL 82CC7980 Device \Driver\NetBT \Device\NetBT_Tcpip_{E471DAD1-2072-4444-8EB7-B33019989FAA} IRP_MJ_CLEANUP 82CC7980 Device \Driver\NetBT \Device\NetBT_Tcpip_{E471DAD1-2072-4444-8EB7-B33019989FAA} IRP_MJ_PNP 82CC7980 ---- Threads - GMER 1.0.12 ---- Thread 4:168 82DC7950 Thread 4:172 82DA7C60 Thread 4:176 82DA7C60 ---- Devices - GMER 1.0.12 ---- Device \Driver\00000047 \Device\00000043 IRP_MJ_POWER [F7446C7E] sptd.sys Device \Driver\00000047 \Device\00000043 IRP_MJ_SYSTEM_CONTROL [F74602A2] sptd.sys Device \Driver\00000047 \Device\00000043 IRP_MJ_PNP [F7461228] sptd.sys Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_CREATE 82D471D8 Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_CLOSE 82D471D8 Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_DEVICE_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_POWER 82D471D8 Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_SYSTEM_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_PNP 82D471D8 Device \Driver\00000047 \Device\00000044 IRP_MJ_POWER [F7446C7E] sptd.sys Device \Driver\00000047 \Device\00000044 IRP_MJ_SYSTEM_CONTROL [F74602A2] sptd.sys Device \Driver\00000047 \Device\00000044 IRP_MJ_PNP [F7461228] sptd.sys Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CREATE 82F671D8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CLOSE 82F671D8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_READ 82F671D8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_WRITE 82F671D8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_FLUSH_BUFFERS 82F671D8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_DEVICE_CONTROL 82F671D8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_INTERNAL_DEVICE_CONTROL 82F671D8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SHUTDOWN 82F671D8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_POWER 82F671D8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SYSTEM_CONTROL 82F671D8 Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_PNP 82F671D8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CREATE 82F671D8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CLOSE 82F671D8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_READ 82F671D8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_WRITE 82F671D8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_FLUSH_BUFFERS 82F671D8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_DEVICE_CONTROL 82F671D8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_INTERNAL_DEVICE_CONTROL 82F671D8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_SHUTDOWN 82F671D8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_POWER 82F671D8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_SYSTEM_CONTROL 82F671D8 Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_PNP 82F671D8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CREATE 82F671D8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CLOSE 82F671D8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_READ 82F671D8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_WRITE 82F671D8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_FLUSH_BUFFERS 82F671D8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_DEVICE_CONTROL 82F671D8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_INTERNAL_DEVICE_CONTROL 82F671D8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_SHUTDOWN 82F671D8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_POWER 82F671D8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_SYSTEM_CONTROL 82F671D8 Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_PNP 82F671D8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CREATE 82F671D8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CLOSE 82F671D8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_READ 82F671D8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_WRITE 82F671D8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_FLUSH_BUFFERS 82F671D8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_DEVICE_CONTROL 82F671D8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_INTERNAL_DEVICE_CONTROL 82F671D8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_SHUTDOWN 82F671D8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_POWER 82F671D8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_SYSTEM_CONTROL 82F671D8 Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_PNP 82F671D8 Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_CREATE 82D471D8 Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_CLOSE 82D471D8 Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_DEVICE_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_POWER 82D471D8 Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_SYSTEM_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_PNP 82D471D8 Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_CREATE 82D471D8 Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_CLOSE 82D471D8 Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_DEVICE_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_INTERNAL_DEVICE_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_POWER 82D471D8 Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_SYSTEM_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_PNP 82D471D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_READ 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_WRITE 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_FLUSH_BUFFERS 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_DEVICE_CONTROL 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SHUTDOWN 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CLEANUP 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_POWER 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SYSTEM_CONTROL 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_PNP 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CREATE 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_READ 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_WRITE 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_FLUSH_BUFFERS 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_DEVICE_CONTROL 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_INTERNAL_DEVICE_CONTROL 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SHUTDOWN 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CLEANUP 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_POWER 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SYSTEM_CONTROL 82FD81D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_PNP 82FD81D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 82D251D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 82D251D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 