Jump to content

John.Doe

Malware Hunters
 View Profile  See their activity

  • Posts

    175

  • Joined

  • Last visited

 Content Type 

Posts posted by John.Doe

    Changes in V1.70

    in Malwarebytes for Windows Support Forum

    Posted

    Hi shadowwar,

    Mbar doesnt look in the same place as a MBAM full scan.
    We know that. The reason for MBAR was the suspicion for rootkits. He has 64bit, so we can't use Gmer or other good rootkitscanner.

    We have still no explanation why MBAM shows absolutely nothing although the malware is still in the quarantine of OTL. One idea was that MBAM exclude this quarantine since 1.70. Another idea are rootkits that prevent MBAM from working.

    bye, andreas

    Changes in V1.70

    in Malwarebytes for Windows Support Forum

    Posted

    Hi shadowwar,

    sure. Watch this log => http://forum.botfrei...ull=1#post85076

    VT-Scan and my control scan => http://forum.botfrei...ull=1#post85170

    File is attached.

    Another thread, same behavior => http://forum.botfrei...d.php?9529-2-11

    bye, andreas

    Edit: We got some more logs

    =====

    SystemLook 30.07.11 by jpshortstuff

    Log created at 23:00 on 11/01/2013 by Jens7

    Administrator - Elevation successful

    ========== dir ==========

    C:\_OTL - Parameters: "/s"

    ---Files---

    MovedFiles.zip --a---- 1770154 bytes [19:57 11/01/2013] [19:57 11/01/2013]

    C:\_OTL\MovedFiles d------ [14:52 11/09/2012]

    01102013_235057.log --a---- 11566 bytes [22:53 10/01/2013] [22:56 10/01/2013]

    09112012_165201.log --a---- 392 bytes [14:53 11/09/2012] [14:53 11/09/2012]

    C:\_OTL\MovedFiles\01102013_235057 d------ [22:50 10/01/2013]

    C:\_OTL\MovedFiles\01102013_235057\C_ProgramData d------ [22:50 10/01/2013]

    dsgsdgdsgdsgw.js --a---- 2889 bytes [16:31 09/01/2013] [16:31 09/01/2013]

    dsgsdgdsgdsgw.pad --a---- 95023320 bytes [16:31 09/01/2013] [23:13 09/01/2013]

    mtbjfghn.xbe --a---- 5115 bytes [15:47 01/08/2011] [15:47 01/08/2011]

    C:\_OTL\MovedFiles\01102013_235057\C_Users d------ [22:50 10/01/2013]

    C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7 d------ [22:50 10/01/2013]

    wgsdgsdgdsgsd.dll --a---- 189192 bytes [16:31 09/01/2013] [16:31 09/01/2013]

    C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData d------ [22:50 10/01/2013]

    C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Local d------ [22:56 10/01/2013]

    C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Local\Temp d------ [22:56 10/01/2013]

    FXSAPIDebugLogFile.txt --a---- 0 bytes [14:54 11/09/2012] [14:54 11/09/2012]

    C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Roaming d------ [22:50 10/01/2013]

    C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Roaming\Microsoft d------ [22:50 10/01/2013]

    C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Roaming\Microsoft\Windows d------ [22:50 10/01/2013]

    C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Roaming\Microsoft\Windows\Start Menu d------ [22:50 10/01/2013]

    C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs d------ [22:50 10/01/2013]

    C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup d------ [22:50 10/01/2013]

    runctf.lnk --a---- 1083 bytes [16:31 09/01/2013] [16:31 09/01/2013]

    C:\_OTL\MovedFiles\09112012_165201 d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Program Files (x86) d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Program Files (x86)\Google d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Program Files (x86)\Google\Update d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Program Files (x86)\Google\Update\1.3.21.115 d------ [14:52 11/09/2012]

    npGoogleUpdate3.dll --a---- 566736 bytes [22:17 14/07/2012] [22:17 14/07/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_ProgramData d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Users d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7 d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Local d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Local\Google d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Local\Google\Update d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Local\Google\Update\1.3.21.123 d------ [14:52 11/09/2012]

    npGoogleUpdate3.dll --a---- 572880 bytes [13:30 09/09/2012] [13:30 09/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Local\Temp d------ [14:53 11/09/2012]

