[Solved] Virus removal help

Bobbye · Mar 6, 2011

Looking good!

Please run this Custom CFScript:

[1]. Close any open browsers.
[2]. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
[3]. Open notepad> click on Format> Uncheck 'Word Wrap'> and copy/paste the text in the code below into it:Be sure to scroll down to include ALL lines.
Code:
File::
c:\archivos de programa\Archivos comunes\IRAABOUT.DLL
c:\archivos de programa\Archivos comunes\IRAMDMTR.DLL
c:\archivos de programa\Archivos comunes\IRALPTTR.DLL
c:\archivos de programa\Archivos comunes\IRAWEBTR.DLL
c:\archivos de programa\Archivos comunes\IRAREG.DLL
c:\archivos de programa\Archivos comunes\IRASRIAL.DLL
c:\docume~1\ELENA\CONFIG~1\Temp\SAS_SelfExtract\SASDI FSV.SYS
c:\docume~1\ELENA\CONFIG~1\Temp\SAS_SelfExtract\SASKU TIL.SYS
c:\windows\TEMP\itbi\setup.exe 
Folder::
C:\TDSSKiller_Quarantine
Driver::
SASDIFSV
SASKUTIL
AMService
Save this as CFScript.txt, in the same location as ComboFix.exe

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it will produce a log for you at C:\ComboFix.txt . Please paste in your next reply.
====================
Download bootkitremover.rar and save to your desktop.

Extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. Use 7-Zip if you don't have an extraction program,

Double-click on the remover.exe file to run the program.
NOTE:The tool should be run from a command line with Administrator privileges.

Paste the output in your next reply.

tom2011 · Mar 7, 2011

I worked through the Services stuff - Telephony was showing as Disabled, so I've changed that to Manual. Remote Connection was Manual and it's now set to Automatic.

New ComboFix log below, I'll run Boot Kit Remover now:

