Started yesterday evening. Have used House Call , Ad Aware to no avail.
Downloaded but could not use DDS.scr. Was able to use Root Repeal, log is pasted below and attached.
AVG Output:
AVG 8.5 Anti-Virus command line scanner
Copyright © 1992 - 2009 AVG Technologies
Program version 8.0.401, engine 8.0.408
Virus Database: Version 270.13.69/2328 2009-08-26
\\?\globalroot\systemroot\system32\UACvbbbqoepas.dll Virus found Win32/Cryptor Object was moved to Virus Vault.
\\?\globalroot\systemroot\system32\UAClhyidqjnox.dll Trojan horse BackDoor.Generic11.AKNN Object was moved to Virus Vault.
C:\WINDOWS\system32\svchost.exe (744) Trojan horse BackDoor.Generic11.AKNN Object was moved to Virus Vault.
\\?\globalroot\systemroot\system32\UACvmkvpxhpve.dll Virus found Win32/Cryptor Object was moved to Virus Vault.
C:\WINDOWS\explorer.exe (1024) Virus found Win32/Cryptor Object was moved to Virus Vault.
\\?\globalroot\systemroot\system32\UACvmkvpxhpve.dll Virus found Win32/Cryptor Object was moved to Virus Vault.
C:\Program Files\Internet Explorer\iexplore.exe (1052) Virus found Win32/Cryptor Object was moved to Virus Vault.
\\?\globalroot\systemroot\system32\UACvmkvpxhpve.dll Virus found Win32/Cryptor Object was moved to Virus Vault.
C:\Program Files\Internet Explorer\iexplore.exe (1240) Virus found Win32/Cryptor Object was moved to Virus Vault.
\\?\globalroot\systemroot\system32\UACvmkvpxhpve.dll Virus found Win32/Cryptor Object was moved to Virus Vault.
C:\Program Files\Internet Explorer\iexplore.exe (1612) Virus found Win32/Cryptor Object was moved to Virus Vault.
\\?\globalroot\systemroot\system32\UACvbbbqoepas.dll Virus found Win32/Cryptor Object was moved to Virus Vault.
C:\Program Files\Mozilla Firefox\firefox.exe (1936) Virus found Win32/Cryptor Object was moved to Virus Vault.
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\icx7n1jt.default\parent.lock Locked file. Not tested.
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\icx7n1jt.default\places.sqlite-journal Locked file. Not tested.
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{F6BDF48C-9353-11DE-8746-8483C1F02E3F}.dat Locked file. Not tested.
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{2B19D906-9354-11DE-8746-8483C1F02E3F}.dat Locked file. Not tested.
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{FD9B19A4-9353-11DE-8746-8483C1F02E3F}.dat Locked file. Not tested.
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Locked file. Not tested.
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Locked file. Not tested.
C:\Documents and Settings\Administrator\NTUSER.DAT Locked file. Not tested.
C:\Documents and Settings\Administrator\NTUSER.DAT.LOG Locked file. Not tested.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\044085696343129efa6e5ea94d0ff7f9_72842028-d04f-4842-b4d9-58bb992c3a28 Locked file. Not tested.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\57e5fe2cd76d33ecd721619869d74b73_72842028-d04f-4842-b4d9-58bb992c3a28 Locked file. Not tested.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\8f422898173ba7081926ec5338bcacd6_72842028-d04f-4842-b4d9-58bb992c3a28 Locked file. Not tested.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Crypto\RSA\MachineKeys\a10cf8da01e885054c6168d1019295aa_72842028-d04f-4842-b4d9-58bb992c3a28 Locked file. Not tested.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Dr Watson\user.dmp Locked file. Not tested.
C:\Documents and Settings\NetworkService.NT AUTHORITY.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Locked file. Not tested.
C:\Documents and Settings\NetworkService.NT AUTHORITY.000\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Locked file. Not tested.
C:\Documents and Settings\NetworkService.NT AUTHORITY.000\NTUSER.DAT Locked file. Not tested.
C:\Documents and Settings\NetworkService.NT AUTHORITY.000\ntuser.dat.LOG Locked file. Not tested.
C:\pagefile.sys Locked file. Not tested.
C:\System Volume Information\ Locked file. Not tested.
C:\WINDOWS\system32\config\default Locked file. Not tested.
C:\WINDOWS\system32\config\default.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\SAM Locked file. Not tested.
C:\WINDOWS\system32\config\SAM.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\SECURITY Locked file. Not tested.
C:\WINDOWS\system32\config\SECURITY.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\software Locked file. Not tested.
C:\WINDOWS\system32\config\software.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\system Locked file. Not tested.
