aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software Run date: 2011-08-07 20:22:14 ----------------------------- 20:22:14.890 OS Version: Windows 5.1.2600 Service Pack 3 20:22:14.890 Number of processors: 2 586 0xF0B 20:22:14.890 ComputerName: VIZION UserName: zach 20:22:15.765 Initialize success 20:22:18.687 AVAST engine defs: 11080701 20:22:20.578 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 20:22:20.578 Disk 0 Vendor: WDC_WD50 12.0 Size: 476940MB BusType: 3 20:22:22.593 Disk 0 MBR read successfully 20:22:22.593 Disk 0 MBR scan 20:22:22.671 Disk 0 MBR:Alureon-G [Rtk] 20:22:22.671 Disk 0 TDL4@MBR code has been found 20:22:22.687 Disk 0 Windows XP default MBR code found via API 20:22:22.703 Disk 0 MBR hidden 20:22:22.968 Disk 0 MBR [TDL4] **ROOTKIT** 20:22:22.968 Disk 0 trace - called modules: 20:22:22.984 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8a3b36d0]<< 20:22:22.984 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a3f9030] 20:22:22.984 3 CLASSPNP.SYS[f7647fd7] -> nt!IofCallDriver -> [0x8ad5c6c0] 20:22:22.984 \Driver\iaStor[0x8ad8aa68] -> IRP_MJ_CREATE -> 0x8a3b36d0 20:22:23.984 AVAST engine scan C:\WINDOWS 20:22:46.937 AVAST engine scan C:\WINDOWS\system32 20:24:42.328 AVAST engine scan C:\WINDOWS\system32\drivers 20:24:57.250 AVAST engine scan C:\Documents and Settings\zach 20:53:26.375 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\zach\Desktop\MBR.dat" 20:53:26.484 The log file has been saved successfully to "C:\Documents and Settings\zach\Desktop\aswMBR.txt" aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software Run date: 2011-11-08 20:33:51 ----------------------------- 20:33:51.375 OS Version: Windows 5.1.2600 Service Pack 3 20:33:51.375 Number of processors: 2 586 0xF0B 20:33:51.375 ComputerName: VIZION UserName: zach 20:33:52.578 Initialize success 20:33:58.171 AVAST engine download error: 0 20:34:08.984 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 20:34:08.984 Disk 0 Vendor: WDC_WD50 12.0 Size: 476940MB BusType: 3 20:34:11.015 Disk 0 MBR read successfully 20:34:11.031 Disk 0 MBR scan 20:34:11.031 Disk 0 Windows XP default MBR code 20:34:11.046 Disk 0 scanning sectors +976768065 20:34:11.140 Disk 0 scanning C:\WINDOWS\system32\drivers 20:34:20.812 File: C:\WINDOWS\system32\drivers\mrxsmb.sys **SUSPICIOUS** 20:34:26.171 Service scanning 20:34:29.765 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32 20:34:30.578 Modules scanning 20:34:35.515 Module: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys **SUSPICIOUS** 20:34:36.562 Disk 0 trace - called modules: 20:34:36.640 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8a026f10]<< 20:34:36.703 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a4da030] 20:34:36.765 3 CLASSPNP.SYS[f7647fd7] -> nt!IofCallDriver -> [0x8a013478] 20:34:36.843 \Driver\00001023[0x8a0135a0] -> IRP_MJ_CREATE -> 0x8a026f10 20:34:36.906 Scan finished successfully 20:35:16.906 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\zach\Desktop\MBR.dat" 20:35:16.953 The log file has been saved successfully to "C:\Documents and Settings\zach\Desktop\aswMBR.txt" aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software Run date: 2011-11-13 03:57:34 ----------------------------- 03:57:34.158 OS Version: Windows 5.1.2600 Service Pack 3 03:57:34.158 Number of processors: 2 586 0xF0B 03:57:34.158 ComputerName: VIZION UserName: zach 03:57:35.861 Initialize success 03:57:39.564 AVAST engine defs: 11111300 