Author Topic: Rootkit: Hidden boot sector (Read 13240 times)

zeroboy · « **on:** February 11, 2011, 03:15:32 AM »

I was getting this avast! popup for rootkit. When I logged into my computer It was constantly BSOD, had to boot up around 3 times just to get back into windows again.

My error from avast! was:
MBR:\\.\PHYSICALDrive0
Rootkit Name: Rootkit: hidden boot sector

I have followed the instructions below:
http://forum.avast.com/index.php?topic=70771

I ran aswMBR.exe and it found the rootkit, I hit "fix" - It wanted a reboot ASAP (didnt reboot yet)
Then I ran TDSSKiller and it found 1 threat, and it said "Suspicious objects", Only option after this was to skip, no reboot option. I obtained the report, then I rebooted.

After the reboot I was able to login successfully with no BSOD, but TDSSKiller still shows 1 threat and aswMBR.exe was producing a different error this time. Both results are below. Please help!!

zeroboy · « **Reply #1 on:** February 11, 2011, 03:16:03 AM »

aswMBR.exe Report:

aswMBR version 0.9.2 Copyright(c) 2011 avast! Software
Run date: 2011-02-11 01:56:20
-----------------------------
17:56:20.640 OS Version: Windows x64 6.1.7600
17:56:20.640 Number of processors: 8 586 0x1A05
17:56:20.640 ComputerName: ZEROBOY64-PC UserName: zeroboy64
17:56:23.370 Initialize success
17:56:24.915 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-5
17:56:24.915 Disk 0 Vendor: ST31000528AS CC38 Size: 953869MB BusType: 11
17:56:24.915 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000086
17:56:24.915 Disk 1 Vendor: Generic_ 9740 Size: 953869MB BusType: 7
17:56:24.915 Disk 2 \Device\Harddisk2\DR2 -> \Device\00000087
17:56:24.915 Disk 2 Vendor: Generic_ 9740 Size: 953869MB BusType: 7
17:56:24.915 Disk 3 \Device\Harddisk3\DR3 -> \Device\00000088
17:56:24.915 Disk 3 Vendor: Generic_ 9740 Size: 953869MB BusType: 7
17:56:24.930 Disk 4 \Device\Harddisk4\DR4 -> \Device\00000089
17:56:24.930 Disk 4 Vendor: Generic_ 9740 Size: 953869MB BusType: 7
17:56:24.930 Disk 0 MBR read successfully
17:56:24.930 Disk 0 MBR scan
17:56:24.930 Disk 0 trace - called modules:
17:56:24.930 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa80025d82c0]<<
17:56:24.930 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8002a70060]
17:56:24.930 3 CLASSPNP.SYS[fffff8800120143f] -> nt!IofCallDriver -> [0xfffffa80028224e0]
17:56:24.930 5 ACPI.sys[fffff88001178781] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP3T0L0-5[0xfffffa8002760060]
17:56:24.930 \Driver\atapi[0xfffffa8002757e70] -> IRP_MJ_CREATE -> 0xfffffa80025d82c0
17:56:24.930 Scan finished successfully

zeroboy · « **Reply #2 on:** February 11, 2011, 03:17:04 AM »

TDSS Report:

2011/02/10 17:52:09.0470 3272   TDSS rootkit removing tool 2.4.17.0 Feb 10 2011 11:07:20
2011/02/10 17:52:09.0486 3272   ================================================================================
2011/02/10 17:52:09.0486 3272   SystemInfo:
2011/02/10 17:52:09.0486 3272
2011/02/10 17:52:09.0486 3272   OS Version: 6.1.7600 ServicePack: 0.0
2011/02/10 17:52:09.0486 3272   Product type: Workstation
2011/02/10 17:52:09.0486 3272   ComputerName: ZEROBOY64-PC
2011/02/10 17:52:09.0486 3272   UserName: zeroboy64
2011/02/10 17:52:09.0486 3272   Windows directory: C:\Windows
2011/02/10 17:52:09.0486 3272   System windows directory: C:\Windows
2011/02/10 17:52:09.0486 3272   Running under WOW64
2011/02/10 17:52:09.0486 3272   Processor architecture: Intel x64
2011/02/10 17:52:09.0486 3272   Number of processors: 8
2011/02/10 17:52:09.0486 3272   Page size: 0x1000
2011/02/10 17:52:09.0486 3272   Boot type: Normal boot
2011/02/10 17:52:09.0486 3272   ================================================================================
2011/02/10 17:52:09.0720 3272   Initialize success
2011/02/10 17:52:10.0890 3700   ================================================================================
2011/02/10 17:52:10.0890 3700   Scan started
2011/02/10 17:52:10.0890 3700   Mode: Manual;
2011/02/10 17:52:10.0890 3700   ================================================================================
2011/02/10 17:52:11.0280 3700   1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys
2011/02/10 17:52:11.0295 3700   ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys
2011/02/10 17:52:11.0311 3700   AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys
2011/02/10 17:52:11.0373 3700   adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/02/10 17:52:11.0404 3700   adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
2011/02/10 17:52:11.0420 3700   adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
2011/02/10 17:52:11.0451 3700   AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys
2011/02/10 17:52:11.0467 3700   agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys
2011/02/10 17:52:11.0498 3700   aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys
2011/02/10 17:52:11.0514 3700   amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys
2011/02/10 17:52:11.0529 3700   AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
2011/02/10 17:52:11.0529 3700   AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
2011/02/10 17:52:11.0560 3700   amdsata (7a4b413614c055935567cf88a9734d38) C:\Windows\system32\DRIVERS\amdsata.sys
2011/02/10 17:52:11.0592 3700   amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/02/10 17:52:11.0623 3700   amdxata (b4ad0cacbab298671dd6f6ef7e20679d) C:\Windows\system32\DRIVERS\amdxata.sys
2011/02/10 17:52:11.0638 3700   AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
2011/02/10 17:52:11.0685 3700   arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
2011/02/10 17:52:11.0716 3700   arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
2011/02/10 17:52:11.0748 3700   aswFsBlk (6923740db573b46fdda13e1df412c577) C:\Windows\system32\drivers\aswFsBlk.sys
2011/02/10 17:52:11.0779 3700   aswMonFlt (de001b988b58bfd453f667842655b22e) C:\Windows\system32\drivers\aswMonFlt.sys
2011/02/10 17:52:11.0779 3700   aswRdr (e0d1002d7fa65dd023788b17f714e682) C:\Windows\system32\drivers\aswRdr.sys
2011/02/10 17:52:11.0810 3700   aswSP (c3eafdc0f533425614430a112ba71e9a) C:\Windows\system32\drivers\aswSP.sys
2011/02/10 17:52:11.0826 3700   aswTdi (0226ffbc420d8fb67ba3b9dbdd1f2dca) C:\Windows\system32\drivers\aswTdi.sys
2011/02/10 17:52:11.0857 3700   AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/02/10 17:52:11.0872 3700   atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys
2011/02/10 17:52:11.0904 3700   b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
2011/02/10 17:52:11.0919 3700   b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
2011/02/10 17:52:11.0950 3700   Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
2011/02/10 17:52:11.0982 3700   blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
2011/02/10 17:52:12.0013 3700   bowser (91ce0d3dc57dd377e690a2d324022b08) C:\Windows\system32\DRIVERS\bowser.sys
2011/02/10 17:52:12.0028 3700   BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2011/02/10 17:52:12.0060 3700   BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2011/02/10 17:52:12.0075 3700   Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
2011/02/10 17:52:12.0091 3700   BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
2011/02/10 17:52:12.0122 3700   BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

zeroboy · « **Reply #3 on:** February 11, 2011, 03:17:40 AM »