C:\WINDOWS\system32\config\system.LOG Locked file. Not tested.
C:\WINDOWS\system32\drivers\sptd.sys Locked file. Not tested.
------------------------------------------------------------
Objects scanned : 224413
Found infections : 13
Found PUPs : 0
Healed infections : 13
Healed PUPs : 0
Warnings : 0
------------------------------------------------------------
Root Repeal Output:
ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/08/27 20:28
Program Version: Version 1.3.5.0
Windows Version: Windows XP Media Center Edition SP3
==================================================
Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF6CED000 Size: 98304 File Visible: No Signed: -
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7D5A000 Size: 8192 File Visible: No Signed: -
Status: -
Name: PCI_PNP7348
Image Path: \Driver\PCI_PNP7348
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF6FE0000 Size: 49152 File Visible: No Signed: -
Status: -
Name: spez.sys
Image Path: spez.sys
Address: 0xF7710000 Size: 1036288 File Visible: No Signed: -
Status: -
Name: sptd
Image Path: \Driver\sptd
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -
Hidden/Locked Files
-------------------
Path: C:\WINDOWS\system32\uacinit.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UAClhyidqjnox.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACqrrxdoywjo.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACrfqjnbaomp.db
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACsilamybirw.dat
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACvbbbqoepas.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACvmkvpxhpve.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\kbiwkmeiexubrr.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\kbiwkmprtlwakv.dat
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\kbiwkmqgkxvmph.dat
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\kbiwkmxevstidw.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\Temp\UAC3284.tmp
Status: Invisible to the Windows API!
Path: C:\WINDOWS\Temp\UAC584c.tmp
Status: Invisible to the Windows API!
Path: C:\WINDOWS\Temp\UACd54.tmp
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\drivers\kbiwkmlxmvasff.sys
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\drivers\UACtnqoywudps.sys
Status: Invisible to the Windows API!
Path: c:\documents and settings\administrator\local settings\temp\~df5e8a.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)
Path: c:\documents and settings\administrator\local settings\temp\~df5e92.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)
Path: C:\Documents and Settings\calderisi\Local Settings\Temp\UACddba.tmp
Status: Invisible to the Windows API!
Path: c:\documents and settings\administrator\local settings\temporary internet files\content.ie5\gdunk96v\1662155449_dpmp4hd_0[1].mp4
Status: Size mismatch (API: 27713839, Raw: 9468040)
Stealth Objects
-------------------
Object: Hidden Module [Name: UAC3284.tmpqoepas.dll]
Process: svchost.exe (PID: 1616) Address: 0x00ab0000 Size: 217088
Object: Hidden Module [Name: UAClhyidqjnox.dll]
Process: svchost.exe (PID: 1616) Address: 0x00a70000 Size: 77824
Object: Hidden Module [Name: UACqrrxdoywjo.dll]
Process: svchost.exe (PID: 1616) Address: 0x00db0000 Size: 73728
Object: Hidden Module [Name: kbiwkmeiexubrr.dll]
Process: svchost.exe (PID: 1616) Address: 0x10000000 Size: 57344
Object: Hidden Module [Name: UAClhyidqjnox.dll]
Process: Explorer.EXE (PID: 1308) Address: 0x00cb0000 Size: 77824
Object: Hidden Module [Name: kbiwkmxevstidw.dll]
Process: Explorer.EXE (PID: 1308) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: UACvbbbqoepas.dll]
Process: Iexplore.exe (PID: 3760) Address: 0x00b50000 Size: 217088
Object: Hidden Module [Name: kbiwkmxevstidw.dll]
Process: Iexplore.exe (PID: 3760) Address: 0x10000000 Size: 32768
Object: Hidden Module [Name: UACvbbbqoepas.dll]
Process: Iexplore.exe (PID: 3832) Address: 0x00e50000 Size: 217088
Object: Hidden Module [Name: kbiwkmxevstidw.dll]
Process: Iexplore.exe (PID: 3832) Address: 0x10000000 Size: 32768
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP]
Process: System Address: 0x873d71f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_CREATE]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_CLOSE]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_READ]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_WRITE]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_EA]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_EA]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_SHUTDOWN]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_CLEANUP]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Fastfat, IRP_MJ_PNP]
Process: System Address: 0x863891f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE]
Process: System Address: 0x871881f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_CLOSE]
Process: System Address: 0x871881f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_READ]
Process: System Address: 0x871881f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_WRITE]
Process: System Address: 0x871881f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x871881f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x871881f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x871881f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_SHUTDOWN]
Process: System Address: 0x871881f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_POWER]
Process: System Address: 0x871881f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x871881f8 Size: 121
Object: Hidden Code [Driver: Cdrom, IRP_MJ_PNP]
Process: System Address: 0x871881f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_CREATE]
Process: System Address: 0x863dd1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_CLOSE]
Process: System Address: 0x863dd1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_READ]
Process: System Address: 0x863dd1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_WRITE]
Process: System Address: 0x863dd1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x863dd1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x863dd1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_POWER]