    FXSAPIDebugLogFile.txt --a---- 0 bytes [08:42 06/10/2010] [08:42 06/10/2010]

    C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Roaming d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Roaming\Microsoft d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Roaming\Microsoft\Windows d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Roaming\Microsoft\Windows\Start Menu d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup d------ [14:52 11/09/2012]

    Telefon.url --a---- 106 bytes [13:01 07/09/2012] [10:06 07/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Windows d------ [14:52 11/09/2012]

    C:\_OTL\MovedFiles\09112012_165201\C_Windows\Tasks d------ [14:52 11/09/2012]

    GoogleUpdateTaskMachineCore.job --a---- 1106 bytes [09:13 06/10/2010] [08:07 10/09/2012]

    GoogleUpdateTaskMachineUA.job --a---- 1110 bytes [09:13 06/10/2010] [14:22 09/09/2012]

    GoogleUpdateTaskUserS-1-5-21-3817058908-3965746830-774432145-1000Core.job --a---- 1068 bytes [21:05 25/08/2011] [13:35 09/09/2012]

    GoogleUpdateTaskUserS-1-5-21-3817058908-3965746830-774432145-1000UA.job --a---- 1120 bytes [21:05 25/08/2011] [14:35 09/09/2012]

    -= EOF =-

    =====

    Malwarebytes Anti-Rootkit 1.01.0.1011

    www.malwarebytes.org

    Database version: v2013.01.11.14

    Windows 7 Service Pack 1 x64 NTFS

    Internet Explorer 9.0.8112.16421

    Jens7 :: PS7004 [administrator]

    11.01.2013 22:25:08

    mbar-log-2013-01-11 (22-25-08).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P

    Scan options disabled:

    Objects scanned: 34800

    Time elapsed: 5 minute(s), 24 second(s)

    Memory Processes Detected: 0

    (No malicious items detected)

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 0

    (No malicious items detected)

    (end)

