Maniac - моля за помощ на поредната жертва на Skype вируса [РЕШЕН] - Страница 2 - Премахване на зловреден софтуер - Kaldata.com

14 януари 201016 г.

Автор

Такаааа

1. CombiFixa се инсталира, тръгна да инсталира и Recovery Console но тъй като не хвана интернет продължи и без нея.

2. На следващия етап засече Rootkit Activity и рестартна машината

3. Направи си всички stages и пак рестартира.

4. Изрева, че не може да намери Win32\Combofix.sys или нещо подобно и каза да не мърдам докато не генерира репорт.

Ето го и него:

ComboFix 10-01-13.0C - Administrator 01.2010 г. 18:23:34.3.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1251.359.1033.18.511.295 [GMT 2:00]

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((( Files Created from 2009-12-14 to 2010-01-14 )))))))))))))))))))))))))))))))

.

2010-01-14 15:47 . 2010-01-14 15:47 388096 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe

2010-01-14 15:47 . 2010-01-14 15:47 -------- d-----w- c:\program files\TrendMicro

2010-01-14 15:46 . 2010-01-14 15:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Panda Security

2010-01-14 15:46 . 2010-01-14 15:46 -------- d-----w- c:\program files\Panda USB Vaccine

2010-01-11 20:04 . 2009-03-30 07:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys

2010-01-11 20:04 . 2009-02-13 09:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys

2010-01-11 20:04 . 2009-02-13 09:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys

2010-01-11 20:04 . 2010-01-11 20:04 -------- d-----w- c:\program files\Avira

2010-01-11 20:04 . 2010-01-11 20:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira

2010-01-11 19:54 . 2010-01-11 19:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files

2010-01-11 19:43 . 2010-01-11 19:43 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2010-01-11 19:43 . 2010-01-07 14:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-11 19:43 . 2010-01-11 19:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-01-11 19:43 . 2010-01-07 14:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-11 09:36 . 2010-01-11 09:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab

2010-01-06 18:13 . 2010-01-11 19:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-01-06 18:04 . 2010-01-11 13:06 -------- d-----w- C:\_OTL

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-13 16:21 . 2005-01-14 02:26 -------- d-----w- c:\program files\Broadcom

2010-01-13 15:26 . 2005-04-29 08:01 70320 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-01-11 19:41 . 2005-01-14 02:25 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-01-11 18:07 . 2005-04-20 12:07 -------- d-----w- c:\program files\WinISO

2010-01-11 18:07 . 2005-06-22 07:01 -------- d-----w- c:\program files\Microsoft.NET

2010-01-11 18:06 . 2005-03-23 18:34 -------- d-----w- c:\program files\Microsoft SQL Server

2010-01-11 18:05 . 2005-06-22 07:01 -------- d-----w- c:\program files\Microsoft ActiveSync

2010-01-11 18:05 . 2005-01-14 02:11 -------- d-----w- c:\program files\microsoft frontpage

2010-01-11 18:04 . 2005-01-14 02:20 -------- d-----w- c:\program files\Java

2010-01-11 18:04 . 2007-07-20 13:35 -------- d-----w- c:\program files\SA Dictionary 2005 T2

2010-01-11 18:04 . 2005-03-24 08:02 -------- d-----w- c:\program files\Satellite Forms EE Redist

2010-01-11 18:04 . 2005-03-26 09:45 -------- d-----w- c:\program files\SA

2010-01-11 18:04 . 2005-03-23 09:00 -------- d-----w- c:\program files\Program Shortcuts

2010-01-11 18:04 . 2006-11-15 01:01 -------- d-----w- c:\program files\MSXML 4.0

2010-01-11 18:04 . 2009-04-06 07:06 -------- d-----w- c:\program files\HP

2010-01-11 18:03 . 2006-04-14 06:24 -------- d-----w- c:\program files\Hewlett-Packard

2010-01-11 18:03 . 2005-03-23 17:49 -------- d-----w- c:\program files\D-Tools

2010-01-11 18:03 . 2005-06-03 14:34 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2010-01-11 18:03 . 2005-01-14 02:29 -------- d-----w- c:\program files\Compaq

2010-01-11 18:03 . 2005-01-14 02:28 -------- d-----w- c:\program files\Common Files\Symantec Shared

2010-01-11 18:03 . 2009-11-16 11:20 -------- d-----w- c:\program files\Common Files\Skype