ComboFix 11-03-07.02 - ELENA 07/03/2011 21:23:56.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.34.3082.18.510.263 [GMT 0:00]
Running from: c:\documents and settings\ELENA\Escritorio\ComboFix.exe
Command switches used :: c:\documents and settings\ELENA\Escritorio\CFScript.txt
AV: McAfee Anti-Virus y Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
FILE ::
"c:\archivos de programa\Archivos comunes\IRAABOUT.DLL"
"c:\archivos de programa\Archivos comunes\IRALPTTR.DLL"
"c:\archivos de programa\Archivos comunes\IRAMDMTR.DLL"
"c:\archivos de programa\Archivos comunes\IRAREG.DLL"
"c:\archivos de programa\Archivos comunes\IRASRIAL.DLL"
"c:\archivos de programa\Archivos comunes\IRAWEBTR.DLL"
"c:\docume~1\ELENA\CONFIG~1\Temp\SAS_SelfExtract\SASDI FSV.SYS"
"c:\docume~1\ELENA\CONFIG~1\Temp\SAS_SelfExtract\SASKU TIL.SYS"
"c:\windows\TEMP\itbi\setup.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\archivos de programa\Archivos comunes\IRAABOUT.DLL
c:\archivos de programa\Archivos comunes\IRALPTTR.DLL
c:\archivos de programa\Archivos comunes\IRAMDMTR.DLL
c:\archivos de programa\Archivos comunes\IRAREG.DLL
c:\archivos de programa\Archivos comunes\IRASRIAL.DLL
c:\archivos de programa\Archivos comunes\IRAWEBTR.DLL
C:\TDSSKiller_Quarantine
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\mbr0000\object.ini
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\mbr0000\tsk0000.dta
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\mbr0000\tsk0000.ini
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\object.ini
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\tdlfs0000\object.ini
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\tdlfs0000\tsk0000.dta
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\tdlfs0000\tsk0000.ini
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\tdlfs0000\tsk0001.dta
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\tdlfs0000\tsk0001.ini
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\tdlfs0000\tsk0002.dta
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\tdlfs0000\tsk0002.ini
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\tdlfs0000\tsk0003.ini
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\tdlfs0000\tsk0004.dta
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\tdlfs0000\tsk0004.ini
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\tdlfs0000\tsk0005.ini
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\tdlfs0000\tsk0006.ini
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\tdlfs0000\tsk0007.ini
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\tdlfs0000\tsk0008.dta
c:\tdsskiller_quarantine\04.03.2011_22.30.47\boot0000\tdlfs0000\tsk0008.ini
c:\windows\system32\LogFiles
c:\windows\system32\LogFiles\header.htm
c:\windows\system32\LogFiles\Tailend.htm
c:\windows\system32\LogFiles\TXRXF11B.HTM
c:\windows\system32\LogFiles\txrxfr5.htm
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\Legacy_AMSERVICE
-------\Legacy_SASDIFSV
-------\Legacy_SASKUTIL
-------\Service_AMService
-------\Service_SASDIFSV
-------\Service_SASKUTIL
.
.
((((((((((((((((((((((((( Files Created from 2011-02-07 to 2011-03-07 )))))))))))))))))))))))))))))))
.
.
2011-03-04 22:42 . 2011-03-04 22:42 -------- d-----w- c:\archivos de programa\ESET
2011-02-21 21:20 . 2008-04-14 03:18 116736 ----a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2011-02-21 21:20 . 2001-08-22 22:15 23040 ----a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2011-02-21 21:20 . 2008-04-14 03:18 18944 ----a-w- c:\windows\system32\dllcache\xrxscnui.dll
2011-02-21 21:20 . 2001-08-22 22:15 27648 ----a-w- c:\windows\system32\dllcache\xrxftplt.exe
2011-02-21 21:19 . 2001-08-22 22:15 4608 ----a-w- c:\windows\system32\dllcache\xrxflnch.exe
2011-02-21 21:19 . 2001-08-22 22:15 99865 ----a-w- c:\windows\system32\dllcache\xlog.exe
2011-02-21 21:19 . 2001-08-17 20:11 16970 ----a-w- c:\windows\system32\dllcache\xem336n5.sys
2011-02-21 21:19 . 2004-08-03 22:29 19455 ----a-w- c:\windows\system32\dllcache\wvchntxx.sys
2011-02-21 21:19 . 2004-08-03 22:29 12063 ----a-w- c:\windows\system32\dllcache\wsiintxx.sys
2011-02-21 21:19 . 2008-04-14 03:18 8192 ----a-w- c:\windows\system32\dllcache\wshirda.dll
2011-02-21 21:19 . 2008-04-13 19:36 8832 ----a-w- c:\windows\system32\dllcache\wmiacpi.sys
2011-02-21 21:18 . 2004-08-03 22:31 154624 ----a-w- c:\windows\system32\dllcache\wlluc48.sys
2011-02-21 21:18 . 2001-08-22 21:35 35402 ----a-w- c:\windows\system32\dllcache\wlandrv2.sys
2011-02-21 21:18 . 2001-08-17 21:28 771581 ----a-w- c:\windows\system32\dllcache\winacisa.sys
2011-02-21 21:18 . 2001-08-22 22:15 54272 ----a-w- c:\windows\system32\dllcache\wiamsmud.dll
2011-02-21 21:18 . 2004-08-20 12:00 41600 ----a-w- c:\windows\system32\dllcache\weitekp9.dll
2011-02-21 21:18 . 2004-08-20 12:00 31488 ----a-w- c:\windows\system32\dllcache\weitekp9.sys
2011-02-21 21:18 . 2001-08-17 21:28 701386 ----a-w- c:\windows\system32\dllcache\wdhaalba.sys
2011-02-21 21:18 . 2004-08-03 22:29 23615 ----a-w- c:\windows\system32\dllcache\wch7xxnt.sys
2011-02-21 21:18 . 2008-04-14 02:51 32000 ----a-w- c:\windows\system32\dllcache\wceusbsh.sys
2011-02-21 21:16 . 2001-08-17 21:28 604253 ----a-w- c:\windows\system32\dllcache\vmodem.sys
2011-02-21 21:16 . 2001-08-17 20:14 249402 ----a-w- c:\windows\system32\dllcache\vinwm.sys
2011-02-21 21:16 . 2001-08-17 21:49 24576 ----a-w- c:\windows\system32\dllcache\viairda.sys
2011-02-21 21:16 . 2008-04-14 03:18 54784 ----a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2011-02-21 21:16 . 2001-08-17 21:28 687999 ----a-w- c:\windows\system32\dllcache\usrwdxjs.sys
2011-02-21 21:16 . 2001-08-17 21:28 765884 ----a-w- c:\windows\system32\dllcache\usrti.sys
2011-02-21 21:16 . 2001-08-17 21:28 113762 ----a-w- c:\windows\system32\dllcache\usrpda.sys
2011-02-21 21:16 . 2001-08-17 21:28 7556 ----a-w- c:\windows\system32\dllcache\usroslba.sys
2011-02-21 21:16 . 2001-08-17 21:28 224802 ----a-w- c:\windows\system32\dllcache\usr1807a.sys
2011-02-21 21:16 . 2001-08-17 21:28 794399 ----a-w- c:\windows\system32\dllcache\usr1806v.sys
2011-02-21 21:15 . 2001-08-17 21:28 793598 ----a-w- c:\windows\system32\dllcache\usr1806.sys
2011-02-21 21:15 . 2001-08-17 21:28 794654 ----a-w- c:\windows\system32\dllcache\usr1801.sys
2011-02-21 21:15 . 2008-04-13 19:45 26112 ----a-w- c:\windows\system32\dllcache\usbser.sys
2011-02-21 21:15 . 2008-04-13 19:45 17152 ----a-w- c:\windows\system32\dllcache\usbohci.sys
2011-02-21 21:15 . 2008-04-13 19:45 32128 ----a-w- c:\windows\system32\dllcache\usbccgp.sys
2011-02-21 21:15 . 2008-04-13 19:45 60032 ----a-w- c:\windows\system32\dllcache\usbaudio.sys
2011-02-21 21:15 . 2004-08-19 15:27 32384 ----a-w- c:\windows\system32\dllcache\usb101et.sys
2011-02-21 21:15 . 2001-08-22 22:15 94720 ----a-w- c:\windows\system32\dllcache\umaxud32.dll
2011-02-21 21:15 . 2001-08-22 22:15 28672 ----a-w- c:\windows\system32\dllcache\umaxu40.dll
2011-02-21 21:15 . 2001-08-22 22:15 27136 ----a-w- c:\windows\system32\dllcache\umaxu22.dll
2011-02-21 21:15 . 2001-08-22 22:15 69632 ----a-w- c:\windows\system32\dllcache\umaxu12.dll
2011-02-21 21:15 . 2001-08-22 22:15 50688 ----a-w- c:\windows\system32\dllcache\umaxscan.dll
2011-02-21 21:14 . 2001-08-17 21:58 22912 ----a-w- c:\windows\system32\dllcache\umaxpcls.sys
2011-02-21 21:14 . 2001-08-22 22:15 50176 ----a-w- c:\windows\system32\dllcache\umaxp60.dll
2011-02-21 21:14 . 2001-08-22 22:15 47616 ----a-w- c:\windows\system32\dllcache\umaxcam.dll
2011-02-21 21:14 . 2001-08-22 22:15 212480 ----a-w- c:\windows\system32\dllcache\um54scan.dll
2011-02-21 21:14 . 2001-08-22 22:15 216576 ----a-w- c:\windows\system32\dllcache\um34scan.dll
2011-02-21 21:14 . 2001-08-17 21:48 11520 ----a-w- c:\windows\system32\dllcache\twotrack.sys
2011-02-21 21:14 . 2004-08-20 12:00 14336 ----a-w- c:\windows\system32\dllcache\tsprof.exe
2011-02-21 21:14 . 2001-08-17 20:51 166784 ----a-w- c:\windows\system32\dllcache\tridxpm.sys
2011-02-21 21:14 . 2001-08-22 22:15 525568 ----a-w- c:\windows\system32\dllcache\tridxp.dll
2011-02-21 21:14 . 2001-08-17 20:51 159232 ----a-w- c:\windows\system32\dllcache\tridkbm.sys
2011-02-21 21:14 . 2001-08-22 22:14 440576 ----a-w- c:\windows\system32\dllcache\tridkb.dll
2011-02-21 21:13 . 2001-08-17 20:51 222336 ----a-w- c:\windows\system32\dllcache\trid3dm.sys
2011-02-21 21:13 . 2001-08-22 22:14 315520 ----a-w- c:\windows\system32\dllcache\trid3d.dll
2011-02-21 21:13 . 2001-08-17 20:12 34375 ----a-w- c:\windows\system32\dllcache\tpro4.sys
2011-02-21 21:13 . 2001-08-22 22:14 43008 ----a-w- c:\windows\system32\dllcache\tp4res.dll
2011-02-21 21:13 . 2008-04-14 03:19 82944 ----a-w- c:\windows\system32\dllcache\tp4mon.exe
2011-02-21 21:13 . 2001-08-22 22:15 31744 ----a-w- c:\windows\system32\dllcache\tp4.dll
2011-02-21 21:13 . 2001-08-17 22:02 230912 ----a-w- c:\windows\system32\dllcache\tosdvd03.sys
2011-02-21 21:13 . 2001-08-17 22:01 241664 ----a-w- c:\windows\system32\dllcache\tosdvd02.sys
2011-02-21 21:13 . 2001-08-17 20:10 28232 ----a-w- c:\windows\system32\dllcache\tos4mo.sys
2011-02-21 21:13 . 2001-08-17 20:14 123995 ----a-w- c:\windows\system32\dllcache\tjisdn.sys
2011-02-21 21:13 . 2004-08-20 12:00 185344 ----a-w- c:\windows\system32\dllcache\thawbrkr.dll
2011-02-21 21:11 . 2001-08-17 22:02 3968 ----a-w- c:\windows\system32\dllcache\swusbflt.sys
2011-02-21 21:11 . 2001-08-22 22:15 10240 ----a-w- c:\windows\system32\dllcache\swpidflt.dll
2011-02-21 21:11 . 2001-08-22 22:15 10240 ----a-w- c:\windows\system32\dllcache\swpdflt2.dll
2011-02-21 21:11 . 2001-08-22 22:15 53760 ----a-w- c:\windows\system32\dllcache\sw_wheel.dll
2011-02-21 21:11 . 2001-08-22 22:15 41472 ----a-w- c:\windows\system32\dllcache\sw_effct.dll
2011-02-21 21:11 . 2001-08-22 22:15 155648 ----a-w- c:\windows\system32\dllcache\stlnprop.dll
2011-02-21 21:11 . 2001-08-22 22:15 53248 ----a-w- c:\windows\system32\dllcache\stlncoin.dll
2011-02-21 21:11 . 2001-08-22 21:28 286848 ----a-w- c:\windows\system32\dllcache\stlnata.sys
2011-02-21 21:11 . 2001-08-22 21:27 17024 ----a-w- c:\windows\system32\dllcache\stcusb.sys
2011-02-21 21:11 . 2001-08-17 20:11 48736 ----a-w- c:\windows\system32\dllcache\srwlnd5.sys
2011-02-21 21:11 . 2004-08-20 12:00 101888 ----a-w- c:\windows\system32\dllcache\srusbusd.dll
2011-02-21 21:11 . 2001-08-22 22:15 99840 ----a-w- c:\windows\system32\dllcache\srusd.dll
2011-02-21 21:09 . 2001-08-22 22:14 147200 ----a-w- c:\windows\system32\dllcache\smidispb.dll
2011-02-21 21:08 . 2001-08-22 22:14 157696 ----a-w- c:\windows\system32\dllcache\sisv256.dll
2011-02-21 21:08 . 2001-08-17 20:50 50432 ----a-w- c:\windows\system32\dllcache\sisv.sys
2011-02-21 21:08 . 2004-08-03 22:31 32768 ----a-w- c:\windows\system32\dllcache\sisnic.sys
2011-02-21 21:08 . 2001-08-22 22:15 238592 ----a-w- c:\windows\system32\dllcache\sisgrv.dll
2011-02-21 21:08 . 2001-08-17 20:50 104064 ----a-w- c:\windows\system32\dllcache\sisgrp.sys
2011-02-21 21:08 . 2001-08-22 22:14 150144 ----a-w- c:\windows\system32\dllcache\sis6306v.dll
2011-02-21 21:08 . 2001-08-17 20:50 68608 ----a-w- c:\windows\system32\dllcache\sis6306p.sys
2011-02-21 21:08 . 2001-08-22 22:14 252032 ----a-w- c:\windows\system32\dllcache\sis300iv.dll
2011-02-21 21:08 . 2004-08-20 12:00 19456 ----a-w- c:\windows\system32\dllcache\simptcp.dll
2011-02-21 21:08 . 2001-08-17 20:50 101760 ----a-w- c:\windows\system32\dllcache\sis300ip.sys
2011-02-21 21:07 . 2001-08-22 21:49 161696 ----a-w- c:\windows\system32\dllcache\sgsmusb.sys
2011-02-21 21:07 . 2001-07-21 22:29 18400 ----a-w- c:\windows\system32\dllcache\sgsmld.sys
2011-02-21 21:07 . 2001-08-17 20:51 98080 ----a-w- c:\windows\system32\dllcache\sgiulnt5.sys
2011-02-21 21:07 . 2001-08-22 22:14 386560 ----a-w- c:\windows\system32\dllcache\sgiul50.dll
2011-02-21 21:07 . 2001-08-17 20:19 36480 ----a-w- c:\windows\system32\dllcache\sfmanm.sys
2011-02-21 21:07 . 2001-08-22 21:49 6912 ----a-w- c:\windows\system32\dllcache\serscan.sys
2011-02-21 21:07 . 2001-08-22 21:49 18176 ----a-w- c:\windows\system32\dllcache\sermouse.sys
2011-02-21 21:07 . 2001-08-22 22:15 26112 ----a-w- c:\windows\system32\dllcache\EXCH_seos.dll
2011-02-21 21:07 . 2001-08-17 21:53 6912 ----a-w- c:\windows\system32\dllcache\seaddsmc.sys
2011-02-21 21:07 . 2008-04-13 19:45 11520 ----a-w- c:\windows\system32\dllcache\scsiscan.sys
2011-02-21 21:06 . 2001-08-17 21:52 11648 ----a-w- c:\windows\system32\dllcache\scsiprnt.sys
2011-02-21 21:06 . 2001-08-22 22:15 57856 ----a-w- c:\windows\system32\dllcache\EXCH_scripto.dll
2011-02-21 21:06 . 2001-08-22 21:49 17536 ----a-w- c:\windows\system32\dllcache\scr111.sys
2011-02-21 21:06 . 2001-08-22 21:48 16768 ----a-w- c:\windows\system32\dllcache\scmstcs.sys
2011-02-21 21:06 . 2001-08-17 21:51 23936 ----a-w- c:\windows\system32\dllcache\sccmusbm.sys
2011-02-21 21:06 . 2001-08-22 21:48 24064 ----a-w- c:\windows\system32\dllcache\sccmn50m.sys
2011-02-21 21:06 . 2008-04-13 19:40 43904 ----a-w- c:\windows\system32\dllcache\sbp2port.sys
2011-02-21 21:06 . 2001-08-22 22:15 495616 ----a-w- c:\windows\system32\dllcache\sblfx.dll
2011-02-21 21:06 . 2001-08-17 20:50 75392 ----a-w- c:\windows\system32\dllcache\s3savmxm.sys
2011-02-21 21:06 . 2001-08-22 22:14 245632 ----a-w- c:\windows\system32\dllcache\s3savmx.dll
2011-02-21 21:06 . 2001-08-17 20:50 77824 ----a-w- c:\windows\system32\dllcache\s3sav4m.sys
2011-02-21 21:04 . 2001-08-17 20:19 30720 ----a-w- c:\windows\system32\dllcache\rthwcls.sys
2011-02-21 21:04 . 2001-08-22 22:15 10240 ----a-w- c:\windows\system32\dllcache\rsmgrstr.dll
2011-02-21 21:04 . 2001-08-17 20:19 3840 ----a-w- c:\windows\system32\dllcache\rpfun.sys
2011-02-21 21:04 . 2008-04-14 02:52 79360 ----a-w- c:\windows\system32\dllcache\rocket.sys
2011-02-21 21:04 . 2001-08-17 20:12 37563 ----a-w- c:\windows\system32\dllcache\rlnet5.sys
2011-02-21 21:04 . 2001-08-22 22:15 86097 ----a-w- c:\windows\system32\dllcache\reslog32.dll
2011-02-21 21:04 . 2001-08-22 22:15 23040 ----a-w- c:\windows\system32\dllcache\EXCH_regtrace.exe
2011-02-21 21:04 . 2004-08-20 12:00 14848 ----a-w- c:\windows\system32\dllcache\register.exe
2011-02-21 21:04 . 2001-08-17 21:51 19584 ----a-w- c:\windows\system32\dllcache\rasirda.sys
2011-02-21 21:04 . 2001-08-22 21:46 715370 ----a-w- c:\windows\system32\dllcache\r2mdmkxx.sys
2011-02-21 21:04 . 2001-08-22 21:46 899754 ----a-w- c:\windows\system32\dllcache\r2mdkxga.sys
2011-02-21 21:04 . 2001-08-22 22:15 41984 ----a-w- c:\windows\system32\dllcache\qvusd.dll
2011-02-21 21:02 . 2001-08-17 21:53 7168 ----a-w- c:\windows\system32\dllcache\pnrmc.sys
2011-02-21 21:01 . 2001-08-17 20:11 29769 ----a-w- c:\windows\system32\dllcache\pcntn5m.sys
2011-02-21 21:01 . 2001-08-17 20:11 30282 ----a-w- c:\windows\system32\dllcache\pcntn5hl.sys
2011-02-21 21:01 . 2001-08-17 20:12 26153 ----a-w- c:\windows\system32\dllcache\pcmlm56.sys
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-21 14:44 . 2004-08-20 12:00 441344 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2004-08-20 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 14:03 . 2004-08-20 12:00 1855104 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2004-08-20 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 23:07 . 2004-08-20 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:07 . 2004-08-20 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-12-20 23:07 . 2004-08-20 12:00 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2010-12-20 23:07 . 2004-08-20 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2010-12-20 17:25 . 2004-08-20 12:00 734720 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 12:55 . 2004-08-20 12:00 389120 ----a-w- c:\windows\system32\html.iec
2010-12-09 15:15 . 2004-08-20 12:00 742912 ----a-w- c:\windows\system32\ntdll.dll
2010-12-09 15:13 . 1980-01-01 00:00 2195200 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 15:13 . 1980-01-01 00:00 2071808 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-09 14:29 . 2004-08-20 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll
2010-08-24 13:57 . 2010-04-29 19:58 24376 ----a-w- c:\archivos de programa\mozilla firefox\components\Scriptff.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-21 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]
"Apoint"="c:\archivos de programa\Apoint\Apoint.exe" [2004-08-21 155648]
"Dell QuickSet"="c:\archivos de programa\Dell\QuickSet\quickset.exe" [2004-05-16 528384]
"PRONoMgr.exe"="c:\archivos de programa\Intel\NCS\PROSet\PRONoMgr.exe" [2003-05-28 86016]
"PCMService"="c:\archivos de programa\Dell\Media Experience\PCMService.exe" [2004-04-11 290816]
"DVDLauncher"="c:\archivos de programa\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
"McAfeeUpdaterUI"="c:\archivos de programa\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
"Harrap's Unabridged Pro"="c:\archivos de programa\Harrap\Harrap's Unabridged Pro\Bin\Multilingual.exe" [2004-03-02 348160]
"Dell AIO Printer A920"="c:\archivos de programa\Dell AIO Printer A920\dlbkbmgr.exe" [2003-06-02 270336]
"mcui_exe"="c:\archivos de programa\McAfee.com\Agent\mcagent.exe" [2010-09-30 1193848]
"SunJavaUpdateSched"="c:\archivos de programa\Archivos comunes\Java\Java Update\jusched.exe" [2010-05-14 248552]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
c:\documents and settings\All Users\Men£ Inicio\Programas\Inicio\
BlueSoleil.lnk - c:\archivos de programa\IVT Corporation\BlueSoleil\BlueSoleil.exe [2005-9-20 1200128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2004-01-12 06:55 110592 ----a-w- c:\windows\SYSTEM32\LgNotify.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^DUEAE Popup.lnk]
path=c:\documents and settings\All Users\Menú Inicio\Programas\Inicio\DUEAE Popup.lnk
backup=c:\windows\pss\DUEAE Popup.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 16:10 35696 ----a-w- c:\archivos de programa\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-12-21 13:55 39408 ----a-w- c:\archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WmdmPmSN"=3 (0x3)
"TapiSrv"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Archivos de programa\\Messenger\\MSMSGS.EXE"=
"c:\\Archivos de programa\\Media Player Classic\\mplayerc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Archivos de programa\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe"=
"c:\\Archivos de programa\\MSN Messenger\\livecall.exe"=
"c:\archivos de programa\Microsoft ActiveSync\rapimgr.exe"= c:\archivos de programa\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\archivos de programa\Microsoft ActiveSync\wcescomm.exe"= c:\archivos de programa\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\archivos de programa\Microsoft ActiveSync\WCESMgr.exe"= c:\archivos de programa\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Archivos de programa\\Skype\\Phone\\Skype.exe"=
"c:\\Archivos de programa\\Archivos comunes\\McAfee\\McSvcHost\\McSvHost.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\SYSTEM32\DRIVERS\mfetdi2k.sys [22/04/2010 22:17 84072]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\archivos de programa\McAfee\SiteAdvisor\McSACore.exe [05/09/2008 21:17 88176]
R2 McMPFSvc;McAfee Servicio Personal Firewall;"c:\archivos de programa\Archivos comunes\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [22/04/2010 22:16 271480]
R2 McNaiAnn;McAfee VirusScan Announcer;"c:\archivos de programa\Archivos comunes\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [22/04/2010 22:16 271480]
R2 mfefire;McAfee Firewall Core Service;c:\archivos de programa\Archivos comunes\McAfee\SystemCore\mfefire.exe [22/04/2010 22:17 188136]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\archivos de programa\Archivos comunes\McAfee\SystemCore\mfevtps.exe [22/04/2010 22:17 141792]
R3 cfwids;McAfee Inc. cfwids;c:\windows\SYSTEM32\DRIVERS\cfwids.sys [22/04/2010 22:17 55840]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\SYSTEM32\DRIVERS\mfefirek.sys [22/04/2010 22:17 313288]
R3 mfendiskmp;mfendiskmp;c:\windows\SYSTEM32\DRIVERS\mfendisk.sys [22/04/2010 22:17 88544]
S2 gupdate;Servicio Google Update (gupdate);c:\archivos de programa\Google\Update\GoogleUpdate.exe [30/01/2010 10:47 135664]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys [09/02/2011 1:02 38224]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\SYSTEM32\DRIVERS\mfendisk.sys [22/04/2010 22:17 88544]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\SYSTEM32\DRIVERS\mferkdet.sys [22/04/2010 22:17 84264]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\archivos de programa\Google\Update\GoogleUpdate.exe [2010-01-30 10:47]
.
2011-03-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\archivos de programa\Google\Update\GoogleUpdate.exe [2010-01-30 10:47]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://mail.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://es.search.yahoo.com/search?fr=mcafee&p=%s
IE: Google Sidewiki... - c:\archivos de programa\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-07 21:39
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1544)
c:\windows\system32\LgNotify.dll
.
- - - - - - - > 'explorer.exe'(3936)
c:\windows\system32\WININET.dll
c:\archiv~1\mcafee\SITEAD~1\saHook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\S24EvMon.exe
c:\windows\system32\ZCfgSvc.exe
c:\windows\system32\1XConfig.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\archivos de programa\IVT Corporation\BlueSoleil\BTNtService.exe
c:\archivos de programa\Java\jre6\bin\jqs.exe
c:\windows\system32\RegSrvc.exe
c:\archivos de programa\Archivos comunes\McAfee\SystemCore\mcshield.exe
c:\archivos de programa\Canon\CAL\CALMAIN.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\archivos de programa\Microsoft ActiveSync\Wcescomm.exe
c:\archivos de programa\Dell AIO Printer A920\dlbkbmon.exe
c:\archivos de programa\Apoint\Apntex.exe
c:\archiv~1\MI3AA1~1\rapimgr.exe
c:\archiv~1\mcafee.com\agent\mcupdate.exe
.
**************************************************************************
.
Completion time: 2011-03-07 21:47:16 - machine was rebooted
ComboFix-quarantined-files.txt 2011-03-07 21:47
ComboFix2.txt 2011-03-05 00:50
.
Pre-Run: 7.264.460.800 bytes libres
Post-Run: 7.293.591.552 bytes libres
.
- - End Of File - - B385F7CBF1316DF1656AFBAB54A368B3