03:57:45.064 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 03:57:45.064 Disk 0 Vendor: WDC_WD5000AAKS-75YGA0 12.01C02 Size: 476940MB BusType: 3 03:57:47.095 Disk 0 MBR read successfully 03:57:47.095 Disk 0 MBR scan 03:57:47.126 Disk 0 Windows XP default MBR code 03:57:47.126 Disk 0 MBR hidden 03:57:47.142 Disk 0 scanning sectors +976773152 03:57:47.236 Disk 0 scanning C:\WINDOWS\system32\drivers 03:58:01.845 File: C:\WINDOWS\system32\drivers\mrxsmb.sys **INFECTED** Win32:Aluroot [Rtk] 03:58:15.126 Service scanning 03:58:15.736 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32 03:58:16.283 Modules scanning 03:58:26.767 Module: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys **SUSPICIOUS** 03:58:31.923 Disk 0 trace - called modules: 03:58:31.955 ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x899b6f10]<< 03:58:31.955 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8ae64ab8] 03:58:31.955 3 CLASSPNP.SYS[ba0f8fd7] -> nt!IofCallDriver -> [0x8a20a370] 03:58:31.955 \Driver\00001504[0x8a22e6c0] -> IRP_MJ_CREATE -> 0x899b6f10 03:58:33.798 AVAST engine scan C:\WINDOWS 03:59:40.736 AVAST engine scan C:\WINDOWS\system32 04:03:46.501 AVAST engine scan C:\WINDOWS\system32\drivers 04:04:02.673 File: C:\WINDOWS\system32\drivers\mrxsmb.sys **INFECTED** Win32:Aluroot [Rtk] 04:05:04.751 AVAST engine scan C:\Documents and Settings\zach 04:14:28.955 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\zach\Desktop\MBR.dat" 04:14:28.970 The log file has been saved successfully to "C:\Documents and Settings\zach\Desktop\aswMBR.txt" aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software Run date: 2011-11-13 14:59:13 ----------------------------- 14:59:13.687 OS Version: Windows 5.1.2600 Service Pack 3 14:59:13.687 Number of processors: 2 586 0xF0B 14:59:13.687 ComputerName: VIZION UserName: zach 14:59:15.703 Initialize success 14:59:23.750 AVAST engine defs: 11111300 15:02:10.718 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 15:02:10.718 Disk 0 Vendor: WDC_WD5000AAKS-75YGA0 12.01C02 Size: 476940MB BusType: 3 15:02:12.734 Disk 0 MBR read successfully 15:02:12.734 Disk 0 MBR scan 15:02:12.781 Disk 0 Windows XP default MBR code 15:02:12.781 Disk 0 MBR hidden 15:02:12.781 Disk 0 scanning sectors +976773152 15:02:12.843 Disk 0 scanning C:\WINDOWS\system32\drivers 15:02:21.843 File: C:\WINDOWS\system32\drivers\mrxsmb.sys **INFECTED** Win32:Aluroot [Rtk] 15:02:31.000 Service scanning 15:02:31.796 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32 15:02:32.375 Modules scanning 15:02:35.343 Module: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys **SUSPICIOUS** 15:02:36.984 Disk 0 trace - called modules: 15:02:37.031 ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x89a21f10]<< 15:02:37.031 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8aeefab8] 15:02:37.031 3 CLASSPNP.SYS[ba0f8fd7] -> nt!IofCallDriver -> [0x8a291450] 15:02:37.031 \Driver\00001541[0x8a0765d0] -> IRP_MJ_CREATE -> 0x89a21f10 15:02:38.750 AVAST engine scan C:\WINDOWS 15:03:05.015 AVAST engine scan C:\WINDOWS\system32 15:05:19.359 AVAST engine scan C:\WINDOWS\system32\drivers 15:05:27.781 File: C:\WINDOWS\system32\drivers\mrxsmb.sys **INFECTED** Win32:Aluroot [Rtk] 15:05:42.359 AVAST engine scan C:\Documents and Settings\zach 16:50:58.859 AVAST engine scan C:\Documents and Settings\All Users 16:52:57.515 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\zach\Desktop\MBR.dat" 16:52:57.546 The log file has