prosze o sprawdzenie loga (problem)

**Posty:** 39 · przez **Rashed** 18 Maj 2007, 16:57

Ostatnio z moim komputerem zaczęły się dziać dziwne rzeczy. Np. Gram sobie w jaka kolwiek gre i nagle wyłącza mi sie dzwięk a zaraz po nim myszka i musze restartowac komputer. Czego może to byc wina.

Oto kod:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:29:10, on 2007-05-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe D:\Program Files\Eset\nod32kui.exe C:\WINDOWS\SOUNDMAN.EXE D:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Skype\Plugin Manager\SkypePM.exe C:\Documents and Settings\Rashed\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

**Posty:** 3854 · przez **Dzi@dek** 18 Maj 2007, 19:49

Czy jesteś zalogowany na koncie administratora, czy też na koncie limitowanym ( gość lub celowo założonym dla Ciebie ) :?:

**Posty:** 18165 · przez **wojtas** 18 Maj 2007, 20:20

skasuj:

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

**Posty:** 39 · przez **Rashed** 18 Maj 2007, 21:53

Tom@szek nie rozumiem pytania ?? Konto mam zalozone juz dawno.

a wojtas to powinno wystarczyc ??

[ Dodano: Dzisiaj o 20:55 ]

Rashed napisał(a):Tom@szek nie rozumiem pytania ?? Konto mam zalozone juz dawno.

a wojtas to powinno wystarczyc ??

_________________________________________________________________________

Oto nowy log po usunieciu

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 21:38:48, on 2007-05-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe D:\Program Files\Eset\nod32kui.exe C:\WINDOWS\SOUNDMAN.EXE D:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Skype\Plugin Manager\SkypePM.exe C:\WINDOWS\system32\svchost.exe D:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Winamp\winamp.exe C:\Documents and Settings\Rashed\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

**Posty:** 18165 · przez **wojtas** 18 Maj 2007, 22:44

daj loga:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

**Posty:** 39 · przez **Rashed** 18 Maj 2007, 22:51

Oto log z combofixa

Kod: Zaznacz wszystko: "Rashed" - 2007-05-18 22:31:41 Dodatek Service Pack 2 ComboFix 07-05.17.6.V - Running from: "C:\Documents and Settings\Rashed\Pulpit\" ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-18 )))))))))))))))))))))))))))))))))) 2007-05-10 20:40 <DIR> d-------- C:\DOCUME~1\Rashed\DANEAP~1\MusicIP 2007-05-10 20:39 9,464 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-05-10 20:39 9,336 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-05-10 20:39 43,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-05-10 20:39 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2007-05-10 20:39 <DIR> d-------- C:\Program Files\Winamp 2007-04-19 21:11 <DIR> d-------- C:\Program Files\Techland 2007-04-19 20:55 <DIR> d-------- C:\WINDOWS\speech 2007-04-19 20:55 <DIR> d-------- C:\WINDOWS\lhsp 2007-04-19 16:41 <DIR> d-------- C:\DOCUME~1\Rashed\DANEAP~1\Activision 2007-04-19 16:40 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-04-19 16:40 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-04-19 16:40 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-04-19 16:40 <DIR> d--hs---- C:\WINDOWS\ftpcache 2007-04-19 16:24 <DIR> d-------- C:\Program Files\Activision (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-18 20:33:16 -------- d-----w C:\DOCUME~1\Rashed\DANEAP~1\Skype 2007-05-16 14:03:02 -------- d-----w C:\DOCUME~1\Rashed\DANEAP~1\BearShare 2007-04-27 23:05:22 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-04-20 14:07:26 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll 2007-04-19 14:41:08 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-04-10 12:25:34 -------- d-----w C:\DOCUME~1\Rashed\DANEAP~1\Philips 2007-03-30 21:26:01 -------- d-----w C:\Program Files\Common Files\Adobe Systems Shared 2007-03-25 08:04:12 68,334 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-03-25 08:04:12 439,194 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-03-18 21:34:31 -------- d-----w C:\Program Files\Windows Media Connect 2 2007-03-18 20:51:40 -------- d-----w C:\DOCUME~1\Rashed\DANEAP~1\teamspeak2 2007-03-17 13:45:36 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-17 11:08:58 -------- d-----w C:\Program Files\Microsoft Works 2007-03-17 11:08:14 -------- d-----w C:\Program Files\Microsoft.NET 2007-03-14 20:40:48 -------- d-----w C:\DOCUME~1\Rashed\DANEAP~1\Opera 2007-03-13 18:48:37 -------- d-----w C:\DOCUME~1\Rashed\DANEAP~1\FlashFXP 2007-03-10 21:16:21 0 ----a-r C:\logwmemory.bin 2007-03-08 17:42:36 -------- d-----w C:\DOCUME~1\Rashed\DANEAP~1\GuiltyGearIsukaNA 2007-03-08 15:38:47 579,072 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:38:47 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:38:47 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:37:33 1,843,840 ----a-w C:\WINDOWS\system32\win32k.sys 2007-03-08 15:11:17 -------- d-----w C:\Program Files\Common Files\Nero 2007-03-08 15:06:52 -------- d-----w C:\Program Files\Common Files\Ahead 2007-03-07 17:02:19 -------- d-----w C:\DOCUME~1\Rashed\DANEAP~1\AdobeUM 2007-03-03 14:25:56 35,143 ----a-w C:\WINDOWS\DIIUnin.dat 2007-03-03 14:24:06 21,840 ----a-w C:\WINDOWS\system32\SIntfNT.dll 2007-03-03 14:24:06 17,212 ----a-w C:\WINDOWS\system32\SIntf32.dll 2007-03-03 14:24:06 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll 2007-02-26 15:30:28 533 ----a-w C:\WINDOWS\eReg.dat 2007-02-24 23:30:03 2,829 ----a-w C:\WINDOWS\DIIUnin.pif 2007-02-24 23:30:03 106,496 ----a-w C:\WINDOWS\DIIUnin.exe 2007-02-23 23:15:06 1,168 ----a-w C:\WINDOWS\mozver.dat 2007-02-23 15:43:55 0 ----a-w C:\WINDOWS\nsreg.dat 2007-02-23 12:30:31 298,104 ----a-w C:\WINDOWS\system32\imon.dll 2007-02-23 12:25:07 4,212 ---h--w C:\WINDOWS\system32\zllictbl.dat 2007-02-23 11:56:49 0 --sha-r C:\MSDOS.SYS 2007-02-23 11:56:49 0 --sha-r C:\IO.SYS 2007-02-23 11:56:49 0 ----a-w C:\CONFIG.SYS 2007-02-23 11:56:49 0 ----a-w C:\AUTOEXEC.BAT 2007-02-23 11:54:05 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-02-05 20:19:48 185,856 ----a-w C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-24 22:10] "ZoneAlarm Client"="D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-01-08 15:29] "nod32kui"="D:\Program Files\Eset\nod32kui.exe" [2007-02-23 14:30] "SoundMan"="SOUNDMAN.EXE" [] "DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 12:48] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-02-09 17:00] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages msv1_0 Security Packages kerberos msv1_0 schannel wdigest Notification Packages scecli [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Rashed^Menu Start^Programy^Autostart^Adobe Gamma.lnk] path=C:\Documents and Settings\Rashed\Menu Start\Programy\Autostart\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svchost] C:\Windows\svchost.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\svchost32] C:\WINDOWS\svchost32.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SYSXP] C:\WINDOWS\System32\sysxp.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HTTPFilter HTTPFilter LocalService Alerter WebClient LmHosts RemoteRegistry upnphost SSDPSRV NetworkService DnsCache DcomLaunch DcomLaunch TermService rpcss RpcSs imgsvc StiSvc termsvcs TermService WudfServiceGroup WUDFSvc HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* *newlycreated* -PROCEXP90 ~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ backup-20070518-213833-599 O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 backup-20070512-223929-905 O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe backup-20070512-223928-184 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe backup-20070512-223928-910 O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll backup-20070512-223928-956 O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll backup-20070512-223928-202 O8 - Extra context menu item: Link to &MidpX - D:\Program Files\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm backup-20070512-223928-740 O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe backup-20070512-223928-605 O3 - Toolbar: Kwyshell MidpX - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - D:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll backup-20070512-223928-848 O2 - BHO: Kwyshell MidpX BHO - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - D:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll backup-20070512-223928-872 O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll backup-20070512-223928-169 O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\FlashFXP\IEFlash.dll backup-20070512-223928-921 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-18 22:33:08 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes ... cmd.exe [6280] scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ******************************************************************** Completion time: 2007-05-18 22:33:52 C:\ComboFix-quarantined-files.txt ... 2007-05-18 22:33 --- E O F ---