2011/02/10 17:52:12.0138 3700   BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
2011/02/10 17:52:12.0153 3700   BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/02/10 17:52:12.0169 3700   cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
2011/02/10 17:52:12.0200 3700   cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys
2011/02/10 17:52:12.0216 3700   circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
2011/02/10 17:52:12.0262 3700   CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
2011/02/10 17:52:12.0294 3700   CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/02/10 17:52:12.0340 3700   cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys
2011/02/10 17:52:12.0356 3700   CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys
2011/02/10 17:52:12.0372 3700   Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
2011/02/10 17:52:12.0418 3700   CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys
2011/02/10 17:52:12.0434 3700   crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
2011/02/10 17:52:12.0481 3700   CSC (4a6173c2279b498cd8f57cae504564cb) C:\Windows\system32\drivers\csc.sys
2011/02/10 17:52:12.0543 3700   ctxusbm (ba8e5b2291c01ef71ca80e25f0c79d55) C:\Windows\system32\DRIVERS\ctxusbm.sys
2011/02/10 17:52:12.0574 3700   DfsC (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys
2011/02/10 17:52:12.0606 3700   discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
2011/02/10 17:52:12.0621 3700   Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
2011/02/10 17:52:12.0699 3700   drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
2011/02/10 17:52:12.0746 3700   DXGKrnl (ebce0b0924835f635f620d19f0529dce) C:\Windows\System32\drivers\dxgkrnl.sys
2011/02/10 17:52:12.0840 3700   ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
2011/02/10 17:52:12.0886 3700   elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
2011/02/10 17:52:12.0902 3700   ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys
2011/02/10 17:52:12.0918 3700   exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
2011/02/10 17:52:12.0933 3700   fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
2011/02/10 17:52:12.0964 3700   fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
2011/02/10 17:52:13.0011 3700   FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
2011/02/10 17:52:13.0042 3700   Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
2011/02/10 17:52:13.0058 3700   flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/02/10 17:52:13.0089 3700   FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys
2011/02/10 17:52:13.0105 3700   FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
2011/02/10 17:52:13.0152 3700   Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
2011/02/10 17:52:13.0198 3700   fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys
2011/02/10 17:52:13.0214 3700   gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
2011/02/10 17:52:13.0245 3700   hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
2011/02/10 17:52:13.0276 3700   HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
2011/02/10 17:52:13.0308 3700   HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/02/10 17:52:13.0323 3700   HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
2011/02/10 17:52:13.0354 3700   HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
2011/02/10 17:52:13.0354 3700   HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
2011/02/10 17:52:13.0401 3700   HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys
2011/02/10 17:52:13.0432 3700   HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys
2011/02/10 17:52:13.0464 3700   HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys
2011/02/10 17:52:13.0479 3700   hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys
2011/02/10 17:52:13.0495 3700   i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/02/10 17:52:13.0510 3700   iaStorV (d83efb6fd45df9d55e9a1afc63640d50) C:\Windows\system32\DRIVERS\iaStorV.sys
2011/02/10 17:52:13.0542 3700   iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

zeroboy · « **Reply #4 on:** February 11, 2011, 03:18:51 AM »

2011/02/10 17:52:13.0557 3700   intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys
2011/02/10 17:52:13.0588 3700   intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
2011/02/10 17:52:13.0620 3700   IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/02/10 17:52:13.0635 3700   IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys
2011/02/10 17:52:13.0651 3700   IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
2011/02/10 17:52:13.0666 3700   IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
2011/02/10 17:52:13.0713 3700   isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys
2011/02/10 17:52:13.0713 3700   iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/02/10 17:52:13.0744 3700   kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/02/10 17:52:13.0776 3700   kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/02/10 17:52:13.0822 3700   KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys
2011/02/10 17:52:13.0854 3700   KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys
2011/02/10 17:52:13.0869 3700   ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
2011/02/10 17:52:13.0916 3700   lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
2011/02/10 17:52:13.0963 3700   LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
2011/02/10 17:52:13.0963 3700   LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
2011/02/10 17:52:13.0994 3700   LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2011/02/10 17:52:14.0025 3700   LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2011/02/10 17:52:14.0072 3700   luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
2011/02/10 17:52:14.0150 3700   lvpopf64 (ce6e5146039d248feb991fbc9e2b6a7b) C:\Windows\system32\DRIVERS\lvpopf64.sys
2011/02/10 17:52:14.0181 3700   LVUSBS64 (6d5ea90f86f9b28cd44af6ba9be03bf9) C:\Windows\system32\drivers\LVUSBS64.sys
2011/02/10 17:52:14.0259 3700   LVUVC64 (eb12688842ede30c843a123fa6855858) C:\Windows\system32\DRIVERS\lvuvc64.sys
2011/02/10 17:52:14.0290 3700   megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
2011/02/10 17:52:14.0306 3700   MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
2011/02/10 17:52:14.0337 3700   Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
2011/02/10 17:52:14.0353 3700   monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
2011/02/10 17:52:14.0384 3700   mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
2011/02/10 17:52:14.0400 3700   mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
2011/02/10 17:52:14.0415 3700   mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys
2011/02/10 17:52:14.0446 3700   mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys
2011/02/10 17:52:14.0462 3700   mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
2011/02/10 17:52:14.0478 3700   MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys
2011/02/10 17:52:14.0493 3700   mrxsmb (767a4c3bcf9410c286ced15a2db17108) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/02/10 17:52:14.0540 3700   mrxsmb10 (920ee0ff995fcfdeb08c41605a959e1c) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/02/10 17:52:14.0571 3700   mrxsmb20 (740d7ea9d72c981510a5292cf6adc941) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/02/10 17:52:14.0587 3700   msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys
2011/02/10 17:52:14.0602 3700   msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys
2011/02/10 17:52:14.0618 3700   Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
2011/02/10 17:52:14.0649 3700   mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
2011/02/10 17:52:14.0680 3700   msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys
2011/02/10 17:52:14.0712 3700   MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

zeroboy · « **Reply #5 on:** February 11, 2011, 03:19:31 AM »

