Malwarebytes + hijack this crash after seconds

KYGuy731 · August 8, 2009

I am having basicly the same problem everyone posting here is atm.

I try to run anti virus/or/ antimalware progs an they just terminate/crash/disapear after sconds of starting scans. MY virus programs, AntiVir/Vipre/AVG can find viruses but when i do a removal at the end of the scans they do same as other progs... either lock up [vipre durring removal], or just disappear.

So far I have tried these progs in turn....

[All updated to newest before running]

Antivirus programs tried

--------------------------

Avira AntiVir -for virus scans, finds virus's but cant remove them.. then wont ever scan again.

AVG [8.5] - same as above... then cant scan again... just doesnt ever start... "assume locked"

Vipre - scans then locks durring removal.

Malware programs tried

---------------------------

Malwarebytes - tried renaming... same prob, kills after 2-3 seconds of scanning

...an then mbam fix... nadda

Spyware Doctor runs for about 30 seconds... then same as first one above

Spybot S&D

Spyhunter 3 security Suite - crashes about 30 seconds in... then locked as others are

AdAware 6 - same as others.

Other progs

--------------------------

combo-fix

Killbox

Hijackthis

Regcure

This is the ONLY logging program that has worked so far and not crashed before making its logs...

DDs. scr

here is the dds log [ btw... if no one can help me my final choice is to do a total restore.. so PLEASE someone help me]...

-----------------------------------------------------

DDS (Ver_09-07-30.01) - NTFSx86

Run by Anthony at 12:37:04.76 on Sat 08/08/2009

Internet Explorer: 6.0.2900.5512

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2619 [GMT -4:00]

AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

svchost.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\PROGRA~1\AVG\AVG8\avgam.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Spyware Terminator\sp_rsser.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Documents and Settings\Anthony\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.garfield.com/

uInternet Settings,ProxyServer = http=localhost:7171

uInternet Settings,ProxyOverride = *.local

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll

BHO: BHO Class: {8b3868b4-eba8-48fa-a19b-e1dfb99066fa} - c:\program files\flashcapture\FCBHO.dll

TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File

TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File

EB: Groove Folder Synchronization: {2a541ae1-5bf6-4665-a8a3-cfa9672e4291} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL

uRun: [PeerGuardian] c:\program files\peerguardian2\pg2.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [HijackThis startup scan] c:\program files\trend micro\hijackthis8\HijackThis.exe /startupscan

mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun

mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe

mRun: [iSTray] "c:\program files\spyware doctor\pctsTray.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe

IE: &Save Flash In This Page - c:\progra~1\flashs~1.0\save.htm

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: Save F&lash with FlashCapture - c:\program files\flashcapture\FCIEXT.dll/FCIEXT.htm

IE: Save Flash - c:\program files\unh solutions\flash saving plugin\FlashSButton.dll/210

IE: {09EA1F80-F40A-11D1-B792-444553540001} - c:\progra~1\flashs~1.0\save.htm

IE: {753BBC4B-CC73-4fb8-A5B5-CA09C804C1DD} - res://c:\program files\flashcapture\FCIEXT.dll/FCIEXT.htm

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

DPF: {17492023-c23a-453e-a040-c7c580bbf700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {2bc66f54-93a8-11d3-beb6-00105aa9b6ae} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1240717898421

DPF: {644e432f-49d3-41a1-8dd5-e099162eeec5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

DPF: {6e32070a-766d-4ee6-879c-dc1fa91d2fc3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1245856334609

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://javadl.sun.com/webapps/download/AutoDL?BundleId=29223

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {9c23d886-43cb-43de-b2db-112a68d7e10a} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab

DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll

Notify: AtiExtEvent - Ati2evxx.dll

Notify: avgrsstarter - avgrsstx.dll

Notify: gotoassist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: {0f147d1d-5b44-4a4d-bc33-96dac3c7ed6e}: {e6de7c3c-ad69-33cb-d4a4-44b5d1d741f0}

SEH: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No File

============= SERVICES / DRIVERS ===============

R0 avgrkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-8-6 12552]