**Posty:** 18165 · przez **wojtas** 18 Maj 2007, 22:56

wklej do notatnika:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\sharedtools\msconfig\startupreg\svchost]

[-HKEY_LOCAL_MACHINE\software\microsoft\sharedtools\msconfig\startupreg\svchost32]

[-HKEY_LOCAL_MACHINE\software\microsoft\sharedtools\msconfig\startupreg\SYSXP]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

**Posty:** 39 · przez **Rashed** 18 Maj 2007, 22:59

Gotowe dać jakieś logi ??

**Posty:** 18165 · przez **wojtas** 18 Maj 2007, 23:20

sciagnij gmera:

http://gmer.net/gmer.zip

1. Zakładka Rootkit >>> zaznaczone wszystko oprócz Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
2. Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta

**Posty:** 39 · przez **Rashed** 19 Maj 2007, 01:02

OK oto:

1.

Kod: Zaznacz wszystko: GMER 1.0.12.12244 - http://www.gmer.net Rootkit scan 2007-05-19 00:44:28 Windows 5.1.2600 Dodatek Service Pack 2 ---- System - GMER 1.0.12 ---- SSDT \SystemRoot\System32\vsdatant.sys ZwConnectPort SSDT \SystemRoot\System32\vsdatant.sys ZwCreateFile SSDT \SystemRoot\System32\vsdatant.sys ZwCreateKey SSDT \SystemRoot\System32\vsdatant.sys ZwCreatePort SSDT \SystemRoot\System32\vsdatant.sys ZwCreateProcess SSDT \SystemRoot\System32\vsdatant.sys ZwCreateProcessEx SSDT \SystemRoot\System32\vsdatant.sys ZwCreateSection SSDT \SystemRoot\System32\vsdatant.sys ZwCreateWaitablePort SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteFile SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteKey SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteValueKey SSDT \SystemRoot\System32\vsdatant.sys ZwDuplicateObject SSDT sptd.sys ZwEnumerateKey SSDT sptd.sys ZwEnumerateValueKey SSDT \SystemRoot\System32\vsdatant.sys ZwLoadKey SSDT \SystemRoot\System32\vsdatant.sys ZwOpenFile SSDT sptd.sys ZwOpenKey SSDT \SystemRoot\System32\vsdatant.sys ZwOpenProcess SSDT \SystemRoot\System32\vsdatant.sys ZwOpenThread SSDT sptd.sys ZwQueryKey SSDT sptd.sys ZwQueryValueKey SSDT \SystemRoot\System32\vsdatant.sys ZwReplaceKey SSDT \SystemRoot\System32\vsdatant.sys ZwRequestWaitReplyPort SSDT \SystemRoot\System32\vsdatant.sys ZwRestoreKey SSDT \SystemRoot\System32\vsdatant.sys ZwSecureConnectPort SSDT \SystemRoot\System32\vsdatant.sys ZwSetInformationFile SSDT \SystemRoot\System32\vsdatant.sys ZwSetValueKey SSDT \SystemRoot\System32\vsdatant.sys ZwTerminateProcess ---- Kernel code sections - GMER 1.0.12 ---- .text ntoskrnl.exe!_abnormal_termination + 104 804E2760 12 Bytes [ E0, 91, EF, BA, 70, F4, EF, ... ] ? C:\WINDOWS\system32\drivers\sptd.sys Proces nie może uzyskać dostępu do pliku, ponieważ jest on używany przez inny proces. ? srescan.sys Nie można odnaleźć określonego pliku. .text USBPORT.SYS!DllUnload F810C62C 5 Bytes JMP 81F801B8 ? System32\Drivers\ai6gqr1p.SYS Nie można odnaleźć określonego pliku. ? C:\WINDOWS\system32\DRIVERS\update.sys .text ntoskrnl.exe!_abnormal_termination + 104 804E2760 12 Bytes [ E0, 91, EF, BA, 70, F4, EF, ... ] ---- Devices - GMER 1.0.12 ---- Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA 823681D8 Device \FileSystem\Ntfs \Ntfs IRP_MJ_PNP 823681D8 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CREATE 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CLOSE 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_READ 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_WRITE 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_INFORMATION 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_INFORMATION 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_EA 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_EA 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_FLUSH_BUFFERS 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_VOLUME_INFORMATION 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_VOLUME_INFORMATION 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_DIRECTORY_CONTROL 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_FILE_SYSTEM_CONTROL 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_DEVICE_CONTROL 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SHUTDOWN 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_LOCK_CONTROL 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CLEANUP 8213A980 Device \FileSystem\Fastfat \FatCdrom IRP_MJ_PNP 8213A980 Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_CREATE 820B5980 Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_CLOSE 820B5980 Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_READ 820B5980 Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_WRITE 820B5980 Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_QUERY_INFORMATION 820B5980 Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_SET_INFORMATION 820B5980 Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_QUERY_VOLUME_INFORMATION 820B5980 Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_DIRECTORY_CONTROL 820B5980 Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_FILE_SYSTEM_CONTROL 820B5980 Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_DEVICE_CONTROL 820B5980 Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_LOCK_CONTROL 820B5980 Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_CLEANUP 820B5980 Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_PNP 820B5980 Device \FileSystem\Udfs \UdfsDisk IRP_MJ_CREATE 820B5980 Device \FileSystem\Udfs \UdfsDisk IRP_MJ_CLOSE 820B5980 Device \FileSystem\Udfs \UdfsDisk IRP_MJ_READ 820B5980 Device \FileSystem\Udfs \UdfsDisk IRP_MJ_WRITE 820B5980 Device \FileSystem\Udfs \UdfsDisk IRP_MJ_QUERY_INFORMATION 820B5980 Device \FileSystem\Udfs \UdfsDisk IRP_MJ_SET_INFORMATION 820B5980 Device \FileSystem\Udfs \UdfsDisk IRP_MJ_QUERY_VOLUME_INFORMATION 820B5980 Device \FileSystem\Udfs \UdfsDisk IRP_MJ_DIRECTORY_CONTROL 820B5980 Device \FileSystem\Udfs \UdfsDisk IRP_MJ_FILE_SYSTEM_CONTROL 820B5980 Device \FileSystem\Udfs \UdfsDisk IRP_MJ_DEVICE_CONTROL 820B5980 Device \FileSystem\Udfs \UdfsDisk IRP_MJ_LOCK_CONTROL 820B5980 Device \FileSystem\Udfs \UdfsDisk IRP_MJ_CLEANUP 820B5980 Device \FileSystem\Udfs \UdfsDisk IRP_MJ_PNP 820B5980 Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP [BAF0A880] vsdatant.sys Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_CREATE 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_CLOSE 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_INTERNAL_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_POWER 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_SYSTEM_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_PNP 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_CREATE 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_CLOSE 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_INTERNAL_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_POWER 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_SYSTEM_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_PNP 81FAC1D8 Device \Driver\00000042 \Device\00000045 IRP_MJ_POWER [F844CC7E] sptd.sys Device \Driver\00000042 \Device\00000045 IRP_MJ_SYSTEM_CONTROL [F84662A2] sptd.sys Device \Driver\00000042 \Device\00000045 IRP_MJ_PNP [F8467228] sptd.sys Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_CREATE 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_CLOSE 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_INTERNAL_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_POWER 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_SYSTEM_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-2 IRP_MJ_PNP 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_CREATE 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_CLOSE 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_INTERNAL_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_POWER 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_SYSTEM_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_PNP 81FAC1D8 Device \Driver\usbehci \Device\USBPDO-4 IRP_MJ_CREATE 81F531D8 Device \Driver\usbehci \Device\USBPDO-4 IRP_MJ_CLOSE 81F531D8 Device \Driver\usbehci \Device\USBPDO-4 IRP_MJ_DEVICE_CONTROL 81F531D8 Device \Driver\usbehci \Device\USBPDO-4 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F531D8 Device \Driver\usbehci \Device\USBPDO-4 IRP_MJ_POWER 81F531D8 Device \Driver\usbehci \Device\USBPDO-4 IRP_MJ_SYSTEM_CONTROL 81F531D8 Device \Driver\usbehci \Device\USBPDO-4 IRP_MJ_PNP 81F531D8 Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [BAF0A880] vsdatant.sys Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_READ 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_WRITE 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_FLUSH_BUFFERS 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_DEVICE_CONTROL 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_INTERNAL_DEVICE_CONTROL 