2010-01-11 18:03 . 2009-03-30 06:54 -------- d-----w- c:\program files\Common Files\Softwin

2010-01-11 18:03 . 2005-03-24 08:02 -------- d-----w- c:\program files\Common Files\Satellite Forms EE

2010-01-11 18:03 . 2005-06-28 13:55 -------- d-----w- c:\program files\Common Files\PCSuite

2010-01-11 18:03 . 2005-06-28 13:55 -------- d-----w- c:\program files\Common Files\Nokia

2010-01-11 18:02 . 2006-11-01 11:05 -------- d-----w- c:\program files\Common Files\Lectra

2010-01-11 18:02 . 2005-01-14 02:20 -------- d-----w- c:\program files\Common Files\Java

2010-01-11 18:02 . 2005-01-14 02:25 -------- d-----w- c:\program files\Common Files\InstallShield

2010-01-11 18:02 . 2005-06-03 15:24 -------- d-----w- c:\program files\Common Files\Ahead

2010-01-11 18:02 . 2005-03-31 07:41 -------- d-----w- c:\program files\Common Files\Adobe

2010-01-11 18:02 . 2005-05-03 10:06 -------- d-----w- c:\program files\Citrix

2010-01-11 18:02 . 2005-03-30 08:23 -------- d-----w- c:\program files\ATI Technologies

2010-01-11 18:01 . 2005-01-14 02:27 -------- d-----w- c:\program files\HPQ

2010-01-11 18:01 . 2005-01-14 02:25 -------- d-----w- c:\program files\Analog Devices

2010-01-11 17:34 . 2007-09-23 09:10 -------- d-----w- c:\documents and settings\plovdiv\Application Data\Symantec

2010-01-11 17:34 . 2007-09-23 09:11 -------- d-----w- c:\documents and settings\plovdiv\Application Data\PC Suite

2010-01-11 17:34 . 2007-09-23 09:11 -------- d-----w- c:\documents and settings\plovdiv\Application Data\Hamachi

2010-01-11 17:34 . 2005-06-04 07:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Ulead Systems

2010-01-11 17:34 . 2005-01-14 02:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec

2010-01-11 17:33 . 2009-04-06 07:06 -------- d-----w- c:\documents and settings\All Users\Application Data\HPSSUPPLY

2010-01-11 17:33 . 2006-04-14 07:44 -------- d-----w- c:\documents and settings\All Users\Application Data\ACD Systems

2010-01-11 17:28 . 2006-01-28 10:13 -------- d-----w- c:\documents and settings\Administrator\Application Data\Talkback

2010-01-11 17:28 . 2005-01-14 02:28 -------- d-----w- c:\documents and settings\Administrator\Application Data\Symantec

2010-01-11 17:28 . 2005-11-01 14:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\SolidDocuments

2010-01-11 17:27 . 2005-08-19 15:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\Skype

2010-01-11 17:27 . 2005-06-28 14:06 -------- d-----w- c:\documents and settings\Administrator\Application Data\Nokia

2010-01-11 17:27 . 2005-06-28 13:56 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Suite

2010-01-11 17:27 . 2009-01-12 16:26 -------- d-----w- c:\documents and settings\Administrator\Application Data\Netscape

2010-01-11 17:26 . 2005-03-24 07:41 -------- d-----w- c:\documents and settings\Administrator\Application Data\Microsoft Web Folders

2010-01-11 17:26 . 2009-04-06 07:05 -------- d-----w- c:\documents and settings\Administrator\Application Data\Hewlett-Packard

2010-01-11 17:26 . 2005-05-03 10:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\ICAClient

2010-01-11 17:26 . 2009-01-12 16:26 -------- d-----w- c:\documents and settings\Administrator\Application Data\Citrix

2009-11-16 11:21 . 2009-11-16 11:21 48 ---ha-w- c:\windows\system32\ezsidmv.dat

2009-11-14 13:06 . 2009-11-14 13:06 59992 ----a-w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 2010 9.0.0.736\English\setup.exe

2005-08-16 14:04 . 2006-04-18 09:44 35840 -c--a-w- c:\program files\winbox.exe

2005-09-15 15:26 . 2006-01-28 10:13 94208 ----a-w- c:\program files\mozilla firefox\components\BrandRes.dll

2005-09-15 15:26 . 2006-01-28 10:13 150912 ----a-w- c:\program files\mozilla firefox\components\fullsoft.dll

