Thank you Elise here are the logs you requested,
Malwarebytes' Anti-Malware 1.40
Database version: 2551
Windows 5.1.2600 Service Pack 2
8/8/2009 10:50:03 PM
mbam-log-2009-08-08 (22-50-03).txt
Scan type: Quick Scan
Objects scanned: 120226
Time elapsed: 14 minute(s), 16 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 3
Registry Data Items Infected: 3
Folders Infected: 1
Files Infected: 7
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msupdate (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\sdra64.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: system32\sdra64.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.
Folders Infected:
C:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot.
Files Infected:
C:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot.
C:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot.
C:\WINDOWS\msupdate.exe (Fake.Dropped.Malware) -> Delete on reboot.
C:\WINDOWS\system32\sdra64.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\install.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\rdlB.tmp.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\rdlD.tmp.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
SUPERAntiSpyware Scan Log
http://www.superantispyware.comGenerated 08/09/2009 at 00:01 AM
Application Version : 4.27.1002
Core Rules Database Version : 4046
Trace Rules Database Version: 1980
Scan type : Quick Scan
Total Scan Time : 00:13:20
Memory items scanned : 466
Memory threats detected : 0
Registry items scanned : 447
Registry threats detected : 28
File items scanned : 8059
File threats detected : 22
Adware.Tracking Cookie
C:\Documents and Settings\User\Cookies\user@ads.bridgetrack[1].txt
C:\Documents and Settings\User\Cookies\user@ar.atwola[3].txt
C:\Documents and Settings\User\Cookies\user@serving-sys[2].txt
C:\Documents and Settings\User\Cookies\user@adbrite[2].txt
C:\Documents and Settings\User\Cookies\user@amlocalhost.trymedia[1].txt
C:\Documents and Settings\User\Cookies\user@apmebf[1].txt
C:\Documents and Settings\User\Cookies\user@atwola[1].txt
C:\Documents and Settings\User\Cookies\user@ad.yieldmanager[2].txt
C:\Documents and Settings\User\Cookies\user@revsci[1].txt
C:\Documents and Settings\User\Cookies\user@questionmarket[1].txt
C:\Documents and Settings\User\Cookies\user@atdmt[1].txt
C:\Documents and Settings\User\Cookies\user@microsoftwlmessengermkt.112.2o7[1].txt
C:\Documents and Settings\User\Cookies\user@ads.pointroll[1].txt
C:\Documents and Settings\User\Cookies\user@ar.atwola[1].txt
C:\Documents and Settings\User\Cookies\user@bs.serving-sys[1].txt
C:\Documents and Settings\User\Cookies\user@at.atwola[1].txt
C:\Documents and Settings\User\Cookies\user@specificmedia[1].txt
C:\Documents and Settings\User\Cookies\user@doubleclick[1].txt
C:\Documents and Settings\User\Cookies\user@mediaplex[1].txt
C:\Documents and Settings\User\Cookies\user@specificclick[2].txt
C:\Documents and Settings\User\Cookies\user@cdn.at.atwola[1].txt
C:\Documents and Settings\User\Cookies\user@advertising[2].txt
Rogue.Component/Trace
HKLM\Software\Microsoft\78B68C04
HKLM\Software\Microsoft\78B68C04#78b68c04
HKLM\Software\Microsoft\78B68C04#Version
HKLM\Software\Microsoft\78B68C04#78b62184
HKLM\Software\Microsoft\78B68C04#78b64861
HKU\S-1-5-21-658334163-3564147418-4196139480-1003\Software\Microsoft\FIAS4018
Rootkit.TDSServ
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys#start
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys#type
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys#imagepath
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys#group
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#TDSSserv
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#TDSSl
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdssservers
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdssmain
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdsslog
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdssadw
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdssinit
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdssurls
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdsspanels
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdsserrors
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#TDSSproc
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\Enum
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\Enum#0
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\Enum#Count
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\Enum#NextInstance
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\Enum#INITSTARTFAILED
ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/08/09 10:17
Program Version: Version 1.3.3.0
Windows Version: Windows XP SP2
==================================================
Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xEDE13000 Size: 98304 File Visible: No Signed: -
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7B41000 Size: 8192 File Visible: No Signed: -
Status: -
Name: PCI_PNP3602
Image Path: \Driver\PCI_PNP3602
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xEC92E000 Size: 49152 File Visible: No Signed: -
Status: -
Name: SKYNETglhuxhbt.sys
Image Path: C:\WINDOWS\system32\drivers\SKYNETglhuxhbt.sys
Address: 0xEE0CE000 Size: 151552 File Visible: - Signed: -
Status: Hidden from the Windows API!