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SHUTDOWN 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CLEANUP 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_POWER 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SYSTEM_CONTROL 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_PNP 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CREATE 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_READ 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_WRITE 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_FLUSH_BUFFERS 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_DEVICE_CONTROL 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_INTERNAL_DEVICE_CONTROL 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SHUTDOWN 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CLEANUP 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_POWER 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SYSTEM_CONTROL 823DA1D8 Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_PNP 823DA1D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 81F471D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 81F471D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 81F471D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 81F471D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 81F471D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 81F471D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F471D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 81F471D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 81F471D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 81F471D8 Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 81F471D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 81F471D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 81F471D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 81F471D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 81F471D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 81F471D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 81F471D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F471D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 81F471D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 81F471D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 81F471D8 Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 81F471D8 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE 823691D8 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLOSE 823691D8 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CONTROL 823691D8 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL 823691D8 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_POWER 823691D8 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SYSTEM_CONTROL 823691D8 Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_PNP 823691D8 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE 823691D8 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLOSE 823691D8 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CONTROL 823691D8 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_INTERNAL_DEVICE_CONTROL 823691D8 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_POWER 823691D8 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SYSTEM_CONTROL 823691D8 Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_PNP 823691D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_CREATE 823691D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_CLOSE 823691D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_DEVICE_CONTROL 823691D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_INTERNAL_DEVICE_CONTROL 823691D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_POWER 823691D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_SYSTEM_CONTROL 823691D8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_PNP 823691D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-3 IRP_MJ_CREATE 823691D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-3 IRP_MJ_CLOSE 823691D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-3 IRP_MJ_DEVICE_CONTROL 823691D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-3 IRP_MJ_INTERNAL_DEVICE_CONTROL 823691D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-3 IRP_MJ_POWER 823691D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-3 IRP_MJ_SYSTEM_CONTROL 823691D8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-3 IRP_MJ_PNP 823691D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE 81F471D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLOSE 81F471D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_READ 81F471D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_WRITE 81F471D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FLUSH_BUFFERS 81F471D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CONTROL 81F471D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F471D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SHUTDOWN 81F471D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_POWER 81F471D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SYSTEM_CONTROL 81F471D8 Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_PNP 81F471D8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CREATE 81F471D8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CLOSE 81F471D8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_READ 81F471D8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_WRITE 81F471D8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_FLUSH_BUFFERS 81F471D8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_DEVICE_CONTROL 81F471D8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F471D8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SHUTDOWN 81F471D8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_POWER 81F471D8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SYSTEM_CONTROL 81F471D8 Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_PNP 81F471D8 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CREATE 820D2980 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLOSE 820D2980 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_DEVICE_CONTROL 820D2980 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_INTERNAL_DEVICE_CONTROL 820D2980 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CLEANUP 820D2980 Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_PNP 820D2980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CREATE 820D2980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLOSE 820D2980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_DEVICE_CONTROL 820D2980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_INTERNAL_DEVICE_CONTROL 820D2980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CLEANUP 820D2980 Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_PNP 820D2980 Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\Udp IRP_MJ_CLOSE [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\Udp IRP_MJ_DEVICE_CONTROL [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\Udp IRP_MJ_CLEANUP [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSE [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_DEVICE_CONTROL [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLEANUP [BAF0A880] vsdatant.sys Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_CREATE 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_CLOSE 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_INTERNAL_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_POWER 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_SYSTEM_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_PNP 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_CREATE 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_CLOSE 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_INTERNAL_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_POWER 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_SYSTEM_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_PNP 81FAC1D8 Device \Driver\NetBT \Device\NetBT_Tcpip_{161398FC-CA15-442D-B7CC-B2D1FD16DC87} IRP_MJ_CREATE 820D2980 Device \Driver\NetBT \Device\NetBT_Tcpip_{161398FC-CA15-442D-B7CC-B2D1FD16DC87} IRP_MJ_CLOSE 820D2980 Device \Driver\NetBT \Device\NetBT_Tcpip_{161398FC-CA15-442D-B7CC-B2D1FD16DC87} IRP_MJ_DEVICE_CONTROL 820D2980 Device \Driver\NetBT \Device\NetBT_Tcpip_{161398FC-CA15-442D-B7CC-B2D1FD16DC87} IRP_MJ_INTERNAL_DEVICE_CONTROL 820D2980 Device \Driver\NetBT \Device\NetBT_Tcpip_{161398FC-CA15-442D-B7CC-B2D1FD16DC87} IRP_MJ_CLEANUP 820D2980 Device \Driver\NetBT \Device\NetBT_Tcpip_{161398FC-CA15-442D-B7CC-B2D1FD16DC87} IRP_MJ_PNP 820D2980 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_NAMED_PIPE 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLOSE 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_READ 