    =====

    ---------------------------------------

    Malwarebytes Anti-Rootkit BETA 1.01.0.1011

    © Malwarebytes Corporation 2011-2012

    OS version: 6.1.7601 Windows 7 Service Pack 1 x64

    Account is Administrative

    Internet Explorer version: 9.0.8112.16421

    File system is: NTFS

    Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, Q:\ DRIVE_FIXED

    CPU speed: 2.800000 GHz

    Memory total: 8572907520, free: 6361698304

    ------------ Kernel report ------------

    01/11/2013 22:19:21

    ------------ Loaded modules -----------

    \SystemRoot\system32\ntoskrnl.exe

    \SystemRoot\system32\hal.dll

    \SystemRoot\system32\kdcom.dll

    \SystemRoot\system32\mcupdate_AuthenticAMD.dll

    \SystemRoot\system32\PSHED.dll

    \SystemRoot\system32\CLFS.SYS

    \SystemRoot\system32\CI.dll

    \SystemRoot\system32\drivers\Wdf01000.sys

    \SystemRoot\system32\drivers\WDFLDR.SYS

    \SystemRoot\system32\drivers\ACPI.sys

    \SystemRoot\system32\drivers\WMILIB.SYS

    \SystemRoot\system32\drivers\msisadrv.sys

    \SystemRoot\system32\drivers\pci.sys

    \SystemRoot\system32\drivers\vdrvroot.sys

    \SystemRoot\System32\drivers\partmgr.sys

    \SystemRoot\system32\drivers\volmgr.sys

    \SystemRoot\System32\drivers\volmgrx.sys

    \SystemRoot\System32\drivers\mountmgr.sys

    \SystemRoot\system32\drivers\amdxata.sys

    \SystemRoot\system32\drivers\fltmgr.sys

    \SystemRoot\system32\drivers\fileinfo.sys

    \SystemRoot\System32\Drivers\PxHlpa64.sys

    \SystemRoot\System32\Drivers\Ntfs.sys

    \SystemRoot\System32\Drivers\msrpc.sys

    \SystemRoot\System32\Drivers\ksecdd.sys

    \SystemRoot\System32\Drivers\cng.sys

    \SystemRoot\System32\drivers\pcw.sys

    \SystemRoot\System32\Drivers\Fs_Rec.sys

    \SystemRoot\system32\drivers\ndis.sys

    \SystemRoot\system32\drivers\NETIO.SYS

    \SystemRoot\System32\Drivers\ksecpkg.sys

    \SystemRoot\System32\drivers\tcpip.sys

    \SystemRoot\System32\drivers\fwpkclnt.sys

    \SystemRoot\system32\drivers\volsnap.sys

    \SystemRoot\System32\Drivers\spldr.sys

    \SystemRoot\System32\drivers\rdyboost.sys

    \SystemRoot\System32\Drivers\mup.sys

    \SystemRoot\System32\drivers\hwpolicy.sys

    \SystemRoot\System32\DRIVERS\fvevol.sys

    \SystemRoot\system32\DRIVERS\disk.sys

    \SystemRoot\system32\DRIVERS\CLASSPNP.SYS

    \SystemRoot\system32\DRIVERS\AtiPcie.sys

    \SystemRoot\system32\DRIVERS\ahcix64s.sys

    \SystemRoot\system32\DRIVERS\storport.sys

    \SystemRoot\system32\DRIVERS\cdrom.sys

    \SystemRoot\System32\Drivers\Null.SYS

    \SystemRoot\System32\Drivers\Beep.SYS

    \SystemRoot\System32\drivers\vga.sys

    \SystemRoot\System32\drivers\VIDEOPRT.SYS

    \SystemRoot\System32\drivers\watchdog.sys

    \SystemRoot\System32\DRIVERS\RDPCDD.sys

    \SystemRoot\system32\drivers\rdpencdd.sys

    \SystemRoot\system32\drivers\rdprefmp.sys

    \SystemRoot\System32\Drivers\Msfs.SYS

    \SystemRoot\System32\Drivers\Npfs.SYS

    \SystemRoot\system32\DRIVERS\tdx.sys

    \SystemRoot\system32\DRIVERS\TDI.SYS

    \SystemRoot\System32\DRIVERS\netbt.sys

    \SystemRoot\system32\drivers\afd.sys

    \SystemRoot\system32\DRIVERS\wfplwf.sys

    \SystemRoot\system32\DRIVERS\pacer.sys

    \SystemRoot\system32\DRIVERS\netbios.sys

    \SystemRoot\system32\DRIVERS\wanarp.sys

    \SystemRoot\system32\drivers\termdd.sys

    \SystemRoot\system32\DRIVERS\rdbss.sys

    \SystemRoot\system32\drivers\nsiproxy.sys

    \SystemRoot\system32\drivers\mssmbios.sys

    \SystemRoot\System32\drivers\discache.sys

    \SystemRoot\System32\Drivers\dfsc.sys

    \SystemRoot\system32\DRIVERS\blbdrive.sys