tom2011 · Mar 7, 2011

bootkit remover log

.\debug.cpp(238) : Debug log started at 07.03.2011 - 22:01:30
.\boot_cleaner.cpp(527) : Bootkit Remover
.\boot_cleaner.cpp(528) : (c) 2009 eSage Lab
.\boot_cleaner.cpp(529) : www.esagelab.com
.\boot_cleaner.cpp(533) : Program version: 1.2.0.0
.\boot_cleaner.cpp(540) : OS Version: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
.\debug.cpp(248) : **********************************************
.\debug.cpp(249) : *** [ LOADED MODULES INFORMATION ] ***********
.\debug.cpp(250) : **********************************************
.\debug.cpp(256) : 0x804d7000 0x00217f00 "\WINDOWS\system32\ntoskrnl.exe"
.\debug.cpp(256) : 0x806ef000 0x00013d00 "\WINDOWS\system32\hal.dll"
.\debug.cpp(256) : 0xf8b07000 0x00002000 "\WINDOWS\system32\KDCOM.DLL"
.\debug.cpp(256) : 0xf8a17000 0x00003000 "\WINDOWS\system32\BOOTVID.dll"
.\debug.cpp(256) : 0xf85b7000 0x0002f000 "ACPI.sys"
.\debug.cpp(256) : 0xf8b09000 0x00002000 "\WINDOWS\system32\DRIVERS\WMILIB.SYS"
.\debug.cpp(256) : 0xf85a6000 0x00011000 "pci.sys"
.\debug.cpp(256) : 0xf8607000 0x0000a000 "isapnp.sys"
.\debug.cpp(256) : 0xf8a1b000 0x00003000 "compbatt.sys"
.\debug.cpp(256) : 0xf8a1f000 0x00004000 "\WINDOWS\system32\DRIVERS\BATTC.SYS"
.\debug.cpp(256) : 0xf8bcf000 0x00001000 "pciide.sys"
.\debug.cpp(256) : 0xf8887000 0x00007000 "\WINDOWS\system32\DRIVERS\PCIIDEX.SYS"
.\debug.cpp(256) : 0xf8b0b000 0x00002000 "aliide.sys"
.\debug.cpp(256) : 0xf8b0d000 0x00002000 "intelide.sys"
.\debug.cpp(256) : 0xf8b0f000 0x00002000 "toside.sys"
.\debug.cpp(256) : 0xf8b11000 0x00002000 "viaide.sys"
.\debug.cpp(256) : 0xf8b13000 0x00002000 "cmdide.sys"
.\debug.cpp(256) : 0xf8588000 0x0001e000 "pcmcia.sys"
.\debug.cpp(256) : 0xf8617000 0x0000b000 "MountMgr.sys"
.\debug.cpp(256) : 0xf8569000 0x0001f000 "ftdisk.sys"
.\debug.cpp(256) : 0xf888f000 0x00005000 "PartMgr.sys"
.\debug.cpp(256) : 0xf8627000 0x0000d000 "VolSnap.sys"
.\debug.cpp(256) : 0xf8a23000 0x00004000 "cpqarray.sys"
.\debug.cpp(256) : 0xf8551000 0x00018000 "\WINDOWS\system32\DRIVERS\SCSIPORT.SYS"
.\debug.cpp(256) : 0xf8539000 0x00018000 "atapi.sys"
.\debug.cpp(256) : 0xf8a27000 0x00004000 "aha154x.sys"
.\debug.cpp(256) : 0xf8897000 0x00005000 "sparrow.sys"
.\debug.cpp(256) : 0xf8a2b000 0x00004000 "symc810.sys"
.\debug.cpp(256) : 0xf8637000 0x0000e000 "aic78xx.sys"
.\debug.cpp(256) : 0xf8a2f000 0x00004000 "dac960nt.sys"
.\debug.cpp(256) : 0xf8647000 0x00009000 "ql10wnt.sys"
.\debug.cpp(256) : 0xf8a33000 0x00003000 "amsint.sys"
.\debug.cpp(256) : 0xf889f000 0x00007000 "asc.sys"
.\debug.cpp(256) : 0xf8a37000 0x00004000 "asc3550.sys"
.\debug.cpp(256) : 0xf88a7000 0x00005000 "mraid35x.sys"
.\debug.cpp(256) : 0xf88af000 0x00005000 "i2omp.sys"
.\debug.cpp(256) : 0xf8a3b000 0x00004000 "ini910u.sys"
.\debug.cpp(256) : 0xf8657000 0x0000a000 "ql1240.sys"
.\debug.cpp(256) : 0xf8667000 0x0000e000 "aic78u2.sys"
.\debug.cpp(256) : 0xf88b7000 0x00008000 "symc8xx.sys"
.\debug.cpp(256) : 0xf88bf000 0x00007000 "sym_hi.sys"
.\debug.cpp(256) : 0xf88c7000 0x00008000 "sym_u3.sys"
.\debug.cpp(256) : 0xf88cf000 0x00006000 "ABP480N5.SYS"
.\debug.cpp(256) : 0xf88d7000 0x00006000 "asc3350p.sys"
.\debug.cpp(256) : 0xf8b15000 0x00002000 "cd20xrnt.sys"
.\debug.cpp(256) : 0xf8677000 0x00009000 "ultra.sys"
.\debug.cpp(256) : 0xf8520000 0x00019000 "adpu160m.sys"
.\debug.cpp(256) : 0xf88df000 0x00005000 "dpti2o.sys"
.\debug.cpp(256) : 0xf8687000 0x0000a000 "ql1080.sys"
.\debug.cpp(256) : 0xf8697000 0x0000c000 "ql1280.sys"
.\debug.cpp(256) : 0xf86a7000 0x0000c000 "ql12160.sys"
.\debug.cpp(256) : 0xf88e7000 0x00007000 "perc2.sys"
.\debug.cpp(256) : 0xf8b17000 0x00002000 "perc2hib.sys"
.\debug.cpp(256) : 0xf88ef000 0x00007000 "hpn.sys"
.\debug.cpp(256) : 0xf8a3f000 0x00004000 "cbidf2k.sys"
.\debug.cpp(256) : 0xf84f4000 0x0002c000 "dac2w2k.sys"
.\debug.cpp(256) : 0xf86b7000 0x00009000 "disk.sys"
.\debug.cpp(256) : 0xf86c7000 0x0000d000 "\WINDOWS\system32\DRIVERS\CLASSPNP.SYS"
.\debug.cpp(256) : 0xf84d4000 0x00020000 "fltmgr.sys"
.\debug.cpp(256) : 0xf84c2000 0x00012000 "sr.sys"
.\debug.cpp(256) : 0xf8465000 0x0005d000 "mfehidk.sys"
.\debug.cpp(256) : 0xf844e000 0x00017000 "KSecDD.sys"
.\debug.cpp(256) : 0xf83c1000 0x0008d000 "Ntfs.sys"
.\debug.cpp(256) : 0xf8394000 0x0002d000 "NDIS.sys"
.\debug.cpp(256) : 0xf86d7000 0x0000a000 "sisagp.sys"
.\debug.cpp(256) : 0xf86e7000 0x0000b000 "viaagp.sys"
.\debug.cpp(256) : 0xf86f7000 0x00010000 "ohci1394.sys"
.\debug.cpp(256) : 0xf8707000 0x0000e000 "\WINDOWS\system32\DRIVERS\1394BUS.SYS"
.\debug.cpp(256) : 0xf837a000 0x0001a000 "Mup.sys"
.\debug.cpp(256) : 0xf88f7000 0x00007000 "BTHidMgr.sys"
.\debug.cpp(256) : 0xf8717000 0x0000b000 "agp440.sys"
.\debug.cpp(256) : 0xf8727000 0x0000b000 "alim1541.sys"
.\debug.cpp(256) : 0xf8737000 0x0000b000 "amdagp.sys"
.\debug.cpp(256) : 0xf8747000 0x0000b000 "agpCPQ.sys"
.\debug.cpp(256) : 0xf8767000 0x00010000 "\SystemRoot\system32\DRIVERS\nic1394.sys"
.\debug.cpp(256) : 0xf82da000 0x0000a000 "\SystemRoot\system32\DRIVERS\intelppm.sys"
.\debug.cpp(256) : 0xf82ae000 0x00004000 "\SystemRoot\system32\DRIVERS\CmBatt.sys"
.\debug.cpp(256) : 0xf7add000 0x000b5000 "\SystemRoot\system32\DRIVERS\ialmnt5.sys"
.\debug.cpp(256) : 0xf7ac9000 0x00014000 "\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS"
.\debug.cpp(256) : 0xf89e7000 0x00006000 "\SystemRoot\system32\DRIVERS\usbuhci.sys"
.\debug.cpp(256) : 0xf7aa5000 0x00024000 "\SystemRoot\system32\DRIVERS\USBPORT.SYS"
.\debug.cpp(256) : 0xf89ef000 0x00008000 "\SystemRoot\system32\DRIVERS\usbehci.sys"
.\debug.cpp(256) : 0xf7847000 0x0025e000 "\SystemRoot\system32\DRIVERS\w70n51.sys"
.\debug.cpp(256) : 0xf7823000 0x00024000 "\SystemRoot\system32\DRIVERS\e100b325.sys"
.\debug.cpp(256) : 0xf7c4e000 0x0000e000 "\SystemRoot\system32\DRIVERS\i8042prt.sys"
.\debug.cpp(256) : 0xf780a000 0x00019000 "\SystemRoot\system32\DRIVERS\Apfiltr.sys"
.\debug.cpp(256) : 0xf89f7000 0x00006000 "\SystemRoot\system32\DRIVERS\mouclass.sys"
.\debug.cpp(256) : 0xf89ff000 0x00007000 "\SystemRoot\system32\DRIVERS\kbdclass.sys"
.\debug.cpp(256) : 0xf77f9000 0x00011000 "\SystemRoot\system32\DRIVERS\serial.sys"
.\debug.cpp(256) : 0xf82a6000 0x00004000 "\SystemRoot\system32\DRIVERS\serenum.sys"
.\debug.cpp(256) : 0xf77e5000 0x00014000 "\SystemRoot\system32\DRIVERS\parport.sys"
.\debug.cpp(256) : 0xf7c3e000 0x0000b000 "\SystemRoot\system32\DRIVERS\imapi.sys"
.\debug.cpp(256) : 0xf8d0b000 0x00001000 "\SystemRoot\System32\Drivers\ElbyDelay.sys"
.\debug.cpp(256) : 0xf8a07000 0x00006000 "\SystemRoot\System32\Drivers\AnyDVD.sys"
.\debug.cpp(256) : 0xf7c2e000 0x00010000 "\SystemRoot\system32\DRIVERS\cdrom.sys"
.\debug.cpp(256) : 0xf7c1e000 0x0000f000 "\SystemRoot\system32\DRIVERS\redbook.sys"
.\debug.cpp(256) : 0xf77c2000 0x00023000 "\SystemRoot\system32\DRIVERS\ks.sys"
.\debug.cpp(256) : 0xf7783000 0x0003f000 "\SystemRoot\system32\drivers\stac97.sys"
.\debug.cpp(256) : 0xf775f000 0x00024000 "\SystemRoot\system32\drivers\portcls.sys"
.\debug.cpp(256) : 0xf7c0e000 0x0000f000 "\SystemRoot\system32\drivers\drmk.sys"
.\debug.cpp(256) : 0xf772e000 0x00031000 "\SystemRoot\system32\DRIVERS\HSFHWICH.sys"
.\debug.cpp(256) : 0xf762f000 0x000ff000 "\SystemRoot\system32\DRIVERS\HSF_DP.sys"
.\debug.cpp(256) : 0xf7589000 0x000a6000 "\SystemRoot\system32\DRIVERS\HSF_CNXT.sys"
.\debug.cpp(256) : 0xf8a0f000 0x00008000 "\SystemRoot\System32\Drivers\Modem.SYS"
.\debug.cpp(256) : 0xf7bfe000 0x0000a000 "\SystemRoot\System32\Drivers\VcommMgr.sys"
.\debug.cpp(256) : 0xf829e000 0x00003000 "\SystemRoot\system32\DRIVERS\vbtenum.sys"
.\debug.cpp(256) : 0xf890f000 0x00005000 "\SystemRoot\system32\DRIVERS\blueletaudio.sys"
.\debug.cpp(256) : 0xf8917000 0x00005000 "\SystemRoot\system32\DRIVERS\BlueletSCOAudio.sys"
.\debug.cpp(256) : 0xf8d0c000 0x00001000 "\SystemRoot\system32\DRIVERS\audstub.sys"
.\debug.cpp(256) : 0xf7575000 0x00014000 "\SystemRoot\system32\DRIVERS\mfendisk.sys"
.\debug.cpp(256) : 0xf8b35000 0x00002000 "\SystemRoot\System32\Drivers\RootMdm.sys"
.\debug.cpp(256) : 0xf7bee000 0x0000d000 "\SystemRoot\system32\DRIVERS\rasl2tp.sys"
.\debug.cpp(256) : 0xf8296000 0x00003000 "\SystemRoot\system32\DRIVERS\ndistapi.sys"
.\debug.cpp(256) : 0xf755e000 0x00017000 "\SystemRoot\system32\DRIVERS\ndiswan.sys"
.\debug.cpp(256) : 0xf7bde000 0x0000b000 "\SystemRoot\system32\DRIVERS\raspppoe.sys"
.\debug.cpp(256) : 0xf7bce000 0x0000c000 "\SystemRoot\system32\DRIVERS\raspptp.sys"
.\debug.cpp(256) : 0xf891f000 0x00005000 "\SystemRoot\system32\DRIVERS\TDI.SYS"
.\debug.cpp(256) : 0xf754d000 0x00011000 "\SystemRoot\system32\DRIVERS\psched.sys"
.\debug.cpp(256) : 0xf7bbe000 0x00009000 "\SystemRoot\system32\DRIVERS\msgpc.sys"
.\debug.cpp(256) : 0xf7529000 0x00024000 "\SystemRoot\system32\drivers\mfeavfk.sys"
.\debug.cpp(256) : 0xf74de000 0x0004b000 "\SystemRoot\system32\drivers\mfefirek.sys"
.\debug.cpp(256) : 0xf892f000 0x00005000 "\SystemRoot\system32\DRIVERS\ptilink.sys"
.\debug.cpp(256) : 0xf893f000 0x00005000 "\SystemRoot\system32\DRIVERS\raspti.sys"
.\debug.cpp(256) : 0xf7f36000 0x00003000 "\SystemRoot\system32\DRIVERS\btnetdrv.sys"
.\debug.cpp(256) : 0xf8947000 0x00008000 "\SystemRoot\system32\DRIVERS\VComm.sys"
.\debug.cpp(256) : 0xf8777000 0x0000a000 "\SystemRoot\system32\DRIVERS\termdd.sys"
.\debug.cpp(256) : 0xf8b43000 0x00002000 "\SystemRoot\system32\DRIVERS\swenum.sys"
.\debug.cpp(256) : 0xf7458000 0x0005e000 "\SystemRoot\system32\DRIVERS\update.sys"
.\debug.cpp(256) : 0xf7f32000 0x00004000 "\SystemRoot\system32\DRIVERS\mssmbios.sys"
.\debug.cpp(256) : 0xf894f000 0x00005000 "\SystemRoot\system32\DRIVERS\omci.sys"
.\debug.cpp(256) : 0xf8787000 0x0000a000 "\SystemRoot\System32\Drivers\NDProxy.SYS"
.\debug.cpp(256) : 0xf87a7000 0x0000f000 "\SystemRoot\system32\DRIVERS\usbhub.sys"
.\debug.cpp(256) : 0xf8b49000 0x00002000 "\SystemRoot\system32\DRIVERS\USBD.SYS"
.\debug.cpp(256) : 0xf82b6000 0x00003000 "\SystemRoot\System32\Drivers\i2omgmt.SYS"
.\debug.cpp(256) : 0xf8b4b000 0x00002000 "\SystemRoot\System32\Drivers\Fs_Rec.SYS"
.\debug.cpp(256) : 0xf8c48000 0x00001000 "\SystemRoot\System32\Drivers\Null.SYS"
.\debug.cpp(256) : 0xf8b4d000 0x00002000 "\SystemRoot\System32\Drivers\Beep.SYS"
.\debug.cpp(256) : 0xf895f000 0x00006000 "\SystemRoot\System32\drivers\vga.sys"
.\debug.cpp(256) : 0xf8b4f000 0x00002000 "\SystemRoot\System32\Drivers\mnmdd.SYS"
.\debug.cpp(256) : 0xf8b51000 0x00002000 "\SystemRoot\System32\DRIVERS\RDPCDD.sys"
.\debug.cpp(256) : 0xf8967000 0x00005000 "\SystemRoot\System32\Drivers\Msfs.SYS"
.\debug.cpp(256) : 0xf896f000 0x00008000 "\SystemRoot\System32\Drivers\Npfs.SYS"
.\debug.cpp(256) : 0xf82b2000 0x00003000 "\SystemRoot\system32\DRIVERS\rasacd.sys"
.\debug.cpp(256) : 0xef305000 0x00013000 "\SystemRoot\system32\DRIVERS\ipsec.sys"
.\debug.cpp(256) : 0xef2ac000 0x00059000 "\SystemRoot\system32\DRIVERS\tcpip.sys"
.\debug.cpp(256) : 0xef299000 0x00013000 "\SystemRoot\system32\drivers\mfetdi2k.sys"
.\debug.cpp(256) : 0xef273000 0x00026000 "\SystemRoot\system32\DRIVERS\ipnat.sys"
.\debug.cpp(256) : 0xef24b000 0x00028000 "\SystemRoot\system32\DRIVERS\netbt.sys"
.\debug.cpp(256) : 0xef229000 0x00022000 "\SystemRoot\System32\drivers\afd.sys"
.\debug.cpp(256) : 0xf87b7000 0x00009000 "\SystemRoot\system32\DRIVERS\netbios.sys"
.\debug.cpp(256) : 0xef1fe000 0x0002b000 "\SystemRoot\system32\DRIVERS\rdbss.sys"
.\debug.cpp(256) : 0xef166000 0x00070000 "\SystemRoot\system32\DRIVERS\mrxsmb.sys"
.\debug.cpp(256) : 0xf87d7000 0x0000b000 "\SystemRoot\System32\Drivers\Fips.SYS"
.\debug.cpp(256) : 0xf87e7000 0x00009000 "\SystemRoot\system32\DRIVERS\wanarp.sys"
.\debug.cpp(256) : 0xf87f7000 0x0000f000 "\SystemRoot\system32\DRIVERS\arp1394.sys"
.\debug.cpp(256) : 0xf8827000 0x00010000 "\SystemRoot\System32\Drivers\Cdfs.SYS"
.\debug.cpp(256) : 0xef0ae000 0x00018000 "\SystemRoot\System32\Drivers\dump_atapi.sys"
.\debug.cpp(256) : 0xf8b5b000 0x00002000 "\SystemRoot\System32\Drivers\dump_WMILIB.SYS"
.\debug.cpp(256) : 0xbf800000 0x001c5000 "\SystemRoot\System32\win32k.sys"
.\debug.cpp(256) : 0xf7440000 0x00003000 "\SystemRoot\System32\drivers\Dxapi.sys"
.\debug.cpp(256) : 0xf8977000 0x00005000 "\SystemRoot\System32\watchdog.sys"
.\debug.cpp(256) : 0xbf000000 0x00012000 "\SystemRoot\System32\drivers\dxg.sys"
.\debug.cpp(256) : 0xf8ca5000 0x00001000 "\SystemRoot\System32\drivers\dxgthk.sys"
.\debug.cpp(256) : 0xbf020000 0x0001e000 "\SystemRoot\System32\ialmdnt5.dll"
.\debug.cpp(256) : 0xbf012000 0x0000e000 "\SystemRoot\System32\ialmrnt5.dll"
.\debug.cpp(256) : 0xbf03e000 0x00026000 "\SystemRoot\System32\ialmdev5.DLL"
.\debug.cpp(256) : 0xbf064000 0x000c1000 "\SystemRoot\System32\ialmdd5.DLL"
.\debug.cpp(256) : 0xbf125000 0x00047000 "\SystemRoot\System32\ATMFD.DLL"
.\debug.cpp(256) : 0xeefd6000 0x00004000 "\SystemRoot\system32\DRIVERS\mdc8021x.sys"
.\debug.cpp(256) : 0xeefd2000 0x00003000 "\SystemRoot\system32\DRIVERS\s24trans.sys"
.\debug.cpp(256) : 0xeefc2000 0x00004000 "\SystemRoot\system32\DRIVERS\ndisuio.sys"
.\debug.cpp(256) : 0xeec39000 0x00015000 "\SystemRoot\system32\drivers\wdmaud.sys"
.\debug.cpp(256) : 0xeedfe000 0x0000f000 "\SystemRoot\system32\drivers\sysaudio.sys"
.\debug.cpp(256) : 0xee936000 0x0002d000 "\SystemRoot\system32\DRIVERS\mrxdav.sys"
.\debug.cpp(256) : 0xeed26000 0x00003000 "\SystemRoot\System32\Drivers\ElbyCDIO.sys"
.\debug.cpp(256) : 0xee7c6000 0x00058000 "\SystemRoot\system32\DRIVERS\srv.sys"
.\debug.cpp(256) : 0xee84e000 0x00003000 "\SystemRoot\system32\DRIVERS\mdmxsdk.sys"
.\debug.cpp(256) : 0xede8d000 0x0000c000 "\SystemRoot\system32\drivers\cfwids.sys"
.\debug.cpp(256) : 0xedaac000 0x0002b000 "\SystemRoot\system32\drivers\kmixer.sys"
.\debug.cpp(256) : 0xf898f000 0x00008000 "\??\C:\ComboFix\catchme.sys"
.\debug.cpp(256) : 0xf8b1b000 0x00002000 "\??\C:\WINDOWS\system32\Drivers\PROCEXP113.SYS"
.\debug.cpp(256) : 0xeda96000 0x00016000 "\SystemRoot\system32\drivers\mfeapfk.sys"
.\debug.cpp(256) : 0xeee0e000 0x0000b000 "\SystemRoot\system32\drivers\mfebopk.sys"
.\debug.cpp(256) : 0x7c910000 0x000b8000 "\WINDOWS\SYSTEM32\ntdll.dll"
.\debug.cpp(263) : **********************************************
.\debug.cpp(307) : *** [ DEVICE OBJECTS INFORMATION ] ***********
.\debug.cpp(308) : **********************************************
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\D:"
.\debug.cpp(400) : Destination "\Device\CdRom0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDIS"
.\debug.cpp(400) : Destination "\Device\Ndis"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY1"
.\debug.cpp(400) : Destination "\Device\Video0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM12"
.\debug.cpp(400) : Destination "\Device\Serial11"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB20#4&289241da&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
.\debug.cpp(400) : Destination "\Device\USBPDO-3"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY2"
.\debug.cpp(400) : Destination "\Device\Video1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{71985f4a-1ca1-11d3-9cc8-00c04f7971e0}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000075"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM13"
.\debug.cpp(400) : Destination "\Device\Serial12"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Bluetooth DUN Modem"
.\debug.cpp(400) : Destination "\Device\00000070"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0C#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"
.\debug.cpp(400) : Destination "\Device\00000097"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{db166191-541f-11d9-b7e0-806d6172696f}"
.\debug.cpp(400) : Destination "\Device\CdRom0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ip"
.\debug.cpp(400) : Destination "\Device\Ip"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomSONY_DVD+-RW_DW-D56A____________________PDS3____#5&24e5db9f&0&0.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP1T0L0-e"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY3"
.\debug.cpp(400) : Destination "\Device\Video2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MODEM#0003#{2c7089aa-2e0e-11d1-b114-00c04fc2aae4}"
.\debug.cpp(400) : Destination "\Device\00000072"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM14"
.\debug.cpp(400) : Destination "\Device\Serial13"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPSECDev"
.\debug.cpp(400) : Destination "\Device\IPSEC"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY4"
.\debug.cpp(400) : Destination "\Device\Video3"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0003#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\0000007a"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000074"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0D#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"
.\debug.cpp(400) : Destination "\Device\00000096"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WGUARDNT"
.\debug.cpp(400) : Destination "\Device\mfehidk"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#HIDCLASS#0000#{57574d37-c5e9-412d-a115-fa6d779eff08}"
.\debug.cpp(400) : Destination "\Device\00000006"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY5"
.\debug.cpp(400) : Destination "\Device\Video4"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MFE_NDISKMP#0001#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\0000006b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{9aa4a2cc-81e0-4cfd-802f-0f74526d2bd3}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\OMCI"
.\debug.cpp(400) : Destination "\Device\OMCI"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{fd0a5af4-b41d-11d2-9c95-00c04f7971e0}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MODEM#0000#{2c7089aa-2e0e-11d1-b114-00c04fc2aae4}"
.\debug.cpp(400) : Destination "\Device\0000006f"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0A#1#{72631e54-78a4-11d0-bcf7-00aa00b7b32a}"
.\debug.cpp(400) : Destination "\Device\00000094"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\BTHidMgr"
.\debug.cpp(400) : Destination "\Device\BTHidMgr"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{1DC9C34C-AD66-4E52-8A4D-774A7121F327}"
.\debug.cpp(400) : Destination "\Device\{1DC9C34C-AD66-4E52-8A4D-774A7121F327}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0000#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\0000007e"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\CompositeBattery"
.\debug.cpp(400) : Destination "\Device\CompositeBattery"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIDataDevice"
.\debug.cpp(400) : Destination "\Device\WMIDataDevice"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM1"
.\debug.cpp(400) : Destination "\Device\Serial0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0401#4&61f3b4b&0#{97f76ef0-f883-11d0-af1f-0000f800845c}"
.\debug.cpp(400) : Destination "\Device\000000b7"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Bluetooth Fax Modem"
.\debug.cpp(400) : Destination "\Device\0000006f"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\BTMgr"
.\debug.cpp(400) : Destination "\Device\BTMgr"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{dff220f3-f70f-11d0-b917-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{E70F8588-3826-4BF5-9114-E10DB7522ACD}"
.\debug.cpp(400) : Destination "\Device\{E70F8588-3826-4BF5-9114-E10DB7522ACD}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PIPE"
.\debug.cpp(400) : Destination "\Device\NamedPipe"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c5066e-72c1-11d2-9755-0000f8004788}"
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{F343BC38-83C1-4EF2-A76B-64805378C702}"
.\debug.cpp(400) : Destination "\Device\{F343BC38-83C1-4EF2-A76B-64805378C702}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&308544ff&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
.\debug.cpp(400) : Destination "\Device\USBPDO-2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0006#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\00000084"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM3"