Name: spls.sys
Image Path: spls.sys
Address: 0xF74A8000 Size: 1048576 File Visible: No Signed: -
Status: -
Name: sptd
Image Path: \Driver\sptd
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -
Hidden/Locked Files
-------------------
Path: C:\WINDOWS\system32\SKYNETecxabdnx.dat
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\SKYNETfkjmamyo.dat
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\SKYNETwmqigexh.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\SKYNETyquipyek.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\drivers\SKYNETglhuxhbt.sys
Status: Invisible to the Windows API!
Path: c:\documents and settings\user\local settings\application data\mozilla\firefox\profiles\kaucmddk.default\cache\20f50ac4d01
Status: Size mismatch (API: 122456, Raw: 122429)
Stealth Objects
-------------------
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: winlogon.exe (PID: 692) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: services.exe (PID: 756) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: lsass.exe (PID: 776) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETyquipyek.dll]
Process: svchost.exe (PID: 1008) Address: 0x00740000 Size: 53248
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: svchost.exe (PID: 1008) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: svchost.exe (PID: 1096) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: svchost.exe (PID: 1204) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: svchost.exe (PID: 1284) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: svchost.exe (PID: 1464) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: spoolsv.exe (PID: 1640) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: AppleMobileDeviceService.exe (PID: 1812) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: avgwdsvc.exe (PID: 1848) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: mDNSResponder.exe (PID: 1876) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: svchost.exe (PID: 220) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: avgrsx.exe (PID: 276) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: avgnsx.exe (PID: 296) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: jqs.exe (PID: 352) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: ngctw32.exe (PID: 496) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: Explorer.EXE (PID: 428) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: PDVDServ.exe (PID: 1144) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: ngtray.exe (PID: 1152) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: WLANmon.exe (PID: 1168) Address: 0x00e00000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: WZCSLDR2.exe (PID: 1252) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: Monitor.exe (PID: 1300) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: hkcmd.exe (PID: 1256) Address: 0x00890000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: igfxpers.exe (PID: 820) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: jusched.exe (PID: 832) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: avgtray.exe (PID: 1388) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: realsched.exe (PID: 1404) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: RIMAutoUpdate.exe (PID: 1424) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: iTunesHelper.exe (PID: 1944) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: ctfmon.exe (PID: 2024) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: msmsgs.exe (PID: 2080) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: ISUSPM.exe (PID: 2236) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: WMPNSCFG.exe (PID: 2248) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: SUPERAntiSpyware.exe (PID: 2328) Address: 0x04ca0000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: svchost.exe (PID: 3232) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: ViewpointService.exe (PID: 3324) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: WMPNetwk.exe (PID: 3408) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: avgemc.exe (PID: 3508) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: avgcsrvx.exe (PID: 3688) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: wscntfy.exe (PID: 3160) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: iPodService.exe (PID: 3056) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: alg.exe (PID: 2916) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: osk.exe (PID: 1772) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: MSSWCHX.EXE (PID: 3660) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: rundll32.exe (PID: 3892) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: msnmsgr.exe (PID: 3984) Address: 0x10000000 Size: 32768
Object: Hidden Handle [Index: 4952, Type: Event]
Process: msnmsgr.exe (PID: 3984) Address: 0x83905250 Size: -
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: usnsvc.exe (PID: 2976) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: igfxsrvc.exe (PID: 4004) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: firefox.exe (PID: 2704) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: WinRAR.exe (PID: 2260) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: RootRepeal.exe (PID: 1712) Address: 0x10000000 Size: 32768
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP]
Process: System Address: 0x83b691f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_CREATE]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_CLOSE]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_READ]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_WRITE]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_EA]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_EA]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_SHUTDOWN]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_CLEANUP]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_PNP]
Process: System Address: 0x832c1500 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_CREATE]
Process: System Address: 0x83b6a1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_CLOSE]
Process: System Address: 0x83b6a1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x83b6a1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x83b6a1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_POWER]
Process: System Address: 0x83b6a1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x83b6a1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_PNP]
Process: System Address: 0x83b6a1f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE]
Process: System Address: 0x839811f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_CLOSE]