82D251D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 82D251D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 82D251D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 82D251D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82D251D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 82D251D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 82D251D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 82D251D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 82D251D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 82D251D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 82D251D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 82D251D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 82D251D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 82D251D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 82D251D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82D251D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 82D251D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 82D251D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 82D251D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 82D251D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_CREATE 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_CLOSE 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_DEVICE_CONTROL 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_INTERNAL_DEVICE_CONTROL 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_POWER 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_SYSTEM_CONTROL 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 IRP_MJ_PNP 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CLOSE 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DEVICE_CONTROL 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_INTERNAL_DEVICE_CONTROL 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_POWER 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SYSTEM_CONTROL 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_PNP 82FD71D8 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE 82FD71D8 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLOSE 82FD71D8 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CONTROL 82FD71D8 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82FD71D8 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_POWER 82FD71D8 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SYSTEM_CONTROL 82FD71D8 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_PNP 82FD71D8 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE 82FD71D8 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLOSE 82FD71D8 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CONTROL 82FD71D8 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82FD71D8 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_POWER 82FD71D8 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SYSTEM_CONTROL 82FD71D8 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_PNP 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_CREATE 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_CLOSE 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_DEVICE_CONTROL 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_INTERNAL_DEVICE_CONTROL 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_POWER 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_SYSTEM_CONTROL 82FD71D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f IRP_MJ_PNP 82FD71D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE 82D251D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLOSE 82D251D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_READ 82D251D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_WRITE 82D251D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FLUSH_BUFFERS 82D251D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CONTROL 82D251D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_INTERNAL_DEVICE_CONTROL 82D251D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SHUTDOWN 82D251D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_POWER 82D251D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SYSTEM_CONTROL 82D251D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_PNP 82D251D8 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CREATE 82CC7980 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLOSE 82CC7980 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_DEVICE_CONTROL 82CC7980 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_INTERNAL_DEVICE_CONTROL 82CC7980 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLEANUP 82CC7980 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_PNP 82CC7980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CREATE 82CC7980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLOSE 82CC7980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_DEVICE_CONTROL 82CC7980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_INTERNAL_DEVICE_CONTROL 82CC7980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLEANUP 82CC7980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_PNP 82CC7980 Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_CREATE 82D471D8 Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_CLOSE 82D471D8 Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_DEVICE_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_POWER 82D471D8 Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_SYSTEM_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_PNP 82D471D8 Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_CREATE 82D471D8 Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_CLOSE 82D471D8 Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_DEVICE_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_POWER 82D471D8 Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_SYSTEM_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_PNP 82D471D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_NAMED_PIPE 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLOSE 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_READ 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_WRITE 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_INFORMATION 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_INFORMATION 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_EA 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_EA 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FLUSH_BUFFERS 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_VOLUME_INFORMATION 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_VOLUME_INFORMATION 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DIRECTORY_CONTROL 