2005-09-15 15:26 . 2006-01-28 10:13 41573 ----a-w- c:\program files\mozilla firefox\components\jar50.dll

2005-09-15 15:26 . 2006-01-28 10:13 48223 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll

2005-09-15 15:26 . 2006-01-28 10:13 8813 ----a-w- c:\program files\mozilla firefox\components\qfaservices.dll

2005-09-15 15:26 . 2006-01-28 10:13 160871 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll

2008-03-13 15:04 . 2008-03-13 15:04 27976 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll

2008-03-13 15:04 . 2008-03-13 15:04 125848 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll

2008-03-13 15:04 . 2008-03-13 15:04 46408 ----a-w- c:\program files\mozilla firefox\plugins\atmccli.dll

2008-03-13 15:04 . 2008-03-13 15:04 98712 ----a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll

2007-08-06 09:07 . 2009-01-08 07:15 8784 ----a-w- c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll

2007-07-18 11:54 . 2009-01-08 07:15 245408 ----a-w- c:\program files\mozilla firefox\plugins\unicows.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 110592]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 0 (0x0)

"EnableInstallerDetection"= 0 (0x0)

"EnableSecureUIAPaths"= 0 (0x0)

"EnableVirtualization"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Hamachi (2).lnk]

path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\Hamachi (2).lnk

backup=c:\windows\pss\Hamachi (2).lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^Skype.lnk]

path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\Skype.lnk

backup=c:\windows\pss\Skype.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk

backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hamachi.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hamachi.lnk

backup=c:\windows\pss\hamachi.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP LaserJet Director.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP LaserJet Director.lnk

backup=c:\windows\pss\HP LaserJet Director.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]

2009-09-24 14:11 2356088 ----a-w- c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]

2004-08-12 18:10 339968 ----a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]

2003-10-02 00:20 81920 ----a-w- c:\program files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP AutoIndexer]

2002-04-22 09:57 90112 ----a-w- c:\program files\Hewlett-Packard\LaserJet 33xx\hppautoindexer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP SchedIndexer]

2002-04-22 09:56 94208 ----a-w- c:\program files\Hewlett-Packard\LaserJet 33xx\hppschedindexer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2004-10-13 16:24 1694208 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2001-07-09 08:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetRefresh]

2003-11-20 18:01 525824 ----a-w- c:\program files\Compaq\SetRefresh\SetRefresh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]

2003-07-30 17:08 143360 ----a-w- c:\program files\Analog Devices\SoundMAX\SMTray.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Palm\\HOTSYNC.EXE"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 pnpshark;pnpshark;c:\windows\system32\drivers\pnpshark.sys [02.10.2003 г. 03:16 119552]

R0 st3shark;st3shark;c:\windows\system32\drivers\st3shark.sys [27.9.2003 г. 14:37 5504]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11.1.2010 г. 22:04 108289]

S3 MA-660;Mobile Action MA-660 USB Infrared Adapter;c:\windows\system32\drivers\MA-660.sys [28.6.2005 г. 13:58 27136]

.

Contents of the 'Scheduled Tasks' folder

2010-01-14 c:\windows\Tasks\PandaUSBVaccine.job

- c:\program files\Panda USB Vaccine\RunInteractiveWin.exe [2010-01-14 14:45]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.lectra.com/

mStart Page = hxxp://go.compaq.com/1Q00CDT/0409/bl7.asp

mSearch Bar = hxxp://go.compaq.com/1Q00CDT/0409/bl8.asp

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

Trusted Zone: lectra.com\gateway

DPF: {2E687AA8-B276-4910-BBFB-4E412F685379} - hxxp://shamal.eu.lectra.com/WebsiteViewerRoot/WebsiteViewer.cab

DPF: {EBC1356E-7D5E-44EC-831D-847882F06FE5} - hxxps://gateway.lectra.com/lectra/cds/CGC/en/CSGProxy.cab

FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\xhwszpi8.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://mirofashion.com/home.htm

FF - component: c:\program files\Mozilla Firefox\components\qfaservices.dll

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("backups.number_of_prefs_copies", 1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.link.open_newwindow.ui", 3); // prefs UI version

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.closed", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.document", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.frames", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.history", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.length", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.opener", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.parent", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.self", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.top", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.default.Window.window", "allAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.disable_window_open_feature.status", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("advanced.always_load_images", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.protocol-handler.external.help", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.connect.timeout", 30); // in seconds