R0 gxc108b;gxc108b;c:\windows\system32\drivers\gxc108b.sys [2009-4-26 137216]

R0 gxc108p;gxc108p;c:\windows\system32\drivers\gxc108p.sys [2009-4-26 5248]

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-8-7 11608]

R1 avgldx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-8-6 335240]

R1 avgmfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-8-6 27784]

R1 avgtdix;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-8-6 108552]

R1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [2009-8-8 13360]

R1 sbtis;sbtis;c:\windows\system32\drivers\sbtis.sys [2009-8-8 202928]

R2 antivirschedulerservice;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-8-7 108289]

R2 antivirservice;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-8-7 185089]

R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-8-6 297752]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-4-26 55656]

S0 cerc6;cerc6; [x]

S0 fith;fith; [x]

S0 fssvvigd;fssvvigd; [x]

S0 gsfl;gsfl; [x]

S0 ilgeyrra;ilgeyrra; [x]

S0 kfzaocai;kfzaocai; [x]

S0 pctcore;PCTools KDS;c:\windows\system32\drivers\pctcore.sys --> c:\windows\system32\drivers\PCTCore.sys [?]

S0 pletnup;pletnup; [x]

S0 qihwewl;qihwewl; [x]

S0 wkapbfet;wkapbfet; [x]

S0 xpfcw;xpfcw; [x]

S0 yflbyg;yflbyg; [x]

S1 saskutil;SASKUTIL;\??\c:\program files\superantispyware\saskutil.sys --> c:\program files\superantispyware\SASKUTIL.sys [?]

S2 lavasoft ad-aware service;Lavasoft Ad-Aware Service; [x]

S2 neroregincdsrv;Nero Registry InCD Service;c:\program files\nero\nero8\incd\NBHRegInCDSrv.exe [2008-2-28 53032]

S2 sbamsvc;VIPRE Antivirus + Antispyware;c:\program files\sunbelt software\vipre2\SBAMSvc.exe [2009-6-10 980264]

S2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2009-8-8 69936]

S2 sdauxservice;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsauxs.exe --> c:\program files\spyware doctor\pctsAuxs.exe [?]

S2 sdcoreservice;PC Tools Security Service;c:\program files\spyware doctor\pctssvc.exe --> c:\program files\spyware doctor\pctsSvc.exe [?]

S2 Uniblue DiskRescue;Uniblue DiskRescue;c:\program files\uniblue\diskrescue\UBDiskRescueSrv.exe [2008-9-10 229648]

S2 wwEngineSvc;Window Washer Engine;c:\program files\webroot\washer\WasherSvc.exe [2009-4-29 598856]

S2 ytjuy;ytjuy;c:\windows\system32\svchost.exe -k netsvcs [2008-4-14 14336]

S3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2009-4-25 84992]

=============== Created Last 30 ================

2009-08-08 11:00 <DIR> --d----- C:\VundoFix Backups

2009-08-08 01:37 0 a------- c:\windows\system32\SBRC.dat

2009-08-08 01:35 69,936 a------- c:\windows\system32\drivers\sbapifs.sys

2009-08-08 01:35 13,360 a------- c:\windows\system32\drivers\sbaphd.sys

2009-08-08 00:42 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Sunbelt

2009-08-08 00:42 <DIR> --d----- c:\docume~1\anthony\applic~1\Sunbelt

2009-08-08 00:41 202,928 a------- c:\windows\system32\drivers\sbtis.sys

2009-08-07 22:40 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avira

2009-08-07 22:30 <DIR> --d----- c:\program files\Sunbelt Software

2009-08-07 15:44 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware2

2009-08-07 11:01 <DIR> --d----- c:\program files\Zone Labs

2009-08-07 11:00 <DIR> --d----- c:\windows\Internet Logs

2009-08-07 10:01 <DIR> --d----- c:\program files\common files\PC Tools

2009-08-07 09:45 <DIR> --d----- c:\documents and settings\anthony\.housecall6.6

2009-08-07 09:30 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-07 09:30 19,096 a------- c:\windows\system32\drivers\mbam.sys