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FILE_SYSTEM_CONTROL 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CONTROL 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_INTERNAL_DEVICE_CONTROL 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SHUTDOWN 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_LOCK_CONTROL 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLEANUP 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_MAILSLOT 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_SECURITY 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_SECURITY 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_POWER 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SYSTEM_CONTROL 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CHANGE 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_QUOTA 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_QUOTA 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_PNP 82CB8568 Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_CREATE 82D471D8 Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_CLOSE 82D471D8 Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_DEVICE_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_INTERNAL_DEVICE_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_POWER 82D471D8 Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_SYSTEM_CONTROL 82D471D8 Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_PNP 82D471D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_NAMED_PIPE 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLOSE 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_READ 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_WRITE 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_INFORMATION 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_INFORMATION 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_EA 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_EA 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FLUSH_BUFFERS 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_VOLUME_INFORMATION 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_VOLUME_INFORMATION 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DIRECTORY_CONTROL 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FILE_SYSTEM_CONTROL 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CONTROL 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_INTERNAL_DEVICE_CONTROL 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SHUTDOWN 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_LOCK_CONTROL 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLEANUP 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_MAILSLOT 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_SECURITY 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_SECURITY 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_POWER 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SYSTEM_CONTROL 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CHANGE 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_QUOTA 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_QUOTA 82CB8568 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_PNP 82CB8568 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_CREATE 82FD81D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_READ 82FD81D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_WRITE 82FD81D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_FLUSH_BUFFERS 82FD81D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_DEVICE_CONTROL 82FD81D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_INTERNAL_DEVICE_CONTROL 82FD81D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_SHUTDOWN 82FD81D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_CLEANUP 82FD81D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_POWER 82FD81D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_SYSTEM_CONTROL 82FD81D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_PNP 82FD81D8 Device \Driver\a7psrixj \Device\Scsi\a7psrixj1 IRP_MJ_CREATE 82C851D8 Device \Driver\a7psrixj \Device\Scsi\a7psrixj1 IRP_MJ_CLOSE 82C851D8 Device \Driver\a7psrixj \Device\Scsi\a7psrixj1 IRP_MJ_DEVICE_CONTROL 82C851D8 Device \Driver\a7psrixj \Device\Scsi\a7psrixj1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82C851D8 Device \Driver\a7psrixj \Device\Scsi\a7psrixj1 IRP_MJ_POWER 82C851D8 Device \Driver\a7psrixj \Device\Scsi\a7psrixj1 IRP_MJ_SYSTEM_CONTROL 82C851D8 Device \Driver\a7psrixj \Device\Scsi\a7psrixj1 IRP_MJ_PNP 82C851D8 Device \Driver\a7psrixj \Device\Scsi\a7psrixj1Port3Path0Target0Lun0 IRP_MJ_CREATE 82C851D8 Device \Driver\a7psrixj \Device\Scsi\a7psrixj1Port3Path0Target0Lun0 IRP_MJ_CLOSE 82C851D8 Device \Driver\a7psrixj \Device\Scsi\a7psrixj1Port3Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 82C851D8 Device \Driver\a7psrixj \Device\Scsi\a7psrixj1Port3Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82C851D8 Device \Driver\a7psrixj \Device\Scsi\a7psrixj1Port3Path0Target0Lun0 IRP_MJ_POWER 82C851D8 Device \Driver\a7psrixj \Device\Scsi\a7psrixj1Port3Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 82C851D8 Device \Driver\a7psrixj \Device\Scsi\a7psrixj1Port3Path0Target0Lun0 IRP_MJ_PNP 82C851D8 Device \Driver\ax11hvd1 \Device\Scsi\ax11hvd11 IRP_MJ_CREATE 82C9A980 Device \Driver\ax11hvd1 \Device\Scsi\ax11hvd11 IRP_MJ_CLOSE 82C9A980 Device \Driver\ax11hvd1 \Device\Scsi\ax11hvd11 IRP_MJ_DEVICE_CONTROL 82C9A980 Device \Driver\ax11hvd1 \Device\Scsi\ax11hvd11 IRP_MJ_INTERNAL_DEVICE_CONTROL 82C9A980 Device \Driver\ax11hvd1 \Device\Scsi\ax11hvd11 IRP_MJ_POWER 82C9A980 Device \Driver\ax11hvd1 \Device\Scsi\ax11hvd11 IRP_MJ_SYSTEM_CONTROL 82C9A980 Device \Driver\ax11hvd1 \Device\Scsi\ax11hvd11 IRP_MJ_PNP 82C9A980 Device \FileSystem\Cdfs \Cdfs IRP_MJ_CREATE 82A4C1D8 Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLOSE 82A4C1D8 Device \FileSystem\Cdfs \Cdfs IRP_MJ_READ 82A4C1D8 Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_INFORMATION 82A4C1D8 Device \FileSystem\Cdfs \Cdfs IRP_MJ_SET_INFORMATION 82A4C1D8 Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_VOLUME_INFORMATION 82A4C1D8 Device \FileSystem\Cdfs \Cdfs IRP_MJ_DIRECTORY_CONTROL 82A4C1D8 Device \FileSystem\Cdfs \Cdfs IRP_MJ_FILE_SYSTEM_CONTROL 82A4C1D8 Device \FileSystem\Cdfs \Cdfs IRP_MJ_DEVICE_CONTROL 82A4C1D8 Device \FileSystem\Cdfs \Cdfs IRP_MJ_SHUTDOWN 82A4C1D8 Device \FileSystem\Cdfs \Cdfs IRP_MJ_LOCK_CONTROL 82A4C1D8 Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLEANUP 82A4C1D8 Device \FileSystem\Cdfs \Cdfs IRP_MJ_PNP 82A4C1D8 ---- Threads - GMER 1.0.12 ---- Thread 4:168 82DC7950 Thread 4:172 82DA7C60 Thread 4:176 82DA7C60 ---- EOF - GMER 1.0.12 ----