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.request.timeout", 120); // in seconds

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN_show_punycode", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.image.imageBehavior", 0); // 0-Accept, 1-dontAcceptForeign, 2-dontUse

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.cookieBehavior", 3); // 0-Accept, 1-dontAcceptForeign, 2-dontUse, 3-p3p

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.id", "{ec8030f7-c20a-464f-9b0e-13a3a9e97384}");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.version",

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.extensions.version", "1.0");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.build_id",

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.update.autoUpdateEnabled", true); // Whether or not background app updates

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.update.url", "chrome://mozapps/locale/update/update.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.update.updatesAvailable", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.update.lastUpdateDate", 0); // UTC offset when last App update was

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("app.update.performed", false); // Whether or not an update has been

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.autoUpdateEnabled", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.autoUpdate", false); // Automatically download and install

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.interval", 604800000); // Check for updates to Extensions and

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.lastUpdateDate", 0); // UTC offset when last Extension/Theme

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.severity.threshold", 5);// The number of pending Extension/Theme

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.update.count", 0); // The number of extension/theme/etc

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("update.interval", 3600000); // Check each of the above intervals

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("update.showSlidingNotification", true); // Windows-only slide-up taskbar

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("update.severity", 0);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("general.useragent.vendor", "Firefox");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("general.useragent.vendorSub",

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.update.resetHomepage", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.startup.homepage_override.1", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.turbo.enabled", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://browser/content/searchconfig.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://browser/content/searchconfig.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("update_notifications.enabled", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("update_notifications.provider.0.frequency", 7); // number of days

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.xul.error_pages.enabled", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("pfs.datasource.url", "chrome://mozapps/locale/plugins/plugins.properties");

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-fpvjmafnv - bxppeevpjgzylokccrric.exe

HKLM-Run-mtwhhs - bxppeevpjgzylokccrric.exe

HKLM-Run-qdmdjaitescs - c:\docume~1\TEMP\LOCALS~1\Temp\bxppeevpjgzylokccrric.exe

HKLM-Explorer_Run-oxcpreip - ypcxhcodskysaypc.exe

HKLM-Explorer_Run-bhjts - c:\docume~1\TEMP\LOCALS~1\Temp\ypcxhcodskysaypc.exe

MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe

MSConfigStartUp-BDMCon - c:\progra~1\Softwin\BITDEF~1\bdmcon.exe

MSConfigStartUp-BDNewsAgent - c:\progra~1\Softwin\BITDEF~1\bdnagent.exe

MSConfigStartUp-BDOESRV - c:\program files\Softwin\BitDefender8\\bdoesrv.exe

MSConfigStartUp-BDSwitchAgent - c:\program files\Softwin\BitDefender8\\bdswitch.exe

MSConfigStartUp-Google Update - c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

MSConfigStartUp-LogMeIn GUI - c:\program files\LogMeIn\x86\LogMeInSystray.exe

MSConfigStartUp-Orb - c:\program files\Winamp Remote\bin\OrbTray.exe

MSConfigStartUp-PrnStatusMX - c:\program files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe

MSConfigStartUp-Skype - c:\program files\Skype\Phone\Skype.exe

MSConfigStartUp-WinampAgent - c:\program files\Winamp\wianmpa.exe

AddRemove-Adobe PageMaker 7.0 - c:\program files\Adobe\PageMaker 7.0\Uninst.isu

AddRemove-Adobe Photoshop 7.0 - c:\program files\Adobe\Photoshop 7.0\Uninst.isu

AddRemove-Bullzip PDF Printer_is1 - c:\program files\Bullzip\PDF Printer\unins000.exe

AddRemove-Gaberoff Koral German Dictionary 1.01 - c:\progra~1\GABERO~1\GABERO~1.0\UNWISE.EXE

AddRemove-GPL Ghostscript Lite_is1 - c:\program files\Bullzip\PDF Printer\gs\unins000.exe

AddRemove-Hamachi - c:\program files\Hamachi\uninstall.exe

AddRemove-Nero - Burning Rom!UninstallKey - c:\program files\Ahead\nero\uninstall\UNNERO.exe

AddRemove-RealVNC_is1 - c:\program files\RealVNC\VNC4\unins000.exe

AddRemove-SCREEN2EXE_is1 - c:\program files\SCREEN2EXE\unins000.exe

AddRemove-WinRAR archiver - c:\program files\WinRAR\uninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-14 18:31