.\debug.cpp(400) : Destination "\Device\Winachsf0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{db166190-541f-11d9-b7e0-806d6172696f}"
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PSched"
.\debug.cpp(400) : Destination "\Device\PSched"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0303#4&61f3b4b&0#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"
.\debug.cpp(400) : Destination "\Device\000000ae"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\UNC"
.\debug.cpp(400) : Destination "\Device\Mup"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPNAT"
.\debug.cpp(400) : Destination "\Device\IPNAT"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0501#4&61f3b4b&0#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\000000b6"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{91951DA7-042C-45D4-82B8-81731AA64914}"
.\debug.cpp(400) : Destination "\Device\{91951DA7-042C-45D4-82B8-81731AA64914}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM4"
.\debug.cpp(400) : Destination "\Device\Serial3"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD0"
.\debug.cpp(400) : Destination "\Device\USBFDO-0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000063"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tcp"
.\debug.cpp(400) : Destination "\Device\Tcp"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\I2OExec"
.\debug.cpp(400) : Destination "\Device\I2OExec"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0008#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\00000086"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM5"
.\debug.cpp(400) : Destination "\Device\Serial4"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgrMsg"
.\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgrMsg"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD1"
.\debug.cpp(400) : Destination "\Device\USBFDO-1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PTIMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\0000007c"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LCD"
.\debug.cpp(400) : Destination "\Device\VideoPdo0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0003#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\00000081"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{6B8FD18E-C1C9-498C-A157-FAF96467B23E}"
.\debug.cpp(400) : Destination "\Device\{6B8FD18E-C1C9-498C-A157-FAF96467B23E}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{82AA9738-D273-43DE-B489-92050CAD4E71}"
.\debug.cpp(400) : Destination "\Device\{82AA9738-D273-43DE-B489-92050CAD4E71}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM6"
.\debug.cpp(400) : Destination "\Device\Serial5"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive0"
.\debug.cpp(400) : Destination "\Device\Harddisk0\DR0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ConexantDiagnosticsServer"
.\debug.cpp(400) : Destination "\Device\ConexantDiagnosticsServer"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PRN"
.\debug.cpp(400) : Destination "\DosDevices\LPT1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD2"
.\debug.cpp(400) : Destination "\Device\USBFDO-2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0001#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000078"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{cf1dda2c-9743-11d0-a3ee-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM7"
.\debug.cpp(400) : Destination "\Device\Serial6"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\RKSAMPLE0"
.\debug.cpp(400) : Destination "\Device\RKSAMPLE0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\mfehidk"
.\debug.cpp(400) : Destination "\Device\mfehidk"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom0"
.\debug.cpp(400) : Destination "\Device\CdRom0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\sysaudio"
.\debug.cpp(400) : Destination "\Device\sysaudio"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\fsWrap"
.\debug.cpp(400) : Destination "\Device\FsWrap"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000077"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{4134FBD3-188F-4676-9789-0FEF254E060B}"
.\debug.cpp(400) : Destination "\Device\{4134FBD3-188F-4676-9789-0FEF254E060B}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0002#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000079"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD3"
.\debug.cpp(400) : Destination "\Device\USBFDO-3"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0010#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0007#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\00000085"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0004#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\00000082"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{CF2733C5-221E-4A71-880D-42EFD7EDF4F3}"
.\debug.cpp(400) : Destination "\Device\{CF2733C5-221E-4A71-880D-42EFD7EDF4F3}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM8"
.\debug.cpp(400) : Destination "\Device\Serial7"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{CA214D64-7557-4EB4-BFB0-8BAC6FE14C96}"
.\debug.cpp(400) : Destination "\Device\{CA214D64-7557-4EB4-BFB0-8BAC6FE14C96}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomSONY_DVD+-RW_DW-D56A____________________PDS3____#5&24e5db9f&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP1T0L0-e"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0000#{65e8773e-8f56-11d0-a3b9-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000063"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C6&SUBSYS_542214F1&REV_01#3&61aaa01&0&FE#{adb44c00-1b8d-11d4-8d5e-00a0c90d1c42}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0013"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM9"
.\debug.cpp(400) : Destination "\Device\Serial8"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0A#2#{72631e54-78a4-11d0-bcf7-00aa00b7b32a}"
.\debug.cpp(400) : Destination "\Device\00000095"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0001#{65e8773d-8f56-11d0-a3b9-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000064"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\S24TRANS_S24TRANS.SYS"
.\debug.cpp(400) : Destination "\Device\S24Trans.sys"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{5D960C69-5B6C-4715-B10A-2E908EC19059}"
.\debug.cpp(400) : Destination "\Device\{5D960C69-5B6C-4715-B10A-2E908EC19059}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0005#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\00000083"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0002#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\00000080"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Global"
.\debug.cpp(400) : Destination "\GLOBAL??"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Apfiltr"
.\debug.cpp(400) : Destination "\Device\Apfiltr"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C5&SUBSYS_01641028&REV_01#3&61aaa01&0&FD#{dda54a40-1e4c-11d1-a050-405705c10000}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0012"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MODEM#0001#{2c7089aa-2e0e-11d1-b114-00c04fc2aae4}"
.\debug.cpp(400) : Destination "\Device\00000070"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Pcmcia0"
.\debug.cpp(400) : Destination "\Device\Pcmcia0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50671-72c1-11d2-9755-0000f8004788}"
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LPTENUM#MicrosoftRawPort#5&2cc18575&0&LPT1#{811fc6a5-f728-11d0-a537-0000f8753ed1}"
.\debug.cpp(400) : Destination "\Device\Parallel0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{D95C55B4-C6BE-45CE-AD97-B7BA2EB40F52}"
.\debug.cpp(400) : Destination "\Device\{D95C55B4-C6BE-45CE-AD97-B7BA2EB40F52}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#ThermalZone#THM_#{4afa3d51-74a7-11d0-be5e-00a0c9062857}"
.\debug.cpp(400) : Destination "\Device\00000092"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(400) : Destination "\Device\{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad809c00-7b88-11d0-a5d6-28db04c10000}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{9ea331fa-b91b-45f8-9285-bd2bc77afcde}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\S24TRANS_S24TRANS_{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(400) : Destination "\Device\s24trans_{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#NET#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\0000007d"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HSF_MDMDevice0"
.\debug.cpp(400) : Destination "\Device\HSF_MDMDevice0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#DiskFUJITSU_MHT2040AH_______________________006C____#5&122c2afa&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP0T0L0-3"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ARP1394"
.\debug.cpp(400) : Destination "\Device\ARP1394"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{373DCE25-E364-4874-801D-4EDA708C3DB3}"
.\debug.cpp(400) : Destination "\Device\{373DCE25-E364-4874-801D-4EDA708C3DB3}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{07dad660-22f1-11d1-a9f4-00c04fbbde8f}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Bluetooth LAP Modem"
.\debug.cpp(400) : Destination "\Device\00000071"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\catchme"
.\debug.cpp(400) : Destination "\Device\catchme"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\VcommMgrDevice"
.\debug.cpp(400) : Destination "\Device\VcommMgrDevice"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0F13#4&61f3b4b&0#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"
.\debug.cpp(400) : Destination "\Device\000000ad"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000064"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0001#{65e8773e-8f56-11d0-a3b9-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000064"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24CD&SUBSYS_01641028&REV_01#3&61aaa01&0&EF#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0008"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&dc2e9ea&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
.\debug.cpp(400) : Destination "\Device\USBPDO-0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C2&SUBSYS_01641028&REV_01#3&61aaa01&0&E8#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0005"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_3582&SUBSYS_01641028&REV_02#3&61aaa01&0&11#{5b45201d-f2f2-4f3b-85bb-30ff1f953599}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0004"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0003#{119967a1-b1db-4d60-b518-1629d0bd3961}"
.\debug.cpp(400) : Destination "\Device\0000008e"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#GenuineIntel_-_x86_Family_6_Model_13#_0#{97fadb10-4e33-40ae-359c-8bef029dbdd0}"
.\debug.cpp(400) : Destination "\Device\00000091"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Bluetooth LAP Modem #2"
.\debug.cpp(400) : Destination "\Device\00000072"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MountPointManager"
.\debug.cpp(400) : Destination "\Device\MountPointManager"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MDC8021X_{3311C212-69D1-421C-BD7B-8C116B0E97E6}"
.\debug.cpp(400) : Destination "\Device\MDC8021X_{3311C212-69D1-421C-BD7B-8C116B0E97E6}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50674-72c1-11d2-9755-0000f8004788}"
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000063"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C7&SUBSYS_01641028&REV_01#3&61aaa01&0&EA#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0007"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0009#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\00000087"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000073"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0E#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"
.\debug.cpp(400) : Destination "\Device\00000098"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MDC8021X"
.\debug.cpp(400) : Destination "\Device\MDC8021X"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArp"
.\debug.cpp(400) : Destination "\Device\WANARP"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C4&SUBSYS_01641028&REV_01#3&61aaa01&0&E9#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0006"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#ftdisk#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\00000005"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0000#{dda54a40-1e4c-11d1-a050-405705c10000}"
.\debug.cpp(400) : Destination "\Device\00000063"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\s24trans_{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(400) : Destination "\Device\s24trans_{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0001#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\0000007f"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MODEM#0002#{2c7089aa-2e0e-11d1-b114-00c04fc2aae4}"
.\debug.cpp(400) : Destination "\Device\00000071"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&30a96598&0&SignatureCFCE28DFOffset3EC1000Length86C2F5C00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_1043&SUBSYS_25618086&REV_04#4&39a85202&0&18F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0016"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_3582&SUBSYS_01641028&REV_02#3&61aaa01&0&10#{5b45201d-f2f2-4f3b-85bb-30ff1f953599}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0003"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIP"
.\debug.cpp(400) : Destination "\Device\NdisWanIp"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_104C&DEV_8029&SUBSYS_01641028&REV_00#4&39a85202&0&09F0#{6bdd1fc1-810f-11d0-bec7-08002be2092f}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0015"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ElbyCDIO"
.\debug.cpp(400) : Destination "\Device\ElbyCDIO"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{bf963d80-c559-11d0-8a2b-00a0c9255ac1}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{fbf6f530-07b9-11d2-a71e-0000f8004788}"
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi0:"
.\debug.cpp(400) : Destination "\Device\Ide\IdePort0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C6&SUBSYS_542214F1&REV_01#3&61aaa01&0&FE#{2c7089aa-2e0e-11d1-b114-00c04fc2aae4}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0013"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomSONY_DVD+-RW_DW-D56A____________________PDS3____#5&24e5db9f&0&0.0.0#{1186654d-47b8-48b9-beb9-7df113ae3c67}"
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP1T0L0-e"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MDC8021X_{1DC9C34C-AD66-4E52-8A4D-774A7121F327}"
.\debug.cpp(400) : Destination "\Device\MDC8021X_{1DC9C34C-AD66-4E52-8A4D-774A7121F327}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{24034FCC-4D37-447E-9487-5E91539687D1}"
.\debug.cpp(400) : Destination "\Device\{24034FCC-4D37-447E-9487-5E91539687D1}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{3311C212-69D1-421C-BD7B-8C116B0E97E6}"
.\debug.cpp(400) : Destination "\Device\{3311C212-69D1-421C-BD7B-8C116B0E97E6}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\1394BUS0"
.\debug.cpp(400) : Destination "\Device\1394BUS0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000076"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK1"
.\debug.cpp(400) : Destination "\Device\ParTechInc0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{a7c7a5b1-5af3-11d1-9ced-00a024bf0407}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\S24Trans.sys"
.\debug.cpp(400) : Destination "\Device\S24Trans.sys"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi1:"
.\debug.cpp(400) : Destination "\Device\Ide\IdePort1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPMULTICAST"
.\debug.cpp(400) : Destination "\Device\IPMULTICAST"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LPT1"
.\debug.cpp(400) : Destination "\Device\Parallel0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NdisWan"
.\debug.cpp(400) : Destination "\Device\NdisWan"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK2"
.\debug.cpp(400) : Destination "\Device\ParTechInc1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Shadow"
.\debug.cpp(400) : Destination "\Device\LanmanRedirector"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK3"
.\debug.cpp(400) : Destination "\Device\ParTechInc2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{64385E22-2B1B-46C6-84DE-F54A0C4E908C}"
.\debug.cpp(400) : Destination "\Device\{64385E22-2B1B-46C6-84DE-F54A0C4E908C}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgr"
.\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgr"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FtControl"
.\debug.cpp(400) : Destination "\Device\FtControl"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\C:"
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C5&SUBSYS_01641028&REV_01#3&61aaa01&0&FD#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0012"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MAILSLOT"
.\debug.cpp(400) : Destination "\Device\MailSlot"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MDC8021X_{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(400) : Destination "\Device\MDC8021X_{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0001#{dda54a40-1e4c-11d1-a050-405705c10000}"
.\debug.cpp(400) : Destination "\Device\00000064"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\AUX"
.\debug.cpp(400) : Destination "\DosDevices\COM1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MFE_NDISKMP#0003#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\0000006d"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MFE_NDISKMP#0002#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\0000006c"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MFE_NDISKMP#0004#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\0000006e"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\GLOBALROOT"
.\debug.cpp(400) : Destination ""
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_MOU#0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"
.\debug.cpp(400) : Destination "\Device\0000008a"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ndisuio"
.\debug.cpp(400) : Destination "\Device\Ndisuio"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NUL"
.\debug.cpp(400) : Destination "\Device\Null"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_103D&SUBSYS_20021028&REV_81#4&39a85202&0&40F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0017"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&65658a9&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
.\debug.cpp(400) : Destination "\Device\USBPDO-1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C5&SUBSYS_01641028&REV_01#3&61aaa01&0&FD#{65e8773e-8f56-11d0-a3b9-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0012"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_KBD#0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"
.\debug.cpp(400) : Destination "\Device\00000089"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM10"
.\debug.cpp(400) : Destination "\Device\Serial9"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PROCEXP113"
.\debug.cpp(400) : Destination "\Device\PROCEXP113"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C5&SUBSYS_01641028&REV_01#3&61aaa01&0&FD#{65e8773d-8f56-11d0-a3b9-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0012"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0501#4&61f3b4b&0#{86e0d1e0-8089-11d0-9ce4-08003e301f73}"
.\debug.cpp(400) : Destination "\Device\000000b6"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM11"
.\debug.cpp(400) : Destination "\Device\Serial10"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Conexant D480 MDC V.9x Modem"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0013"
.\debug.cpp(409) : --
.\debug.cpp(453) : **********************************************