**Posty:** 8694 · przez **Red** 12 Lis 2006, 01:46

dokonczył,ale jest zupełnie czysto..

[ Dodano: Dzisiaj o 0:28 ]
daj jeszcze log z opcji w Gmer:

Rootkit >>> zaznaczone tylko Pokazuj wszystko + Usługi >>> Szukaj >>> Kopiuj >>> Ctrl + V do posta

**Posty:** 115 · przez **EncorE** 12 Lis 2006, 01:52

Proszę

Kod: Zaznacz wszystko: GMER 1.0.12.11889 - http://www.gmer.net Rootkit scan 2006-11-12 00:28:06 Windows 5.1.2600 Dodatek Service Pack 2 ---- Services - GMER 1.0.12 ---- Service .NET CLR Data Service .NET CLR Networking Service .NET Data Provider for Oracle Service .NET Data Provider for SqlServer Service .NETFramework Service [DISABLED] Abiosdsk Service [DISABLED] abp480n5 Service D:\WINDOWS\System32\DRIVERS\ACPI.sys [BOOT] ACPI Service [DISABLED] ACPIEC Service [DISABLED] adpu160m Service D:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec Service D:\WINDOWS\System32\drivers\afd.sys [SYSTEM] AFD Service [DISABLED] Aha154x Service [DISABLED] aic78u2 Service [DISABLED] aic78xx Service D:\WINDOWS\system32\DRIVERS\alcan5wn.sys [MANUAL] alcan5wn Service D:\WINDOWS\system32\DRIVERS\alcaudsl.sys [MANUAL] alcaudsl Service D:\WINDOWS\System32\svchost.exe [DISABLED] Alerter Service D:\WINDOWS\System32\alg.exe [MANUAL] ALG Service [DISABLED] AliIde Service D:\WINDOWS\System32\DRIVERS\amdk7.sys [SYSTEM] AmdK7 Service [DISABLED] amsint Service D:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt Service [DISABLED] asc Service [DISABLED] asc3350p Service [DISABLED] asc3550 Service ASP.NET Service ASP.NET_1.1.4322 Service ASP.NET_2.0.50727 Service D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [MANUAL] aspnet_state Service D:\WINDOWS\System32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac Service D:\WINDOWS\System32\DRIVERS\atapi.sys [BOOT] atapi Service [DISABLED] Atdisk Service D:\WINDOWS\system32\Ati2evxx.exe [DISABLED] Ati HotKey Poller Service D:\WINDOWS\system32\ati2sgag.exe [DISABLED] ATI Smart Service D:\WINDOWS\system32\DRIVERS\ati2mtag.sys [MANUAL] ati2mtag Service D:\WINDOWS\System32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc Service D:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv Service D:\WINDOWS\System32\DRIVERS\audstub.sys [MANUAL] audstub Service C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe [AUTO] AVP Service BattC Service [SYSTEM] Beep Service D:\WINDOWS\System32\svchost.exe [MANUAL] BITS Service D:\WINDOWS\System32\svchost.exe [AUTO] Browser Service [DISABLED] cbidf2k Service [DISABLED] cd20xrnt Service [SYSTEM] Cdaudio Service [DISABLED] Cdfs Service D:\WINDOWS\System32\DRIVERS\cdrom.sys [SYSTEM] Cdrom Service [SYSTEM] Changer Service D:\WINDOWS\System32\cisvc.exe [MANUAL] cisvc Service D:\WINDOWS\system32\clipsrv.exe [DISABLED] ClipSrv Service D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [MANUAL] clr_optimization_v2.0.50727_32 Service [DISABLED] CmdIde Service D:\WINDOWS\system32\drivers\cmuda.sys [MANUAL] cmuda Service D:\WINDOWS\System32\dllhost.exe [MANUAL] COMSysApp Service ContentFilter Service ContentIndex Service [DISABLED] Cpqarray Service D:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc Service [DISABLED] dac2w2k Service [DISABLED] dac960nt Service D:\WINDOWS\system32\svchost.exe [AUTO] DcomLaunch Service D:\WINDOWS\System32\svchost.exe [AUTO] Dhcp Service D:\WINDOWS\System32\DRIVERS\disk.sys [BOOT] Disk Service D:\Program Files\Executive Software\DiskeeperLite\DKService.exe [AUTO] Diskeeper Service D:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin Service D:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot Service D:\WINDOWS\System32\drivers\dmio.sys [BOOT] dmio Service D:\WINDOWS\System32\drivers\dmload.sys [BOOT] dmload Service D:\WINDOWS\System32\svchost.exe [AUTO] dmserver Service D:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic Service D:\WINDOWS\System32\svchost.exe [AUTO] Dnscache Service [DISABLED] dpti2o Service D:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud Service D:\WINDOWS\System32\svchost.exe [DISABLED] ERSvc Service D:\WINDOWS\system32\services.exe [AUTO] Eventlog Service D:\WINDOWS\System32\svchost.exe [MANUAL] EventSystem Service [DISABLED] Fastfat Service D:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility Service D:\WINDOWS\System32\DRIVERS\fdc.sys [MANUAL] Fdc Service D:\WINDOWS\system32\DRIVERS\fetnd5b.sys [MANUAL] FETNDIS Service [SYSTEM] Fips Service D:\WINDOWS\System32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk Service D:\WINDOWS\system32\drivers\fltmgr.sys [BOOT] FltMgr Service d:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [MANUAL] FontCache3.0.0.0 Service [SYSTEM] Fs_Rec Service D:\WINDOWS\System32\DRIVERS\ftdisk.sys [BOOT] Ftdisk Service D:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer Service D:\WINDOWS\System32\DRIVERS\msgpc.sys [MANUAL] Gpc Service [MANUAL] GVCplDrv Service D:\WINDOWS\system32\DRIVERS\hamachi.sys [MANUAL] hamachi Service D:\WINDOWS\System32\svchost.exe [AUTO] helpsvc Service D:\WINDOWS\System32\svchost.exe [DISABLED] HidServ Service [DISABLED] hpn Service [DISABLED] hpt3xx Service D:\WINDOWS\System32\Drivers\HTTP.sys [MANUAL] HTTP Service D:\WINDOWS\System32\svchost.exe [MANUAL] HTTPFilter Service [SYSTEM] i2omgmt Service [DISABLED] i2omp Service D:\WINDOWS\System32\DRIVERS\i8042prt.sys [SYSTEM] i8042prt Service D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [MANUAL] idsvc Service D:\WINDOWS\system32\DRIVERS\imapi.sys [SYSTEM] Imapi Service D:\WINDOWS\System32\imapi.exe [MANUAL] ImapiService Service system32\drivers\InCDFs.sys [DISABLED] InCDFs Service system32\drivers\InCDPass.sys [SYSTEM] InCDPass Service system32\drivers\InCDRm.sys [SYSTEM] InCDRm Service inetaccs Service [DISABLED] ini910u Service Inport Service [DISABLED] IntelIde Service D:\WINDOWS\system32\drivers\ip6fw.sys [MANUAL] ip6fw Service D:\WINDOWS\System32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver Service D:\WINDOWS\System32\DRIVERS\ipinip.sys [MANUAL] IpInIp Service D:\WINDOWS\System32\DRIVERS\ipnat.sys [MANUAL] IpNat Service D:\WINDOWS\System32\DRIVERS\ipsec.sys [SYSTEM] IPSec Service D:\WINDOWS\system32\DRIVERS\irda.sys [AUTO] irda Service