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully

user: MBR read successfully

called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x82F75550]<<

kernel: MBR read successfully

detected MBR rootkit hooks:

\Driver\Disk -> CLASSPNP.SYS @ 0xf8539fc3

\Driver\ACPI -> ACPI.sys @ 0xf84accb8

\Driver\atapi -> 0x82f75550

IoDeviceObjectType ->\Device\Harddisk0\DR0 ->NDIS: Broadcom NetXtreme Gigabit Ethernet -> SendCompleteHandler -> NDIS.sys @ 0xf8314ba0

PacketIndicateHandler -> NDIS.sys @ 0xf8303a0b

SendHandler -> NDIS.sys @ 0xf8317b31

Warning: possible MBR rootkit infection !

user & kernel MBR OK

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(772)

c:\windows\system32\Ati2evxx.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\windows\system32\crypserv.exe

c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\program files\Analog Devices\SoundMAX\SMAgent.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Panda USB Vaccine\USBVaccine.exe

c:\windows\system32\wscntfy.exe

c:\progra~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE

c:\progra~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE

.

**************************************************************************

.

Completion time: 2010-01-14 18:36:45 - machine was rebooted

ComboFix-quarantined-files.txt 2010-01-14 16:36

Pre-Run: 59 334 676 480 bytes free

Post-Run: 59 369 304 064 bytes free

- - End Of File - - 6EA24ECAFE8F40D658A4BB38246A42CA

14 януари 201016 г.

СТЪПКА 1

Изтеглете TDSSKiller и го разархивирайте на вашия десктоп.

Сега отворете Notepad.exe и въведете:

@ECHO OFF

START /WAIT TDSSKILLER.exe -l Logit.txt -v

START Logit.txt

del %0

Запазете файла с име - fix.bat

Трябва да изглежда ето така -

Стартирайте го и публикувайте лог файла.

СТЪПКА 2

Моля, изтеглете mbr.exe и го запазете C:\ . (Важно е да го направите!).

Отворете Start -> Run и напишете: cmd /c mbr.exe -t >log.txt&start log.txt
Потвърдете с клавишния бутон Enter
Излезте от Command Prompt

Публикувайте лог файла.

14 януари 201016 г.

...
СТЪПКА 2

Моля, изтеглете mbr.exe и го запазете C:\ . (Важно е да го направите!).

Отворете Start -> Run и напишете: cmd /c mbr.exe -t >log.txt&start log.txt
Потвърдете с клавишния бутон Enter
Излезте от Command Prompt

Публикувайте лог файла.

Един ред от кода трябва малко да се пипне, защото така няма как да проработи:

cmd /c mbr.exe -t >log.txt&start log.txt

да стане:

cmd /c C:\mbr.exe -t >log.txt&start log.txt

Извинявам се за забележката, но предполагам, че е грешка от разсеяност.

1

14 януари 201016 г.

Не е грешка:

http://www.google.bg/search?hl=bg&source=hp&q=%22cmd+%2Fc+mbr.exe+-t+%3Elog.txt%26start+log.txt%22&btnG=Google+%D0%A2%D1%8A%D1%80%D1%81%D0%B5%D0%BD%D0%B5&meta=&aq=f&oq=

14 януари 201016 г.

Prompt-а, стартиран от Start -> Run -> cmd отива в pwd на текущият потребител.

Няма да споря, но бих попитал какво ще накара промпта да смени директорията с C:\?

Най-лесно е да се пробва!

ПС: Важна забележка е да се знае, че ако имате инсталирана и друга, различна от Win ОС, програмата ще ви посъветва:

Use "Recovery Console" command "fixmbr" to clear infection !

Това би затрило стартирането на други OS! Предупреждавам, за да няма изненадани.

2

14 януари 201016 г.

Prompt-а, стартиран от Start -> Run -> cmd отива в pwd на текущият потребител.
Няма да споря, но бих попитал какво ще накара промпта да смени директорията с C:\?
Най-лесно е да се пробва!

ПС: Важна забележка е да се знае, че ако имате инсталирана и друга, различна от Win ОС, програмата ще ви посъветва:
Use "Recovery Console" command "fixmbr" to clear infection !
Това би затрило стартирането на други OS! Предупреждавам, за да няма изненадани.

