Olimpo Informatico

[Lebistes]

Allora,la situazione per la mia amica si è complicata parecchio.
Intanto il files .bat non funziona,nel senso che si apre una finestrella,che però mostra varie scritte erimane aperta,chiedendo un si oppure un no.Qualunque risp gli si inserisce ritorna come prima.
Gli altri passaggi li abbiamo fatti,ma a quanto pare ad ogni connessione per scaricare i programmini o altro entrano nuovi virus e si riattivano gli altri. Ora stà facendo la scansione da modalità provvisoria con ewido,con avast,poi con ad-aware e infine con spybot.Infine mi manderà il log di ewido e quello di hijackthis e oggi pomeriggio posto tutto.
Cosa si può fare per fare una pulizia totale?

Nel mio computer invece ho trovato tramite scansione online con Kaspersky e tramite avast,che ho installato,un'infezione da win32.agent.gen trojan che ho letto deriva da LinkOptimizer.Ho seguito la tua guida e sono riuscito a fare un pò pulizia. Ho fatto anche pulizia con ViritLT e con Bitdifender online.Ora ti posto il mio log di hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 13.21.03, on 28/07/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\VEXPLITE\viritsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\carpserv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\System32\ZoneLabs\isafe.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Fabio\Documenti\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O8 - Extra context menu item: &Cerca con Google - res://C:\Programmi\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Traduci parola in italiano - res://C:\Programmi\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Link a ritroso - res://C:\Programmi\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pagine simili - res://C:\Programmi\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Versione cache della pagina - res://C:\Programmi\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://home3.ca.com/PestPatrol/uniblue/pestscan/pestscan.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2F6B8EC1-5CBA-49FC-BF11-8BE7CA0B088C}: NameServer = 193.70.152.15 193.70.152.25
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\System32\ZoneLabs\isafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Questo invece è il log di Gmer rootkit:

GMER 1.0.10.10122 - http://www.gmer.net
Rootkit 2006-07-28 05:16:12
Windows 5.1.2600 Service Pack 1


---- System - GMER 1.0.10 ----

SSDT d347bus.sys ZwClose
SSDT \SystemRoot\System32\vsdatant.sys ZwConnectPort
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateFile
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateKey
SSDT d347bus.sys ZwCreatePagingFile
SSDT \SystemRoot\System32\vsdatant.sys ZwCreatePort
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateProcess
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateProcessEx
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateSection
SSDT \SystemRoot\System32\vsdatant.sys ZwCreateWaitablePort
SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteFile
SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteKey
SSDT \SystemRoot\System32\vsdatant.sys ZwDeleteValueKey
SSDT \SystemRoot\System32\vsdatant.sys ZwDuplicateObject
SSDT d347bus.sys ZwEnumerateKey
SSDT d347bus.sys ZwEnumerateValueKey
SSDT \SystemRoot\System32\vsdatant.sys ZwLoadKey
SSDT \SystemRoot\System32\vsdatant.sys ZwMapViewOfSection
SSDT \SystemRoot\System32\vsdatant.sys ZwOpenFile
SSDT d347bus.sys ZwOpenKey
SSDT \SystemRoot\System32\vsdatant.sys ZwOpenProcess
SSDT \SystemRoot\System32\vsdatant.sys ZwOpenThread
SSDT d347bus.sys ZwQueryKey
SSDT d347bus.sys ZwQueryValueKey
SSDT \SystemRoot\System32\vsdatant.sys ZwReplaceKey
SSDT \SystemRoot\System32\vsdatant.sys ZwRequestWaitReplyPort
SSDT \SystemRoot\System32\vsdatant.sys ZwRestoreKey
SSDT \SystemRoot\System32\vsdatant.sys ZwSecureConnectPort
SSDT \SystemRoot\System32\vsdatant.sys ZwSetInformationFile
SSDT \SystemRoot\System32\vsdatant.sys ZwSetSystemInformation
SSDT d347bus.sys ZwSetSystemPowerState
SSDT \SystemRoot\System32\vsdatant.sys ZwSetValueKey
SSDT \SystemRoot\System32\vsdatant.sys ZwTerminateProcess