    \SystemRoot\system32\DRIVERS\avkmgr.sys

    \SystemRoot\system32\DRIVERS\avipbb.sys

    \SystemRoot\system32\DRIVERS\tunnel.sys

    \SystemRoot\system32\DRIVERS\amdppm.sys

    \SystemRoot\system32\DRIVERS\atikmpag.sys

    \SystemRoot\system32\DRIVERS\atipmdag.sys

    \SystemRoot\System32\drivers\dxgkrnl.sys

    \SystemRoot\System32\drivers\dxgmms1.sys

    \SystemRoot\system32\drivers\HDAudBus.sys

    \SystemRoot\system32\DRIVERS\usbohci.sys

    \SystemRoot\system32\DRIVERS\USBPORT.SYS

    \SystemRoot\system32\DRIVERS\usbehci.sys

    \SystemRoot\system32\DRIVERS\mouclass.sys

    \SystemRoot\system32\DRIVERS\Rt64win7.sys

    \SystemRoot\system32\drivers\wmiacpi.sys

    \SystemRoot\system32\drivers\CompositeBus.sys

    \SystemRoot\system32\DRIVERS\AgileVpn.sys

    \SystemRoot\system32\DRIVERS\rasl2tp.sys

    \SystemRoot\system32\DRIVERS\ndistapi.sys

    \SystemRoot\system32\DRIVERS\ndiswan.sys

    \SystemRoot\system32\DRIVERS\raspppoe.sys

    \SystemRoot\system32\DRIVERS\raspptp.sys

    \SystemRoot\system32\DRIVERS\rassstp.sys

    \SystemRoot\system32\DRIVERS\kbdclass.sys

    \SystemRoot\system32\drivers\swenum.sys

    \SystemRoot\system32\drivers\ks.sys

    \SystemRoot\system32\drivers\umbus.sys

    \SystemRoot\system32\DRIVERS\usbhub.sys

    \SystemRoot\System32\Drivers\NDProxy.SYS

    \SystemRoot\system32\drivers\AtihdW76.sys

    \SystemRoot\system32\drivers\portcls.sys

    \SystemRoot\system32\drivers\drmk.sys

    \SystemRoot\system32\drivers\ksthunk.sys

    \SystemRoot\system32\drivers\RTKVHD64.sys

    \SystemRoot\System32\Drivers\crashdmp.sys

    \SystemRoot\System32\Drivers\dump_diskdump.sys

    \SystemRoot\System32\Drivers\dump_ahcix64s.sys

    \SystemRoot\System32\Drivers\dump_dumpfve.sys

    \SystemRoot\system32\DRIVERS\usbccgp.sys

    \SystemRoot\system32\DRIVERS\USBD.SYS

    \SystemRoot\System32\Drivers\RTL2832UUSB.sys

    \SystemRoot\system32\drivers\RTL2832UBDA.sys

    \SystemRoot\system32\drivers\BdaSup.SYS

    \SystemRoot\system32\DRIVERS\RTL2832U_IRHID.sys

    \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

    \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

    \SystemRoot\System32\win32k.sys

    \SystemRoot\System32\drivers\Dxapi.sys

    \SystemRoot\system32\DRIVERS\kbdhid.sys

    \SystemRoot\system32\DRIVERS\hidusb.sys

    \SystemRoot\system32\DRIVERS\USBSTOR.SYS

    \SystemRoot\system32\DRIVERS\V0470Vid.sys

    \SystemRoot\system32\drivers\usbaudio.sys

    \SystemRoot\system32\DRIVERS\mouhid.sys

    \SystemRoot\system32\DRIVERS\monitor.sys

    \SystemRoot\System32\TSDDD.dll

    \SystemRoot\System32\cdd.dll

    \SystemRoot\System32\ATMFD.DLL

    \SystemRoot\system32\drivers\luafv.sys

    \SystemRoot\system32\DRIVERS\avgntflt.sys

    \??\C:\Windows\system32\drivers\mbam.sys

    \SystemRoot\system32\DRIVERS\Sftvollh.sys

    \SystemRoot\system32\drivers\WudfPf.sys

    \SystemRoot\system32\DRIVERS\lltdio.sys

    \SystemRoot\system32\DRIVERS\rspndr.sys

    \SystemRoot\system32\drivers\HTTP.sys

    \SystemRoot\system32\DRIVERS\bowser.sys

    \SystemRoot\System32\drivers\mpsdrv.sys

    \SystemRoot\system32\DRIVERS\mrxsmb.sys

    \SystemRoot\system32\DRIVERS\mrxsmb10.sys

    \SystemRoot\system32\DRIVERS\mrxsmb20.sys

    \SystemRoot\system32\drivers\peauth.sys

    \SystemRoot\System32\Drivers\secdrv.SYS

    \SystemRoot\system32\DRIVERS\Sftfslh.sys

    \SystemRoot\system32\DRIVERS\Sftplaylh.sys

    \SystemRoot\System32\DRIVERS\srvnet.sys

    \SystemRoot\System32\drivers\tcpipreg.sys

    \SystemRoot\System32\DRIVERS\srv2.sys

    \SystemRoot\System32\DRIVERS\srv.sys