Наистина не спорете. Командата е правилна и съм я използвам неведнъж:

http://forum.avira.com/wbb/index.php?page=Thread&postID=882515#post882515

Мога да разчитам логове на MBR.exe, но благодаря за включването.

В случая след използването на TDSSkiller не очаквам да видя в лога "Use "Recovery Console" command "fixmbr" to clear infection !".

Очаквам да бъдет деактиривани драйверите на Daemon Tools и да видя съобщение от рода на:

device: opened successfully

user: MBR read successfully

called modules: >>UNKNOWN [0x........]<<

kernel: MBR read successfully

user & kernel MBR OK

1

14 януари 201016 г.

Автор

Здравейте с малко закъснение, но от време на време се налага и да хапва човек :lol6:

Доверявам се безрезервно на г-н Петков и ето двата лога:

За жалост вторият действително завърши с :

Use "Recovery Console" command "fixmbr" to clear infection !

Само да информирам, че втора ОС нямам на този комп.

Имам вече един Image.tib на машината с Acronis и backup на важните файлове. Мога да направя още един, ако трябва да се пуска fixmbr и каквото става да става вече

Само да вмъкна и че от форума по моделистика, който си чета От време на време един колега беше предложил същото решение: Нов вирус Chudo

22:50:15:890 3776 TDSS rootkit removing tool 2.2.2 Jan 13 2010 08:42:25

22:50:15:890 3776 ================================================================================

22:50:15:890 3776 SystemInfo:

22:50:15:890 3776 OS Version: 5.1.2600 ServicePack: 2.0

22:50:15:890 3776 Product type: Workstation

22:50:15:890 3776 ComputerName: HP24

22:50:15:890 3776 UserName: Administrator

22:50:15:890 3776 Windows directory: C:\windows

22:50:15:890 3776 Processor architecture: Intel x86

22:50:15:890 3776 Number of processors: 2

22:50:15:890 3776 Page size: 0x1000

22:50:15:890 3776 Boot type: Normal boot

22:50:15:890 3776 ================================================================================

22:50:15:890 3776 UnloadDriverW: NtUnloadDriver error 2

22:50:15:890 3776 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2

22:50:15:890 3776 MyNtCreateFileW: NtCreateFile(\??\C:\windows\system32\drivers\klmd.sys) returned status 00000000

22:50:15:937 3776 UtilityInit: KLMD drop and load success

22:50:15:937 3776 KLMD_OpenDevice: Trying to open KLMD Device(KLMD201000)

22:50:15:937 3776 UtilityInit: KLMD open success

22:50:15:937 3776 UtilityInit: Initialize success

22:50:15:937 3776

22:50:15:937 3776 Scanning Services ...

22:50:15:937 3776 CreateRegParser: Registry parser init started

22:50:15:937 3776 DisableWow64Redirection: GetProcAddress(Wow64DisableWow64FsRedirection) error 127

22:50:15:937 3776 CreateRegParser: DisableWow64Redirection error

22:50:15:937 3776 wfopen_ex: Trying to open file C:\windows\system32\config\system

22:50:15:937 3776 MyNtCreateFileW: NtCreateFile(\??\C:\windows\system32\config\system) returned status C0000043

22:50:15:937 3776 wfopen_ex: MyNtCreateFileW error 32 (C0000043)

22:50:15:937 3776 wfopen_ex: Trying to KLMD file open

22:50:15:937 3776 KLMD_CreateFileW: Trying to open file C:\windows\system32\config\system

22:50:15:937 3776 wfopen_ex: File opened ok (Flags 2)

22:50:15:937 3776 CreateRegParser: HIVE_ADAPTER(C:\windows\system32\config\system) init success: 9C4888

22:50:15:937 3776 wfopen_ex: Trying to open file C:\windows\system32\config\software

22:50:15:937 3776 MyNtCreateFileW: NtCreateFile(\??\C:\windows\system32\config\software) returned status C0000043

22:50:15:937 3776 wfopen_ex: MyNtCreateFileW error 32 (C0000043)

22:50:15:937 3776 wfopen_ex: Trying to KLMD file open

22:50:15:937 3776 KLMD_CreateFileW: Trying to open file C:\windows\system32\config\software

22:50:15:937 3776 wfopen_ex: File opened ok (Flags 2)

22:50:15:937 3776 CreateRegParser: HIVE_ADAPTER(C:\windows\system32\config\software) init success: 9C4930

22:50:15:937 3776 EnableWow64Redirection: GetProcAddress(Wow64RevertWow64FsRedirection) error 127

22:50:15:937 3776 CreateRegParser: EnableWow64Redirection error

22:50:15:937 3776 CreateRegParser: RegParser init completed

22:50:16:468 3776 GetAdvancedServicesInfo: Raw services enum returned 350 services

22:50:16:468 3776 fclose_ex: Trying to close file C:\windows\system32\config\system

22:50:16:468 3776 fclose_ex: Trying to close file C:\windows\system32\config\software

22:50:16:468 3776

22:50:16:468 3776 Scanning Kernel memory ...