tom2011 · Mar 7, 2011

bootkit remover log part 2

.\boot_cleaner.cpp(565) : System volume is \\.\C:
.\boot_cleaner.cpp(600) : \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`03ec1000
.\boot_cleaner.cpp(276) : Boot sector MD5 is: 58ecce6ee11c762f12393e1a4f86f16a
.\boot_cleaner.cpp(1060) :
.\boot_cleaner.cpp(1061) : Size Device Name MBR Status
.\boot_cleaner.cpp(1062) : --------------------------------------------
.\boot_cleaner.cpp(1106) : 37 GB \\.\PhysicalDrive0 Unknown boot code
.\boot_cleaner.cpp(1112) :
.\boot_cleaner.cpp(1118) : Unknown boot code has been found on some of your physical disks.
.\boot_cleaner.cpp(1120) : To inspect the boot code manually, dump the master boot sector:
.\boot_cleaner.cpp(1121) : remover.exe dump <device_name> [output_file]
.\boot_cleaner.cpp(1125) : To disinfect the master boot sector, use the following command:
.\boot_cleaner.cpp(1126) : remover.exe fix <device_name>
.\boot_cleaner.cpp(1129) :
.\boot_cleaner.cpp(1151) : Done;

Bobbye · Mar 8, 2011

Open Notepad
Copy and paste the text in the codebox into Notepad:
Code:
@ECHO OFF
START 
remover.exe fix \\.\PhysicalDrive0

EXIT
Go FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES

Then in the FILE NAME box type fix.bat.

Save fix.bat to your Desktop.

Double click on fix.bat to run
(You may see a black box appear; this is normal.)