been saved successfully to "C:\Documents and Settings\zach\Desktop\aswMBR.txt" aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software Run date: 2011-11-13 14:59:13 ----------------------------- 14:59:13.687 OS Version: Windows 5.1.2600 Service Pack 3 14:59:13.687 Number of processors: 2 586 0xF0B 14:59:13.687 ComputerName: VIZION UserName: zach 14:59:15.703 Initialize success 14:59:23.750 AVAST engine defs: 11111300 15:02:10.718 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 15:02:10.718 Disk 0 Vendor: WDC_WD5000AAKS-75YGA0 12.01C02 Size: 476940MB BusType: 3 15:02:12.734 Disk 0 MBR read successfully 15:02:12.734 Disk 0 MBR scan 15:02:12.781 Disk 0 Windows XP default MBR code 15:02:12.781 Disk 0 MBR hidden 15:02:12.781 Disk 0 scanning sectors +976773152 15:02:12.843 Disk 0 scanning C:\WINDOWS\system32\drivers 15:02:21.843 File: C:\WINDOWS\system32\drivers\mrxsmb.sys **INFECTED** Win32:Aluroot [Rtk] 15:02:31.000 Service scanning 15:02:31.796 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32 15:02:32.375 Modules scanning 15:02:35.343 Module: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys **SUSPICIOUS** 15:02:36.984 Disk 0 trace - called modules: 15:02:37.031 ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x89a21f10]<< 15:02:37.031 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8aeefab8] 15:02:37.031 3 CLASSPNP.SYS[ba0f8fd7] -> nt!IofCallDriver -> [0x8a291450] 15:02:37.031 \Driver\00001541[0x8a0765d0] -> IRP_MJ_CREATE -> 0x89a21f10 15:02:38.750 AVAST engine scan C:\WINDOWS 15:03:05.015 AVAST engine scan C:\WINDOWS\system32 15:05:19.359 AVAST engine scan C:\WINDOWS\system32\drivers 15:05:27.781 File: C:\WINDOWS\system32\drivers\mrxsmb.sys **INFECTED** Win32:Aluroot [Rtk] 15:05:42.359 AVAST engine scan C:\Documents and Settings\zach 16:50:58.859 AVAST engine scan C:\Documents and Settings\All Users 16:52:57.515 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\zach\Desktop\MBR.dat" 16:52:57.546 The log file has been saved successfully to "C:\Documents and Settings\zach\Desktop\aswMBR.txt" 17:08:14.578 Scan finished successfully 17:57:11.156 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\zach\Desktop\MBR.dat" 17:57:11.156 The log file has been saved successfully to "C:\Documents and Settings\zach\Desktop\aswMBR.txt" aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software Run date: 2011-11-13 14:59:13 ----------------------------- 14:59:13.687 OS Version: Windows 5.1.2600 Service Pack 3 14:59:13.687 Number of processors: 2 586 0xF0B 14:59:13.687 ComputerName: VIZION UserName: zach 14:59:15.703 Initialize success 14:59:23.750 AVAST engine defs: 11111300 15:02:10.718 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 15:02:10.718 Disk 0 Vendor: WDC_WD5000AAKS-75YGA0 12.01C02 Size: 476940MB BusType: 3 15:02:12.734 Disk 0 MBR read successfully 15:02:12.734 Disk 0 MBR scan 15:02:12.781 Disk 0 Windows XP default MBR code 15:02:12.781 Disk 0 MBR hidden 15:02:12.781 Disk 0 scanning sectors +976773152 15:02:12.843 Disk 0 scanning C:\WINDOWS\system32\drivers 15:02:21.843 File: C:\WINDOWS\system32\drivers\mrxsmb.sys **INFECTED** Win32:Aluroot [Rtk] 15:02:31.000 Service scanning 15:02:31.796 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32 15:02:32.375 Modules scanning 15:02:35.343 Module: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys **SUSPICIOUS** 15:02:36.984 Disk 0 trace - called modules: 15:02:37.031 ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x89a21f10]<< 