John.Doe

Malware Hunters
  • Content count

    175
  • Joined

  • Last visited

About John.Doe

  • Rank
    Advanced Member

Contact Methods

  • ICQ
    0

Profile Information

  • Location
    Germany
  1. Hi, UGGunz.exe, 12d6545cf1297c18fcb0aed605f349f4, https://www.virustotal.com/de/file/382d24cbf22bc50320ef6c8a859194fa7178a6687ed3a509bb787290f0361e39/analysis/1372762289/ bye, andreas UGGunz.zip Edit: Why is the message censored? Just google for universegamers gunz.
  2. Hi, congratulations, Malwarebytes is number one. => http://threatcenter.crdf.fr/?Stats bye, andreas
  3. Hi, update.exe, 614967ccd2943890cc9eb9a6fe94b89a, https://www.virustotal.com/de/file/26ffd87bf2e7e3d3725fba6a48f07e653b7b16068482ec9219298ae307a11a5b/analysis/1365703562/ Part of DVBViewer TE2 bye, andreas update.zip
  4. Hi, FreeIcons.dll, 0f638538e76ddf0b0de690154693dd52, https://www.virustotal.com/file/bf6ab8b6124087f50c72ba6f491655fc768da3205b916d299412d0dfdf426b2d/analysis/1360352273/ Thread: http://forum.botfrei.de/showthread.php?9871-GVU-2-11-Win7-Home-Premium-64-Bit-SP1 bye, andreas
  5. Thank you. bye, andreas
  6. Hi shadowwar, We know that. The reason for MBAR was the suspicion for rootkits. He has 64bit, so we can't use Gmer or other good rootkitscanner.We have still no explanation why MBAM shows absolutely nothing although the malware is still in the quarantine of OTL. One idea was that MBAM exclude this quarantine since 1.70. Another idea are rootkits that prevent MBAM from working. bye, andreas
  7. Hi shadowwar, sure. Watch this log => http://forum.botfrei...ull=1#post85076 VT-Scan and my control scan => http://forum.botfrei...ull=1#post85170 File is attached. Another thread, same behavior => http://forum.botfrei...d.php?9529-2-11 bye, andreas Edit: We got some more logs ===== SystemLook 30.07.11 by jpshortstuff Log created at 23:00 on 11/01/2013 by Jens7 Administrator - Elevation successful ========== dir ========== C:\_OTL - Parameters: "/s" ---Files--- MovedFiles.zip --a---- 1770154 bytes [19:57 11/01/2013] [19:57 11/01/2013] C:\_OTL\MovedFiles d------ [14:52 11/09/2012] 01102013_235057.log --a---- 11566 bytes [22:53 10/01/2013] [22:56 10/01/2013] 09112012_165201.log --a---- 392 bytes [14:53 11/09/2012] [14:53 11/09/2012] C:\_OTL\MovedFiles\01102013_235057 d------ [22:50 10/01/2013] C:\_OTL\MovedFiles\01102013_235057\C_ProgramData d------ [22:50 10/01/2013] dsgsdgdsgdsgw.js --a---- 2889 bytes [16:31 09/01/2013] [16:31 09/01/2013] dsgsdgdsgdsgw.pad --a---- 95023320 bytes [16:31 09/01/2013] [23:13 09/01/2013] mtbjfghn.xbe --a---- 5115 bytes [15:47 01/08/2011] [15:47 01/08/2011] C:\_OTL\MovedFiles\01102013_235057\C_Users d------ [22:50 10/01/2013] C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7 d------ [22:50 10/01/2013] wgsdgsdgdsgsd.dll --a---- 189192 bytes [16:31 09/01/2013] [16:31 09/01/2013] C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData d------ [22:50 10/01/2013] C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Local d------ [22:56 10/01/2013] C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Local\Temp d------ [22:56 10/01/2013] FXSAPIDebugLogFile.txt --a---- 0 bytes [14:54 11/09/2012] [14:54 11/09/2012] C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Roaming d------ [22:50 10/01/2013] C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Roaming\Microsoft d------ [22:50 10/01/2013] C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Roaming\Microsoft\Windows d------ [22:50 10/01/2013] C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Roaming\Microsoft\Windows\Start Menu d------ [22:50 10/01/2013] C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs d------ [22:50 10/01/2013] C:\_OTL\MovedFiles\01102013_235057\C_Users\Jens7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup d------ [22:50 10/01/2013] runctf.lnk --a---- 1083 bytes [16:31 