22:50:16:468 3776 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk

22:50:16:468 3776 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 82F5BB80

22:50:16:468 3776 DetectCureTDL3: KLMD_GetDeviceObjectList returned 6 DevObjects

22:50:16:468 3776

22:50:16:468 3776 DetectCureTDL3: DEVICE_OBJECT: 829106E0

22:50:16:468 3776 KLMD_GetLowerDeviceObject: Trying to get lower device object for 829106E0

22:50:16:468 3776 KLMD_ReadMem: Trying to ReadMemory 0x829106E0[0x38]

22:50:16:468 3776 DetectCureTDL3: DRIVER_OBJECT: 82F5BB80

22:50:16:468 3776 KLMD_ReadMem: Trying to ReadMemory 0x82F5BB80[0xA8]

22:50:16:468 3776 KLMD_ReadMem: Trying to ReadMemory 0xE1009210[0x18]

22:50:16:468 3776 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk

22:50:16:468 3776 DetectCureTDL3: IrpHandler (0) addr: F853BC30

22:50:16:468 3776 DetectCureTDL3: IrpHandler (1) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (2) addr: F853BC30

22:50:16:468 3776 DetectCureTDL3: IrpHandler (3) addr: F8535D9B

22:50:16:468 3776 DetectCureTDL3: IrpHandler (4) addr: F8535D9B

22:50:16:468 3776 DetectCureTDL3: IrpHandler (5) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (6) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (7) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (8) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (9) addr: F8536366

22:50:16:468 3776 DetectCureTDL3: IrpHandler (10) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (11) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (12) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (13) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (14) addr: F853644D

22:50:16:468 3776 DetectCureTDL3: IrpHandler (15) addr: F8539FC3

22:50:16:468 3776 DetectCureTDL3: IrpHandler (16) addr: F8536366

22:50:16:468 3776 DetectCureTDL3: IrpHandler (17) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (18) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (19) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (20) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (21) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (22) addr: F8537EF3

22:50:16:468 3776 DetectCureTDL3: IrpHandler (23) addr: F853CA24

22:50:16:468 3776 DetectCureTDL3: IrpHandler (24) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (25) addr: 804F9709

22:50:16:468 3776 DetectCureTDL3: IrpHandler (26) addr: 804F9709

22:50:16:468 3776 TDL3_FileDetect: Processing driver: Disk

22:50:16:468 3776 TDL3_FileDetect: Processing driver file: C:\windows\system32\DRIVERS\disk.sys

22:50:16:468 3776 KLMD_CreateFileW: Trying to open file C:\windows\system32\DRIVERS\disk.sys

22:50:16:484 3776 TDL3_FileDetect: C:\windows\system32\DRIVERS\disk.sys - Verdict: Clean

22:50:16:484 3776

22:50:16:484 3776 DetectCureTDL3: DEVICE_OBJECT: 82677AB8

22:50:16:484 3776 KLMD_GetLowerDeviceObject: Trying to get lower device object for 82677AB8

22:50:16:484 3776 DetectCureTDL3: DEVICE_OBJECT: 8287D920

22:50:16:484 3776 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8287D920

22:50:16:484 3776 KLMD_ReadMem: Trying to ReadMemory 0x8287D920[0x38]

22:50:16:484 3776 DetectCureTDL3: DRIVER_OBJECT: 82E84A60

22:50:16:484 3776 KLMD_ReadMem: Trying to ReadMemory 0x82E84A60[0xA8]

22:50:16:484 3776 KLMD_ReadMem: Trying to ReadMemory 0xE12A8188[0x1E]

22:50:16:484 3776 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR

22:50:16:484 3776 DetectCureTDL3: IrpHandler (0) addr: F8842218

22:50:16:484 3776 DetectCureTDL3: IrpHandler (1) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (2) addr: F8842218

