moj log

2

moj log

offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Pokreni HijackThis, opet skeniraj i štikliraj sledeću liniju:

O3 - Toolbar: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - (no file)

a zatim klikni na Fix Checked.

Nakon toga restartuj kompjuter.

Pokreni Notepad i u njega iskopiraj sledeću liniju:

dir C:\Docume~1\Dj\Applic~1\SKS~1 /S /X > C:\lista.txt

Klikni na File, Save: kada se otvori Save dijalog, Save as type postavi na All Files i snimi kao lister.bat .
Nakon toga pronađi taj snimljeni file i pokreni ga dvoklikom ( command prompt će se nakratko pokrenuti ).

U sledeću poruku iskopiraj sadržaj file-a C:\lista.txt i postavi novi HijackThis log.

offline
  • Pridružio: 16 Avg 2007
  • Poruke: 22

evo ga sadrzaj fajla C:\lista.txt :

Volume in drive C is SYSTEM
Volume Serial Number is 2E33-1BFF

Directory of C:\Docume~1\Dj\Applic~1\SKS~1

01/18/2007 12:50 AM <DIR> .
01/18/2007 12:50 AM <DIR> ..
0 File(s) 0 bytes

Total Files Listed:
0 File(s) 0 bytes
2 Dir(s) 960,380,928 bytes free





evo ga novi log :

Logfile of HijackThis v1.99.1
Scan saved at 9:50:42 AM, on 8/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Eset\nod32kui.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Dj\Desktop\Duh nibor\New Folder\New Folder\New Folder\New Folder\traaalal\lelekuku.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = home.sweetim.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {F76DA368-6FD5-6374-F79F-6744E48519CF} - (no file)
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O4 - Global Startup: PCSuiteForNokia6600 Detect.lnk = C:\Program Files\Nokia\PC Suite for Nokia 6600\connmngmntbox.exe
O4 - Global Startup: PCSuiteForNokia6600 TS.lnk = C:\Program Files\Nokia\PC Suite for Nokia 6600\ectaskscheduler.exe
O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Ako to već nisi uradio, aktiviraj prikaz skrivenih file-ova/foldera po sledećem uputstvu:
http://www.mycity.rs/Uputstva-sa-ex-SuperSajta/Kako-videti-skrivene-fajlove.html

Potrebno je da upload-uješ file:

C:\Documents and Settings\Dj\Application Data\??sks\?hkntfs.exe

preko sledeće forme: http://www.mycity.rs/ambulanta-upload.php

U samim nazivima foldera ''??sks'' i filea ''?hkntfs.exe'' na tvom kompjuteru se umesto upitnika nalaze neki karakteri koji ne pripadaju engleskom alfabetu, pa ih HijackThis prikazuje kao ''?''.
Stoga ti ja ne mogu reći tačan naziv file-a, već ćeš sam morati da ''vidiš'' koji folder/file je u pitanju.
Znači, otvori
C:\Documents and Settings\Dj\Application Data
i pronađi folder čiji naziv ima 5 karaktera od kojih su poslednja 3 ''sks'' i u njemu, istom logikom, pronađi file ?hkntfs.exe.

Kada ga pronađeš i uploaduješ, javi da možemo nastaviti.

offline
  • Pridružio: 16 Avg 2007
  • Poruke: 22

aktivirao sam prikaz skrivenih fajlova, po tom uputstvu.

jedini folder na toj putanji koji u sebi ima ??sks je folder TASKS, ali on je prazan... nema tog ?hkntfs fajla..

da li treba da upload-ujem taj TASKS folder ?

offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Za sada, ne.

Uradi sledeće:
preuzmi fajl gmer.zip sa ovog linka i sačuvaj na Desktop-u.
Raspakuj ga u neki folder.

Dupli klik na gmer.exe za početak: Izaberi Rootkit Tab na vrhu.
Klikni na Scan.
Kada je skeniranje završeno, klik na Copy dugme ispod - ovo će sačuvati to u Clipboard.
Iskoristi opciju Paste u Notepad-u da bi to prebacio u tekst. Snimi taj tekst iz Notepada kao file1.txt.
Ponovi ovo isto sa Autostart Tab-om. Snimi taj tekst iz Notepada kao file2.txt.