2009-08-07 09:30 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware

2009-08-07 00:20 93,180 a------- c:\windows\system32\drivers\847b4010.sys

2009-08-06 23:29 <DIR> --d----- c:\program files\Trend Micro

2009-08-06 21:48 <DIR> --d----- c:\program files\Spybot - Search & Destroy

2009-08-06 21:48 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy

2009-08-06 20:50 <DIR> --d----- c:\documents and settings\anthony\DoctorWeb

2009-08-06 18:28 <DIR> --d----- c:\program files\BulletProofSoft.com

2009-08-06 15:29 <DIR> --d----- C:\!KillBox

2009-08-06 15:00 <DIR> --d----- c:\program files\Spyware Doctor

2009-08-06 14:59 141,312 a------- c:\windows\system32\drivers\sp_rsdrv2.sys

2009-08-06 14:59 <DIR> --d----- c:\docume~1\anthony\applic~1\Spyware Terminator

2009-08-06 14:59 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spyware Terminator

2009-08-06 14:59 <DIR> --d----- c:\program files\Spyware Terminator

2009-08-06 14:49 <DIR> --d----- c:\windows\RegCure

2009-08-06 14:44 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com

2009-08-06 14:44 <DIR> --d----- c:\docume~1\anthony\applic~1\SUPERAntiSpyware.com

2009-08-06 14:39 61,440 a------- c:\windows\system32\drivers\bivuu.sys

2009-08-06 14:27 11,952 a------- c:\windows\system32\avgrsstx.dll

2009-08-06 14:27 108,552 a------- c:\windows\system32\drivers\avgtdix.sys

2009-08-06 14:27 12,552 a------- c:\windows\system32\drivers\avgrkx86.sys

2009-08-06 14:27 335,240 a------- c:\windows\system32\drivers\avgldx86.sys

2009-08-06 14:27 <DIR> --d----- c:\windows\system32\drivers\Avg

2009-08-06 14:27 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8

2009-08-06 14:07 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800}(2)

2009-08-06 14:00 <DIR> --d----- c:\program files\Lavasoft

2009-08-06 13:27 <DIR> --d----- c:\program files\GoldEsel

2009-08-06 13:23 1,238,456 a------- c:\windows\system32\NMSDVDXU.dll

2009-08-06 13:23 877,568 a------- c:\windows\system32\NCTAudioFile2.dll

2009-08-06 13:23 376,832 a------- c:\windows\system32\cmd22.dll

2009-08-06 13:23 102,400 a------- c:\windows\system32\ccrpprg6.ocx

2009-08-06 13:23 724,992 a------- c:\windows\system32\ebCrypt.dll

2009-08-06 13:23 401,408 a------- c:\windows\system32\srmInfo.dll

2009-08-06 13:23 253,952 a------- c:\windows\system32\SkinBoxer43.dll

2009-08-06 13:21 <DIR> --d----- c:\program files\Exact Audio Copy

2009-08-05 15:33 <DIR> --d----- c:\program files\Autodesk

2009-07-29 13:16 <DIR> --d----- c:\docume~1\anthony\applic~1\Star Trek Armada II Fleet Operations