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_WRITE 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_INFORMATION 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_INFORMATION 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_EA 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_EA 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FLUSH_BUFFERS 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_VOLUME_INFORMATION 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_VOLUME_INFORMATION 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DIRECTORY_CONTROL 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FILE_SYSTEM_CONTROL 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CONTROL 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_INTERNAL_DEVICE_CONTROL 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SHUTDOWN 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_LOCK_CONTROL 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLEANUP 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_MAILSLOT 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_SECURITY 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_SECURITY 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_POWER 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SYSTEM_CONTROL 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CHANGE 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_QUOTA 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_QUOTA 821481D8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_PNP 821481D8 Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLOSE [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_DEVICE_CONTROL [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL [BAF0A880] vsdatant.sys Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLEANUP [BAF0A880] vsdatant.sys Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_CREATE 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_CLOSE 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_INTERNAL_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_POWER 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_SYSTEM_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-2 IRP_MJ_PNP 81FAC1D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_NAMED_PIPE 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLOSE 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_READ 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_WRITE 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_INFORMATION 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_INFORMATION 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_EA 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_EA 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FLUSH_BUFFERS 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_VOLUME_INFORMATION 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_VOLUME_INFORMATION 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DIRECTORY_CONTROL 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FILE_SYSTEM_CONTROL 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CONTROL 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_INTERNAL_DEVICE_CONTROL 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SHUTDOWN 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_LOCK_CONTROL 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLEANUP 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_MAILSLOT 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_SECURITY 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_SECURITY 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_POWER 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SYSTEM_CONTROL 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CHANGE 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_QUOTA 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_QUOTA 821481D8 Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_PNP 821481D8 Device \Driver\usbuhci \Device\USBFDO-3 IRP_MJ_CREATE 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-3 IRP_MJ_CLOSE 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-3 IRP_MJ_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-3 IRP_MJ_INTERNAL_DEVICE_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-3 IRP_MJ_POWER 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-3 IRP_MJ_SYSTEM_CONTROL 81FAC1D8 Device \Driver\usbuhci \Device\USBFDO-3 IRP_MJ_PNP 81FAC1D8 Device \Driver\usbehci \Device\USBFDO-4 IRP_MJ_CREATE 81F531D8 Device \Driver\usbehci \Device\USBFDO-4 IRP_MJ_CLOSE 81F531D8 Device \Driver\usbehci \Device\USBFDO-4 IRP_MJ_DEVICE_CONTROL 81F531D8 Device \Driver\usbehci \Device\USBFDO-4 IRP_MJ_INTERNAL_DEVICE_CONTROL 81F531D8 Device \Driver\usbehci \Device\USBFDO-4 IRP_MJ_POWER 81F531D8 Device \Driver\usbehci \Device\USBFDO-4 IRP_MJ_SYSTEM_CONTROL 81F531D8 Device \Driver\usbehci \Device\USBFDO-4 IRP_MJ_PNP 81F531D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_CREATE 823DA1D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_READ 823DA1D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_WRITE 823DA1D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_FLUSH_BUFFERS 823DA1D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_DEVICE_CONTROL 823DA1D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_INTERNAL_DEVICE_CONTROL 823DA1D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_SHUTDOWN 823DA1D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_CLEANUP 823DA1D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_POWER 823DA1D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_SYSTEM_CONTROL 823DA1D8 Device \Driver\Ftdisk \Device\FtControl IRP_MJ_PNP 823DA1D8 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target2Lun0 IRP_MJ_CREATE 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target2Lun0 IRP_MJ_CLOSE 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target2Lun0 IRP_MJ_DEVICE_CONTROL 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target2Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target2Lun0 IRP_MJ_POWER 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target2Lun0 IRP_MJ_SYSTEM_CONTROL 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target2Lun0 IRP_MJ_PNP 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target0Lun0 IRP_MJ_CREATE 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target0Lun0 IRP_MJ_CLOSE 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target0Lun0 IRP_MJ_POWER 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target0Lun0 IRP_MJ_PNP 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1 IRP_MJ_CREATE 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1 IRP_MJ_CLOSE 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1 IRP_MJ_DEVICE_CONTROL 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1 IRP_MJ_POWER 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1 IRP_MJ_SYSTEM_CONTROL 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1 IRP_MJ_PNP 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target1Lun0 IRP_MJ_CREATE 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target1Lun0 IRP_MJ_CLOSE 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target1Lun0 IRP_MJ_DEVICE_CONTROL 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target1Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target1Lun0 IRP_MJ_POWER 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target1Lun0 IRP_MJ_SYSTEM_CONTROL 82205980 Device \Driver\ai6gqr1p \Device\Scsi\ai6gqr1p1Port2Path0Target1Lun0 IRP_MJ_PNP 82205980 Device \FileSystem\Fastfat \Fat IRP_MJ_CREATE 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_CLOSE 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_READ 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_WRITE 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_SET_EA 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP 8213A980 Device \FileSystem\Fastfat \Fat IRP_MJ_PNP 8213A980 Device \FileSystem\Cdfs \Cdfs IRP_MJ_CREATE 82091980 Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLOSE 82091980 Device \FileSystem\Cdfs \Cdfs IRP_MJ_READ 82091980 Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_INFORMATION 82091980 Device \FileSystem\Cdfs \Cdfs IRP_MJ_SET_INFORMATION 82091980 Device \FileSystem\Cdfs \Cdfs IRP_MJ_QUERY_VOLUME_INFORMATION 82091980 Device \FileSystem\Cdfs \Cdfs IRP_MJ_DIRECTORY_CONTROL 82091980 Device \FileSystem\Cdfs \Cdfs IRP_MJ_FILE_SYSTEM_CONTROL 82091980 Device \FileSystem\Cdfs \Cdfs IRP_MJ_DEVICE_CONTROL 82091980 Device \FileSystem\Cdfs \Cdfs IRP_MJ_SHUTDOWN 82091980 Device \FileSystem\Cdfs \Cdfs IRP_MJ_LOCK_CONTROL 82091980 Device \FileSystem\Cdfs \Cdfs IRP_MJ_CLEANUP 82091980 Device \FileSystem\Cdfs \Cdfs IRP_MJ_PNP 82091980 ---- EOF - GMER 1.0.12 ----