D:\WINDOWS\System32\DRIVERS\irenum.sys [MANUAL] IRENUM Service D:\WINDOWS\system32\svchost.exe [AUTO] Irmon Service ISAPISearch Service D:\WINDOWS\System32\DRIVERS\isapnp.sys [BOOT] isapnp Service D:\WINDOWS\System32\DRIVERS\kbdclass.sys [SYSTEM] Kbdclass Service D:\WINDOWS\system32\drivers\kl1.sys [BOOT] kl1 Service D:\WINDOWS\system32\drivers\klif.sys [SYSTEM] klif Service D:\WINDOWS\system32\drivers\kmixer.sys [MANUAL] kmixer Service [BOOT] KSecDD Service D:\WINDOWS\System32\svchost.exe [AUTO] lanmanserver Service D:\WINDOWS\System32\svchost.exe [AUTO] lanmanworkstation Service [SYSTEM] lbrtfdc Service ldap Service LicenseService Service D:\WINDOWS\System32\svchost.exe [AUTO] LmHosts Service D:\WINDOWS\System32\svchost.exe [DISABLED] Messenger Service [SYSTEM] mnmdd Service D:\WINDOWS\System32\mnmsrvc.exe [MANUAL] mnmsrvc Service [MANUAL] Modem Service D:\WINDOWS\System32\DRIVERS\mouclass.sys [SYSTEM] Mouclass Service [BOOT] MountMgr Service [DISABLED] mraid35x Service D:\WINDOWS\System32\DRIVERS\mrxdav.sys [MANUAL] MRxDAV Service D:\WINDOWS\System32\DRIVERS\mrxsmb.sys [SYSTEM] MRxSmb Service D:\WINDOWS\System32\msdtc.exe [MANUAL] MSDTC Service MSDTC Bridge 3.0.0.0 Service [SYSTEM] Msfs Service D:\WINDOWS\system32\msiexec.exe [MANUAL] MSIServer Service D:\WINDOWS\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV Service D:\WINDOWS\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK Service D:\WINDOWS\system32\drivers\MSPQM.sys [MANUAL] MSPQM Service D:\WINDOWS\System32\DRIVERS\mssmbios.sys [MANUAL] mssmbios Service [BOOT] Mup Service [BOOT] NDIS Service D:\WINDOWS\System32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi Service D:\WINDOWS\System32\DRIVERS\ndisuio.sys [MANUAL] Ndisuio Service D:\WINDOWS\System32\DRIVERS\ndiswan.sys [MANUAL] NdisWan Service [MANUAL] NDProxy Service D:\WINDOWS\System32\DRIVERS\netbios.sys [SYSTEM] NetBIOS Service D:\WINDOWS\System32\DRIVERS\netbt.sys [SYSTEM] NetBT Service D:\WINDOWS\system32\netdde.exe [DISABLED] NetDDE Service D:\WINDOWS\system32\netdde.exe [DISABLED] NetDDEdsdm Service D:\WINDOWS\System32\lsass.exe [DISABLED] Netlogon Service D:\WINDOWS\System32\svchost.exe [MANUAL] Netman Service D:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [DISABLED] NetTcpPortSharing Service D:\WINDOWS\System32\svchost.exe [MANUAL] Nla Service [SYSTEM] Npfs Service [DISABLED] Ntfs Service D:\WINDOWS\System32\lsass.exe [MANUAL] NtLmSsp Service D:\WINDOWS\system32\svchost.exe [MANUAL] NtmsSvc Service [SYSTEM] Null Service nv4 Service D:\WINDOWS\System32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt Service D:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd Service D:\WINDOWS\System32\DRIVERS\parport.sys [MANUAL] Parport Service [BOOT] PartMgr Service [AUTO] ParVdm Service D:\WINDOWS\System32\DRIVERS\pci.sys [BOOT] PCI Service [SYSTEM] PCIDump Service [DISABLED] PCIIde Service [DISABLED] Pcmcia Service [MANUAL] PDCOMP Service [MANUAL] PDFRAME Service [MANUAL] PDRELI Service [MANUAL] PDRFRAME Service [DISABLED] perc2 Service [DISABLED] perc2hib Service PerfDisk Service PerfNet Service