2009-07-21 14:50 10,240 a------- c:\windows\system32\virport.dll

2009-07-21 14:42 176,235 a------- c:\windows\system32\Primomonnt.dll

2009-07-19 18:17 <DIR> --d----- C:\DOWNLOADS

2009-07-19 18:17 <DIR> --d----- C:\!Temp

2009-07-16 18:25 5,632 a------- c:\windows\system32\ptpusb.dll

2009-07-16 18:25 159,232 a------- c:\windows\system32\ptpusd.dll

2009-07-15 19:23 <DIR> --d----- c:\windows\Logs

2009-07-15 19:23 <DIR> --d-h--- c:\windows\msdownld.tmp

2009-07-15 19:23 <DIR> --d----- c:\program files\Utherverse Digital Inc

2009-07-15 13:40 <DIR> --d----- c:\windows\Downloaded Installations

2009-07-11 19:56 32 a------- c:\windows\Start.INI

==================== Find3M ====================

2009-07-28 16:33 55,656 a------- c:\windows\system32\drivers\avgntflt.sys

2009-06-10 06:00 68,392 a------- c:\windows\system32\sbbd.exe

2009-06-04 23:21 113,116 a------- c:\windows\xobglu32.dll

2009-06-04 23:21 63,488 a------- c:\windows\xobglu16.dll

2009-05-22 18:33 217,088 -------- c:\windows\system32\SpaceBattleSS.scr

2009-05-05 09:56 88,576 a---h--- c:\docume~1\anthony\applic~1\rbap550.dll

2005-01-31 20:38 1,340,416 a------- c:\program files\mplayerc.exe

2003-09-16 01:19 99,544 a------- c:\windows\inf\virprn.exe

2003-09-16 01:19 18,950 a------- c:\windows\inf\virpntd.dll

2003-09-16 01:19 10,240 a------- c:\windows\inf\virport.dll

2003-09-16 01:19 90,624 a------- c:\windows\inf\prtproc.dll

============= FINISH: 12:37:14.59 ===============

the attach.txt is linked here...

http://www.megaupload.com/?d=O1OPKHJU

[megaupload was only place I could find to link it]

KYGuy731 · August 8, 2009

Update

Here is an aditional scan using root repeal....

couldnt post it here ... said it was too long.

http://www.megaupload.com/?d=DY1Q31TZ

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2009/08/08 13:23

Program Version: Version 1.3.3.0

Windows Version: Windows XP SP3

==================================================

Drivers

-------------------

Name:

Image Path:

Address: 0xB9DAC000 Size: 98304 File Visible: No Signed: -

Status: -

Name: 847b4010.sys

Image Path: C:\WINDOWS\System32\drivers\847b4010.sys

Address: 0xBA288000 Size: 47488 File Visible: No Signed: -

Status: -

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xACAE1000 Size: 98304 File Visible: No Signed: -

Status: -

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xBA5E8000 Size: 8192 File Visible: No Signed: -

Status: -

Name: PCI_PNP1036

Image Path: \Driver\PCI_PNP1036

Address: 0x00000000 Size: 0 File Visible: No Signed: -

Status: -

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xA9AA2000 Size: 49152 File Visible: No Signed: -

Status: -

Name: spmt.sys

Image Path: spmt.sys

Address: 0xB9EAA000 Size: 1036288 File Visible: No Signed: -

Status: -

Name: sptd

Image Path: \Driver\sptd

Address: 0x00000000 Size: 0 File Visible: No Signed: -

Status: -

Name: win32k.sys:1

Image Path: C:\WINDOWS\win32k.sys:1

Address: 0xBA490000 Size: 20480 File Visible: No Signed: -

Status: -

Name: win32k.sys:2

Image Path: C:\WINDOWS\win32k.sys:2

Address: 0xBA298000 Size: 61440 File Visible: No Signed: -

Status: -

Hidden/Locked Files

-------------------

Path: C:\WINDOWS\system32\scecli.dll

Status: Locked to the Windows API!

Path: C:\WINDOWS\system32\drivers\847b4010.sys

Status: Locked to the Windows API!

SSDT

-------------------

#: 025 Function Name: NtClose

Status: Hooked by "a347bus.sys" at address 0xb9e78028

#: 035 Function Name: NtCreateEvent

Status: Hooked by "C:\WINDOWS\System32\drivers\847b4010.sys" at address 0xba28ebad

#: 041 Function Name: NtCreateKey

Status: Hooked by "C:\WINDOWS\System32\drivers\847b4010.sys" at address 0xba28cc85