When done, run remover.exe again and post its output.
Do NOT reboot computer!

tom2011 · Mar 8, 2011

.\debug.cpp(238) : Debug log started at 08.03.2011 - 20:00:07
.\boot_cleaner.cpp(527) : Bootkit Remover
.\boot_cleaner.cpp(528) : (c) 2009 eSage Lab
.\boot_cleaner.cpp(529) : www.esagelab.com
.\boot_cleaner.cpp(533) : Program version: 1.2.0.0
.\boot_cleaner.cpp(540) : OS Version: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
.\debug.cpp(248) : **********************************************
.\debug.cpp(249) : *** [ LOADED MODULES INFORMATION ] ***********
.\debug.cpp(250) : **********************************************
.\debug.cpp(256) : 0x804d7000 0x00217f00 "\WINDOWS\system32\ntoskrnl.exe"
.\debug.cpp(256) : 0x806ef000 0x00013d00 "\WINDOWS\system32\hal.dll"
.\debug.cpp(256) : 0xf8af7000 0x00002000 "\WINDOWS\system32\KDCOM.DLL"
.\debug.cpp(256) : 0xf8a07000 0x00003000 "\WINDOWS\system32\BOOTVID.dll"
.\debug.cpp(256) : 0xf85a7000 0x0002f000 "ACPI.sys"
.\debug.cpp(256) : 0xf8af9000 0x00002000 "\WINDOWS\system32\DRIVERS\WMILIB.SYS"
.\debug.cpp(256) : 0xf8596000 0x00011000 "pci.sys"
.\debug.cpp(256) : 0xf85f7000 0x0000a000 "isapnp.sys"
.\debug.cpp(256) : 0xf8a0b000 0x00003000 "compbatt.sys"
.\debug.cpp(256) : 0xf8a0f000 0x00004000 "\WINDOWS\system32\DRIVERS\BATTC.SYS"
.\debug.cpp(256) : 0xf8bbf000 0x00001000 "pciide.sys"
.\debug.cpp(256) : 0xf8877000 0x00007000 "\WINDOWS\system32\DRIVERS\PCIIDEX.SYS"
.\debug.cpp(256) : 0xf8afb000 0x00002000 "aliide.sys"
.\debug.cpp(256) : 0xf8afd000 0x00002000 "intelide.sys"
.\debug.cpp(256) : 0xf8aff000 0x00002000 "toside.sys"
.\debug.cpp(256) : 0xf8b01000 0x00002000 "viaide.sys"
.\debug.cpp(256) : 0xf8b03000 0x00002000 "cmdide.sys"
.\debug.cpp(256) : 0xf8578000 0x0001e000 "pcmcia.sys"
.\debug.cpp(256) : 0xf8607000 0x0000b000 "MountMgr.sys"
.\debug.cpp(256) : 0xf8559000 0x0001f000 "ftdisk.sys"
.\debug.cpp(256) : 0xf887f000 0x00005000 "PartMgr.sys"
.\debug.cpp(256) : 0xf8617000 0x0000d000 "VolSnap.sys"
.\debug.cpp(256) : 0xf8a13000 0x00004000 "cpqarray.sys"
.\debug.cpp(256) : 0xf8541000 0x00018000 "\WINDOWS\system32\DRIVERS\SCSIPORT.SYS"
.\debug.cpp(256) : 0xf8529000 0x00018000 "atapi.sys"
.\debug.cpp(256) : 0xf8a17000 0x00004000 "aha154x.sys"
.\debug.cpp(256) : 0xf8887000 0x00005000 "sparrow.sys"
.\debug.cpp(256) : 0xf8a1b000 0x00004000 "symc810.sys"
.\debug.cpp(256) : 0xf8627000 0x0000e000 "aic78xx.sys"
.\debug.cpp(256) : 0xf8a1f000 0x00004000 "dac960nt.sys"
.\debug.cpp(256) : 0xf8637000 0x00009000 "ql10wnt.sys"
.\debug.cpp(256) : 0xf8a23000 0x00003000 "amsint.sys"
.\debug.cpp(256) : 0xf888f000 0x00007000 "asc.sys"
.\debug.cpp(256) : 0xf8a27000 0x00004000 "asc3550.sys"
.\debug.cpp(256) : 0xf8897000 0x00005000 "mraid35x.sys"
.\debug.cpp(256) : 0xf889f000 0x00005000 "i2omp.sys"
.\debug.cpp(256) : 0xf8a2b000 0x00004000 "ini910u.sys"
.\debug.cpp(256) : 0xf8647000 0x0000a000 "ql1240.sys"
.\debug.cpp(256) : 0xf8657000 0x0000e000 "aic78u2.sys"
.\debug.cpp(256) : 0xf88a7000 0x00008000 "symc8xx.sys"
.\debug.cpp(256) : 0xf88af000 0x00007000 "sym_hi.sys"
.\debug.cpp(256) : 0xf88b7000 0x00008000 "sym_u3.sys"
.\debug.cpp(256) : 0xf88bf000 0x00006000 "ABP480N5.SYS"
.\debug.cpp(256) : 0xf88c7000 0x00006000 "asc3350p.sys"
.\debug.cpp(256) : 0xf8b05000 0x00002000 "cd20xrnt.sys"
.\debug.cpp(256) : 0xf8667000 0x00009000 "ultra.sys"
.\debug.cpp(256) : 0xf8510000 0x00019000 "adpu160m.sys"
.\debug.cpp(256) : 0xf88cf000 0x00005000 "dpti2o.sys"
.\debug.cpp(256) : 0xf8677000 0x0000a000 "ql1080.sys"
.\debug.cpp(256) : 0xf8687000 0x0000c000 "ql1280.sys"
.\debug.cpp(256) : 0xf8697000 0x0000c000 "ql12160.sys"
.\debug.cpp(256) : 0xf88d7000 0x00007000 "perc2.sys"
.\debug.cpp(256) : 0xf8b07000 0x00002000 "perc2hib.sys"
.\debug.cpp(256) : 0xf88df000 0x00007000 "hpn.sys"
.\debug.cpp(256) : 0xf8a2f000 0x00004000 "cbidf2k.sys"
.\debug.cpp(256) : 0xf84e4000 0x0002c000 "dac2w2k.sys"
.\debug.cpp(256) : 0xf86a7000 0x00009000 "disk.sys"
.\debug.cpp(256) : 0xf86b7000 0x0000d000 "\WINDOWS\system32\DRIVERS\CLASSPNP.SYS"
.\debug.cpp(256) : 0xf84c4000 0x00020000 "fltmgr.sys"
.\debug.cpp(256) : 0xf84b2000 0x00012000 "sr.sys"
.\debug.cpp(256) : 0xf8455000 0x0005d000 "mfehidk.sys"
.\debug.cpp(256) : 0xf843e000 0x00017000 "KSecDD.sys"
.\debug.cpp(256) : 0xf83b1000 0x0008d000 "Ntfs.sys"
.\debug.cpp(256) : 0xf8384000 0x0002d000 "NDIS.sys"
.\debug.cpp(256) : 0xf86c7000 0x0000a000 "sisagp.sys"
.\debug.cpp(256) : 0xf86d7000 0x0000b000 "viaagp.sys"
.\debug.cpp(256) : 0xf86e7000 0x00010000 "ohci1394.sys"
.\debug.cpp(256) : 0xf86f7000 0x0000e000 "\WINDOWS\system32\DRIVERS\1394BUS.SYS"
.\debug.cpp(256) : 0xf836a000 0x0001a000 "Mup.sys"
.\debug.cpp(256) : 0xf88e7000 0x00007000 "BTHidMgr.sys"
.\debug.cpp(256) : 0xf8707000 0x0000b000 "agp440.sys"
.\debug.cpp(256) : 0xf8717000 0x0000b000 "alim1541.sys"
.\debug.cpp(256) : 0xf8727000 0x0000b000 "amdagp.sys"
.\debug.cpp(256) : 0xf8737000 0x0000b000 "agpCPQ.sys"
.\debug.cpp(256) : 0xf8807000 0x00010000 "\SystemRoot\system32\DRIVERS\nic1394.sys"
.\debug.cpp(256) : 0xf7cd4000 0x0000a000 "\SystemRoot\system32\DRIVERS\intelppm.sys"
.\debug.cpp(256) : 0xf8aef000 0x00004000 "\SystemRoot\system32\DRIVERS\CmBatt.sys"
.\debug.cpp(256) : 0xf7b93000 0x000b5000 "\SystemRoot\system32\DRIVERS\ialmnt5.sys"
.\debug.cpp(256) : 0xf7b7f000 0x00014000 "\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS"
.\debug.cpp(256) : 0xf89ef000 0x00006000 "\SystemRoot\system32\DRIVERS\usbuhci.sys"
.\debug.cpp(256) : 0xf7b5b000 0x00024000 "\SystemRoot\system32\DRIVERS\USBPORT.SYS"
.\debug.cpp(256) : 0xf89f7000 0x00008000 "\SystemRoot\system32\DRIVERS\usbehci.sys"
.\debug.cpp(256) : 0xf78fd000 0x0025e000 "\SystemRoot\system32\DRIVERS\w70n51.sys"
.\debug.cpp(256) : 0xf78d9000 0x00024000 "\SystemRoot\system32\DRIVERS\e100b325.sys"
.\debug.cpp(256) : 0xf7cb4000 0x0000e000 "\SystemRoot\system32\DRIVERS\i8042prt.sys"
.\debug.cpp(256) : 0xf78c0000 0x00019000 "\SystemRoot\system32\DRIVERS\Apfiltr.sys"
.\debug.cpp(256) : 0xf89ff000 0x00006000 "\SystemRoot\system32\DRIVERS\mouclass.sys"
.\debug.cpp(256) : 0xf88ff000 0x00007000 "\SystemRoot\system32\DRIVERS\kbdclass.sys"
.\debug.cpp(256) : 0xf78af000 0x00011000 "\SystemRoot\system32\DRIVERS\serial.sys"
.\debug.cpp(256) : 0xf82a2000 0x00004000 "\SystemRoot\system32\DRIVERS\serenum.sys"
.\debug.cpp(256) : 0xf789b000 0x00014000 "\SystemRoot\system32\DRIVERS\parport.sys"
.\debug.cpp(256) : 0xf7ca4000 0x0000b000 "\SystemRoot\system32\DRIVERS\imapi.sys"
.\debug.cpp(256) : 0xf8bde000 0x00001000 "\SystemRoot\System32\Drivers\ElbyDelay.sys"
.\debug.cpp(256) : 0xf8907000 0x00006000 "\SystemRoot\System32\Drivers\AnyDVD.sys"
.\debug.cpp(256) : 0xf7c94000 0x00010000 "\SystemRoot\system32\DRIVERS\cdrom.sys"
.\debug.cpp(256) : 0xf7c84000 0x0000f000 "\SystemRoot\system32\DRIVERS\redbook.sys"
.\debug.cpp(256) : 0xf7878000 0x00023000 "\SystemRoot\system32\DRIVERS\ks.sys"
.\debug.cpp(256) : 0xf7839000 0x0003f000 "\SystemRoot\system32\drivers\stac97.sys"
.\debug.cpp(256) : 0xf7815000 0x00024000 "\SystemRoot\system32\drivers\portcls.sys"
.\debug.cpp(256) : 0xf7c74000 0x0000f000 "\SystemRoot\system32\drivers\drmk.sys"
.\debug.cpp(256) : 0xf77e4000 0x00031000 "\SystemRoot\system32\DRIVERS\HSFHWICH.sys"
.\debug.cpp(256) : 0xf76e5000 0x000ff000 "\SystemRoot\system32\DRIVERS\HSF_DP.sys"
.\debug.cpp(256) : 0xf763f000 0x000a6000 "\SystemRoot\system32\DRIVERS\HSF_CNXT.sys"
.\debug.cpp(256) : 0xf890f000 0x00008000 "\SystemRoot\System32\Drivers\Modem.SYS"
.\debug.cpp(256) : 0xf8767000 0x0000a000 "\SystemRoot\System32\Drivers\VcommMgr.sys"
.\debug.cpp(256) : 0xf829a000 0x00003000 "\SystemRoot\system32\DRIVERS\vbtenum.sys"
.\debug.cpp(256) : 0xf8917000 0x00005000 "\SystemRoot\system32\DRIVERS\blueletaudio.sys"
.\debug.cpp(256) : 0xf891f000 0x00005000 "\SystemRoot\system32\DRIVERS\BlueletSCOAudio.sys"
.\debug.cpp(256) : 0xf8bdf000 0x00001000 "\SystemRoot\system32\DRIVERS\audstub.sys"
.\debug.cpp(256) : 0xf762b000 0x00014000 "\SystemRoot\system32\DRIVERS\mfendisk.sys"
.\debug.cpp(256) : 0xf8b1f000 0x00002000 "\SystemRoot\System32\Drivers\RootMdm.sys"
.\debug.cpp(256) : 0xf8777000 0x0000d000 "\SystemRoot\system32\DRIVERS\rasl2tp.sys"
.\debug.cpp(256) : 0xf8292000 0x00003000 "\SystemRoot\system32\DRIVERS\ndistapi.sys"
.\debug.cpp(256) : 0xf75ec000 0x00017000 "\SystemRoot\system32\DRIVERS\ndiswan.sys"
.\debug.cpp(256) : 0xf8787000 0x0000b000 "\SystemRoot\system32\DRIVERS\raspppoe.sys"
.\debug.cpp(256) : 0xf8797000 0x0000c000 "\SystemRoot\system32\DRIVERS\raspptp.sys"
.\debug.cpp(256) : 0xf8927000 0x00005000 "\SystemRoot\system32\DRIVERS\TDI.SYS"
.\debug.cpp(256) : 0xf75db000 0x00011000 "\SystemRoot\system32\DRIVERS\psched.sys"
.\debug.cpp(256) : 0xf87a7000 0x00009000 "\SystemRoot\system32\DRIVERS\msgpc.sys"
.\debug.cpp(256) : 0xf75b7000 0x00024000 "\SystemRoot\system32\drivers\mfeavfk.sys"
.\debug.cpp(256) : 0xf756c000 0x0004b000 "\SystemRoot\system32\drivers\mfefirek.sys"
.\debug.cpp(256) : 0xf8937000 0x00005000 "\SystemRoot\system32\DRIVERS\ptilink.sys"
.\debug.cpp(256) : 0xf8987000 0x00005000 "\SystemRoot\system32\DRIVERS\raspti.sys"
.\debug.cpp(256) : 0xf8249000 0x00003000 "\SystemRoot\system32\DRIVERS\btnetdrv.sys"
.\debug.cpp(256) : 0xf893f000 0x00008000 "\SystemRoot\system32\DRIVERS\VComm.sys"
.\debug.cpp(256) : 0xf87c7000 0x0000a000 "\SystemRoot\system32\DRIVERS\termdd.sys"
.\debug.cpp(256) : 0xf8b2b000 0x00002000 "\SystemRoot\system32\DRIVERS\swenum.sys"
.\debug.cpp(256) : 0xf74e6000 0x0005e000 "\SystemRoot\system32\DRIVERS\update.sys"
.\debug.cpp(256) : 0xf8ab7000 0x00004000 "\SystemRoot\system32\DRIVERS\mssmbios.sys"
.\debug.cpp(256) : 0xf8947000 0x00005000 "\SystemRoot\system32\DRIVERS\omci.sys"
.\debug.cpp(256) : 0xf8817000 0x0000a000 "\SystemRoot\System32\Drivers\NDProxy.SYS"
.\debug.cpp(256) : 0xf8837000 0x0000f000 "\SystemRoot\system32\DRIVERS\usbhub.sys"
.\debug.cpp(256) : 0xf8b3d000 0x00002000 "\SystemRoot\system32\DRIVERS\USBD.SYS"
.\debug.cpp(256) : 0xf8261000 0x00003000 "\SystemRoot\System32\Drivers\i2omgmt.SYS"
.\debug.cpp(256) : 0xf8b43000 0x00002000 "\SystemRoot\System32\Drivers\Fs_Rec.SYS"
.\debug.cpp(256) : 0xf8cfb000 0x00001000 "\SystemRoot\System32\Drivers\Null.SYS"
.\debug.cpp(256) : 0xf8b45000 0x00002000 "\SystemRoot\System32\Drivers\Beep.SYS"
.\debug.cpp(256) : 0xf896f000 0x00006000 "\SystemRoot\System32\drivers\vga.sys"
.\debug.cpp(256) : 0xf8b47000 0x00002000 "\SystemRoot\System32\Drivers\mnmdd.SYS"
.\debug.cpp(256) : 0xf8b49000 0x00002000 "\SystemRoot\System32\DRIVERS\RDPCDD.sys"
.\debug.cpp(256) : 0xf8977000 0x00005000 "\SystemRoot\System32\Drivers\Msfs.SYS"
.\debug.cpp(256) : 0xf897f000 0x00008000 "\SystemRoot\System32\Drivers\Npfs.SYS"
.\debug.cpp(256) : 0xf825d000 0x00003000 "\SystemRoot\system32\DRIVERS\rasacd.sys"
.\debug.cpp(256) : 0xef393000 0x00013000 "\SystemRoot\system32\DRIVERS\ipsec.sys"
.\debug.cpp(256) : 0xef33a000 0x00059000 "\SystemRoot\system32\DRIVERS\tcpip.sys"
.\debug.cpp(256) : 0xef327000 0x00013000 "\SystemRoot\system32\drivers\mfetdi2k.sys"
.\debug.cpp(256) : 0xef301000 0x00026000 "\SystemRoot\system32\DRIVERS\ipnat.sys"
.\debug.cpp(256) : 0xef2d9000 0x00028000 "\SystemRoot\system32\DRIVERS\netbt.sys"
.\debug.cpp(256) : 0xef2b7000 0x00022000 "\SystemRoot\System32\drivers\afd.sys"
.\debug.cpp(256) : 0xf8867000 0x00009000 "\SystemRoot\system32\DRIVERS\netbios.sys"
.\debug.cpp(256) : 0xef28c000 0x0002b000 "\SystemRoot\system32\DRIVERS\rdbss.sys"
.\debug.cpp(256) : 0xef1f4000 0x00070000 "\SystemRoot\system32\DRIVERS\mrxsmb.sys"
.\debug.cpp(256) : 0xf834a000 0x0000b000 "\SystemRoot\System32\Drivers\Fips.SYS"
.\debug.cpp(256) : 0xf833a000 0x00009000 "\SystemRoot\system32\DRIVERS\wanarp.sys"
.\debug.cpp(256) : 0xf832a000 0x0000f000 "\SystemRoot\system32\DRIVERS\arp1394.sys"
.\debug.cpp(256) : 0xf82ca000 0x00010000 "\SystemRoot\System32\Drivers\Cdfs.SYS"
.\debug.cpp(256) : 0xef13c000 0x00018000 "\SystemRoot\System32\Drivers\dump_atapi.sys"
.\debug.cpp(256) : 0xf8bab000 0x00002000 "\SystemRoot\System32\Drivers\dump_WMILIB.SYS"
.\debug.cpp(256) : 0xbf800000 0x001c5000 "\SystemRoot\System32\win32k.sys"
.\debug.cpp(256) : 0xf8ac7000 0x00003000 "\SystemRoot\System32\drivers\Dxapi.sys"
.\debug.cpp(256) : 0xf74ce000 0x00005000 "\SystemRoot\System32\watchdog.sys"
.\debug.cpp(256) : 0xbf000000 0x00012000 "\SystemRoot\System32\drivers\dxg.sys"
.\debug.cpp(256) : 0xf8cfa000 0x00001000 "\SystemRoot\System32\drivers\dxgthk.sys"
.\debug.cpp(256) : 0xbf020000 0x0001e000 "\SystemRoot\System32\ialmdnt5.dll"
.\debug.cpp(256) : 0xbf012000 0x0000e000 "\SystemRoot\System32\ialmrnt5.dll"
.\debug.cpp(256) : 0xbf03e000 0x00026000 "\SystemRoot\System32\ialmdev5.DLL"
.\debug.cpp(256) : 0xbf064000 0x000c1000 "\SystemRoot\System32\ialmdd5.DLL"
.\debug.cpp(256) : 0xbf125000 0x00047000 "\SystemRoot\System32\ATMFD.DLL"
.\debug.cpp(256) : 0xef064000 0x00004000 "\SystemRoot\system32\DRIVERS\mdc8021x.sys"
.\debug.cpp(256) : 0xef060000 0x00003000 "\SystemRoot\system32\DRIVERS\s24trans.sys"
.\debug.cpp(256) : 0xef050000 0x00004000 "\SystemRoot\system32\DRIVERS\ndisuio.sys"
.\debug.cpp(256) : 0xeecc7000 0x00015000 "\SystemRoot\system32\drivers\wdmaud.sys"
.\debug.cpp(256) : 0xeee74000 0x0000f000 "\SystemRoot\system32\drivers\sysaudio.sys"
.\debug.cpp(256) : 0xeeab4000 0x0002d000 "\SystemRoot\system32\DRIVERS\mrxdav.sys"
.\debug.cpp(256) : 0xeedb0000 0x00003000 "\SystemRoot\System32\Drivers\ElbyCDIO.sys"
.\debug.cpp(256) : 0xee944000 0x00058000 "\SystemRoot\system32\DRIVERS\srv.sys"
.\debug.cpp(256) : 0xeea70000 0x00003000 "\SystemRoot\system32\DRIVERS\mdmxsdk.sys"
.\debug.cpp(256) : 0xeec04000 0x0000c000 "\SystemRoot\system32\drivers\cfwids.sys"
.\debug.cpp(256) : 0xee2a2000 0x00016000 "\SystemRoot\system32\drivers\mfeapfk.sys"
.\debug.cpp(256) : 0xee448000 0x0000b000 "\SystemRoot\system32\drivers\mfebopk.sys"
.\debug.cpp(256) : 0xed476000 0x0002b000 "\SystemRoot\system32\drivers\kmixer.sys"
.\debug.cpp(256) : 0x7c910000 0x000b8000 "\WINDOWS\SYSTEM32\ntdll.dll"
.\debug.cpp(263) : **********************************************
.\debug.cpp(307) : *** [ DEVICE OBJECTS INFORMATION ] ***********
.\debug.cpp(308) : **********************************************
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\D:"
.\debug.cpp(400) : Destination "\Device\CdRom0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM12"
.\debug.cpp(400) : Destination "\Device\Serial11"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY1"
.\debug.cpp(400) : Destination "\Device\Video0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDIS"
.\debug.cpp(400) : Destination "\Device\Ndis"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0C#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"
.\debug.cpp(400) : Destination "\Device\00000094"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Bluetooth DUN Modem"
.\debug.cpp(400) : Destination "\Device\0000006d"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM13"
.\debug.cpp(400) : Destination "\Device\Serial12"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPPOEMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000072"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{71985f4a-1ca1-11d3-9cc8-00c04f7971e0}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY2"
.\debug.cpp(400) : Destination "\Device\Video1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB20#4&289241da&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
.\debug.cpp(400) : Destination "\Device\USBPDO-3"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ffbb6e3f-ccfe-4d84-90d9-421418b03a8e}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM14"
.\debug.cpp(400) : Destination "\Device\Serial13"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MODEM#0003#{2c7089aa-2e0e-11d1-b114-00c04fc2aae4}"
.\debug.cpp(400) : Destination "\Device\0000006f"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY3"
.\debug.cpp(400) : Destination "\Device\Video2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomSONY_DVD+-RW_DW-D56A____________________PDS3____#5&24e5db9f&0&0.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP1T0L0-e"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ip"
.\debug.cpp(400) : Destination "\Device\Ip"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{db166191-541f-11d9-b7e0-806d6172696f}"
.\debug.cpp(400) : Destination "\Device\CdRom0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0D#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"
.\debug.cpp(400) : Destination "\Device\00000093"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_NDISWANIP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000071"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0003#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000077"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY4"
.\debug.cpp(400) : Destination "\Device\Video3"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPSECDev"
.\debug.cpp(400) : Destination "\Device\IPSEC"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{9aa4a2cc-81e0-4cfd-802f-0f74526d2bd3}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MFE_NDISKMP#0001#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000068"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\DISPLAY5"
.\debug.cpp(400) : Destination "\Device\Video4"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#HIDCLASS#0000#{57574d37-c5e9-412d-a115-fa6d779eff08}"
.\debug.cpp(400) : Destination "\Device\00000006"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WGUARDNT"
.\debug.cpp(400) : Destination "\Device\mfehidk"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MODEM#0000#{2c7089aa-2e0e-11d1-b114-00c04fc2aae4}"
.\debug.cpp(400) : Destination "\Device\0000006c"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{fd0a5af4-b41d-11d2-9c95-00c04f7971e0}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3c0d501a-140b-11d1-b40f-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\OMCI"
.\debug.cpp(400) : Destination "\Device\OMCI"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\CompositeBattery"
.\debug.cpp(400) : Destination "\Device\CompositeBattery"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0000#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\0000007b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{1DC9C34C-AD66-4E52-8A4D-774A7121F327}"
.\debug.cpp(400) : Destination "\Device\{1DC9C34C-AD66-4E52-8A4D-774A7121F327}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\BTHidMgr"
.\debug.cpp(400) : Destination "\Device\BTHidMgr"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0A#1#{72631e54-78a4-11d0-bcf7-00aa00b7b32a}"
.\debug.cpp(400) : Destination "\Device\00000091"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Bluetooth Fax Modem"
.\debug.cpp(400) : Destination "\Device\0000006c"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0401#4&61f3b4b&0#{97f76ef0-f883-11d0-af1f-0000f800845c}"
.\debug.cpp(400) : Destination "\Device\000000b4"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM1"
.\debug.cpp(400) : Destination "\Device\Serial0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WMIDataDevice"
.\debug.cpp(400) : Destination "\Device\WMIDataDevice"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{E70F8588-3826-4BF5-9114-E10DB7522ACD}"
.\debug.cpp(400) : Destination "\Device\{E70F8588-3826-4BF5-9114-E10DB7522ACD}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{dff220f3-f70f-11d0-b917-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\BTMgr"
.\debug.cpp(400) : Destination "\Device\BTMgr"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PIPE"
.\debug.cpp(400) : Destination "\Device\NamedPipe"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM3"
.\debug.cpp(400) : Destination "\Device\Winachsf0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0006#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\00000081"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&308544ff&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
.\debug.cpp(400) : Destination "\Device\USBPDO-2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{F343BC38-83C1-4EF2-A76B-64805378C702}"
.\debug.cpp(400) : Destination "\Device\{F343BC38-83C1-4EF2-A76B-64805378C702}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{2eb07ea0-7e70-11d0-a5d6-28db04c10000}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c5066e-72c1-11d2-9755-0000f8004788}"
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM4"
.\debug.cpp(400) : Destination "\Device\Serial3"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{91951DA7-042C-45D4-82B8-81731AA64914}"
.\debug.cpp(400) : Destination "\Device\{91951DA7-042C-45D4-82B8-81731AA64914}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{0a4252a0-7e70-11d0-a5d6-28db04c10000}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0501#4&61f3b4b&0#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\000000b3"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPNAT"
.\debug.cpp(400) : Destination "\Device\IPNAT"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\UNC"