Iskopiraj nam ovde sadržaj ta dva fajla koja smo malopre snimili.

offline
  • Pridružio: 16 Avg 2007
  • Poruke: 22

file 1 :

GMER 1.0.13.12551 - gmer.net
Rootkit scan 2007-08-18 09:41:30
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.13 ----

SSDT d347bus.sys ZwClose
SSDT \??\C:\WINDOWS\system32\windrvNT.sys ZwCreateFile
SSDT d347bus.sys ZwCreateKey
SSDT d347bus.sys ZwCreatePagingFile
SSDT d347bus.sys ZwEnumerateKey
SSDT d347bus.sys ZwEnumerateValueKey
SSDT \??\C:\WINDOWS\system32\windrvNT.sys ZwOpenFile
SSDT d347bus.sys ZwOpenKey
SSDT \??\C:\WINDOWS\system32\windrvNT.sys ZwQueryDirectoryFile
SSDT \??\C:\WINDOWS\system32\windrvNT.sys ZwQueryInformationProcess
SSDT d347bus.sys ZwQueryKey
SSDT d347bus.sys ZwQueryValueKey
SSDT \??\C:\WINDOWS\system32\windrvNT.sys ZwSetInformationFile
SSDT d347bus.sys ZwSetSystemPowerState
SSDT sptd.sys ZwSetValueKey

---- Kernel code sections - GMER 1.0.13 ----

? C:\WINDOWS\system32\drivers\sptd.sys The process cannot access the file because it is being used by another process.
? C:\WINDOWS\System32\Drivers\SPTD9117.SYS The process cannot access the file because it is being used by another process.

---- User code sections - GMER 1.0.13 ----

.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!LoadLibraryA 7C801D77 6 Bytes JMP 5F250F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!LoadResource 7C809FB5 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!GetProcAddress 7C80ADA0 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!LoadLibraryW 7C80AE4B 6 Bytes JMP 5F220F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!FindResourceW 7C80BBCE 6 Bytes JMP 5F160F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!SizeofResource 7C80BC69 6 Bytes JMP 5F190F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!SetUnhandledExceptionFilter 7C84467D 5 Bytes JMP 004DE392 C:\Program Files\MSN Messenger\MsnMsgr.Exe
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] ADVAPI32.dll!RegQueryValueExA 77DD7883 6 Bytes JMP 5F040F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5F130F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] USER32.dll!SetWindowLongW 7E41D62B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] USER32.dll!DestroyWindow 7E41DAEA 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] USER32.dll!DestroyWindow + 4 7E41DAEE 2 Bytes [ 11, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] USER32.dll!CreateWindowExW 7E41FC25 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] WININET.dll!HttpOpenRequestA 771C36CD 6 Bytes JMP 5F280F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] WININET.dll!InternetCloseHandle 771C4D8C 6 Bytes JMP 5F310F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] WININET.dll!HttpQueryInfoA 771C782A 6 Bytes JMP 5F2B0F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] WININET.dll!InternetReadFile 771C8114 6 Bytes JMP 5F2E0F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] WININET.dll!GetUrlCacheEntryInfoExW 771D68B5 6 Bytes JMP 5F340F5A