---- Devices - GMER 1.0.10 ----

Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 823A1450
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CLOSEIRP_MJ_READ [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_MAILSLOT [AAEBBA80] vsdatant.sys
Device \Driver\NetBT \Device\NetBT_Tcpip_{E2E545B7-3B7D-4568-ABBD-617AF52EF7DF} IRP_MJ_CREATE 81F96AE8
Device \Driver\dmio \Device\DmControl\DmIoDaemon IRP_MJ_CREATE 823A2378
Device \Driver\dmio \Device\DmControl\DmConfig IRP_MJ_CREATE 823A2378
Device \Driver\dmio \Device\DmControl\DmPnP IRP_MJ_CREATE 823A2378
Device \Driver\dmio \Device\DmControl\DmInfo IRP_MJ_CREATE 823A2378
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSEIRP_MJ_READ [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_MAILSLOT [AAEBBA80] vsdatant.sys
Device \Driver\prodrv06 \Device\ProDrv06 IRP_MJ_CREATE E19F2C30
Device \Driver\Ftdisk \Device\HarddiskVolume1 IRP_MJ_CREATE 823A2630
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_NAMED_PIPE 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSEIRP_MJ_READ 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_EA 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_EA 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_VOLUME_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_VOLUME_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DIRECTORY_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FILE_SYSTEM_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_LOCK_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLEANUP 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_MAILSLOT 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_SECURITY 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_SECURITY 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CHANGE 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_QUOTA 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_QUOTA 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 8210C008
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP_POWER 8210C008
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_NAMED_PIPE 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLOSEIRP_MJ_READ 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_WRITE 8200ED70
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_INFORMATION 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_INFORMATION 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_EA 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_EA 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FLUSH_BUFFERS 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_VOLUME_INFORMATION 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_VOLUME_INFORMATION 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DIRECTORY_CONTROL 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_FILE_SYSTEM_CONTROL 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CONTROL 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_INTERNAL_DEVICE_CONTROL 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SHUTDOWN 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_LOCK_CONTROL 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CLEANUP 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_CREATE_MAILSLOT 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_SECURITY 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_SECURITY 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_POWER 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SYSTEM_CONTROL 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_DEVICE_CHANGE 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_QUERY_QUOTA 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_SET_QUOTA 820FB0E8
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_PNP 820FB0E8
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_NAMED_PIPE 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSEIRP_MJ_READ 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_EA 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_EA 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_VOLUME_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_VOLUME_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DIRECTORY_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FILE_SYSTEM_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_LOCK_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLEANUP 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_MAILSLOT 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_SECURITY 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_SECURITY 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CHANGE 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_QUOTA 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_QUOTA 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 8210C008
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP_POWER 8210C008
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_NAMED_PIPE 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLOSEIRP_MJ_READ 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_WRITE 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_EA 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_EA 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FLUSH_BUFFERS 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_VOLUME_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_VOLUME_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DIRECTORY_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FILE_SYSTEM_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SHUTDOWN 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_LOCK_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLEANUP 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_MAILSLOT 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_SECURITY 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_SECURITY 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_POWER 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SYSTEM_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CHANGE 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_QUOTA 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_QUOTA 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_PNP 81EFD328
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_PNP_POWER 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_NAMED_PIPE 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLOSEIRP_MJ_READ 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_WRITE 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_EA 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_EA 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FLUSH_BUFFERS 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_VOLUME_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_VOLUME_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DIRECTORY_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FILE_SYSTEM_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_INTERNAL_DEVICE_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SHUTDOWN 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_LOCK_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLEANUP 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_MAILSLOT 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_SECURITY 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_SECURITY 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_POWER 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SYSTEM_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CHANGE 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_QUOTA 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_QUOTA 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_PNP 81EFD328
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_PNP_POWER 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_CREATE 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_CREATE_NAMED_PIPE 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_CLOSEIRP_MJ_READ 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_WRITE 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_QUERY_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_SET_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_QUERY_EA 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_SET_EA 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_FLUSH_BUFFERS 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_QUERY_VOLUME_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_SET_VOLUME_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_DIRECTORY_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_FILE_SYSTEM_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_DEVICE_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_INTERNAL_DEVICE_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_SHUTDOWN 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_LOCK_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_CLEANUP 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_CREATE_MAILSLOT 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_QUERY_SECURITY 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_SET_SECURITY 