15:02:37.031 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8aeefab8] 15:02:37.031 3 CLASSPNP.SYS[ba0f8fd7] -> nt!IofCallDriver -> [0x8a291450] 15:02:37.031 \Driver\00001541[0x8a0765d0] -> IRP_MJ_CREATE -> 0x89a21f10 15:02:38.750 AVAST engine scan C:\WINDOWS 15:03:05.015 AVAST engine scan C:\WINDOWS\system32 15:05:19.359 AVAST engine scan C:\WINDOWS\system32\drivers 15:05:27.781 File: C:\WINDOWS\system32\drivers\mrxsmb.sys **INFECTED** Win32:Aluroot [Rtk] 15:05:42.359 AVAST engine scan C:\Documents and Settings\zach 16:50:58.859 AVAST engine scan C:\Documents and Settings\All Users 16:52:57.515 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\zach\Desktop\MBR.dat" 16:52:57.546 The log file has been saved successfully to "C:\Documents and Settings\zach\Desktop\aswMBR.txt" 17:08:14.578 Scan finished successfully 17:57:11.156 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\zach\Desktop\MBR.dat" 17:57:11.156 The log file has been saved successfully to "C:\Documents and Settings\zach\Desktop\aswMBR.txt" 21:20:36.812 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\zach\Desktop\MBR.dat" 21:20:36.812 The log file has been saved successfully to "C:\Documents and Settings\zach\Desktop\aswMBR.txt" aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software Run date: 2011-11-21 22:08:56 ----------------------------- 22:08:56.843 OS Version: Windows 5.1.2600 Service Pack 3 22:08:56.843 Number of processors: 2 586 0xF0B 22:08:56.843 ComputerName: VIZION UserName: zach 22:08:58.703 Initialize success 22:09:12.171 AVAST engine defs: 11111300 22:09:14.250 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 22:09:14.250 Disk 0 Vendor: WDC_WD5000AAKS-75YGA0 12.01C02 Size: 476940MB BusType: 3 22:09:16.281 Disk 0 MBR read successfully 22:09:16.281 Disk 0 MBR scan 22:09:16.343 Disk 0 Windows XP default MBR code 22:09:16.343 Disk 0 MBR hidden 22:09:16.343 Disk 0 scanning sectors +976773152 22:09:16.437 Disk 0 scanning C:\WINDOWS\system32\drivers 22:09:34.718 Service scanning 22:09:35.421 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32 22:09:36.046 Modules scanning 22:09:46.562 Disk 0 trace - called modules: 22:09:46.593 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8aec7fa9]<< 22:09:46.625 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8aee1ab8] 22:09:46.625 3 CLASSPNP.SYS[ba0f8fd7] -> nt!IofCallDriver -> \Device\00000069[0x8af9c4f8] 22:09:46.625 5 ACPI.sys[b9e67620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8aee5940] 22:09:46.625 \Driver\atapi[0x8aedc240] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x8aec7fa9 22:09:47.921 AVAST engine scan C:\WINDOWS 22:10:57.328 AVAST engine scan C:\WINDOWS\system32 22:13:05.406 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\zach\Desktop\MBR.dat" 22:13:05.453 The log file has been saved successfully to "C:\Documents and Settings\zach\Desktop\aswMBR.txt" aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software Run date: 2011-11-21 22:08:56 ----------------------------- 22:08:56.843 OS Version: Windows 5.1.2600 Service Pack 3 22:08:56.843 Number of processors: 2 586 0xF0B 22:08:56.843 ComputerName: VIZION UserName: zach 22:08:58.703 Initialize success 22:09:12.171 AVAST engine defs: 11111300 22:09:14.250 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 22:09:14.250 Disk 0 Vendor: WDC_WD5000AAKS-75YGA0 12.01C02 Size: 476940MB BusType: 3 22:09:16.281 Disk 0 MBR read successfully 22:09:16.281 Disk 0 