---- Kernel IAT/EAT - GMER 1.0.13 ----

IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F758989E] sptd.sys
IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F759FD86] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F7589E24] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F7589D28] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IofCallDriver] [F7589EF4] sptd.sys
IAT dmio.sys[ntoskrnl.exe!IofCallDriver] [F7589EF4] sptd.sys
IAT dmio.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F7589E24] sptd.sys
IAT dmio.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F7589D28] sptd.sys
IAT PartMgr.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F759F1AE] sptd.sys
IAT PartMgr.sys[ntoskrnl.exe!IoDetachDevice] [F7589A5A] sptd.sys
IAT disk.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F759FE4A] sptd.sys
IAT \WINDOWS\system32\DRIVERS\CLASSPNP.SYS[ntoskrnl.exe!IoDetachDevice] [F758E8C6] sptd.sys
IAT \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!IofCompleteRequest] [F759F04A] sptd.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F759F056] sptd.sys
IAT \SystemRoot\system32\DRIVERS\cdrom.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F759FE4A] sptd.sys
IAT \SystemRoot\system32\DRIVERS\rdbss.sys[ntoskrnl.exe!IofCallDriver] [F7589CC6] sptd.sys
IAT \SystemRoot\system32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IofCallDriver] [F7589CC6] sptd.sys

---- Devices - GMER 1.0.13 ----

Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CREATE 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CLOSE 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_READ 83BCA550
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_WRITE 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_INFORMATION 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_INFORMATION 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_EA 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_EA 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_FLUSH_BUFFERS 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_VOLUME_INFORMATION 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_VOLUME_INFORMATION 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_DIRECTORY_CONTROL 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_FILE_SYSTEM_CONTROL 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_DEVICE_CONTROL 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SHUTDOWN 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_LOCK_CONTROL 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CLEANUP 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_PNP 83BCA688
Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [F7BC985A] avgtdi.sys
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CREATE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CLOSE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_READ 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_WRITE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_FLUSH_BUFFERS 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_INTERNAL_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SHUTDOWN 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_POWER 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SYSTEM_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_PNP 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CREATE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CLOSE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_READ 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_WRITE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_FLUSH_BUFFERS 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_INTERNAL_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_SHUTDOWN 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_POWER 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_SYSTEM_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_PNP 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CREATE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CLOSE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_READ 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_WRITE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_FLUSH_BUFFERS 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_INTERNAL_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_SHUTDOWN 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_POWER 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_SYSTEM_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_PNP 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CREATE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CLOSE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_READ 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_WRITE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_FLUSH_BUFFERS 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_INTERNAL_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_SHUTDOWN 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_POWER 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_SYSTEM_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_PNP 83BCA0E8
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F7BC985A] avgtdi.sys
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_CREATE E1B62600
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_CLOSE E1B62600
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_DEVICE_CONTROL E1B62600
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_READ 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_WRITE 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_FLUSH_BUFFERS 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_DEVICE_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_INTERNAL_DEVICE_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SHUTDOWN 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CLEANUP 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_POWER 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SYSTEM_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_PNP 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CREATE 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_READ 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_WRITE 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_FLUSH_BUFFERS 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_DEVICE_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_INTERNAL_DEVICE_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SHUTDOWN 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CLEANUP 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_POWER 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SYSTEM_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_PNP 83BCB260
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_NAMED_PIPE 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_EA 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_EA 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_VOLUME_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_VOLUME_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DIRECTORY_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FILE_SYSTEM_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_LOCK_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLEANUP 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_MAILSLOT 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_SECURITY 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_SECURITY 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CHANGE 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_QUOTA 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_QUOTA 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 83852668
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_NAMED_PIPE 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLOSE 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_READ 8360C1E0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_WRITE 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_INFORMATION 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_INFORMATION 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_EA 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_EA 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FLUSH_BUFFERS 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_VOLUME_INFORMATION 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_VOLUME_INFORMATION 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DIRECTORY_CONTROL 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FILE_SYSTEM_CONTROL 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CONTROL 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_INTERNAL_DEVICE_CONTROL 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SHUTDOWN 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_LOCK_CONTROL 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLEANUP 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_MAILSLOT 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_SECURITY 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_SECURITY 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_POWER 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SYSTEM_CONTROL 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CHANGE 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_QUOTA 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_QUOTA 8399B1F8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CREATE 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_READ 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_WRITE 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_FLUSH_BUFFERS 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_DEVICE_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_INTERNAL_DEVICE_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_SHUTDOWN 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CLEANUP 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_POWER 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_SYSTEM_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_PNP 83BCB260
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_NAMED_PIPE 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_EA 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_EA 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_VOLUME_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_VOLUME_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DIRECTORY_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FILE_SYSTEM_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_LOCK_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLEANUP 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_MAILSLOT 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_SECURITY 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_SECURITY 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CHANGE 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_QUOTA 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_QUOTA 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 83852668
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE_NAMED_PIPE 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CLOSE 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_READ 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_WRITE 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_EA 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_EA 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_FLUSH_BUFFERS 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_VOLUME_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_VOLUME_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DIRECTORY_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_FILE_SYSTEM_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DEVICE_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_INTERNAL_DEVICE_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SHUTDOWN 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_LOCK_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CLEANUP 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE_MAILSLOT 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_SECURITY 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_SECURITY 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_POWER 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SYSTEM_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DEVICE_CHANGE 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_QUOTA 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_QUOTA 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_PNP 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_NAMED_PIPE 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLOSE 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_READ 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_WRITE 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_EA 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_EA 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FLUSH_BUFFERS 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_VOLUME_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_VOLUME_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DIRECTORY_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FILE_SYSTEM_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\I

offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Gde je ostatak?
Potrebno je da iskopiraš kompletan sadržaj oba file-a.

offline
  • Pridružio: 16 Avg 2007
  • Poruke: 22

File 1 :

GMER 1.0.13.12551 - gmer.net
Rootkit scan 2007-08-18 09:41:30
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.13 ----

SSDT d347bus.sys ZwClose
SSDT \??\C:\WINDOWS\system32\windrvNT.sys ZwCreateFile
SSDT d347bus.sys ZwCreateKey
SSDT d347bus.sys ZwCreatePagingFile
SSDT d347bus.sys ZwEnumerateKey
SSDT d347bus.sys ZwEnumerateValueKey
SSDT \??\C:\WINDOWS\system32\windrvNT.sys ZwOpenFile
SSDT d347bus.sys ZwOpenKey
SSDT \??\C:\WINDOWS\system32\windrvNT.sys ZwQueryDirectoryFile
SSDT \??\C:\WINDOWS\system32\windrvNT.sys ZwQueryInformationProcess
SSDT d347bus.sys ZwQueryKey
SSDT d347bus.sys ZwQueryValueKey
SSDT \??\C:\WINDOWS\system32\windrvNT.sys ZwSetInformationFile
SSDT d347bus.sys ZwSetSystemPowerState
SSDT sptd.sys ZwSetValueKey

---- Kernel code sections - GMER 1.0.13 ----

? C:\WINDOWS\system32\drivers\sptd.sys The process cannot access the file because it is being used by another process.
? C:\WINDOWS\System32\Drivers\SPTD9117.SYS The process cannot access the file because it is being used by another process.

---- User code sections - GMER 1.0.13 ----

.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!LoadLibraryExW 7C801AF1 6 Bytes JMP 5F070F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!LoadLibraryA 7C801D77 6 Bytes JMP 5F250F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!LoadResource 7C809FB5 6 Bytes JMP 5F1C0F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!GetProcAddress 7C80ADA0 6 Bytes JMP 5F1F0F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!LoadLibraryW 7C80AE4B 6 Bytes JMP 5F220F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!FindResourceW 7C80BBCE 6 Bytes JMP 5F160F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!SizeofResource 7C80BC69 6 Bytes JMP 5F190F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] kernel32.dll!SetUnhandledExceptionFilter 7C84467D 5 Bytes JMP 004DE392 C:\Program Files\MSN Messenger\MsnMsgr.Exe
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] ADVAPI32.dll!RegQueryValueExA 77DD7883 6 Bytes JMP 5F040F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] USER32.dll!DispatchMessageW 7E418A01 6 Bytes JMP 5F130F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] USER32.dll!SetWindowLongW 7E41D62B 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] USER32.dll!DestroyWindow 7E41DAEA 3 Bytes [ FF, 25, 1E ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] USER32.dll!DestroyWindow + 4 7E41DAEE 2 Bytes [ 11, 5F ]
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] USER32.dll!CreateWindowExW 7E41FC25 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] WININET.dll!HttpOpenRequestA 771C36CD 6 Bytes JMP 5F280F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] WININET.dll!InternetCloseHandle 771C4D8C 6 Bytes JMP 5F310F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] WININET.dll!HttpQueryInfoA 771C782A 6 Bytes JMP 5F2B0F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] WININET.dll!InternetReadFile 771C8114 6 Bytes JMP 5F2E0F5A
.text C:\Program Files\MSN Messenger\MsnMsgr.Exe[2808] WININET.dll!GetUrlCacheEntryInfoExW 771D68B5 6 Bytes JMP 5F340F5A