2.[code] GMER 1.0.12.12244 - http://www.gmer.net
Rootkit scan 2007-05-19 00:45:13
Windows 5.1.2600 Dodatek Service Pack 2

---- Services - GMER 1.0.12 ----

Service .NET CLR Data
Service .NET CLR Networking
Service .NETFramework
Service [DISABLED] Abiosdsk
Service [DISABLED] abp480n5
Service C:\WINDOWS\system32\DRIVERS\ACPI.sys [BOOT] ACPI
Service [DISABLED] ACPIEC
Service C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [MANUAL] Adobe LM Service
Service [DISABLED] adpu160m
Service C:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec
Service C:\WINDOWS\System32\drivers\afd.sys [SYSTEM] AFD
Service C:\WINDOWS\system32\DRIVERS\agp440.sys [BOOT] agp440
Service [DISABLED] Aha154x
Service [DISABLED] aic78u2
Service [DISABLED] aic78xx
Service C:\WINDOWS\system32\drivers\ALCXSENS.SYS [MANUAL] ALCXSENS
Service C:\WINDOWS\system32\drivers\ALCXWDM.SYS [MANUAL] ALCXWDM
Service C:\WINDOWS\system32\svchost.exe [DISABLED] Alerter
Service C:\WINDOWS\System32\alg.exe [MANUAL] ALG
Service [DISABLED] AliIde
Service C:\WINDOWS\system32\drivers\amon.sys [AUTO] AMON
Service [DISABLED] amsint
Service C:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt
Service [DISABLED] asc
Service [DISABLED] asc3350p
Service [DISABLED] asc3550
Service ASP.NET
Service ASP.NET_1.1.4322
Service C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [MANUAL] aspnet_state
Service C:\WINDOWS\system32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac
Service C:\WINDOWS\system32\DRIVERS\atapi.sys [BOOT] atapi
Service [DISABLED] Atdisk
Service C:\WINDOWS\system32\Ati2evxx.exe [AUTO] Ati HotKey Poller
Service C:\WINDOWS\system32\ati2sgag.exe [AUTO] ATI Smart
Service C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [MANUAL] ati2mtag
Service C:\WINDOWS\system32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc
Service C:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv
Service C:\WINDOWS\system32\DRIVERS\audstub.sys [MANUAL] audstub
Service BattC
Service [SYSTEM] Beep
Service C:\WINDOWS\system32\svchost.exe [AUTO] BITS
Service C:\WINDOWS\system32\svchost.exe [AUTO] Browser
Service [DISABLED] cbidf2k
Service [DISABLED] cd20xrnt
Service [SYSTEM] Cdaudio
Service [DISABLED] Cdfs
Service C:\WINDOWS\system32\DRIVERS\cdrom.sys [SYSTEM] Cdrom
Service [SYSTEM] Changer
Service C:\WINDOWS\system32\cisvc.exe [MANUAL] CiSvc
Service C:\WINDOWS\system32\clipsrv.exe [DISABLED] ClipSrv
Service [DISABLED] CmdIde
Service C:\WINDOWS\system32\dllhost.exe [MANUAL] COMSysApp
Service ContentFilter
Service ContentIndex
Service [DISABLED] Cpqarray
Service C:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc
Service [DISABLED] dac2w2k
Service [DISABLED] dac960nt
Service C:\WINDOWS\system32\svchost.exe [AUTO] DcomLaunch
Service D:\Program Files\sXe Injected\ddsxei.sys [MANUAL] ddsxeiservice
Service C:\WINDOWS\system32\svchost.exe [AUTO] Dhcp
Service C:\WINDOWS\system32\DRIVERS\disk.sys [BOOT] Disk
Service C:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin
Service C:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot
Service C:\WINDOWS\System32\drivers\dmio.sys [DISABLED] dmio
Service C:\WINDOWS\System32\drivers\dmload.sys [DISABLED] dmload
Service C:\WINDOWS\System32\svchost.exe [MANUAL] dmserver
Service C:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic
Service C:\WINDOWS\system32\svchost.exe [AUTO] Dnscache
Service [DISABLED] dpti2o
Service C:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud
Service C:\WINDOWS\System32\svchost.exe [AUTO] ERSvc
Service C:\WINDOWS\system32\services.exe [AUTO] Eventlog
Service C:\WINDOWS\system32\svchost.exe [MANUAL] EventSystem
Service [DISABLED] Fastfat
Service C:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility
Service C:\WINDOWS\system32\DRIVERS\fdc.sys [MANUAL] Fdc
Service [SYSTEM] Fips
Service C:\WINDOWS\system32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk
Service C:\WINDOWS\system32\DRIVERS\fltMgr.sys [BOOT] FltMgr
Service [SYSTEM] Fs_Rec
Service C:\WINDOWS\system32\DRIVERS\ftdisk.sys [BOOT] Ftdisk
Service E:\Fxdrv.sys [MANUAL] FXDRV
Service C:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer
Service C:\WINDOWS\system32\DRIVERS\msgpc.sys [MANUAL] Gpc
Service C:\WINDOWS\System32\svchost.exe [AUTO] helpsvc
Service C:\WINDOWS\System32\svchost.exe [AUTO] HidServ
Service C:\WINDOWS\system32\DRIVERS\hidusb.sys [/code:1:c9520c1