Process: System Address: 0x863dd1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x863dd1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_PNP]
Process: System Address: 0x863dd1f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_CREATE]
Process: System Address: 0x873d91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_CLOSE]
Process: System Address: 0x873d91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_READ]
Process: System Address: 0x873d91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_WRITE]
Process: System Address: 0x873d91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x873d91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x873d91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x873d91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_SHUTDOWN]
Process: System Address: 0x873d91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_POWER]
Process: System Address: 0x873d91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x873d91f8 Size: 121
Object: Hidden Code [Driver: dmio, IRP_MJ_PNP]
Process: System Address: 0x873d91f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_CREATE]
Process: System Address: 0x87187500 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_CLOSE]
Process: System Address: 0x87187500 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x87187500 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x87187500 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_POWER]
Process: System Address: 0x87187500 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x87187500 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_PNP]
Process: System Address: 0x87187500 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CREATE]
Process: System Address: 0x8736b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_READ]
Process: System Address: 0x8736b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_WRITE]
Process: System Address: 0x8736b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8736b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8736b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8736b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8736b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CLEANUP]
Process: System Address: 0x8736b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_POWER]
Process: System Address: 0x8736b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8736b1f8 Size: 121
Object: Hidden Code [Driver: Ftdisk, IRP_MJ_PNP]
Process: System Address: 0x8736b1f8 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_CREATE]
Process: System Address: 0x865411f8 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_CLOSE]
Process: System Address: 0x865411f8 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x865411f8 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x865411f8 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_CLEANUP]
Process: System Address: 0x865411f8 Size: 121
Object: Hidden Code [Driver: NetBT, IRP_MJ_PNP]
Process: System Address: 0x865411f8 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE]
Process: System Address: 0x87303500 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE]
Process: System Address: 0x87303500 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x87303500 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x87303500 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER]
Process: System Address: 0x87303500 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x87303500 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP]
Process: System Address: 0x87303500 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_NAMED_PIPE]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLOSE]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_READ]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_WRITE]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_EA]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_EA]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLEANUP]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_MAILSLOT]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_SECURITY]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_POWER]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CHANGE]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_QUOTA]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: MRxSmb, IRP_MJ_PNP]
Process: System Address: 0x8651b1f8 Size: 121
Object: Hidden Code [Driver: CdfsЅఉ浗灩, IRP_MJ_CREATE]
Process: System Address: 0x865191f8 Size: 121
Object: Hidden Code [Driver: CdfsЅఉ浗灩, IRP_MJ_CLOSE]
Process: System Address: 0x865191f8 Size: 121
Object: Hidden Code [Driver: CdfsЅఉ浗灩, IRP_MJ_READ]
Process: System Address: 0x865191f8 Size: 121
Object: Hidden Code [Driver: CdfsЅఉ浗灩, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x865191f8 Size: 121
Object: Hidden Code [Driver: CdfsЅఉ浗灩, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x865191f8 Size: 121
Object: Hidden Code [Driver: CdfsЅఉ浗灩, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x865191f8 Size: 121
Object: Hidden Code [Driver: CdfsЅఉ浗灩, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x865191f8 Size: 121
Object: Hidden Code [Driver: CdfsЅఉ浗灩, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x865191f8 Size: 121
Object: Hidden Code [Driver: CdfsЅఉ浗灩, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x865191f8 Size: 121
Object: Hidden Code [Driver: CdfsЅఉ浗灩, IRP_MJ_SHUTDOWN]
Process: System Address: 0x865191f8 Size: 121
Object: Hidden Code [Driver: CdfsЅఉ浗灩, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x865191f8 Size: 121
Object: Hidden Code [Driver: CdfsЅఉ浗灩, IRP_MJ_CLEANUP]
Process: System Address: 0x865191f8 Size: 121
Object: Hidden Code [Driver: CdfsЅఉ浗灩, IRP_MJ_PNP]
Process: System Address: 0x865191f8 Size: 121
Hidden Services
-------------------
Service Name: kbiwkmvpyfwowi
Image Path: C:\WINDOWS\system32\drivers\kbiwkmlxmvasff.sys
Service Name: UACd.sys
Image Path: C:\WINDOWS\system32\drivers\UACtnqoywudps.sys
==EOF==
Any input you can have is much appreciated!!!!!!!