ROOTREPEAL (c) AD, 2007-2009 ================================================== Scan Start Time: 2009/07/22 19:45 Program Version: Version 1.3.2.0 Windows Version: Windows XP SP2 ================================================== Drivers ------------------- Name: 00000058 Image Path: \Driver\00000058 Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: ab6kyxj4.SYS Image Path: C:\WINDOWS\System32\Drivers\ab6kyxj4.SYS Address: 0xF78B3000 Size: 303104 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xB40A1000 Size: 49152 File Visible: No Signed: - Status: - Hidden/Locked Files ------------------- Path: C:\RootRepeal report 07-22-09 (19-45-34).txt Status: Visible to the Windows API, but not on disk. Path: c:\documents and settings\l\local settings\temp\etilqs_lhijqcdptdumzjbxwpps Status: Allocation size mismatch (API: 32768, Raw: 0) SSDT ------------------- #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\system32\TUKERNEL.EXE" at address 0x804d70d9 #: 071 Function Name: NtEnumerateKey Status: Hooked by "sptd.sys" at address 0xf8451d1c #: 073 Function Name: NtEnumerateValueKey Status: Hooked by "sptd.sys" at address 0xf84520bc #: 119 Function Name: NtOpenKey Status: Hooked by "C:\WINDOWS\system32\TUKERNEL.EXE" at address 0x804d70de #: 160 Function Name: NtQueryKey Status: Hooked by "sptd.sys" at address 0xf8452194 #: 177 Function Name: NtQueryValueKey Status: Hooked by "sptd.sys" at address 0xf8452014 #: 247 Function Name: NtSetValueKey Status: Hooked by "sptd.sys" at address 0xf8452226 Stealth Objects ------------------- Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP] Process: System Address: 0x8236f1d8 Address: 151 Object: Hidden Code [Driver: Fastfat, IRP_MJ_CREATE] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_CLOSE] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_READ] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_WRITE] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_INFORMATION] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_EA] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_EA] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_SHUTDOWN] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_CLEANUP] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: Fastfat, IRP_MJ_PNP] Process: System Address: 0x820978a8 Address: 162 Object: Hidden Code [Driver: , IRP_MJ_CREATE] Process: System Address: 0x81eed990 Address: 447 Object: Hidden Code [Driver: , IRP_MJ_CLOSE] Process: System Address: 0x81eed990 Address: 447 Object: Hidden Code [Driver: , IRP_MJ_READ] Process: System Address: 0x81eed990 Address: 447 Object: Hidden Code [Driver: , IRP_MJ_WRITE] Process: System Address: 0x81eed990 Address: 447 Object: Hidden Code [Driver: , IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x81eed990 Address: 447 Object: Hidden Code [Driver: , IRP_MJ_SET_INFORMATION] Process: System Address: 0x81eed990 Address: 447 Object: Hidden Code [Driver: , IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x81eed990 Address: 447 Object: Hidden Code [Driver: , IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x81eed990 Address: 447 Object: Hidden Code [Driver: , IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x81eed990 Address: 447 Object: Hidden Code [Driver: , IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x81eed990 Address: 447 Object: Hidden Code [Driver: , IRP_MJ_LOCK_CONTROL] Process: System Address: 0x81eed990 Address: 447 Object: Hidden Code [Driver: , IRP_MJ_CLEANUP] Process: System Address: 0x81eed990 Address: 447 Object: Hidden Code [Driver: , IRP_MJ_PNP] Process: System Address: 0x81eed990 Address: 447 Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE] Process: System Address: 0x81f11990 Address: 193 Object: Hidden Code [Driver: Cdrom, IRP_MJ_CLOSE] Process: System Address: 0x81f11990 Address: 193 Object: Hidden Code [Driver: Cdrom, IRP_MJ_READ] Process: System Address: 0x81f11990 Address: 193 Object: Hidden Code [Driver: Cdrom, IRP_MJ_WRITE] Process: System Address: 0x81f11990 Address: 193 Object: Hidden Code [Driver: Cdrom, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x81f11990 Address: 193 Object: Hidden Code [Driver: Cdrom, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x81f11990 Address: 193 Object: Hidden Code [Driver: Cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x81f11990 Address: 193 Object: Hidden Code [Driver: Cdrom, IRP_MJ_SHUTDOWN] Process: System Address: 0x81f11990 Address: 193 Object: Hidden Code [Driver: Cdrom, IRP_MJ_POWER] Process: System Address: 0x81f11990 Address: 193 Object: Hidden Code [Driver: Cdrom, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x81f11990 Address: 193 Object: Hidden Code [Driver: Cdrom, IRP_MJ_PNP] Process: System Address: 0x81f11990 Address: 193 Object: Hidden Code [Driver: atapi, IRP_MJ_CREATE] Process: System Address: 0x823d81d8 Address: 447 Object: Hidden Code [Driver: atapi, IRP_MJ_CLOSE] Process: System Address: 0x823d81d8 Address: 447 Object: Hidden Code [Driver: atapi, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x823d81d8 Address: 447 Object: Hidden Code [Driver: atapi, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x823d81d8 Address: 447 Object: Hidden Code [Driver: atapi, IRP_MJ_POWER] Process: System Address: 0x823d81d8 Address: 447 Object: Hidden Code [Driver: atapi, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x823d81d8 Address: 447 Object: Hidden Code [Driver: atapi, IRP_MJ_PNP] Process: System Address: 0x823d81d8 Address: 447 Object: Hidden Code [Driver: dmio, IRP_MJ_CREATE] Process: System Address: 0x823711d8 Address: 447 Object: Hidden Code [Driver: dmio, IRP_MJ_CLOSE] Process: System Address: 0x823711d8 Address: 447 Object: Hidden Code [Driver: dmio, IRP_MJ_READ] Process: System Address: 0x823711d8 Address: 447 Object: Hidden Code [Driver: dmio, IRP_MJ_WRITE] Process: System Address: 0x823711d8 Address: 447 Object: Hidden Code [Driver: dmio, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x823711d8 Address: 447 Object: Hidden Code [Driver: dmio, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x823711d8 Address: 447 Object: Hidden Code [Driver: dmio, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x823711d8 Address: 447 Object: Hidden Code [Driver: dmio, IRP_MJ_SHUTDOWN] Process: System Address: 0x823711d8 Address: 447 Object: Hidden Code [Driver: dmio, IRP_MJ_POWER] Process: System Address: 0x823711d8 Address: 447 Object: Hidden Code [Driver: dmio, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x823711d8 Address: 447 Object: Hidden Code [Driver: dmio, IRP_MJ_PNP] Process: System Address: 0x823711d8 Address: 447 Object: Hidden Code [Driver: usbuhci, IRP_MJ_CREATE] Process: System Address: 0x81ebd990 Address: 447 Object: Hidden Code [Driver: usbuhci, IRP_MJ_CLOSE] Process: System Address: 0x81ebd990 Address: 447 Object: Hidden Code [Driver: usbuhci, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x81ebd990 Address: 447 Object: Hidden Code [Driver: usbuhci, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x81ebd990 Address: 447 Object: Hidden Code [Driver: usbuhci, IRP_MJ_POWER] Process: System Address: 0x81ebd990 Address: 447 Object: Hidden Code [Driver: usbuhci, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x81ebd990 Address: 447 Object: Hidden Code [Driver: usbuhci, IRP_MJ_PNP] Process: System Address: 0x81ebd990 Address: 447 Object: Hidden Code [Driver: ab6kyxj4ȅ఍坓牢{8c07dd50-7a, IRP_MJ_CREATE] Process: System Address: 0x81f1c990 Address: 447 Object: Hidden Code [Driver: ab6kyxj4ȅ఍坓牢{8c07dd50-7a, IRP_MJ_CLOSE] Process: System Address: 0x81f1c990 Address: 447 Object: Hidden Code [Driver: ab6kyxj4ȅ఍坓牢{8c07dd50-7a, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x81f1c990 Address: 447 Object: Hidden Code [Driver: ab6kyxj4ȅ఍坓牢{8c07dd50-7a, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x81f1c990 Address: 447 Object: Hidden Code [Driver: ab6kyxj4ȅ఍坓牢{8c07dd50-7a, IRP_MJ_POWER] Process: System Address: 0x81f1c990 Address: 447 Object: Hidden Code [Driver: ab6kyxj4ȅ఍坓牢{8c07dd50-7a, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x81f1c990 Address: 447 Object: Hidden Code [Driver: ab6kyxj4ȅ఍坓牢{8c07dd50-7a, IRP_MJ_PNP] Process: System Address: 0x81f1c990 Address: 447 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CREATE] Process: System Address: 0x823d91d8 Address: 447 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_READ] Process: System Address: 0x823d91d8 Address: 447 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_WRITE] Process: System Address: 0x823d91d8 Address: 447 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x823d91d8 Address: 447 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x823d91d8 Address: 447 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x823d91d8 Address: 447 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SHUTDOWN] Process: System Address: 0x823d91d8 Address: 447 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CLEANUP] Process: System Address: 0x823d91d8 Address: 447 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_POWER] Process: System Address: 0x823d91d8 Address: 447 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x823d91d8 Address: 447 