PerfOS Service PerfProc Service D:\WINDOWS\system32\services.exe [AUTO] PlugPlay Service D:\WINDOWS\System32\lsass.exe [AUTO] PolicyAgent Service D:\WINDOWS\System32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport Service D:\WINDOWS\System32\DRIVERS\processr.sys [SYSTEM] Processor Service D:\WINDOWS\system32\lsass.exe [AUTO] ProtectedStorage Service D:\WINDOWS\System32\DRIVERS\psched.sys [MANUAL] PSched Service D:\WINDOWS\System32\DRIVERS\ptilink.sys [MANUAL] Ptilink Service [DISABLED] ql1080 Service [DISABLED] Ql10wnt Service [DISABLED] ql12160 Service [DISABLED] ql1240 Service [DISABLED] ql1280 Service D:\WINDOWS\System32\DRIVERS\rasacd.sys [SYSTEM] RasAcd Service D:\WINDOWS\System32\svchost.exe [MANUAL] RasAuto Service D:\WINDOWS\System32\DRIVERS\rasirda.sys [MANUAL] Rasirda Service D:\WINDOWS\System32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp Service D:\WINDOWS\System32\svchost.exe [MANUAL] RasMan Service D:\WINDOWS\System32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe Service D:\WINDOWS\System32\DRIVERS\raspti.sys [MANUAL] Raspti Service D:\WINDOWS\System32\DRIVERS\rdbss.sys [SYSTEM] Rdbss Service D:\WINDOWS\System32\DRIVERS\RDPCDD.sys [SYSTEM] RDPCDD Service RDPDD Service D:\WINDOWS\System32\DRIVERS\rdpdr.sys [MANUAL] rdpdr Service RDPNP Service [MANUAL] RDPWD Service D:\WINDOWS\system32\sessmgr.exe [MANUAL] RDSessMgr Service D:\WINDOWS\System32\DRIVERS\redbook.sys [SYSTEM] redbook Service D:\WINDOWS\System32\svchost.exe [DISABLED] RemoteAccess Service D:\WINDOWS\system32\svchost.exe [DISABLED] RemoteRegistry Service D:\WINDOWS\System32\locator.exe [MANUAL] RpcLocator Service D:\WINDOWS\system32\svchost.exe [AUTO] RpcSs Service D:\WINDOWS\System32\rsvp.exe [MANUAL] RSVP Service D:\WINDOWS\system32\lsass.exe [AUTO] SamSs Service D:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardSvr Service D:\WINDOWS\System32\svchost.exe [AUTO] Schedule Service ScsiPort Service D:\WINDOWS\System32\DRIVERS\secdrv.sys [MANUAL] Secdrv Service D:\WINDOWS\System32\svchost.exe [DISABLED] seclogon Service D:\WINDOWS\system32\svchost.exe [AUTO] SENS Service D:\WINDOWS\System32\DRIVERS\serenum.sys [MANUAL] serenum Service D:\WINDOWS\System32\DRIVERS\serial.sys [SYSTEM] Serial Service ServiceModelEndpoint 3.0.0.0 Service ServiceModelOperation 3.0.0.0 Service ServiceModelService 3.0.0.0 Service [SYSTEM] Sfloppy Service D:\WINDOWS\System32\svchost.exe [AUTO] SharedAccess Service D:\WINDOWS\System32\svchost.exe [AUTO] ShellHWDetection Service [DISABLED] Simbad Service SMSvcHost 3.0.0.0 Service [DISABLED] Sparrow Service D:\WINDOWS\system32\drivers\splitter.sys [MANUAL] splitter Service D:\WINDOWS\system32\spoolsv.exe [AUTO] Spooler Service D:\WINDOWS\System32\Drivers\sptd.sys [BOOT] sptd Service D:\WINDOWS\System32\DRIVERS\sr.sys [BOOT] sr Service D:\WINDOWS\System32\svchost.exe [AUTO] srservice Service D:\WINDOWS\System32\DRIVERS\srv.sys [MANUAL] Srv Service D:\WINDOWS\System32\svchost.exe [MANUAL] SSDPSRV Service D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe [AUTO] StarWindService Service