ROOTREPEAL (c) AD, 2007-2009 ================================================== Scan Start Time: 2009/12/27 22:28 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ------------------- Name: Image Path: Address: 0xF74BB000 Size: 98304 File Visible: No Signed: - Status: - Name: Image Path: Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: catchme.sys Image Path: C:\DOCUME~1\RM\LOCALS~1\Temp\catchme.sys Address: 0xF79BC000 Size: 31744 File Visible: No Signed: - Status: - Name: dump_iaStor.sys Image Path: C:\WINDOWS\System32\Drivers\dump_iaStor.sys Address: 0xF6B93000 Size: 479232 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xF6181000 Size: 49152 File Visible: No Signed: - Status: - Hidden/Locked Files ------------------- Path: c:\windows\system32\ativvaxx.dhl Status: Allocation size mismatch (API: 2670592, Raw: 1015808) Path: c:\windows\system32\atidemgx.dll Status: Allocation size mismatch (API: 208896, Raw: 368640) Path: c:\windows\system32\atifglpf.xml Status: Allocation size mismatch (API: 4096, Raw: 8192) Path: c:\windows\system32\atiicd8x.dat Status: Allocation size mismatch (API: 184320, Raw: 159744) Path: c:\windows\system32\at kvmg.d,l Status: Allocation size mismatch (API: 475136, Raw: 385024) Path: C:\WINDOWS\SYSTEM32\atioglx2.dll Status: Locked to the Windows API! Path: c:\windows\system32\atioglxx.dl Status: Allocation size mismatch (API: 11841536, Raw: 5435392) Path: C:\WINDOWS\SYSTEM32\atipdlxx.dll Status: Locked to the Windows API! Path: c:\windows\system32\at vcox.dll Status: Allocation size mismatch (API: 16384, Raw: 24576) Path: c:\windows\system32\ativva5x.dt Status: Allocation size mismatch (API: 2056192, Raw: 3108864) Path: C:\WINDOWS\SYSTEM32\ativvaxx.dat Status: Locked to the Windows API! Path: c:\windows\system32\ativvaxx.dll Status: Allocation size mismatch (API: 2670592, Raw: 520192) Path: C:\WINDOWS\SYSTEM32\ATKCTRS.DLL Status: Locked to the Windows API! Path: C:\WINDOWS\SYSTEM32\atl71.dll Status: Locked to the Windows API! Path: C:\WINDOWS\SYSTEM32\ATMADM.EXE Status: Locked to the Windows API! Path: C:\WINDOWS\SYSTEM32\ATMFD.DLL Status: Locked to the Windows API! Path: C:\WINDOWS\SYSTEM32\ATMLIB.DLL Status: Locked to the Windows API! Path: C:\WINDOWS\SYSTEM32\ATMPVCNO.DLL Status: Locked to the Windows API! Path: C:\WINDOWS\SYSTEM32\atpdf251.cat Status: Locked to the Windows API! Path: C:\WINDOWS\SYSTEM32\ATRACE.DLL Status: Locked to the Windows API! Path: C:\WINDOWS\SYSTEM32\att.gif Status: Locked to the Windows API! Path: C:\WINDOWS\SYSTEM32\ATTRIB.EXE Status: Locked to the Windows API! Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{C9680222-2EA3-124E-1B68-6E624A80E931}\13\216-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v113-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v216-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{C9680222-2EA3-124E-1B68-6E624A80E931}\16\219-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v116-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v219-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{C9680222-2EA3-124E-1B68-6E624A80E931}\17\220-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v117-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v220-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{C9680222-2EA3-124E-1B68-6E624A80E931}\20\223-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v120-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v223-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{C9680222-2EA3-124E-1B68-6E624A80E931}\21\224-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v121-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v224-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{C9680222-2EA3-124E-1B68-6E624A80E931}\22\225-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v122-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v225-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{C9680222-2EA3-124E-1B68-6E624A80E931}\26\215-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v126-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v215-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{D8E80470-4630-7D11-2212-47F4360495FB}\87\208-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v87-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v208-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{D8E80470-4630-7D11-2212-47F4360495FB}\88\209-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v88-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v209-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{D8E80470-4630-7D11-2212-47F4360495FB}\89\210-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v89-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v210-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{D8E80470-4630-7D11-2212-47F4360495FB}\93\200-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v93-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v200-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{D8E80470-4630-7D11-2212-47F4360495FB}\94\201-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v94-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v201-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{D8E80470-4630-7D11-2212-47F4360495FB}\97\204-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v97-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v204-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{D8E80470-4630-7D11-2212-47F4360495FB}\98\205-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v98-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v205-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{82036CAA-86EB-8DED-E3BD-F1661F6D7138}\19\419-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v419-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v419-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{82036CAA-86EB-8DED-E3BD-F1661F6D7138}\48\448-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v448-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v448-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{82036CAA-86EB-8DED-E3BD-F1661F6D7138}\49\449-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v449-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v449-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{82036CAA-86EB-8DED-E3BD-F1661F6D7138}\71\71-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v71-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v71-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{82036CAA-86EB-8DED-E3BD-F1661F6D7138}\74\74-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v74-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v74-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{82036CAA-86EB-8DED-E3BD-F1661F6D7138}\75\75-{47~1.FRX:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{82036CAA-86EB-8DED-E3BD-F1661F6D7138}\76\186-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v76-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v186-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{82036CAA-86EB-8DED-E3BD-F1661F6D7138}\78\167-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v78-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v167-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{82036CAA-86EB-8DED-E3BD-F1661F6D7138}\83\187-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v83-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v187-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Naomi\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{157CD894-9356-222E-DBAD-4EB389A67DCD}\30\230-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v230-{470C4B59-2FA7-455E-8C39-D1BD7FD8B8CF}-v230-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Visible to the Windows API, but not on disk. ==EOF==