**Posty:** 18165 · przez **wojtas** 19 Maj 2007, 15:50

wklej caly 2 log

**Posty:** 39 · przez **Rashed** 19 Maj 2007, 16:21

To jest caly drugi log:

Kod: Zaznacz wszystko: GMER 1.0.12.12244 - http://www.gmer.net Rootkit scan 2007-05-19 16:04:43 Windows 5.1.2600 Dodatek Service Pack 2 ---- Services - GMER 1.0.12 ---- Service .NET CLR Data Service .NET CLR Networking Service .NETFramework Service [DISABLED] Abiosdsk Service [DISABLED] abp480n5 Service C:\WINDOWS\system32\DRIVERS\ACPI.sys [BOOT] ACPI Service [DISABLED] ACPIEC Service C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [MANUAL] Adobe LM Service Service [DISABLED] adpu160m Service C:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec Service C:\WINDOWS\System32\drivers\afd.sys [SYSTEM] AFD Service C:\WINDOWS\system32\DRIVERS\agp440.sys [BOOT] agp440 Service [DISABLED] Aha154x Service [DISABLED] aic78u2 Service [DISABLED] aic78xx Service C:\WINDOWS\system32\drivers\ALCXSENS.SYS [MANUAL] ALCXSENS Service C:\WINDOWS\system32\drivers\ALCXWDM.SYS [MANUAL] ALCXWDM Service C:\WINDOWS\system32\svchost.exe [DISABLED] Alerter Service C:\WINDOWS\System32\alg.exe [MANUAL] ALG Service [DISABLED] AliIde Service C:\WINDOWS\system32\drivers\amon.sys [AUTO] AMON Service [DISABLED] amsint Service C:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt Service [DISABLED] asc Service [DISABLED] asc3350p Service [DISABLED] asc3550 Service ASP.NET Service ASP.NET_1.1.4322 Service C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [MANUAL] aspnet_state Service C:\WINDOWS\system32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac Service C:\WINDOWS\system32\DRIVERS\atapi.sys [BOOT] atapi Service [DISABLED] Atdisk Service C:\WINDOWS\system32\Ati2evxx.exe [AUTO] Ati HotKey Poller Service C:\WINDOWS\system32\ati2sgag.exe [AUTO] ATI Smart Service C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [MANUAL] ati2mtag Service C:\WINDOWS\system32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc Service C:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv Service C:\WINDOWS\system32\DRIVERS\audstub.sys [MANUAL] audstub Service BattC Service [SYSTEM] Beep Service C:\WINDOWS\system32\svchost.exe [AUTO] BITS Service C:\WINDOWS\system32\svchost.exe [AUTO] Browser Service [DISABLED] cbidf2k Service [DISABLED] cd20xrnt Service [SYSTEM] Cdaudio Service [DISABLED] Cdfs Service C:\WINDOWS\system32\DRIVERS\cdrom.sys [SYSTEM] Cdrom Service [SYSTEM] Changer Service C:\WINDOWS\system32\cisvc.exe [MANUAL] CiSvc Service C:\WINDOWS\system32\clipsrv.exe [DISABLED] ClipSrv Service [DISABLED] CmdIde Service C:\WINDOWS\system32\dllhost.exe [MANUAL] COMSysApp Service ContentFilter Service ContentIndex Service [DISABLED] Cpqarray Service C:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc Service [DISABLED] dac2w2k Service [DISABLED] dac960nt Service C:\WINDOWS\system32\svchost.exe [AUTO] DcomLaunch Service D:\Program Files\sXe Injected\ddsxei.sys [MANUAL] ddsxeiservice Service C:\WINDOWS\system32\svchost.exe [AUTO] Dhcp Service C:\WINDOWS\system32\DRIVERS\disk.sys [BOOT] Disk Service C:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin Service C:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot Service C:\WINDOWS\System32\drivers\dmio.sys [DISABLED] dmio Service C:\WINDOWS\System32\drivers\dmload.sys [DISABLED] dmload Service C:\WINDOWS\System32\svchost.exe [MANUAL] dmserver Service C:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic Service C:\WINDOWS\system32\svchost.exe [AUTO] Dnscache Service [DISABLED] dpti2o Service C:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud Service C:\WINDOWS\System32\svchost.exe [AUTO] ERSvc Service C:\WINDOWS\system32\services.exe [AUTO] Eventlog Service C:\WINDOWS\system32\svchost.exe [MANUAL] EventSystem Service [DISABLED] Fastfat Service C:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility Service C:\WINDOWS\system32\DRIVERS\fdc.sys [MANUAL] Fdc Service [SYSTEM] Fips Service C:\WINDOWS\system32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk Service C:\WINDOWS\system32\DRIVERS\fltMgr.sys [BOOT] FltMgr Service [SYSTEM] Fs_Rec Service C:\WINDOWS\system32\DRIVERS\ftdisk.sys [BOOT] Ftdisk Service E:\Fxdrv.sys [MANUAL] FXDRV Service C:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer Service C:\WINDOWS\system32\DRIVERS\msgpc.sys [MANUAL] Gpc Service C:\WINDOWS\System32\svchost.exe [AUTO] helpsvc Service C:\WINDOWS\System32\svchost.exe [AUTO] HidServ Service C:\WINDOWS\system32\DRIVERS\hidusb.sys [MANUAL] HidUsb Service [DISABLED] hpn Service C:\WINDOWS\System32\Drivers\HTTP.sys [MANUAL] HTTP Service C:\WINDOWS\System32\svchost.exe [MANUAL] HTTPFilter Service [SYSTEM] i2omgmt Service [DISABLED] i2omp Service C:\WINDOWS\system32\DRIVERS\i8042prt.sys [SYSTEM] i8042prt Service C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [MANUAL] IDriverT Service C:\WINDOWS\system32\DRIVERS\imapi.sys [SYSTEM] Imapi Service C:\WINDOWS\system32\imapi.exe [MANUAL] ImapiService