MBR scan 22:09:16.343 Disk 0 Windows XP default MBR code 22:09:16.343 Disk 0 MBR hidden 22:09:16.343 Disk 0 scanning sectors +976773152 22:09:16.437 Disk 0 scanning C:\WINDOWS\system32\drivers 22:09:34.718 Service scanning 22:09:35.421 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32 22:09:36.046 Modules scanning 22:09:46.562 Disk 0 trace - called modules: 22:09:46.593 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8aec7fa9]<< 22:09:46.625 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8aee1ab8] 22:09:46.625 3 CLASSPNP.SYS[ba0f8fd7] -> nt!IofCallDriver -> \Device\00000069[0x8af9c4f8] 22:09:46.625 5 ACPI.sys[b9e67620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8aee5940] 22:09:46.625 \Driver\atapi[0x8aedc240] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x8aec7fa9 22:09:47.921 AVAST engine scan C:\WINDOWS 22:10:57.328 AVAST engine scan C:\WINDOWS\system32 22:13:05.406 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\zach\Desktop\MBR.dat" 22:13:05.453 The log file has been saved successfully to "C:\Documents and Settings\zach\Desktop\aswMBR.txt" 22:15:06.906 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\zach\Desktop\MBR.dat" 22:15:06.906 The log file has been saved successfully to "C:\Documents and Settings\zach\Desktop\aswMBR.txt" aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software Run date: 2011-11-21 22:08:56 ----------------------------- 22:08:56.843 OS Version: Windows 5.1.2600 Service Pack 3 22:08:56.843 Number of processors: 2 586 0xF0B 22:08:56.843 ComputerName: VIZION UserName: zach 22:08:58.703 Initialize success 22:09:12.171 AVAST engine defs: 11111300 22:09:14.250 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 22:09:14.250 Disk 0 Vendor: WDC_WD5000AAKS-75YGA0 12.01C02 Size: 476940MB BusType: 3 22:09:16.281 Disk 0 MBR read successfully 22:09:16.281 Disk 0 MBR scan 22:09:16.343 Disk 0 Windows XP default MBR code 22:09:16.343 Disk 0 MBR hidden 22:09:16.343 Disk 0 scanning sectors +976773152 22:09:16.437 Disk 0 scanning C:\WINDOWS\system32\drivers 22:09:34.718 Service scanning 22:09:35.421 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32 22:09:36.046 Modules scanning 22:09:46.562 Disk 0 trace - called modules: 22:09:46.593 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8aec7fa9]<< 22:09:46.625 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8aee1ab8] 22:09:46.625 3 CLASSPNP.SYS[ba0f8fd7] -> nt!IofCallDriver -> \Device\00000069[0x8af9c4f8] 22:09:46.625 5 ACPI.sys[b9e67620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8aee5940] 22:09:46.625 \Driver\atapi[0x8aedc240] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x8aec7fa9 22:09:47.921 AVAST engine scan C:\WINDOWS 22:10:57.328 AVAST engine scan C:\WINDOWS\system32 22:13:05.406 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\zach\Desktop\MBR.dat" 22:13:05.453 The log file has been saved successfully to "C:\Documents and Settings\zach\Desktop\aswMBR.txt" 22:15:06.906 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\zach\Desktop\MBR.dat" 22:15:06.906 The log file has been saved successfully to "C:\Documents and Settings\zach\Desktop\aswMBR.txt" 22:20:06.906 AVAST engine scan C:\WINDOWS\system32\drivers 22:21:18.921 AVAST engine scan C:\Documents and Settings\zach 22:22:14.656 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\zach\Desktop\MBR.dat" 22:22:14.671 The log file has been saved successfully to "C:\Documents and Settings\zach\Desktop\aswMBR.txt"