.\debug.cpp(400) : Destination "\Device\Mup"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0303#4&61f3b4b&0#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"
.\debug.cpp(400) : Destination "\Device\000000ab"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PSched"
.\debug.cpp(400) : Destination "\Device\PSched"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Volume{db166190-541f-11d9-b7e0-806d6172696f}"
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgrMsg"
.\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgrMsg"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM5"
.\debug.cpp(400) : Destination "\Device\Serial4"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0008#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\00000083"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\I2OExec"
.\debug.cpp(400) : Destination "\Device\I2OExec"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Tcp"
.\debug.cpp(400) : Destination "\Device\Tcp"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD0"
.\debug.cpp(400) : Destination "\Device\USBFDO-0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0000#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000060"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM6"
.\debug.cpp(400) : Destination "\Device\Serial5"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{82AA9738-D273-43DE-B489-92050CAD4E71}"
.\debug.cpp(400) : Destination "\Device\{82AA9738-D273-43DE-B489-92050CAD4E71}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{6B8FD18E-C1C9-498C-A157-FAF96467B23E}"
.\debug.cpp(400) : Destination "\Device\{6B8FD18E-C1C9-498C-A157-FAF96467B23E}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0003#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\0000007e"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LCD"
.\debug.cpp(400) : Destination "\Device\VideoPdo0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PTIMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000079"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD1"
.\debug.cpp(400) : Destination "\Device\USBFDO-1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PhysicalDrive0"
.\debug.cpp(400) : Destination "\Device\Harddisk0\DR0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\RKSAMPLE0"
.\debug.cpp(400) : Destination "\Device\RKSAMPLE0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM7"
.\debug.cpp(400) : Destination "\Device\Serial6"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{53172480-4791-11d0-a5d6-28db04c10000}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{cf1dda2c-9743-11d0-a3ee-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0001#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000075"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD2"
.\debug.cpp(400) : Destination "\Device\USBFDO-2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PRN"
.\debug.cpp(400) : Destination "\DosDevices\LPT1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ConexantDiagnosticsServer"
.\debug.cpp(400) : Destination "\Device\ConexantDiagnosticsServer"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{CA214D64-7557-4EB4-BFB0-8BAC6FE14C96}"
.\debug.cpp(400) : Destination "\Device\{CA214D64-7557-4EB4-BFB0-8BAC6FE14C96}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM8"
.\debug.cpp(400) : Destination "\Device\Serial7"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{CF2733C5-221E-4A71-880D-42EFD7EDF4F3}"
.\debug.cpp(400) : Destination "\Device\{CF2733C5-221E-4A71-880D-42EFD7EDF4F3}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0004#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\0000007f"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0007#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\00000082"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0010#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\00000085"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{97ebaacb-95bd-11d0-a3ea-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HCD3"
.\debug.cpp(400) : Destination "\Device\USBFDO-3"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0002#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000076"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{4134FBD3-188F-4676-9789-0FEF254E060B}"
.\debug.cpp(400) : Destination "\Device\{4134FBD3-188F-4676-9789-0FEF254E060B}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PSCHEDMP#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000074"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\fsWrap"
.\debug.cpp(400) : Destination "\Device\FsWrap"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\sysaudio"
.\debug.cpp(400) : Destination "\Device\sysaudio"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\mfehidk"
.\debug.cpp(400) : Destination "\Device\mfehidk"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\CdRom0"
.\debug.cpp(400) : Destination "\Device\CdRom0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM9"
.\debug.cpp(400) : Destination "\Device\Serial8"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C6&SUBSYS_542214F1&REV_01#3&61aaa01&0&FE#{adb44c00-1b8d-11d4-8d5e-00a0c90d1c42}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0013"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0000#{65e8773e-8f56-11d0-a3b9-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000060"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomSONY_DVD+-RW_DW-D56A____________________PDS3____#5&24e5db9f&0&0.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP1T0L0-e"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Global"
.\debug.cpp(400) : Destination "\GLOBAL??"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0002#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\0000007d"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0005#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\00000080"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{5D960C69-5B6C-4715-B10A-2E908EC19059}"
.\debug.cpp(400) : Destination "\Device\{5D960C69-5B6C-4715-B10A-2E908EC19059}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\S24TRANS_S24TRANS.SYS"
.\debug.cpp(400) : Destination "\Device\S24Trans.sys"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0001#{65e8773d-8f56-11d0-a3b9-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000061"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0A#2#{72631e54-78a4-11d0-bcf7-00aa00b7b32a}"
.\debug.cpp(400) : Destination "\Device\00000092"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Apfiltr"
.\debug.cpp(400) : Destination "\Device\Apfiltr"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Pcmcia0"
.\debug.cpp(400) : Destination "\Device\Pcmcia0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MODEM#0001#{2c7089aa-2e0e-11d1-b114-00c04fc2aae4}"
.\debug.cpp(400) : Destination "\Device\0000006d"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C5&SUBSYS_01641028&REV_01#3&61aaa01&0&FD#{dda54a40-1e4c-11d1-a050-405705c10000}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0012"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#ThermalZone#THM_#{4afa3d51-74a7-11d0-be5e-00a0c9062857}"
.\debug.cpp(400) : Destination "\Device\0000008f"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{D95C55B4-C6BE-45CE-AD97-B7BA2EB40F52}"
.\debug.cpp(400) : Destination "\Device\{D95C55B4-C6BE-45CE-AD97-B7BA2EB40F52}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LPTENUM#MicrosoftRawPort#5&2cc18575&0&LPT1#{811fc6a5-f728-11d0-a537-0000f8753ed1}"
.\debug.cpp(400) : Destination "\Device\Parallel0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50671-72c1-11d2-9755-0000f8004788}"
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\HSF_MDMDevice0"
.\debug.cpp(400) : Destination "\Device\HSF_MDMDevice0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#NET#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\0000007a"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\S24TRANS_S24TRANS_{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(400) : Destination "\Device\s24trans_{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{9ea331fa-b91b-45f8-9285-bd2bc77afcde}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad809c00-7b88-11d0-a5d6-28db04c10000}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(400) : Destination "\Device\{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Bluetooth LAP Modem"
.\debug.cpp(400) : Destination "\Device\0000006e"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{07dad660-22f1-11d1-a9f4-00c04fbbde8f}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{373DCE25-E364-4874-801D-4EDA708C3DB3}"
.\debug.cpp(400) : Destination "\Device\{373DCE25-E364-4874-801D-4EDA708C3DB3}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ARP1394"
.\debug.cpp(400) : Destination "\Device\ARP1394"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#DiskFUJITSU_MHT2040AH_______________________006C____#5&122c2afa&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP0T0L0-3"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C2&SUBSYS_01641028&REV_01#3&61aaa01&0&E8#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0005"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&dc2e9ea&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
.\debug.cpp(400) : Destination "\Device\USBPDO-0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24CD&SUBSYS_01641028&REV_01#3&61aaa01&0&EF#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0008"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0001#{65e8773e-8f56-11d0-a3b9-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000061"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0001#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000061"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0F13#4&61f3b4b&0#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"
.\debug.cpp(400) : Destination "\Device\000000aa"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\VcommMgrDevice"
.\debug.cpp(400) : Destination "\Device\VcommMgrDevice"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Bluetooth LAP Modem #2"
.\debug.cpp(400) : Destination "\Device\0000006f"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#GenuineIntel_-_x86_Family_6_Model_13#_0#{97fadb10-4e33-40ae-359c-8bef029dbdd0}"
.\debug.cpp(400) : Destination "\Device\0000008e"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0003#{119967a1-b1db-4d60-b518-1629d0bd3961}"
.\debug.cpp(400) : Destination "\Device\0000008b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_3582&SUBSYS_01641028&REV_02#3&61aaa01&0&11#{5b45201d-f2f2-4f3b-85bb-30ff1f953599}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0004"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0C0E#2&daba3ff&0#{4afa3d53-74a7-11d0-be5e-00a0c9062857}"
.\debug.cpp(400) : Destination "\Device\00000095"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_L2TPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000070"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0009#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\00000084"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C7&SUBSYS_01641028&REV_01#3&61aaa01&0&EA#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0007"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0000#{65e8773d-8f56-11d0-a3b9-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\00000060"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{d6c50674-72c1-11d2-9755-0000f8004788}"
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MDC8021X_{3311C212-69D1-421C-BD7B-8C116B0E97E6}"
.\debug.cpp(400) : Destination "\Device\MDC8021X_{3311C212-69D1-421C-BD7B-8C116B0E97E6}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MountPointManager"
.\debug.cpp(400) : Destination "\Device\MountPointManager"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#ftdisk#0000#{53f5630e-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\00000005"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C4&SUBSYS_01641028&REV_01#3&61aaa01&0&E9#{3abf6f2d-71c4-462a-8a92-1e6861e6af27}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0006"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\WanArp"
.\debug.cpp(400) : Destination "\Device\WANARP"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MDC8021X"
.\debug.cpp(400) : Destination "\Device\MDC8021X"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MODEM#0002#{2c7089aa-2e0e-11d1-b114-00c04fc2aae4}"
.\debug.cpp(400) : Destination "\Device\0000006e"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#PORTS#0001#{4d36e978-e325-11ce-bfc1-08002be10318}"
.\debug.cpp(400) : Destination "\Device\0000007c"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\s24trans_{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(400) : Destination "\Device\s24trans_{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0000#{dda54a40-1e4c-11d1-a050-405705c10000}"
.\debug.cpp(400) : Destination "\Device\00000060"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_104C&DEV_8029&SUBSYS_01641028&REV_00#4&39a85202&0&09F0#{6bdd1fc1-810f-11d0-bec7-08002be2092f}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0015"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NDISWANIP"
.\debug.cpp(400) : Destination "\Device\NdisWanIp"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_3582&SUBSYS_01641028&REV_02#3&61aaa01&0&10#{5b45201d-f2f2-4f3b-85bb-30ff1f953599}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0003"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_1043&SUBSYS_25618086&REV_04#4&39a85202&0&18F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0016"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\STORAGE#Volume#1&30a96598&0&SignatureCFCE28DFOffset3EC1000Length86C2F5C00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C6&SUBSYS_542214F1&REV_01#3&61aaa01&0&FE#{2c7089aa-2e0e-11d1-b114-00c04fc2aae4}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0013"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi0:"
.\debug.cpp(400) : Destination "\Device\Ide\IdePort0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\SW#{a7c7a5b0-5af3-11d1-9ced-00a024bf0407}#{9B365890-165F-11D0-A195-0020AFD156E4}#{fbf6f530-07b9-11d2-a71e-0000f8004788}"
.\debug.cpp(400) : Destination "\Device\KSENUM#00000002"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{bf963d80-c559-11d0-8a2b-00a0c9255ac1}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ElbyCDIO"
.\debug.cpp(400) : Destination "\Device\ElbyCDIO"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\1394BUS0"
.\debug.cpp(400) : Destination "\Device\1394BUS0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{3311C212-69D1-421C-BD7B-8C116B0E97E6}"
.\debug.cpp(400) : Destination "\Device\{3311C212-69D1-421C-BD7B-8C116B0E97E6}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{24034FCC-4D37-447E-9487-5E91539687D1}"
.\debug.cpp(400) : Destination "\Device\{24034FCC-4D37-447E-9487-5E91539687D1}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MDC8021X_{1DC9C34C-AD66-4E52-8A4D-774A7121F327}"
.\debug.cpp(400) : Destination "\Device\MDC8021X_{1DC9C34C-AD66-4E52-8A4D-774A7121F327}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IDE#CdRomSONY_DVD+-RW_DW-D56A____________________PDS3____#5&24e5db9f&0&0.0.0#{1186654d-47b8-48b9-beb9-7df113ae3c67}"
.\debug.cpp(400) : Destination "\Device\Ide\IdeDeviceP1T0L0-e"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK1"
.\debug.cpp(400) : Destination "\Device\ParTechInc0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MS_PPTPMINIPORT#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000073"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{4747b320-62ce-11cf-a5d6-28db04c10000}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#SYSTEM#0000#{a7c7a5b1-5af3-11d1-9ced-00a024bf0407}"
.\debug.cpp(400) : Destination "\Device\00000088"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK2"
.\debug.cpp(400) : Destination "\Device\ParTechInc1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NdisWan"
.\debug.cpp(400) : Destination "\Device\NdisWan"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\LPT1"
.\debug.cpp(400) : Destination "\Device\Parallel0"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\IPMULTICAST"
.\debug.cpp(400) : Destination "\Device\IPMULTICAST"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Scsi1:"
.\debug.cpp(400) : Destination "\Device\Ide\IdePort1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\S24Trans.sys"
.\debug.cpp(400) : Destination "\Device\S24Trans.sys"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Shadow"
.\debug.cpp(400) : Destination "\Device\LanmanRedirector"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PTILINK3"
.\debug.cpp(400) : Destination "\Device\ParTechInc2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FtControl"
.\debug.cpp(400) : Destination "\Device\FtControl"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\FltMgr"
.\debug.cpp(400) : Destination "\FileSystem\Filters\FltMgr"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\{64385E22-2B1B-46C6-84DE-F54A0C4E908C}"
.\debug.cpp(400) : Destination "\Device\{64385E22-2B1B-46C6-84DE-F54A0C4E908C}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\C:"
.\debug.cpp(400) : Destination "\Device\HarddiskVolume2"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C5&SUBSYS_01641028&REV_01#3&61aaa01&0&FD#{6994ad04-93ef-11d0-a3cc-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0012"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MFE_NDISKMP#0004#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\0000006b"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MFE_NDISKMP#0002#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\00000069"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MFE_NDISKMP#0003#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\0000006a"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\AUX"
.\debug.cpp(400) : Destination "\DosDevices\COM1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#MEDIA#0001#{dda54a40-1e4c-11d1-a050-405705c10000}"
.\debug.cpp(400) : Destination "\Device\00000061"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MDC8021X_{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(400) : Destination "\Device\MDC8021X_{35BC0792-43F9-4543-B972-0495BAC15E77}"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\MAILSLOT"
.\debug.cpp(400) : Destination "\Device\MailSlot"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\USB#ROOT_HUB#4&65658a9&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}"
.\debug.cpp(400) : Destination "\Device\USBPDO-1"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\NUL"
.\debug.cpp(400) : Destination "\Device\Null"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Ndisuio"
.\debug.cpp(400) : Destination "\Device\Ndisuio"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\GLOBALROOT"
.\debug.cpp(400) : Destination ""
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_MOU#0000#{378de44c-56ef-11d1-bc8c-00a0c91405dd}"
.\debug.cpp(400) : Destination "\Device\00000087"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_103D&SUBSYS_20021028&REV_81#4&39a85202&0&40F0#{ad498944-762f-11d0-8dcb-00c04fc3358c}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0017"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM10"
.\debug.cpp(400) : Destination "\Device\Serial9"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Root#RDP_KBD#0000#{884b96c3-56ef-11d1-bc8c-00a0c91405dd}"
.\debug.cpp(400) : Destination "\Device\00000086"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C5&SUBSYS_01641028&REV_01#3&61aaa01&0&FD#{65e8773e-8f56-11d0-a3b9-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0012"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\Conexant D480 MDC V.9x Modem"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0013"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\COM11"
.\debug.cpp(400) : Destination "\Device\Serial10"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\ACPI#PNP0501#4&61f3b4b&0#{86e0d1e0-8089-11d0-9ce4-08003e301f73}"
.\debug.cpp(400) : Destination "\Device\000000b3"
.\debug.cpp(409) : --
.\debug.cpp(369) : SymbolicLink "\GLOBAL??\PCI#VEN_8086&DEV_24C5&SUBSYS_01641028&REV_01#3&61aaa01&0&FD#{65e8773d-8f56-11d0-a3b9-00a0c9223196}"
.\debug.cpp(400) : Destination "\Device\NTPNP_PCI0012"
.\debug.cpp(409) : --
.\debug.cpp(453) : **********************************************
.\boot_cleaner.cpp(565) : System volume is \\.\C:
.\boot_cleaner.cpp(600) : \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`03ec1000
.\boot_cleaner.cpp(276) : Boot sector MD5 is: 6def5ffcbcdbdb4082f1015625e597bd
.\boot_cleaner.cpp(1060) :
.\boot_cleaner.cpp(1061) : Size Device Name MBR Status
.\boot_cleaner.cpp(1062) : --------------------------------------------
.\boot_cleaner.cpp(1106) : 37 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)
.\boot_cleaner.cpp(1112) :
.\boot_cleaner.cpp(1151) : Done;