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_POWER 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_SYSTEM_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_DEVICE_CHANGE 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_QUERY_QUOTA 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_SET_QUOTA 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_PNP 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_PNP_POWER 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_CREATE 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_CREATE_NAMED_PIPE 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_CLOSEIRP_MJ_READ 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_WRITE 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_QUERY_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_SET_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_QUERY_EA 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_SET_EA 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_FLUSH_BUFFERS 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_QUERY_VOLUME_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_SET_VOLUME_INFORMATION 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_DIRECTORY_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_FILE_SYSTEM_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_DEVICE_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_INTERNAL_DEVICE_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_SHUTDOWN 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_LOCK_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_CLEANUP 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_CREATE_MAILSLOT 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_QUERY_SECURITY 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_SET_SECURITY 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_POWER 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_SYSTEM_CONTROL 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_DEVICE_CHANGE 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_QUERY_QUOTA 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_SET_QUOTA 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_PNP 81EFD328
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-6 IRP_MJ_PNP_POWER 81EFD328
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE_NAMED_PIPE 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLOSEIRP_MJ_READ 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_WRITE 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_EA 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_EA 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FLUSH_BUFFERS 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_VOLUME_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_VOLUME_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DIRECTORY_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_FILE_SYSTEM_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_INTERNAL_DEVICE_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SHUTDOWN 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_LOCK_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CLEANUP 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_CREATE_MAILSLOT 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_SECURITY 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_SECURITY 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_POWER 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SYSTEM_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_DEVICE_CHANGE 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_QUERY_QUOTA 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_SET_QUOTA 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_PNP 8210C008
Device \Driver\Cdrom \Device\CdRom2 IRP_MJ_PNP_POWER 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CREATE 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CREATE_NAMED_PIPE 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CLOSEIRP_MJ_READ 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_WRITE 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_QUERY_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SET_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_QUERY_EA 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SET_EA 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_FLUSH_BUFFERS 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_QUERY_VOLUME_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SET_VOLUME_INFORMATION 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_DIRECTORY_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_FILE_SYSTEM_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_DEVICE_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_INTERNAL_DEVICE_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SHUTDOWN 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_LOCK_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CLEANUP 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_CREATE_MAILSLOT 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_QUERY_SECURITY 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SET_SECURITY 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_POWER 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SYSTEM_CONTROL 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_DEVICE_CHANGE 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_QUERY_QUOTA 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_SET_QUOTA 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_PNP 8210C008
Device \Driver\Cdrom \Device\CdRom3 IRP_MJ_PNP_POWER 8210C008
Device \Driver\prohlp02 \Device\ProHlp02 IRP_MJ_CREATE E1018B50
Device \Driver\NetBT \Device\NetBt_Wins_Export IRP_MJ_CREATE 81F96AE8
Device \Driver\NetBT \Device\NetbiosSmb IRP_MJ_CREATE 81F96AE8
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CLOSEIRP_MJ_READ [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_SHUTDOWN [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\Udp IRP_MJ_CREATE_MAILSLOT [AAEBBA80] vsdatant.sys
Device \Driver\Disk \Device\Harddisk0\DR0 IRP_MJ_CREATE 823A1708
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSEIRP_MJ_READ [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_SHUTDOWN [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_MAILSLOT [AAEBBA80] vsdatant.sys
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_NAMED_PIPE 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLOSEIRP_MJ_READ 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_WRITE 8200CF70
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_INFORMATION 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_INFORMATION 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_EA 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_EA 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FLUSH_BUFFERS 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_VOLUME_INFORMATION 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_VOLUME_INFORMATION 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DIRECTORY_CONTROL 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_FILE_SYSTEM_CONTROL 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CONTROL 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_INTERNAL_DEVICE_CONTROL 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SHUTDOWN 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_LOCK_CONTROL 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CLEANUP 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_CREATE_MAILSLOT 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_SECURITY 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_SECURITY 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_POWER 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SYSTEM_CONTROL 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_DEVICE_CHANGE 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_QUERY_QUOTA 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_SET_QUOTA 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_PNP 82067770
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver IRP_MJ_PNP_POWER 82067770
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLOSEIRP_MJ_READ [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_SHUTDOWN [AAEBBA80] vsdatant.sys
Device \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE_MAILSLOT [AAEBBA80] vsdatant.sys
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_NAMED_PIPE 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLOSEIRP_MJ_READ 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_WRITE 8200CF70