    \SystemRoot\system32\DRIVERS\Sftredirlh.sys

    \SystemRoot\system32\DRIVERS\WUDFRd.sys

    \??\C:\Windows\system32\drivers\mbamchameleon.sys

    \??\C:\Windows\system32\drivers\mbamswissarmy.sys

    \Windows\System32\ntdll.dll

    \Windows\System32\smss.exe

    \Windows\System32\apisetschema.dll

    \Windows\System32\autochk.exe

    \Windows\System32\urlmon.dll

    \Windows\System32\psapi.dll

    \Windows\System32\shlwapi.dll

    \Windows\System32\sechost.dll

    \Windows\System32\lpk.dll

    \Windows\System32\rpcrt4.dll

    \Windows\System32\nsi.dll

    \Windows\System32\difxapi.dll

    \Windows\System32\ole32.dll

    \Windows\System32\imagehlp.dll

    \Windows\System32\iertutil.dll

    \Windows\System32\msctf.dll

    \Windows\System32\clbcatq.dll

    \Windows\System32\user32.dll

    \Windows\System32\wininet.dll

    \Windows\System32\Wldap32.dll

    \Windows\System32\setupapi.dll

    \Windows\System32\msvcrt.dll

    \Windows\System32\oleaut32.dll

    \Windows\System32\gdi32.dll

    \Windows\System32\imm32.dll

    \Windows\System32\comdlg32.dll

    \Windows\System32\advapi32.dll

    \Windows\System32\ws2_32.dll

    \Windows\System32\shell32.dll

    \Windows\System32\usp10.dll

    \Windows\System32\kernel32.dll

    \Windows\System32\normaliz.dll

    \Windows\System32\cfgmgr32.dll

    \Windows\System32\wintrust.dll

    \Windows\System32\devobj.dll

    \Windows\System32\crypt32.dll

    \Windows\System32\comctl32.dll

    ----------- End -----------

    <<<1>>>

    Upper Device Name: \Device\Harddisk5\DR5

    Upper Device Object: 0xfffffa800972b790

    Upper Device Driver Name: \Driver\Disk\

    Lower Device Name: \Device\0000008d\

    Lower Device Object: 0xfffffa80094dcb60

    Lower Device Driver Name: \Driver\USBSTOR\

    Driver name found: USBSTOR

    DriverEntry returned 0x0

    Function returned 0x0

    <<<1>>>

    Upper Device Name: \Device\Harddisk4\DR4

    Upper Device Object: 0xfffffa8008f19790

    Upper Device Driver Name: \Driver\Disk\

    Lower Device Name: \Device\0000008c\

    Lower Device Object: 0xfffffa80094ddb60

    Lower Device Driver Name: \Driver\USBSTOR\

    Driver name found: USBSTOR

    <<<1>>>

    Upper Device Name: \Device\Harddisk3\DR3

    Upper Device Object: 0xfffffa8009490790

    Upper Device Driver Name: \Driver\Disk\

    Lower Device Name: \Device\0000008b\

    Lower Device Object: 0xfffffa80094dbb60

    Lower Device Driver Name: \Driver\USBSTOR\

    Driver name found: USBSTOR

    <<<1>>>

    Upper Device Name: \Device\Harddisk2\DR2

    Upper Device Object: 0xfffffa8008f14790

    Upper Device Driver Name: \Driver\Disk\

    Lower Device Name: \Device\0000008a\

    Lower Device Object: 0xfffffa80094d6b60

    Lower Device Driver Name: \Driver\USBSTOR\

    Driver name found: USBSTOR

    <<<1>>>

    Upper Device Name: \Device\Harddisk1\DR1

    Upper Device Object: 0xfffffa80097c5790

    Upper Device Driver Name: \Driver\Disk\

    Lower Device Name: \Device\00000089\

    Lower Device Object: 0xfffffa80094dab60

    Lower Device Driver Name: \Driver\USBSTOR\

    Driver name found: USBSTOR

    <<<1>>>

    Upper Device Name: \Device\Harddisk0\DR0

    Upper Device Object: 0xfffffa80082e8790

    Upper Device Driver Name: \Driver\Disk\

    Lower Device Name: \Device\00000064\

    Lower Device Object: 0xfffffa800791d9c0

    Lower Device Driver Name: \Driver\ahcix64s\

    Driver name found: ahcix64s

    DriverEntry returned 0x0

    Function returned 0x0

    Downloaded database version: v2013.01.11.14

    Downloaded database version: v2013.01.04.01

    Initializing...

    Done!