Service inetaccs Service [DISABLED] ini910u Service Inport Service C:\WINDOWS\system32\DRIVERS\intelide.sys [BOOT] IntelIde Service C:\WINDOWS\system32\DRIVERS\intelppm.sys [SYSTEM] intelppm Service C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys [MANUAL] Ip6Fw Service C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver Service C:\WINDOWS\system32\DRIVERS\ipinip.sys [MANUAL] IpInIp Service C:\WINDOWS\system32\DRIVERS\ipnat.sys [MANUAL] IpNat Service C:\WINDOWS\system32\DRIVERS\ipsec.sys [SYSTEM] IPSec Service C:\WINDOWS\system32\DRIVERS\irenum.sys [MANUAL] IRENUM Service ISAPISearch Service C:\WINDOWS\system32\DRIVERS\isapnp.sys [BOOT] isapnp Service C:\WINDOWS\system32\DRIVERS\kbdclass.sys [SYSTEM] Kbdclass Service C:\WINDOWS\system32\drivers\kmixer.sys [MANUAL] kmixer Service [BOOT] KSecDD Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanserver Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanworkstation Service [SYSTEM] lbrtfdc Service ldap Service LicenseService Service C:\WINDOWS\system32\svchost.exe [AUTO] LmHosts Service C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [AUTO] MDM Service C:\WINDOWS\system32\svchost.exe [DISABLED] Messenger Service [SYSTEM] mnmdd Service C:\WINDOWS\system32\mnmsrvc.exe [MANUAL] mnmsrvc Service [MANUAL] Modem Service C:\WINDOWS\system32\DRIVERS\mouclass.sys [SYSTEM] Mouclass Service C:\WINDOWS\system32\DRIVERS\mouhid.sys [MANUAL] mouhid Service [BOOT] MountMgr Service [DISABLED] mraid35x Service C:\WINDOWS\system32\DRIVERS\mrxdav.sys [MANUAL] MRxDAV Service C:\WINDOWS\system32\DRIVERS\mrxsmb.sys [SYSTEM] MRxSmb Service C:\WINDOWS\system32\msdtc.exe [MANUAL] MSDTC Service [SYSTEM] Msfs Service C:\WINDOWS\system32\msiexec.exe [MANUAL] MSIServer Service C:\WINDOWS\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV Service C:\WINDOWS\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK Service C:\WINDOWS\system32\drivers\MSPQM.sys [MANUAL] MSPQM Service C:\WINDOWS\system32\DRIVERS\mssmbios.sys [MANUAL] mssmbios Service [BOOT] Mup Service [BOOT] NDIS Service C:\WINDOWS\system32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi Service C:\WINDOWS\system32\DRIVERS\ndisuio.sys [MANUAL] Ndisuio Service C:\WINDOWS\system32\DRIVERS\ndiswan.sys [MANUAL] NdisWan Service [MANUAL] NDProxy Service C:\WINDOWS\system32\DRIVERS\netbios.sys [SYSTEM] NetBIOS Service C:\WINDOWS\system32\DRIVERS\netbt.sys [SYSTEM] NetBT Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDE Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDEdsdm Service C:\WINDOWS\system32\lsass.exe [MANUAL] Netlogon Service C:\WINDOWS\System32\svchost.exe [MANUAL] Netman Service C:\WINDOWS\system32\svchost.exe [MANUAL] Nla Service C:\WINDOWS\system32\drivers\nod32drv.sys [SYSTEM] nod32drv Service D:\Program Files\Eset\nod32krn.exe [AUTO] NOD32krn Service [SYSTEM] Npfs Service D:\Program Files\Lineage II\system\npkcrypt.sys [MANUAL] npkcrypt Service [DISABLED] Ntfs Service C:\WINDOWS\system32\lsass.exe [MANUAL] NtLmSsp Service C:\WINDOWS\system32\svchost.exe [MANUAL] NtmsSvc Service [SYSTEM] Null Service C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt Service C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd Service C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [MANUAL] ose Service Outlook Service C:\WINDOWS\system32\DRIVERS\parport.sys [MANUAL] Parport Service [BOOT] PartMgr Service [AUTO] ParVdm Service C:\WINDOWS\system32\DRIVERS\pci.sys [BOOT] PCI Service [SYSTEM] PCIDump Service C:\WINDOWS\system32\DRIVERS\pciide.sys [BOOT] PCIIde Service [DISABLED] Pcmcia Service [MANUAL] PDCOMP Service [MANUAL] PDFRAME Service [MANUAL] PDRELI Service [MANUAL] PDRFRAME Service [DISABLED] perc2 Service [DISABLED] perc2hib Service PerfDisk Service PerfNet Service PerfOS Service PerfProc Service C:\WINDOWS\system32\services.exe [AUTO] PlugPlay Service C:\WINDOWS\system32\lsass.exe [AUTO] PolicyAgent Service C:\WINDOWS\system32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport Service C:\WINDOWS\system32\lsass.exe [AUTO] ProtectedStorage Service C:\WINDOWS\system32\DRIVERS\psched.sys [MANUAL] PSched Service C:\WINDOWS\system32\DRIVERS\ptilink.sys [MANUAL] Ptilink Service C:\WINDOWS\System32\Drivers\PxHelp20.sys [BOOT] PxHelp20 Service [DISABLED] ql1080 Service [DISABLED] Ql10wnt Service [DISABLED] ql12160 Service [DISABLED] ql1240 Service [DISABLED] ql1280 Service C:\WINDOWS\system32\DRIVERS\qv2kux.sys [MANUAL] QV2KUX Service C:\WINDOWS\system32\DRIVERS\rasacd.sys [SYSTEM] RasAcd Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasAuto Service C:\WINDOWS\system32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasMan Service C:\WINDOWS\system32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe Service C:\WINDOWS\system32\DRIVERS\raspti.sys [MANUAL] Raspti Service C:\WINDOWS\system32\DRIVERS\rdbss.sys [SYSTEM] Rdbss Service C:\WINDOWS\System32\DRIVERS\RDPCDD.sys [SYSTEM] RDPCDD Service RDPDD Service RDPNP Service [MANUAL] RDPWD