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_INFORMATION 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_INFORMATION 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_EA 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_EA 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FLUSH_BUFFERS 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_VOLUME_INFORMATION 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_VOLUME_INFORMATION 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DIRECTORY_CONTROL 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_FILE_SYSTEM_CONTROL 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CONTROL 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_INTERNAL_DEVICE_CONTROL 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SHUTDOWN 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_LOCK_CONTROL 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CLEANUP 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_CREATE_MAILSLOT 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_SECURITY 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_SECURITY 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_POWER 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SYSTEM_CONTROL 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_DEVICE_CHANGE 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_QUERY_QUOTA 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_SET_QUOTA 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_PNP 82067770
Device \FileSystem\MRxSmb \Device\LanmanRedirector IRP_MJ_PNP_POWER 82067770
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CREATE 820A51E8
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CREATE_NAMED_PIPE 820A51E8
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_CLOSEIRP_MJ_READ 820A51E8
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_WRITE 821366E8
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_QUERY_INFORMATION 820A51E8
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_SET_INFORMATION 820A51E8
Device \FileSystem\Npfs \Device\NamedPipe IRP_MJ_QUERY_EA 820A51E8
Device \Driver\Ftdisk \Device\FtControl IRP_MJ_CREATE 823A2630
Device \FileSystem\Msfs \Device\Mailslot IRP_MJ_CREATE 82370530
Device \Driver\viasraid \Device\Scsi\viasraid1 IRP_MJ_CREATE 823A1EB0
Device \Driver\viasraid \Device\Scsi\viasraid1 IRP_MJ_SHUTDOWN [F8A43661] prosync1.sys
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_CREATE 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_CREATE_NAMED_PIPE 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_CLOSEIRP_MJ_READ 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_WRITE 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_QUERY_INFORMATION 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_SET_INFORMATION 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_QUERY_EA 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_SET_EA 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_FLUSH_BUFFERS 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_QUERY_VOLUME_INFORMATION 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_SET_VOLUME_INFORMATION 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_DIRECTORY_CONTROL 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_FILE_SYSTEM_CONTROL 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_SHUTDOWN 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_LOCK_CONTROL 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_CLEANUP 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_CREATE_MAILSLOT 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_QUERY_SECURITY 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_SET_SECURITY 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_POWER 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_DEVICE_CHANGE 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_QUERY_QUOTA 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_SET_QUOTA 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_PNP 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1Port4Path0Target0Lun0 IRP_MJ_PNP_POWER 82027638
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_CREATE 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_CREATE_NAMED_PIPE 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_CLOSEIRP_MJ_READ 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_WRITE 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_QUERY_INFORMATION 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_SET_INFORMATION 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_QUERY_EA 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_SET_EA 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_FLUSH_BUFFERS 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_QUERY_VOLUME_INFORMATION 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_SET_VOLUME_INFORMATION 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_DIRECTORY_CONTROL 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_FILE_SYSTEM_CONTROL 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_SHUTDOWN 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_LOCK_CONTROL 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_CLEANUP 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_CREATE_MAILSLOT 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_QUERY_SECURITY 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_SET_SECURITY 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_POWER 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_DEVICE_CHANGE 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_QUERY_QUOTA 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_SET_QUOTA 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_PNP 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1Port3Path0Target0Lun0 IRP_MJ_PNP_POWER 8203A008
Device \Driver\viasraid \Device\Scsi\viasraid1Port2Path0Target0Lun0 IRP_MJ_CREATE 823A1EB0
Device \Driver\viasraid \Device\Scsi\viasraid1Port2Path0Target0Lun0 IRP_MJ_SHUTDOWN [F8A43661] prosync1.sys
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CREATE 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CREATE_NAMED_PIPE 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CLOSEIRP_MJ_READ 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_WRITE 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_INFORMATION 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_INFORMATION 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_EA 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_EA 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_FLUSH_BUFFERS 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_VOLUME_INFORMATION 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_VOLUME_INFORMATION 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_DIRECTORY_CONTROL 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_FILE_SYSTEM_CONTROL 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_DEVICE_CONTROL 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SHUTDOWN 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_LOCK_CONTROL 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CLEANUP 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_CREATE_MAILSLOT 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_SECURITY 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_SECURITY 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_POWER 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SYSTEM_CONTROL 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_DEVICE_CHANGE 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_QUERY_QUOTA 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_SET_QUOTA 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_PNP 82027638
Device \Driver\a347scsi \Device\Scsi\a347scsi1 IRP_MJ_PNP_POWER 82027638
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CREATE 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CREATE_NAMED_PIPE 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CLOSEIRP_MJ_READ 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_WRITE 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_INFORMATION 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_INFORMATION 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_EA 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_EA 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_FLUSH_BUFFERS 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_VOLUME_INFORMATION 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_VOLUME_INFORMATION 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_DIRECTORY_CONTROL 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_FILE_SYSTEM_CONTROL 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_DEVICE_CONTROL 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_INTERNAL_DEVICE_CONTROL 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SHUTDOWN 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_LOCK_CONTROL 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CLEANUP 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_CREATE_MAILSLOT 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_SECURITY 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_SECURITY 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_POWER 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SYSTEM_CONTROL 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_DEVICE_CHANGE 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_QUERY_QUOTA 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_SET_QUOTA 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_PNP 8203A008
Device \Driver\d347prt \Device\Scsi\d347prt1 IRP_MJ_PNP_POWER 8203A008
Device \FileSystem\Cdfs \Cdfs IRP_MJ_CREATE 820A90E8