Bobbye · Mar 10, 2011

Tom, please give me an update on the system.

tom2011 · Mar 11, 2011

Last thing I did was the steps you outlined in your previous post:
run fix.bat and then rerun remover.exe.

I had pasted the new log in my last post. Is there something else I should have done?

Bobbye · Mar 11, 2011

No, I meant have the original problems been resolved: are you still getting popus? Can you do the Windows Updates? The Eset scan is clean, the rootkit has been removed.

tom2011 · Mar 12, 2011

OK. Windows Update is working again, and I am no longer getting popups. I guess it's now ok to reboot my computer? Are there any final steps to take?

tom2011 · Mar 12, 2011

Just ran my weekly scheduled McAfee scan - it found and quarantined a trojan called Generic.dx!wmm. Is there anything I need to do about this?

Bobbye · Mar 12, 2011

Let McAfee do it's job! If it found and quarantined the Trojan, it's working.

You can check the task Manager and make sure the process isn't running:

Hold down Ctrl + Alt + Delete.

Click on the "Task Manager."

Double click on the "Processes" tab to alpha sort.

Scroll down the list of processes and look for "Generic.dx."

If you find it> Right-click on "Generic.dx," and select "End Process."

This was just added to their database on 3/10.

Make sure you've rebooted since doing the McAfee scan. If it's still on the system, we can look further.

tom2011 · Mar 13, 2011

ok, I've rebooted and everything seems to be fine.
Thanks a lot for your help - I really appreciate it.

Bobbye · Mar 13, 2011

Okay- you're welcome. I'm going to close the thread now.

TechSpot

[Solved] Virus removal help

Bobbye Helper on the Fringe

tom2011 Newcomer, in training

tom2011 Newcomer, in training

tom2011 Newcomer, in training

Bobbye Helper on the Fringe

tom2011 Newcomer, in training

Bobbye Helper on the Fringe

tom2011 Newcomer, in training

Bobbye Helper on the Fringe

tom2011 Newcomer, in training

tom2011 Newcomer, in training

Bobbye Helper on the Fringe

tom2011 Newcomer, in training

Bobbye Helper on the Fringe