---- Kernel IAT/EAT - GMER 1.0.13 ----

IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [F758989E] sptd.sys
IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F759FD86] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F7589E24] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F7589D28] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IofCallDriver] [F7589EF4] sptd.sys
IAT dmio.sys[ntoskrnl.exe!IofCallDriver] [F7589EF4] sptd.sys
IAT dmio.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F7589E24] sptd.sys
IAT dmio.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F7589D28] sptd.sys
IAT PartMgr.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F759F1AE] sptd.sys
IAT PartMgr.sys[ntoskrnl.exe!IoDetachDevice] [F7589A5A] sptd.sys
IAT disk.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F759FE4A] sptd.sys
IAT \WINDOWS\system32\DRIVERS\CLASSPNP.SYS[ntoskrnl.exe!IoDetachDevice] [F758E8C6] sptd.sys
IAT \SystemRoot\system32\DRIVERS\USBPORT.SYS[ntoskrnl.exe!IofCompleteRequest] [F759F04A] sptd.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F759F056] sptd.sys
IAT \SystemRoot\system32\DRIVERS\cdrom.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F759FE4A] sptd.sys
IAT \SystemRoot\system32\DRIVERS\rdbss.sys[ntoskrnl.exe!IofCallDriver] [F7589CC6] sptd.sys
IAT \SystemRoot\system32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IofCallDriver] [F7589CC6] sptd.sys