---- Modules - GMER 1.0.10 ----

Module _________ F835B000

---- Files - GMER 1.0.10 ----

File C:\System Volume Information\tracking.log
File C:\System Volume Information\_restore{2D442F79-6959-43CE-A367-0595B752FC33}

---- EOF - GMER 1.0.10 ----

e questo quello di Gmer autostart:

GMER 1.0.10.10122 - http://www.gmer.net
Autostart 2006-07-28 05:16:38
Windows 5.1.2600 Service Pack 1


HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit = C:\WINDOWS\system32\userinit.exe,

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent@DLLName = Ati2evxx.dll

HKLM\SYSTEM\CurrentControlSet\Services\ >>>
aswUpdSv /*avast! iAVS4 Control Service*/@ = "C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe"
Ati HotKey Poller@ = %SystemRoot%\System32\Ati2evxx.exe
ATI Smart /*ATI Smart*/@ = C:\WINDOWS\system32\ati2sgag.exe
avast! Antivirus /*avast! Antivirus*/@ = "C:\Programmi\Alwil Software\Avast4\ashServ.exe"
NetWye /*NetW

[holifay]

Il tuo PC adesso mi sembra OK, almeno a giudicare dai log che hai postato.
Hai ancora traccia del trojan Agent /linkoptimizer?


Per il PC di tua sorella, falle installare Prevx e fai una scansione dalla modalità provvisoria, dopo averlo aggiornato online

Poi posta il log di Prevx e un nuovo log di HijackThis

Ciao


PS: clicca su rispondi, non su nuovo, così continuiamo in un topic già aperto