#: 045 Function Name: NtCreatePagingFile

Status: Hooked by "a347bus.sys" at address 0xb9e6bb00

#: 053 Function Name: NtCreateThread

Status: Hooked by "<unknown>" at address 0xba6c8a7c

#: 063 Function Name: NtDeleteKey

Status: Hooked by "<unknown>" at address 0xba6c8a8b

#: 065 Function Name: NtDeleteValueKey

Status: Hooked by "<unknown>" at address 0xba6c8a95

#: 071 Function Name: NtEnumerateKey

Status: Hooked by "a347bus.sys" at address 0xb9e6c5dc

#: 073 Function Name: NtEnumerateValueKey

Status: Hooked by "a347bus.sys" at address 0xb9e78120

#: 098 Function Name: NtLoadKey

Status: Hooked by "<unknown>" at address 0xba6c8a9a

#: 116 Function Name: NtOpenFile

Status: Hooked by "a347bus.sys" at address 0xb9e6bb40

#: 119 Function Name: NtOpenKey

Status: Hooked by "C:\WINDOWS\System32\drivers\847b4010.sys" at address 0xba28cd45

#: 122 Function Name: NtOpenProcess

Status: Hooked by "<unknown>" at address 0xba6c8a68

#: 128 Function Name: NtOpenThread

Status: Hooked by "<unknown>" at address 0xba6c8a6d

#: 160 Function Name: NtQueryKey

Status: Hooked by "a347bus.sys" at address 0xb9e6c5fc

#: 177 Function Name: NtQueryValueKey

Status: Hooked by "a347bus.sys" at address 0xb9e78076

#: 193 Function Name: NtReplaceKey

Status: Hooked by "<unknown>" at address 0xba6c8aa4

#: 204 Function Name: NtRestoreKey

Status: Hooked by "<unknown>" at address 0xba6c8a9f

#: 241 Function Name: NtSetSystemPowerState

Status: Hooked by "a347bus.sys" at address 0xb9e77550

#: 247 Function Name: NtSetValueKey

Status: Hooked by "<unknown>" at address 0xba6c8a90

#: 257 Function Name: NtTerminateProcess

Status: Hooked by "<unknown>" at address 0xba6c8a77

Stealth Objects

-------------------

Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ]

Process: System Address: 0x8a71687c Size: 11

Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP]

Process: System Address: 0x8a7071f8 Size: 121

Object: Hidden Code [Driver: incdrec, IRP_MJ_READ]

Process: System Address: 0x8a014d64 Size: 11

Object: Hidden Code [Driver: Fastfat, IRP_MJ_CREATE]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_CLOSE]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_READ]

Process: System Address: 0x899c517c Size: 11

Object: Hidden Code [Driver: Fastfat, IRP_MJ_WRITE]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_INFORMATION]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_INFORMATION]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_EA]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_EA]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_FLUSH_BUFFERS]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_VOLUME_INFORMATION]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_VOLUME_INFORMATION]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_DIRECTORY_CONTROL]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_FILE_SYSTEM_CONTROL]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_DEVICE_CONTROL]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_SHUTDOWN]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_LOCK_CONTROL]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_CLEANUP]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_PNP]

Process: System Address: 0x89eac500 Size: 121

Object: Hidden Code [Driver: a347scsi, IRP_MJ_CREATE]

Process: System Address: 0x8a7081f8 Size: 121

Object: Hidden Code [Driver: a347scsi, IRP_MJ_CLOSE]

Process: System Address: 0x8a7081f8 Size: 121

Object: Hidden Code [Driver: a347scsi, IRP_MJ_DEVICE_CONTROL]

Process: System Address: 0x8a7081f8 Size: 121

Object: Hidden Code [Driver: a347scsi, IRP_MJ_INTERNAL_DEVICE_CONTROL]

Process: System Address: 0x8a7081f8 Size: 121

Object: Hidden Code [Driver: a347scsi, IRP_MJ_POWER]

Process: System Address: 0x8a7081f8 Size: 121

Object: Hidden Code [Driver: a347scsi, IRP_MJ_SYSTEM_CONTROL]

Process: System Address: 0x8a7081f8 Size: 121

Object: Hidden Code [Driver: a347scsi, IRP_MJ_PNP]

Process: System Address: 0x8a7081f8 Size: 121

Object: Hidden Code [Driver: atapi, IRP_MJ_CREATE]