2011/02/10 17:52:14.0727 3700   MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/02/10 17:52:14.0758 3700   MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
2011/02/10 17:52:14.0821 3700   MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys
2011/02/10 17:52:14.0930 3700   mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/02/10 17:52:14.0946 3700   MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
2011/02/10 17:52:14.0961 3700   MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
2011/02/10 17:52:15.0008 3700   MTsensor (19b006b181e3875fd254f7b67acf1e7c) C:\Windows\system32\DRIVERS\ASACPI.sys
2011/02/10 17:52:15.0024 3700   Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
2011/02/10 17:52:15.0055 3700   NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
2011/02/10 17:52:15.0086 3700   NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys
2011/02/10 17:52:15.0117 3700   NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
2011/02/10 17:52:15.0148 3700   NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/02/10 17:52:15.0164 3700   Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/02/10 17:52:15.0195 3700   NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/02/10 17:52:15.0195 3700   NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys
2011/02/10 17:52:15.0226 3700   NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
2011/02/10 17:52:15.0242 3700   NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys
2011/02/10 17:52:15.0289 3700   nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
2011/02/10 17:52:15.0351 3700   Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
2011/02/10 17:52:15.0367 3700   nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
2011/02/10 17:52:15.0414 3700   Ntfs (356698a13c4630d5b31c37378d469196) C:\Windows\system32\drivers\Ntfs.sys
2011/02/10 17:52:15.0429 3700   Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
2011/02/10 17:52:15.0460 3700   NVHDA (e20abd5b229760158f753ca90b97e090) C:\Windows\system32\drivers\nvhda64v.sys
2011/02/10 17:52:15.0663 3700   nvlddmkm (e55cab397f77d5208db18a78b1b7c0d5) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/02/10 17:52:15.0726 3700   nvraid (3e38712941e9bb4ddbee00affe3fed3d) C:\Windows\system32\DRIVERS\nvraid.sys
2011/02/10 17:52:15.0741 3700   nvstor (477dc4d6deb99be37084c9ac6d013da1) C:\Windows\system32\DRIVERS\nvstor.sys
2011/02/10 17:52:15.0772 3700   nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys
2011/02/10 17:52:15.0788 3700   ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/02/10 17:52:15.0819 3700   Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
2011/02/10 17:52:15.0850 3700   partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys
2011/02/10 17:52:15.0866 3700   pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys
2011/02/10 17:52:15.0882 3700   pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys
2011/02/10 17:52:15.0897 3700   pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/02/10 17:52:15.0897 3700   pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
2011/02/10 17:52:15.0928 3700   PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
2011/02/10 17:52:15.0975 3700   PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys
2011/02/10 17:52:15.0991 3700   Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
2011/02/10 17:52:16.0022 3700   Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys
2011/02/10 17:52:16.0069 3700   ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

zeroboy · « **Reply #6 on:** February 11, 2011, 03:20:59 AM »