    <<<2>>>

    Device number: 0, partition: 3

    Physical Sector Size: 512

    Drive: 0, DevicePointer: 0xfffffa80082e8790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

    --------- Disk Stack ------

    DevicePointer: 0xfffffa80082e82c0, DeviceName: Unknown, DriverName: \Driver\partmgr\

    DevicePointer: 0xfffffa80082e8790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

    DevicePointer: 0xfffffa800791d9c0, DeviceName: \Device\00000064\, DriverName: \Driver\ahcix64s\

    ------------ End ----------

    Upper DeviceData: 0xfffff8a00decd150, 0xfffffa80082e8790, 0xfffffa800ca4e790

    Lower DeviceData: 0xfffff8a0024c6a20, 0xfffffa800791d9c0, 0xfffffa800d0651f0

    <<<3>>>

    Volume: C:

    File system type: NTFS

    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

    Scanning directory: C:\Windows\system32\drivers...

    Done!

    Drive 0

    Scanning MBR on drive 0...

    Inspecting partition table:

    MBR Signature: 55AA

    Disk Signature: 4F16D6A4

    Partition information:

    Partition 0 type is Other (0x27)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 2048 Numsec = 31457280

    Partition 1 type is Primary (0x7)

    Partition is ACTIVE.

    Partition starts at LBA: 31459328 Numsec = 204800

    Partition file system is NTFS

    Partition is bootable

    Partition 2 type is Primary (0x7)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 31664128 Numsec = 960393216

    Partition 3 type is Primary (0x7)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 992057344 Numsec = 961333248

    Disk Size: 1000137752576 bytes

    Sector size: 512 bytes

    Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1953374048-1953394048)...

    Physical Sector Size: 0

    Drive: 1, DevicePointer: 0xfffffa80097c5790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

    --------- Disk Stack ------

    DevicePointer: 0xfffffa80097c52c0, DeviceName: Unknown, DriverName: \Driver\partmgr\

    DevicePointer: 0xfffffa80097c5790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

    DevicePointer: 0xfffffa80094dab60, DeviceName: \Device\00000089\, DriverName: \Driver\USBSTOR\

    ------------ End ----------

    Physical Sector Size: 0

    Drive: 2, DevicePointer: 0xfffffa8008f14790, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\

    --------- Disk Stack ------

    DevicePointer: 0xfffffa8008f142c0, DeviceName: Unknown, DriverName: \Driver\partmgr\

    DevicePointer: 0xfffffa8008f14790, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\

    DevicePointer: 0xfffffa80094d6b60, DeviceName: \Device\0000008a\, DriverName: \Driver\USBSTOR\

    ------------ End ----------

    Physical Sector Size: 0

    Drive: 3, DevicePointer: 0xfffffa8009490790, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\

    --------- Disk Stack ------

    DevicePointer: 0xfffffa80094902c0, DeviceName: Unknown, DriverName: \Driver\partmgr\

    DevicePointer: 0xfffffa8009490790, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\

    DevicePointer: 0xfffffa80094dbb60, DeviceName: \Device\0000008b\, DriverName: \Driver\USBSTOR\

    ------------ End ----------

    Physical Sector Size: 0

    Drive: 4, DevicePointer: 0xfffffa8008f19790, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\

    --------- Disk Stack ------

    DevicePointer: 0xfffffa8008f192c0, DeviceName: Unknown, DriverName: \Driver\partmgr\

    DevicePointer: 0xfffffa8008f19790, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\

    DevicePointer: 0xfffffa80094ddb60, DeviceName: \Device\0000008c\, DriverName: \Driver\USBSTOR\

    ------------ End ----------

    Physical Sector Size: 0

    Drive: 5, DevicePointer: 0xfffffa800972b790, DeviceName: \Device\Harddisk5\DR5\, DriverName: \Driver\Disk\

    --------- Disk Stack ------

    DevicePointer: 0xfffffa800972b2c0, DeviceName: Unknown, DriverName: \Driver\partmgr\

    DevicePointer: 0xfffffa800972b790, DeviceName: \Device\Harddisk5\DR5\, DriverName: \Driver\Disk\

    DevicePointer: 0xfffffa80094dcb60, DeviceName: \Device\0000008d\, DriverName: \Driver\USBSTOR\

    ------------ End ----------

    Done!

    Performing system, memory and registry scan...

    Done!

    Scan finished

    =======================================

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.