Service C:\WINDOWS\system32\sessmgr.exe [MANUAL] RDSessMgr Service C:\WINDOWS\system32\DRIVERS\redbook.sys [SYSTEM] redbook Service C:\WINDOWS\system32\svchost.exe [DISABLED] RemoteAccess Service C:\WINDOWS\system32\locator.exe [MANUAL] RpcLocator Service C:\WINDOWS\system32\svchost.exe [AUTO] RpcSs Service C:\WINDOWS\system32\rsvp.exe [MANUAL] RSVP Service C:\WINDOWS\system32\DRIVERS\Rtlnic51.sys [MANUAL] RTL8023 Service C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [MANUAL] rtl8139 Service C:\WINDOWS\system32\lsass.exe [AUTO] SamSs Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardSvr Service C:\WINDOWS\System32\svchost.exe [AUTO] Schedule Service C:\WINDOWS\system32\DRIVERS\secdrv.sys [AUTO] Secdrv Service C:\WINDOWS\System32\svchost.exe [AUTO] seclogon Service C:\WINDOWS\system32\svchost.exe [AUTO] SENS Service C:\WINDOWS\system32\DRIVERS\serenum.sys [MANUAL] serenum Service C:\WINDOWS\system32\DRIVERS\serial.sys [SYSTEM] Serial Service [SYSTEM] Sfloppy Service C:\WINDOWS\system32\svchost.exe [AUTO] SharedAccess Service C:\WINDOWS\System32\svchost.exe [AUTO] ShellHWDetection Service [DISABLED] Simbad Service [DISABLED] Sparrow Service C:\WINDOWS\system32\drivers\splitter.sys [MANUAL] splitter Service C:\WINDOWS\system32\spoolsv.exe [AUTO] Spooler Service C:\WINDOWS\System32\Drivers\sptd.sys [BOOT] sptd Service C:\WINDOWS\system32\DRIVERS\sr.sys [BOOT] sr Service C:\WINDOWS\system32\ZoneLabs\srescan.sys [BOOT] srescan Service C:\WINDOWS\system32\svchost.exe [AUTO] srservice Service C:\WINDOWS\system32\DRIVERS\srv.sys [MANUAL] Srv Service C:\WINDOWS\system32\svchost.exe [MANUAL] SSDPSRV Service C:\WINDOWS\system32\svchost.exe [MANUAL] stisvc Service C:\WINDOWS\system32\DRIVERS\swenum.sys [MANUAL] swenum Service C:\WINDOWS\system32\drivers\swmidi.sys [MANUAL] swmidi Service C:\WINDOWS\system32\dllhost.exe [MANUAL] SwPrv Service [DISABLED] symc810 Service [DISABLED] symc8xx Service [DISABLED] sym_hi Service [DISABLED] sym_u3 Service C:\WINDOWS\system32\drivers\sysaudio.sys [MANUAL] sysaudio Service C:\WINDOWS\system32\smlogsvc.exe [MANUAL] SysmonLog Service C:\WINDOWS\System32\svchost.exe [MANUAL] TapiSrv Service C:\WINDOWS\system32\DRIVERS\tcpip.sys [SYSTEM] Tcpip Service [MANUAL] TDPIPE Service [MANUAL] TDTCP Service C:\WINDOWS\system32\DRIVERS\termdd.sys [SYSTEM] TermDD Service C:\WINDOWS\System32\svchost.exe [MANUAL] TermService Service C:\WINDOWS\System32\svchost.exe [AUTO] Themes Service [DISABLED] TosIde Service C:\WINDOWS\system32\svchost.exe [AUTO] TrkWks Service TSDDD Service [DISABLED] Udfs Service [DISABLED] ultra Service C:\WINDOWS\system32\DRIVERS\update.sys [MANUAL] Update Service C:\WINDOWS\system32\svchost.exe [MANUAL] upnphost Service C:\WINDOWS\System32\ups.exe [MANUAL] UPS Service C:\WINDOWS\system32\DRIVERS\usbccgp.sys [MANUAL] usbccgp Service C:\WINDOWS\system32\DRIVERS\usbehci.sys [MANUAL] usbehci Service C:\WINDOWS\system32\DRIVERS\usbhub.sys [MANUAL] usbhub Service C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [MANUAL] USBSTOR Service C:\WINDOWS\system32\DRIVERS\usbuhci.sys [MANUAL] usbuhci Service C:\WINDOWS\System32\svchost.exe [MANUAL] usprserv Service C:\WINDOWS\System32\drivers\vga.sys [SYSTEM] VgaSave Service [DISABLED] ViaIde Service [BOOT] VolSnap Service C:\WINDOWS\System32\vsdatant.sys [SYSTEM] vsdatant Service C:\WINDOWS\system32\ZoneLabs\vsmon.exe [AUTO] vsmon Service C:\WINDOWS\System32\vssvc.exe [MANUAL] VSS Service C:\WINDOWS\System32\svchost.exe [AUTO] W32Time Service W3SVC Service C:\WINDOWS\system32\DRIVERS\wanarp.sys [MANUAL] Wanarp Service [MANUAL] WDICA Service C:\WINDOWS\system32\drivers\wdmaud.sys [MANUAL] wdmaud Service C:\WINDOWS\system32\svchost.exe [AUTO] WebClient Service C:\WINDOWS\system32\svchost.exe [AUTO] winmgmt Service [MANUAL] Winsock Service WinSock2 Service WinTrust Service C:\WINDOWS\System32\svchost.exe [MANUAL] WmdmPmSN Service WmiApRpl Service C:\WINDOWS\system32\wbem\wmiapsrv.exe [MANUAL] WmiApSrv Service C:\Program Files\Windows Media Player\WMPNetwk.exe [MANUAL] WMPNetworkSvc Service C:\WINDOWS\System32\drivers\ws2ifsl.sys [SYSTEM] WS2IFSL Service C:\WINDOWS\System32\svchost.exe [AUTO] wscsvc Service C:\WINDOWS\system32\svchost.exe [AUTO] wuauserv Service C:\WINDOWS\system32\DRIVERS\WudfPf.sys [MANUAL] WudfPf Service C:\WINDOWS\system32\DRIVERS\wudfrd.sys [MANUAL] WudfRd Service C:\WINDOWS\system32\svchost.exe [MANUAL] WudfSvc Service C:\WINDOWS\System32\svchost.exe [AUTO] WZCSVC Service C:\WINDOWS\System32\svchost.exe [MANUAL] xmlprov Service {161398FC-CA15-442D-B7CC-B2D1FD16DC87} Service [MANUAL] a4owp287 ---- EOF - GMER 1.0.12 ----

**Posty:** 18165 · przez **wojtas** 19 Maj 2007, 16:27

w logu nic nie ma juz

**Posty:** 39 · przez **Rashed** 19 Maj 2007, 16:31

a masz moze jakis pomysl??

**Posty:** 18165 · przez **wojtas** 19 Maj 2007, 16:55

to cos ze sprzetem komputerowym nie wina wirusow

prosze o sprawdzenie loga (problem)

Prosze o sprawdzenie loga (problem)

Kto jest na forum