2011/02/10 17:52:16.0084 3700   ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
2011/02/10 17:52:16.0116 3700   QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
2011/02/10 17:52:16.0131 3700   RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
2011/02/10 17:52:16.0162 3700   RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
2011/02/10 17:52:16.0194 3700   Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/02/10 17:52:16.0225 3700   RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/02/10 17:52:16.0225 3700   RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
2011/02/10 17:52:16.0256 3700   rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys
2011/02/10 17:52:16.0256 3700   rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
2011/02/10 17:52:16.0287 3700   RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/02/10 17:52:16.0318 3700   RDPDR (9706b84dbabfc4b4ca46c5a82b14dfa3) C:\Windows\system32\drivers\rdpdr.sys
2011/02/10 17:52:16.0334 3700   RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
2011/02/10 17:52:16.0365 3700   RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
2011/02/10 17:52:16.0381 3700   RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys
2011/02/10 17:52:16.0396 3700   rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys
2011/02/10 17:52:16.0443 3700   rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
2011/02/10 17:52:16.0459 3700   RTL8167 (b49dc435ae3695bac5623dd94b05732d) C:\Windows\system32\DRIVERS\Rt64win7.sys
2011/02/10 17:52:16.0474 3700   s3cap (88af6e02ab19df7fd07ecdf9c91e9af6) C:\Windows\system32\DRIVERS\vms3cap.sys
2011/02/10 17:52:16.0506 3700   sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys
2011/02/10 17:52:16.0537 3700   scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys
2011/02/10 17:52:16.0568 3700   secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
2011/02/10 17:52:16.0599 3700   Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
2011/02/10 17:52:16.0630 3700   Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
2011/02/10 17:52:16.0646 3700   sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
2011/02/10 17:52:16.0693 3700   sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys
2011/02/10 17:52:16.0724 3700   sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys
2011/02/10 17:52:16.0740 3700   sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\DRIVERS\sffp_sd.sys
2011/02/10 17:52:16.0771 3700   sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/02/10 17:52:16.0833 3700   SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2011/02/10 17:52:16.0849 3700   SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
2011/02/10 17:52:16.0896 3700   Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
2011/02/10 17:52:16.0927 3700   spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
2011/02/10 17:52:16.0989 3700   sptd (602884696850c86434530790b110e8eb) C:\Windows\system32\Drivers\sptd.sys
2011/02/10 17:52:16.0989 3700   Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 602884696850c86434530790b110e8eb
2011/02/10 17:52:17.0005 3700   sptd - detected Locked file (1)
2011/02/10 17:52:17.0036 3700   srv (de6f5658da951c4bc8e498570b5b0d5f) C:\Windows\system32\DRIVERS\srv.sys
2011/02/10 17:52:17.0067 3700   srv2 (4d33d59c0b930c523d29f9bd40cda9d2) C:\Windows\system32\DRIVERS\srv2.sys
2011/02/10 17:52:17.0083 3700   srvnet (5a663fd67049267bc5c3f3279e631ffb) C:\Windows\system32\DRIVERS\srvnet.sys
2011/02/10 17:52:17.0161 3700   StarOpen (e57b778208c783d8debab320c16a1b82) C:\Windows\system32\drivers\StarOpen.sys
2011/02/10 17:52:17.0192 3700   stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
2011/02/10 17:52:17.0239 3700   storflt (ffd7a6f15b14234b5b0e5d49e7961895) C:\Windows\system32\DRIVERS\vmstorfl.sys
2011/02/10 17:52:17.0270 3700   storvsc (8fccbefc5c440b3c23454656e551b09a) C:\Windows\system32\DRIVERS\storvsc.sys

zeroboy · « **Reply #7 on:** February 11, 2011, 03:21:22 AM »