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_PNP] Process: System Address: 0x823d91d8 Address: 447 Object: Hidden Code [Driver: NetBT, IRP_MJ_CREATE] Process: System Address: 0x81fad990 Address: 447 Object: Hidden Code [Driver: NetBT, IRP_MJ_CLOSE] Process: System Address: 0x81fad990 Address: 447 Object: Hidden Code [Driver: NetBT, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x81fad990 Address: 447 Object: Hidden Code [Driver: NetBT, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x81fad990 Address: 447 Object: Hidden Code [Driver: NetBT, IRP_MJ_CLEANUP] Process: System Address: 0x81fad990 Address: 447 Object: Hidden Code [Driver: NetBT, IRP_MJ_PNP] Process: System Address: 0x81fad990 Address: 447 Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE] Process: System Address: 0x81f98990 Address: 447 Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE] Process: System Address: 0x81f98990 Address: 447 Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x81f98990 Address: 447 Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x81f98990 Address: 447 Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER] Process: System Address: 0x81f98990 Address: 447 Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x81f98990 Address: 447 Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP] Process: System Address: 0x81f98990 Address: 447 Object: Hidden Code [Driver: IdeChnDr, IRP_MJ_CREATE] Process: System Address: 0x823701d8 Address: 447 Object: Hidden Code [Driver: IdeChnDr, IRP_MJ_CLOSE] Process: System Address: 0x823701d8 Address: 447 Object: Hidden Code [Driver: IdeChnDr, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x823701d8 Address: 447 Object: Hidden Code [Driver: IdeChnDr, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x823701d8 Address: 447 Object: Hidden Code [Driver: IdeChnDr, IRP_MJ_POWER] Process: System Address: 0x823701d8 Address: 447 Object: Hidden Code [Driver: IdeChnDr, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x823701d8 Address: 447 Object: Hidden Code [Driver: IdeChnDr, IRP_MJ_PNP] Process: System Address: 0x823701d8 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_NAMED_PIPE] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLOSE] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_READ] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_WRITE] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_INFORMATION] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_EA] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_EA] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SHUTDOWN] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLEANUP] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_MAILSLOT] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_SECURITY] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_SECURITY] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_POWER] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CHANGE] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_QUOTA] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_QUOTA] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_PNP] Process: System Address: 0x81fd1470 Address: 447 Object: Hidden Code [Driver: CdfsЅః瑎て, IRP_MJ_CREATE] Process: System Address: 0x81fb9990 Address: 447 Object: Hidden Code [Driver: CdfsЅః瑎て, IRP_MJ_CLOSE] Process: System Address: 0x81fb9990 Address: 447 Object: Hidden Code [Driver: CdfsЅః瑎て, IRP_MJ_READ] Process: System Address: 0x81fb9990 Address: 447 Object: Hidden Code [Driver: CdfsЅః瑎て, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x81fb9990 Address: 447 Object: Hidden Code [Driver: CdfsЅః瑎て, IRP_MJ_SET_INFORMATION] Process: System Address: 0x81fb9990 Address: 447 Object: Hidden Code [Driver: CdfsЅః瑎て, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x81fb9990 Address: 447 Object: Hidden Code [Driver: CdfsЅః瑎て, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x81fb9990 Address: 447 Object: Hidden Code [Driver: CdfsЅః瑎て, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x81fb9990 Address: 447 Object: Hidden Code [Driver: CdfsЅః瑎て, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x81fb9990 Address: 447 Object: Hidden Code [Driver: CdfsЅః瑎て, IRP_MJ_SHUTDOWN] Process: System Address: 0x81fb9990 Address: 447 Object: Hidden Code [Driver: CdfsЅః瑎て, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x81fb9990 Address: 447 Object: Hidden Code [Driver: CdfsЅః瑎て, IRP_MJ_CLEANUP] Process: System Address: 0x81fb9990 Address: 447 Object: Hidden Code [Driver: CdfsЅః瑎て, IRP_MJ_PNP] Process: System Address: 0x81fb9990 Address: 447 ==EOF==