---- Devices - GMER 1.0.13 ----

Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CREATE 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CLOSE 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_READ 83BCA550
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_WRITE 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_INFORMATION 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_INFORMATION 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_EA 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_EA 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_FLUSH_BUFFERS 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_QUERY_VOLUME_INFORMATION 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SET_VOLUME_INFORMATION 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_DIRECTORY_CONTROL 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_FILE_SYSTEM_CONTROL 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_DEVICE_CONTROL 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_SHUTDOWN 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_LOCK_CONTROL 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_CLEANUP 83BCA688
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_PNP 83BCA688
Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [F7BC985A] avgtdi.sys
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CREATE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CLOSE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_READ 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_WRITE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_FLUSH_BUFFERS 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_INTERNAL_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SHUTDOWN 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_POWER 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_SYSTEM_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_PNP 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CREATE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CLOSE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_READ 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_WRITE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_FLUSH_BUFFERS 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_INTERNAL_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_SHUTDOWN 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_POWER 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_SYSTEM_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_PNP 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CREATE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CLOSE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_READ 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_WRITE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_FLUSH_BUFFERS 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_INTERNAL_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_SHUTDOWN 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_POWER 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_SYSTEM_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_PNP 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CREATE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CLOSE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_READ 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_WRITE 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_FLUSH_BUFFERS 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_INTERNAL_DEVICE_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_SHUTDOWN 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_POWER 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_SYSTEM_CONTROL 83BCA0E8
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_PNP 83BCA0E8
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F7BC985A] avgtdi.sys
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_CREATE E1B62600
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_CLOSE E1B62600
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_DEVICE_CONTROL E1B62600
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_READ 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_WRITE 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_FLUSH_BUFFERS 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_DEVICE_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_INTERNAL_DEVICE_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SHUTDOWN 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CLEANUP 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_POWER 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_SYSTEM_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_PNP 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CREATE 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_READ 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_WRITE 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_FLUSH_BUFFERS 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_DEVICE_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_INTERNAL_DEVICE_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SHUTDOWN 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_CLEANUP 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_POWER 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_SYSTEM_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume2 IRP_MJ_PNP 83BCB260
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_NAMED_PIPE 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_EA 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_EA 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_VOLUME_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_VOLUME_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DIRECTORY_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FILE_SYSTEM_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_LOCK_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLEANUP 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_MAILSLOT 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_SECURITY 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_SECURITY 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CHANGE 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_QUOTA 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_QUOTA 83852668
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 83852668
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_NAMED_PIPE 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLOSE 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_READ 8360C1E0
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_WRITE 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_INFORMATION 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_INFORMATION 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_EA 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_EA 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FLUSH_BUFFERS 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_VOLUME_INFORMATION 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_VOLUME_INFORMATION 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DIRECTORY_CONTROL 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FILE_SYSTEM_CONTROL 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CONTROL 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_INTERNAL_DEVICE_CONTROL 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SHUTDOWN 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_LOCK_CONTROL 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLEANUP 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_MAILSLOT 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_SECURITY 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_SECURITY 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_POWER 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SYSTEM_CONTROL 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CHANGE 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_QUOTA 8399B1F8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_QUOTA 8399B1F8
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CREATE 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_READ 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_WRITE 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_FLUSH_BUFFERS 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_DEVICE_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_INTERNAL_DEVICE_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_SHUTDOWN 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_CLEANUP 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_POWER 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_SYSTEM_CONTROL 83BCB260
Device \Driver\Ftdisk \Device\HarddiskVolume3 IRP_MJ_PNP 83BCB260
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_NAMED_PIPE 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_EA 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_EA 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_VOLUME_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_VOLUME_INFORMATION 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DIRECTORY_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FILE_SYSTEM_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_LOCK_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLEANUP 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_MAILSLOT 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_SECURITY 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_SECURITY 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CHANGE 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_QUOTA 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_QUOTA 83852668
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 83852668
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE_NAMED_PIPE 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CLOSE 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_READ 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_WRITE 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_EA 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_EA 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_FLUSH_BUFFERS 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_VOLUME_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_VOLUME_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DIRECTORY_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_FILE_SYSTEM_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DEVICE_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_INTERNAL_DEVICE_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SHUTDOWN 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_LOCK_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CLEANUP 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE_MAILSLOT 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_SECURITY 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_SECURITY 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_POWER 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SYSTEM_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DEVICE_CHANGE 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_QUOTA 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_QUOTA 839CF220
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_PNP 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_NAMED_PIPE 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLOSE 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_READ 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_WRITE 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_EA 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_EA 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FLUSH_BUFFERS 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_VOLUME_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_VOLUME_INFORMATION 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DIRECTORY_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FILE_SYSTEM_CONTROL 839CF220
Device \Driver\atapi \Device\Ide\Id

offline
  • Pridružio: 16 Avg 2007
  • Poruke: 22

kao da je poruka predugacka za post, pa bude "isecena kad hocu da postujem.

poslacu je iz delova posto ne mogu drugacije.

offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

djolem89, bilo bi dobro da vidimo te logove.
Možeš ih postaviti i korišćenjem opcije ''Prikači fajl'' i onda u sledećoj poruci postavi linkove.

Ko je trenutno na forumu
 

Ukupno su 794 korisnika na forumu :: 35 registrovanih, 3 sakrivenih i 756 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 3466 - dana 01 Jun 2021 17:07

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: _Rade, A.R.Chafee.Jr., Bahuss, Buzdovan, captaingox, cezar 35, crnitrn, danilopu, darkstar101, djboj, Faki-Valjevo, JOntra, kovinacc, Mahovljani, Majki, manda87, Mihajlo, milenko crazy north, mk, nadjas_515, nenad81, novator, Sale.S, shaja1, shone34, Sibin, Sirius, Skywhaler, Snorks, stug, time, uruk, vladas87, voja64, Warhawk