22:50:16:484 3776 DetectCureTDL3: IrpHandler (3) addr: F884223C

22:50:16:484 3776 DetectCureTDL3: IrpHandler (4) addr: F884223C

22:50:16:484 3776 DetectCureTDL3: IrpHandler (5) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (6) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (7) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (8) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (9) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (10) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (11) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (12) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (13) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (14) addr: F8842180

22:50:16:484 3776 DetectCureTDL3: IrpHandler (15) addr: F883D9E6

22:50:16:484 3776 DetectCureTDL3: IrpHandler (16) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (17) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (18) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (19) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (20) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (21) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (22) addr: F88415F0

22:50:16:484 3776 DetectCureTDL3: IrpHandler (23) addr: F883FA6E

22:50:16:484 3776 DetectCureTDL3: IrpHandler (24) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (25) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (26) addr: 804F9709

22:50:16:484 3776 KLMD_ReadMem: Trying to ReadMemory 0xF883EF26[0x400]

22:50:16:484 3776 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0

22:50:16:484 3776 TDL3_FileDetect: Processing driver: USBSTOR

22:50:16:484 3776 TDL3_FileDetect: Processing driver file: C:\windows\system32\DRIVERS\USBSTOR.SYS

22:50:16:484 3776 KLMD_CreateFileW: Trying to open file C:\windows\system32\DRIVERS\USBSTOR.SYS

22:50:16:484 3776 TDL3_FileDetect: C:\windows\system32\DRIVERS\USBSTOR.SYS - Verdict: Clean

22:50:16:484 3776

22:50:16:484 3776 DetectCureTDL3: DEVICE_OBJECT: 82620418

22:50:16:484 3776 KLMD_GetLowerDeviceObject: Trying to get lower device object for 82620418

22:50:16:484 3776 KLMD_ReadMem: Trying to ReadMemory 0x82620418[0x38]

22:50:16:484 3776 DetectCureTDL3: DRIVER_OBJECT: 82F5BB80

22:50:16:484 3776 KLMD_ReadMem: Trying to ReadMemory 0x82F5BB80[0xA8]

22:50:16:484 3776 KLMD_ReadMem: Trying to ReadMemory 0xE1009210[0x18]

22:50:16:484 3776 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk

22:50:16:484 3776 DetectCureTDL3: IrpHandler (0) addr: F853BC30

22:50:16:484 3776 DetectCureTDL3: IrpHandler (1) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (2) addr: F853BC30

22:50:16:484 3776 DetectCureTDL3: IrpHandler (3) addr: F8535D9B

22:50:16:484 3776 DetectCureTDL3: IrpHandler (4) addr: F8535D9B

22:50:16:484 3776 DetectCureTDL3: IrpHandler (5) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (6) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (7) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (8) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (9) addr: F8536366

22:50:16:484 3776 DetectCureTDL3: IrpHandler (10) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (11) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (12) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (13) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (14) addr: F853644D

22:50:16:484 3776 DetectCureTDL3: IrpHandler (15) addr: F8539FC3

22:50:16:484 3776 DetectCureTDL3: IrpHandler (16) addr: F8536366

22:50:16:484 3776 DetectCureTDL3: IrpHandler (17) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (18) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (19) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (20) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (21) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (22) addr: F8537EF3

22:50:16:484 3776 DetectCureTDL3: IrpHandler (23) addr: F853CA24

22:50:16:484 3776 DetectCureTDL3: IrpHandler (24) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (25) addr: 804F9709

22:50:16:484 3776 DetectCureTDL3: IrpHandler (26) addr: 804F9709

22:50:16:484 3776 TDL3_FileDetect: Processing driver: Disk

22:50:16:484 3776 TDL3_FileDetect: Processing driver file: C:\windows\system32\DRIVERS\disk.sys

22:50:16:484 3776 KLMD_CreateFileW: Trying to open file C:\windows\system32\DRIVERS\disk.sys

22:50:16:484 3776 TDL3_FileDetect: C:\windows\system32\DRIVERS\disk.sys - Verdict: Clean

22:50:16:484 3776

22:50:16:484 3776 DetectCureTDL3: DEVICE_OBJECT: 82659AB8

22:50:16:484 3776 KLMD_GetLowerDeviceObject: Trying to get lower device object for 82659AB8

22:50:16:484 3776 KLMD_ReadMem: Trying to ReadMemory 0x82659AB8[0x38]