2011/02/10 17:52:17.0286 3700   swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
2011/02/10 17:52:17.0442 3700   Tcpip (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys
2011/02/10 17:52:17.0504 3700   TCPIP6 (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys
2011/02/10 17:52:17.0551 3700   tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys
2011/02/10 17:52:17.0582 3700   TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
2011/02/10 17:52:17.0613 3700   TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
2011/02/10 17:52:17.0644 3700   tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys
2011/02/10 17:52:17.0660 3700   TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys
2011/02/10 17:52:17.0722 3700   tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/02/10 17:52:17.0769 3700   tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys
2011/02/10 17:52:17.0816 3700   uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
2011/02/10 17:52:17.0832 3700   udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys
2011/02/10 17:52:17.0894 3700   uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys
2011/02/10 17:52:17.0910 3700   umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys
2011/02/10 17:52:17.0925 3700   UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
2011/02/10 17:52:17.0972 3700   usbaudio (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys
2011/02/10 17:52:17.0988 3700   usbccgp (b26afb54a534d634523c4fb66765b026) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/02/10 17:52:18.0003 3700   usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys
2011/02/10 17:52:18.0019 3700   usbehci (2ea4aff7be7eb4632e3aa8595b0803b5) C:\Windows\system32\DRIVERS\usbehci.sys
2011/02/10 17:52:18.0034 3700   usbhub (4c9042b8df86c1e8e6240c218b99b39b) C:\Windows\system32\DRIVERS\usbhub.sys
2011/02/10 17:52:18.0050 3700   usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
2011/02/10 17:52:18.0066 3700   usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
2011/02/10 17:52:18.0112 3700   usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
2011/02/10 17:52:18.0144 3700   USBSTOR (080d3820da6c046be82fc8b45a893e83) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/02/10 17:52:18.0159 3700   usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/02/10 17:52:18.0190 3700   vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys
2011/02/10 17:52:18.0206 3700   vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/02/10 17:52:18.0222 3700   VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
2011/02/10 17:52:18.0253 3700   vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys
2011/02/10 17:52:18.0268 3700   viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys
2011/02/10 17:52:18.0300 3700   vmbus (1501699d7eda984abc4155a7da5738d1) C:\Windows\system32\DRIVERS\vmbus.sys
2011/02/10 17:52:18.0331 3700   VMBusHID (ae10c35761889e65a6f7176937c5592c) C:\Windows\system32\DRIVERS\VMBusHID.sys
2011/02/10 17:52:18.0362 3700   volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys
2011/02/10 17:52:18.0393 3700   volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys
2011/02/10 17:52:18.0409 3700   volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys
2011/02/10 17:52:18.0440 3700   vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
2011/02/10 17:52:18.0471 3700   vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
2011/02/10 17:52:18.0518 3700   wacmoumonitor (43ce14e1e17da81ea71dfe686805ed07) C:\Windows\system32\DRIVERS\wacmoumonitor.sys
2011/02/10 17:52:18.0549 3700   wacommousefilter (e04d43c7d1641e95d35cae6086c7e350) C:\Windows\system32\DRIVERS\wacommousefilter.sys
2011/02/10 17:52:18.0565 3700   WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
2011/02/10 17:52:18.0580 3700   wacomvhid (ec1ceb237e365330c1fcfc4876aa0ac0) C:\Windows\system32\DRIVERS\wacomvhid.sys
2011/02/10 17:52:18.0627 3700   WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
2011/02/10 17:52:18.0643 3700   Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
2011/02/10 17:52:18.0674 3700   Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
2011/02/10 17:52:18.0705 3700   Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
2011/02/10 17:52:18.0736 3700   WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
2011/02/10 17:52:18.0752 3700   WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
2011/02/10 17:52:18.0814 3700   WinUsb (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUsb.sys
2011/02/10 17:52:18.0846 3700   WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/02/10 17:52:18.0924 3700   ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
2011/02/10 17:52:18.0970 3700   WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys
2011/02/10 17:52:18.0986 3700   WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/02/10 17:52:19.0048 3700   ================================================================================
2011/02/10 17:52:19.0048 3700   Scan finished
2011/02/10 17:52:19.0048 3700   ================================================================================
2011/02/10 17:52:19.0064 1408   Detected object count: 1
2011/02/10 17:53:12.0572 1408   Locked file(sptd) - User select action: Skip

Avast-s · « **Reply #8 on:** February 14, 2011, 03:09:52 PM »

aswMBR version 0.9.2 Copyright(c) 2011 avast! Software
Run date: 2011-02-14 14:04:47
-----------------------------
17:04:47.171 OS Version: Windows 5.1.2600 Service Pack 2
17:04:47.171 Number of processors: 1 586 0x604
17:04:47.171 ComputerName: MODY UserName:
17:04:49.031 Initialize success
17:05:44.375 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e
17:05:44.375 Disk 0 Vendor: WDC_WD800JD-55MUA1 10.01E01 Size: 76319MB BusType: 3
17:05:44.390 Disk 0 MBR read successfully
17:05:44.390 Disk 0 MBR scan
17:05:44.390 Disk 0 scanning sectors +156280320
17:05:44.437 Disk 0 trace - called modules:
17:05:44.437 ntkrnlpa.exe diskpt.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
17:05:44.453 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82330040]
17:05:44.453 3 CLASSPNP.SYS[f84b505b] -> nt!IofCallDriver -> \Device\00000086[0x823423a8]
17:05:44.468 5 ACPI.sys[f834b620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-e[0x823424d0]
17:05:44.468 \Driver\atapi[0x823438e0] -> IRP_MJ_DEVICE_CONTROL -> diskpt.sys[0xf82c7362]
17:05:44.484 \Driver\atapi[0x823438e0] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> diskpt.sys[0xf82c6e18]
17:05:44.500 Scan finished successfully

Author Topic: Rootkit: Hidden boot sector (Read 13240 times)

zeroboy

Rootkit: Hidden boot sector

zeroboy

Re: Rootkit: Hidden boot sector

zeroboy

Re: Rootkit: Hidden boot sector

zeroboy

Re: Rootkit: Hidden boot sector

zeroboy

Re: Rootkit: Hidden boot sector

zeroboy

Re: Rootkit: Hidden boot sector

zeroboy

Re: Rootkit: Hidden boot sector

zeroboy

Re: Rootkit: Hidden boot sector

Avast-s

Re: Rootkit: Hidden boot sector