Process: System Address: 0x839811f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_READ]
Process: System Address: 0x839811f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_WRITE]
Process: System Address: 0x839811f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x839811f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x839811f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x839811f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_SHUTDOWN]
Process: System Address: 0x839811f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_POWER]
Process: System Address: 0x839811f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x839811f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_PNP]
Process: System Address: 0x839811f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_CREATE]
Process: System Address: 0x83bd91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_CLOSE]
Process: System Address: 0x83bd91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_READ]
Process: System Address: 0x83bd91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_WRITE]
Process: System Address: 0x83bd91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x83bd91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x83bd91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x83bd91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_SHUTDOWN]
Process: System Address: 0x83bd91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_POWER]
Process: System Address: 0x83bd91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x83bd91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_PNP]
Process: System Address: 0x83bd91f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_CREATE]
Process: System Address: 0x839db1f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_CLOSE]
Process: System Address: 0x839db1f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x839db1f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x839db1f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_POWER]
Process: System Address: 0x839db1f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x839db1f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_PNP]
Process: System Address: 0x839db1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CREATE]
Process: System Address: 0x83b6b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_READ]
Process: System Address: 0x83b6b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_WRITE]
Process: System Address: 0x83b6b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x83b6b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x83b6b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x83b6b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SHUTDOWN]
Process: System Address: 0x83b6b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CLEANUP]
Process: System Address: 0x83b6b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_POWER]
Process: System Address: 0x83b6b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x83b6b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_PNP]
Process: System Address: 0x83b6b1f8 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_CREATE]
Process: System Address: 0x83791500 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_CLOSE]
Process: System Address: 0x83791500 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x83791500 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x83791500 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_CLEANUP]
Process: System Address: 0x83791500 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_PNP]
Process: System Address: 0x83791500 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE]
Process: System Address: 0x839ad340 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE]
Process: System Address: 0x839ad340 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x839ad340 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x839ad340 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER]
Process: System Address: 0x839ad340 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x839ad340 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP]
Process: System Address: 0x839ad340 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_NAMED_PIPE]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLOSE]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_READ]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_WRITE]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_EA]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_EA]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLEANUP]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_MAILSLOT]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_SECURITY]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_POWER]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CHANGE]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_QUOTA]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_PNP]
Process: System Address: 0x8338a1f8 Size: 121
Object: Hidden Code [Driver: Cdfsࠅ䵃慄ࠁఏ䵃慄歶N, IRP_MJ_CREATE]
Process: System Address: 0x838fb1f8 Size: 121
Object: Hidden Code [Driver: Cdfsࠅ䵃慄ࠁఏ䵃慄歶N, IRP_MJ_CLOSE]
Process: System Address: 0x838fb1f8 Size: 121
Object: Hidden Code [Driver: Cdfsࠅ䵃慄ࠁఏ䵃慄歶N, IRP_MJ_READ]
Process: System Address: 0x838fb1f8 Size: 121
Object: Hidden Code [Driver: Cdfsࠅ䵃慄ࠁఏ䵃慄歶N, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x838fb1f8 Size: 121
Object: Hidden Code [Driver: Cdfsࠅ䵃慄ࠁఏ䵃慄歶N, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x838fb1f8 Size: 121
Object: Hidden Code [Driver: Cdfsࠅ䵃慄ࠁఏ䵃慄歶N, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x838fb1f8 Size: 121
Object: Hidden Code [Driver: Cdfsࠅ䵃慄ࠁఏ䵃慄歶N, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x838fb1f8 Size: 121
Object: Hidden Code [Driver: Cdfsࠅ䵃慄ࠁఏ䵃慄歶N, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x838fb1f8 Size: 121
Object: Hidden Code [Driver: Cdfsࠅ䵃慄ࠁఏ䵃慄歶N, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x838fb1f8 Size: 121
Object: Hidden Code [Driver: Cdfsࠅ䵃慄ࠁఏ䵃慄歶N, IRP_MJ_SHUTDOWN]
Process: System Address: 0x838fb1f8 Size: 121
Object: Hidden Code [Driver: Cdfsࠅ䵃慄ࠁఏ䵃慄歶N, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x838fb1f8 Size: 121
Object: Hidden Code [Driver: Cdfsࠅ䵃慄ࠁఏ䵃慄歶N, IRP_MJ_CLEANUP]
Process: System Address: 0x838fb1f8 Size: 121
Object: Hidden Code [Driver: Cdfsࠅ䵃慄ࠁఏ䵃慄歶N, IRP_MJ_PNP]
Process: System Address: 0x838fb1f8 Size: 121
Hidden Services
-------------------
Service Name: SKYNETrxlaqhkd
Image Path: C:\WINDOWS\system32\drivers\SKYNETglhuxhbt.sys
==EOF==
Also there are no ! or ? under the device manager screen.