09/01/2013] [16:31 09/01/2013] C:\_OTL\MovedFiles\09112012_165201 d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Program Files (x86) d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Program Files (x86)\Google d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Program Files (x86)\Google\Update d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Program Files (x86)\Google\Update\1.3.21.115 d------ [14:52 11/09/2012] npGoogleUpdate3.dll --a---- 566736 bytes [22:17 14/07/2012] [22:17 14/07/2012] C:\_OTL\MovedFiles\09112012_165201\C_ProgramData d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Users d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7 d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Local d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Local\Google d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Local\Google\Update d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Local\Google\Update\1.3.21.123 d------ [14:52 11/09/2012] npGoogleUpdate3.dll --a---- 572880 bytes [13:30 09/09/2012] [13:30 09/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Local\Temp d------ [14:53 11/09/2012] FXSAPIDebugLogFile.txt --a---- 0 bytes [08:42 06/10/2010] [08:42 06/10/2010] C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Roaming d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Roaming\Microsoft d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Roaming\Microsoft\Windows d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Roaming\Microsoft\Windows\Start Menu d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Users\Jens7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup d------ [14:52 11/09/2012] Telefon.url --a---- 106 bytes [13:01 07/09/2012] [10:06 07/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Windows d------ [14:52 11/09/2012] C:\_OTL\MovedFiles\09112012_165201\C_Windows\Tasks d------ [14:52 11/09/2012] GoogleUpdateTaskMachineCore.job --a---- 1106 bytes [09:13 06/10/2010] [08:07 10/09/2012] GoogleUpdateTaskMachineUA.job --a---- 1110 bytes [09:13 06/10/2010] [14:22 09/09/2012] GoogleUpdateTaskUserS-1-5-21-3817058908-3965746830-774432145-1000Core.job --a---- 1068 bytes [21:05 25/08/2011] [13:35 09/09/2012] GoogleUpdateTaskUserS-1-5-21-3817058908-3965746830-774432145-1000UA.job --a---- 1120 bytes [21:05 25/08/2011] [14:35 09/09/2012] -= EOF =- ===== Malwarebytes Anti-Rootkit 1.01.0.1011 www.malwarebytes.org Database version: v2013.01.11.14 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Jens7 :: PS7004 [administrator] 11.01.2013 22:25:08 mbar-log-2013-01-11 (22-25-08).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 34800 Time elapsed: 5 minute(s), 24 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) ===== --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.01.0.1011 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7601 Windows 7 Service Pack 1 x64 Account is Administrative Internet Explorer version: 9.0.8112.16421 File system is: NTFS Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, Q:\ DRIVE_FIXED CPU speed: 2.800000 GHz Memory total: 8572907520, free: 6361698304 ------------ Kernel report ------------ 01/11/2013 22:19:21 ------------ Loaded modules ----------- \SystemRoot\system32\ntoskrnl.exe \SystemRoot\system32\hal.dll \SystemRoot\system32\kdcom.dll \SystemRoot\system32\mcupdate_AuthenticAMD.dll \SystemRoot\system32\PSHED.dll \SystemRoot\system32\CLFS.SYS \SystemRoot\system32\CI.dll \SystemRoot\system32\drivers\Wdf01000.sys \SystemRoot\system32\drivers\WDFLDR.SYS \SystemRoot\system32\drivers\ACPI.sys \SystemRoot\system32\drivers\WMILIB.SYS \SystemRoot\system32\drivers\msisadrv.sys \SystemRoot\system32\drivers\pci.sys \SystemRoot\system32\drivers\vdrvroot.sys \SystemRoot\System32\drivers\partmgr.sys \SystemRoot\system32\drivers\volmgr.sys \SystemRoot\System32\drivers\volmgrx.sys \SystemRoot\System32\drivers\mountmgr.sys \SystemRoot\system32\drivers\amdxata.sys \SystemRoot\system32\drivers\fltmgr.sys \SystemRoot\system32\drivers\fileinfo.sys \SystemRoot\System32\Drivers\PxHlpa64.sys \SystemRoot\System32\Drivers\Ntfs.sys \SystemRoot\System32\Drivers\msrpc.sys \SystemRoot\System32\Drivers\ksecdd.sys \SystemRoot\System32\Drivers\cng.sys \SystemRoot\System32\drivers\pcw.sys \SystemRoot\System32\Drivers\Fs_Rec.sys \SystemRoot\system32\drivers\ndis.sys \SystemRoot\system32\drivers\NETIO.SYS \SystemRoot\System32\Drivers\ksecpkg.sys \SystemRoot\System32\drivers\tcpip.sys \SystemRoot\System32\drivers\fwpkclnt.sys \SystemRoot\system32\drivers\volsnap.sys \SystemRoot\System32\Drivers\spldr.sys \SystemRoot\System32\drivers\rdyboost.sys \SystemRoot\System32\Drivers\mup.sys \SystemRoot\System32\drivers\hwpolicy.sys \SystemRoot\System32\DRIVERS\fvevol.sys \SystemRoot\system32\DRIVERS\disk.sys \SystemRoot\system32\DRIVERS\CLASSPNP.SYS \SystemRoot\system32\DRIVERS\AtiPcie.sys \SystemRoot\system32\DRIVERS\ahcix64s.sys \SystemRoot\system32\DRIVERS\storport.sys \SystemRoot\system32\DRIVERS\cdrom.sys \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\drivers\VIDEOPRT.SYS \SystemRoot\System32\drivers\watchdog.sys \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\system32\drivers\rdpencdd.sys \SystemRoot\system32\drivers\rdprefmp.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\tdx.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\System32\DRIVERS\netbt.sys \SystemRoot\system32\drivers\afd.sys \SystemRoot\system32\DRIVERS\wfplwf.sys \SystemRoot\system32\DRIVERS\pacer.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\wanarp.sys \SystemRoot\system32\drivers\termdd.sys \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\system32\drivers\nsiproxy.sys \SystemRoot\system32\drivers\mssmbios.sys \SystemRoot\System32\drivers\discache.sys \SystemRoot\System32\Drivers\dfsc.sys \SystemRoot\system32\DRIVERS\blbdrive.sys \SystemRoot\system32\DRIVERS\avkmgr.sys \SystemRoot\system32\DRIVERS\avipbb.sys \SystemRoot\system32\DRIVERS\tunnel.sys \SystemRoot\system32\DRIVERS\amdppm.sys \SystemRoot\system32\DRIVERS\atikmpag.sys \SystemRoot\system32\DRIVERS\atipmdag.sys \SystemRoot\System32\drivers\dxgkrnl.sys \SystemRoot\System32\drivers\dxgmms1.sys \SystemRoot\system32\drivers\HDAudBus.sys \SystemRoot\system32\DRIVERS\usbohci.sys \SystemRoot\system32\DRIVERS\USBPORT.SYS \SystemRoot\system32\DRIVERS\usbehci.sys \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\Rt64win7.sys \SystemRoot\system32\drivers\wmiacpi.sys \SystemRoot\system32\drivers\CompositeBus.sys \SystemRoot\system32\DRIVERS\AgileVpn.sys \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\rassstp.sys \SystemRoot\system32\DRIVERS\kbdclass.sys \SystemRoot\system32\drivers\swenum.sys \SystemRoot\system32\drivers\ks.sys \SystemRoot\system32\drivers\umbus.sys \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\system32\drivers\AtihdW76.sys \SystemRoot\system32\drivers\portcls.sys \SystemRoot\system32\drivers\drmk.sys \SystemRoot\system32\drivers\ksthunk.sys \SystemRoot\system32\drivers\RTKVHD64.sys \SystemRoot\System32\Drivers\crashdmp.sys \SystemRoot\System32\Drivers\dump_diskdump.sys \SystemRoot\System32\Drivers\dump_ahcix64s.sys \SystemRoot\System32\Drivers\dump_dumpfve.sys \SystemRoot\system32\DRIVERS\usbccgp.sys \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\System32\Drivers\RTL2832UUSB.sys \SystemRoot\system32\drivers\RTL2832UBDA.sys \SystemRoot\system32\drivers\BdaSup.SYS \SystemRoot\system32\DRIVERS\RTL2832U_IRHID.sys \SystemRoot\system32\DRIVERS\HIDCLASS.SYS \SystemRoot\system32\DRIVERS\HIDPARSE.SYS \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\system32\DRIVERS\kbdhid.sys \SystemRoot\system32\DRIVERS\hidusb.sys \SystemRoot\system32\DRIVERS\USBSTOR.SYS \SystemRoot\system32\DRIVERS\V0470Vid.sys \SystemRoot\system32\drivers\usbaudio.sys \SystemRoot\system32\DRIVERS\mouhid.sys \SystemRoot\system32\DRIVERS\monitor.sys \SystemRoot\System32\TSDDD.dll \SystemRoot\System32\cdd.dll \SystemRoot\System32\ATMFD.DLL \SystemRoot\system32\drivers\luafv.sys \SystemRoot\system32\DRIVERS\avgntflt.sys \??