D:\WINDOWS\system32\DRIVERS\irstusb.sys [MANUAL] STIrUsb Service D:\WINDOWS\System32\svchost.exe [MANUAL] stisvc Service D:\WINDOWS\System32\DRIVERS\swenum.sys [MANUAL] swenum Service D:\WINDOWS\system32\drivers\swmidi.sys [MANUAL] swmidi Service D:\WINDOWS\System32\dllhost.exe [MANUAL] SwPrv Service swwd Service [DISABLED] symc810 Service [DISABLED] symc8xx Service [DISABLED] sym_hi Service [DISABLED] sym_u3 Service D:\WINDOWS\system32\drivers\sysaudio.sys [MANUAL] sysaudio Service D:\WINDOWS\system32\smlogsvc.exe [MANUAL] SysmonLog Service D:\WINDOWS\System32\svchost.exe [MANUAL] TapiSrv Service D:\WINDOWS\System32\DRIVERS\tcpip.sys [SYSTEM] Tcpip Service [MANUAL] TDPIPE Service [MANUAL] TDTCP Service D:\WINDOWS\System32\DRIVERS\termdd.sys [SYSTEM] TermDD Service D:\WINDOWS\System32\svchost.exe [MANUAL] TermService Service D:\WINDOWS\System32\svchost.exe [AUTO] Themes Service D:\WINDOWS\System32\tlntsvr.exe [MANUAL] TlntSvr Service [DISABLED] TosIde Service D:\WINDOWS\system32\svchost.exe [AUTO] TrkWks Service TSDDD Service [DISABLED] Udfs Service [DISABLED] ultra Service D:\WINDOWS\system32\wdfmgr.exe [AUTO] UMWdf Service D:\WINDOWS\System32\DRIVERS\update.sys [MANUAL] Update Service D:\WINDOWS\System32\svchost.exe [MANUAL] upnphost Service D:\WINDOWS\System32\ups.exe [MANUAL] UPS Service D:\WINDOWS\System32\DRIVERS\usbhub.sys [MANUAL] usbhub Service D:\WINDOWS\system32\DRIVERS\usbprint.sys [MANUAL] usbprint Service D:\WINDOWS\System32\DRIVERS\usbuhci.sys [MANUAL] usbuhci Service D:\WINDOWS\System32\drivers\vga.sys [SYSTEM] VgaSave Service D:\WINDOWS\system32\DRIVERS\viaagp1.sys [BOOT] viaagp1 Service D:\WINDOWS\System32\DRIVERS\viaide.sys [BOOT] ViaIde Service [BOOT] VolSnap Service D:\WINDOWS\System32\vssvc.exe [MANUAL] VSS Service D:\WINDOWS\System32\svchost.exe [AUTO] W32Time Service W3SVC Service D:\WINDOWS\System32\DRIVERS\wanarp.sys [MANUAL] Wanarp Service [MANUAL] WDICA Service D:\WINDOWS\system32\drivers\wdmaud.sys [MANUAL] wdmaud Service D:\WINDOWS\System32\svchost.exe [AUTO] WebClient Service Windows Workflow Foundation 3.0.0.0 Service D:\WINDOWS\system32\svchost.exe [AUTO] winmgmt Service [MANUAL] Winsock Service WinSock2 Service WinTrust Service D:\WINDOWS\System32\svchost.exe [MANUAL] WmdmPmSN Service D:\WINDOWS\System32\svchost.exe [MANUAL] Wmi Service WmiApRpl Service D:\WINDOWS\System32\wbem\wmiapsrv.exe [MANUAL] WmiApSrv Service D:\WINDOWS\System32\svchost.exe [AUTO] wscsvc Service D:\WINDOWS\System32\svchost.exe [AUTO] wuauserv Service D:\WINDOWS\System32\svchost.exe [AUTO] WZCSVC Service D:\WINDOWS\System32\svchost.exe [MANUAL] xmlprov Service {D0407EDF-645A-43F7-8BBE-74CAB9FEB1F9} Service {E471DAD1-2072-4444-8EB7-B33019989FAA} Service [MANUAL] a7psrixj Service [MANUAL] ax11hvd1 ---- EOF - GMER 1.0.12 ----

**Posty:** 8694 · przez **Red** 12 Lis 2006, 01:56

czysto ,niestety

Autor postu otrzymał pochwałę

**Posty:** 115 · przez **EncorE** 12 Lis 2006, 02:29

ehhh...

no cóż, wielkie dzięki za starania!!

problem z komputerem - pozostałości po wirusach?

Problem z komputerem - pozostałości po wirusach?

Kto jest na forum