\C:\Windows\system32\drivers\mbam.sys \SystemRoot\system32\DRIVERS\Sftvollh.sys \SystemRoot\system32\drivers\WudfPf.sys \SystemRoot\system32\DRIVERS\lltdio.sys \SystemRoot\system32\DRIVERS\rspndr.sys \SystemRoot\system32\drivers\HTTP.sys \SystemRoot\system32\DRIVERS\bowser.sys \SystemRoot\System32\drivers\mpsdrv.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\system32\DRIVERS\mrxsmb10.sys \SystemRoot\system32\DRIVERS\mrxsmb20.sys \SystemRoot\system32\drivers\peauth.sys \SystemRoot\System32\Drivers\secdrv.SYS \SystemRoot\system32\DRIVERS\Sftfslh.sys \SystemRoot\system32\DRIVERS\Sftplaylh.sys \SystemRoot\System32\DRIVERS\srvnet.sys \SystemRoot\System32\drivers\tcpipreg.sys \SystemRoot\System32\DRIVERS\srv2.sys \SystemRoot\System32\DRIVERS\srv.sys \SystemRoot\system32\DRIVERS\Sftredirlh.sys \SystemRoot\system32\DRIVERS\WUDFRd.sys \??\C:\Windows\system32\drivers\mbamchameleon.sys \??\C:\Windows\system32\drivers\mbamswissarmy.sys \Windows\System32\ntdll.dll \Windows\System32\smss.exe \Windows\System32\apisetschema.dll \Windows\System32\autochk.exe \Windows\System32\urlmon.dll \Windows\System32\psapi.dll \Windows\System32\shlwapi.dll \Windows\System32\sechost.dll \Windows\System32\lpk.dll \Windows\System32\rpcrt4.dll \Windows\System32\nsi.dll \Windows\System32\difxapi.dll \Windows\System32\ole32.dll \Windows\System32\imagehlp.dll \Windows\System32\iertutil.dll \Windows\System32\msctf.dll \Windows\System32\clbcatq.dll \Windows\System32\user32.dll \Windows\System32\wininet.dll \Windows\System32\Wldap32.dll \Windows\System32\setupapi.dll \Windows\System32\msvcrt.dll \Windows\System32\oleaut32.dll \Windows\System32\gdi32.dll \Windows\System32\imm32.dll \Windows\System32\comdlg32.dll \Windows\System32\advapi32.dll \Windows\System32\ws2_32.dll \Windows\System32\shell32.dll \Windows\System32\usp10.dll \Windows\System32\kernel32.dll \Windows\System32\normaliz.dll \Windows\System32\cfgmgr32.dll \Windows\System32\wintrust.dll \Windows\System32\devobj.dll \Windows\System32\crypt32.dll \Windows\System32\comctl32.dll ----------- End ----------- <<<1>>> Upper Device Name: \Device\Harddisk5\DR5 Upper Device Object: 0xfffffa800972b790 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\0000008d\ Lower Device Object: 0xfffffa80094dcb60 Lower Device Driver Name: \Driver\USBSTOR\ Driver name found: USBSTOR DriverEntry returned 0x0 Function returned 0x0 <<<1>>> Upper Device Name: \Device\Harddisk4\DR4 Upper Device Object: 0xfffffa8008f19790 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\0000008c\ Lower Device Object: 0xfffffa80094ddb60 Lower Device Driver Name: \Driver\USBSTOR\ Driver name found: USBSTOR <<<1>>> Upper Device Name: \Device\Harddisk3\DR3 Upper Device Object: 0xfffffa8009490790 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\0000008b\ Lower Device Object: 0xfffffa80094dbb60 Lower Device Driver Name: \Driver\USBSTOR\ Driver name found: USBSTOR <<<1>>> Upper Device Name: \Device\Harddisk2\DR2 Upper Device Object: 0xfffffa8008f14790 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\0000008a\ Lower Device Object: 0xfffffa80094d6b60 Lower Device Driver Name: \Driver\USBSTOR\ Driver name found: USBSTOR <<<1>>> Upper Device Name: \Device\Harddisk1\DR1 Upper Device Object: 0xfffffa80097c5790 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\00000089\ Lower Device Object: 0xfffffa80094dab60 Lower Device Driver Name: \Driver\USBSTOR\ Driver name found: USBSTOR <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xfffffa80082e8790 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\00000064\ Lower Device Object: 0xfffffa800791d9c0 Lower Device Driver Name: \Driver\ahcix64s\ Driver name found: ahcix64s DriverEntry returned 0x0 Function returned 0x0 Downloaded database version: v2013.01.11.14 Downloaded database version: v2013.01.04.01 Initializing... Done! <<<2>>> Device number: 0, partition: 3 Physical Sector Size: 512 Drive: 0, DevicePointer: 0xfffffa80082e8790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xfffffa80082e82c0, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xfffffa80082e8790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xfffffa800791d9c0, DeviceName: \Device\00000064\, DriverName: \Driver\ahcix64s\ ------------ End ---------- Upper DeviceData: 0xfffff8a00decd150, 0xfffffa80082e8790, 0xfffffa800ca4e790 Lower DeviceData: 0xfffff8a0024c6a20, 0xfffffa800791d9c0, 0xfffffa800d0651f0 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning directory: C:\Windows\system32\drivers... Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: 4F16D6A4 Partition information: Partition 0 type is Other (0x27) Partition is NOT ACTIVE. Partition starts at LBA: 2048 Numsec = 31457280 Partition 1 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 31459328 Numsec = 204800 Partition file system is NTFS Partition is bootable Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 31664128 Numsec = 960393216 Partition 3 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 992057344 Numsec = 961333248 Disk Size: 1000137752576 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1953374048-1953394048)... Physical Sector Size: 0 Drive: 1, DevicePointer: 0xfffffa80097c5790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xfffffa80097c52c0, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xfffffa80097c5790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\ DevicePointer: 0xfffffa80094dab60, DeviceName: \Device\00000089\, DriverName: \Driver\USBSTOR\ ------------ End ---------- Physical Sector Size: 0 Drive: 2, DevicePointer: 0xfffffa8008f14790, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xfffffa8008f142c0, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xfffffa8008f14790, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\ DevicePointer: 0xfffffa80094d6b60, DeviceName: \Device\0000008a\, DriverName: \Driver\USBSTOR\ ------------ End ---------- Physical Sector Size: 0 Drive: 3, DevicePointer: 0xfffffa8009490790, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xfffffa80094902c0, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xfffffa8009490790, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\ DevicePointer: 0xfffffa80094dbb60, DeviceName: \Device\0000008b\, DriverName: \Driver\USBSTOR\ ------------ End ---------- Physical Sector Size: 0 Drive: 4, DevicePointer: 0xfffffa8008f19790, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xfffffa8008f192c0, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xfffffa8008f19790, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\ DevicePointer: 0xfffffa80094ddb60, DeviceName: \Device\0000008c\, DriverName: \Driver\USBSTOR\ ------------ End ---------- Physical Sector Size: 0 Drive: 5, DevicePointer: 0xfffffa800972b790, DeviceName: \Device\Harddisk5\DR5\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xfffffa800972b2c0, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xfffffa800972b790, DeviceName: \Device\Harddisk5\DR5\, DriverName: \Driver\Disk\ DevicePointer: 0xfffffa80094dcb60, DeviceName: \Device\0000008d\, DriverName: \Driver\USBSTOR\ ------------ End ---------- Done! Performing system, memory and registry scan... Done! Scan finished =======================================
  8. Hi, we observed a strange behavior of Malwarebytes scanning the quarantine of OTL. Malware is not detected anymore like before. Is this intentional? I found nothing about that in the changelog. bye, andreas