GMER - Rootkit

Polski	GMER	http://www.gmer.net
all your rootkits are belong to us

Logs

Antivirus

Files

FAQ

Contact

Rootkit

Gmer detects rootkits. It scans for:

- hidden processes
- hidden files
- hidden services
- hidden registry keys
- hidden drivers
- drivers hooking SSDT (System Service Descriptor Table)
- drivers hooking IDT (Interrupt Descriptor Table)
- drivers hooking IRP (IO Request Packet) calls

You can see some scanning output samples here ...

hidden processes

Process   hxdef100.exe (*** hidden *** )                       936
Process   explorer.exe (*** hidden *** )                       1596

hidden files

File     D:\WINDOWS\Prefetch\HXDEF100.EXE-04EC8234.pf
File     E:\hx_def_100\hxdef100.2.ini
File     E:\hx_def_100\hxdef100.exe
File     E:\hx_def_100\hxdef100.ini
File     E:\hx_def_100\hxdefdrv.sys
File     D:\WINDOWS\system32\drivers\sysbus32.sys
File     D:\WINDOWS\Prefetch\MAIN6.EXE-1BC7E02F.pf                                    
File     D:\WINDOWS\system32\drivers\isa32.sys                                                 
File     D:\WINDOWS\system32\main6.exe

hidden services

Service  D:\WINDOWS\System32\DRIVERS\sysbus32.sys (*** hidden *** )                   [AUTO] sysbus32
Service  D:\WINDOWS\System32\DRIVERS\isa32.sys                                        [MANUAL] isa32

hidden registry kes

      
Reg      \Registry\MACHINE\SYSTEM\ControlSet001\Services\sysbus32
Reg      \Registry\MACHINE\SYSTEM\ControlSet001\Services\sysbus32@Type                1
Reg      \Registry\MACHINE\SYSTEM\ControlSet001\Services\sysbus32@ErrorControl        1
Reg      \Registry\MACHINE\SYSTEM\ControlSet001\Services\sysbus32@Start               2
Reg      \Registry\MACHINE\SYSTEM\ControlSet001\Services\sysbus32@ImagePath           System32\DRIVERS\sysbus32.sys
Reg      \Registry\MACHINE\SYSTEM\ControlSet001\Services\sysbus32@ExtParam            0xF1 0x15 0x28 0xD4 ...
Reg      \Registry\MACHINE\SYSTEM\ControlSet003\Services\sysbus32                     
Reg      \Registry\MACHINE\SYSTEM\ControlSet003\Services\sysbus32@Type                1
Reg      \Registry\MACHINE\SYSTEM\ControlSet003\Services\sysbus32@ErrorControl        1
Reg      \Registry\MACHINE\SYSTEM\ControlSet003\Services\sysbus32@Start               2
Reg      \Registry\MACHINE\SYSTEM\ControlSet003\Services\sysbus32@ImagePath           System32\DRIVERS\sysbus32.sys
Reg      \Registry\MACHINE\SYSTEM\ControlSet003\Services\sysbus32@ExtParam            0xF1 0x15 0x28 0xD4 ...
Reg      \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\sysbus32                 
Reg      \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\sysbus32@Type            1
Reg      \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\sysbus32@ErrorControl    1
Reg      \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\sysbus32@Start           2
Reg      \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\sysbus32@ImagePath       System32\DRIVERS\sysbus32.sys
Reg      \Registry\MACHINE\SYSTEM\CurrentControlSet\Services\sysbus32@ExtParam        0xF1 0x15 0x28 0xD4 ...

hidden drivers

drivers hooking SSDT

      
SSDT     8182860A                                                                     ZwEnumerateKey
SSDT     818298B6                                                                     ZwQueryDirectoryFile

SSDT     \SystemRoot\System32\DRIVERS\isa32.sys                                       ZwEnumerateKey
SSDT     \SystemRoot\System32\DRIVERS\isa32.sys                                       ZwEnumerateValueKey
SSDT     \SystemRoot\System32\DRIVERS\isa32.sys                                       ZwQueryDirectoryFile

drivers hooking IDT

      
INT 0x2E  \??\C:\driver\examples\strace.sys  F7D812A0

drivers hooking IRP

      
Device   \Driver\Tcpip \Device\Ip IRP_MJ_CREATE                                       81828CEE
Device   \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE                                      81828CEE
Device   \Driver\Tcpip \Device\Udp IRP_MJ_CREATE                                      81828CEE
Device   \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE                                    81828CEE
Device   \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE                              81828CEE

Device   \Driver\Tcpip \Device\Ip IRP_MJ_CREATE                                       isa32.sys
Device   \Driver\Tcpip \Device\Ip IRP_MJ_CLOSEIRP_MJ_READ                             isa32.sys
Device   \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL                      isa32.sys
Device   \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE                                      isa32.sys
Device   \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSEIRP_MJ_READ                            isa32.sys
Device   \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL                     isa32.sys
Device   \Driver\Tcpip \Device\Udp IRP_MJ_CREATE                                      isa32.sys
Device   \Driver\Tcpip \Device\Udp IRP_MJ_CLOSEIRP_MJ_READ                            isa32.sys
Device   \Driver\Tcpip \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL                     isa32.sys
Device   \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE                                    isa32.sys
Device   \Driver\Tcpip \Device\RawIp IRP_MJ_CLOSEIRP_MJ_READ                          isa32.sys
Device   \Driver\Tcpip \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL                   isa32.sys
Device   \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CREATE                              isa32.sys
Device   \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_CLOSEIRP_MJ_READ                    isa32.sys
Device   \Driver\Tcpip \Device\IPMULTICAST IRP_MJ_INTERNAL_DEVICE_CONTROL             isa32.sys

Rootkit He4hookInv

 
Device  \FileSystem\Ntfs IRP_MJ_CREATE                       816290B6
Device  \FileSystem\Ntfs IRP_MJ_CREATE_NAMED_PIPE            816290B6
Device  \FileSystem\Ntfs IRP_MJ_CLOSEIRP_MJ_READ             816290B6
Device  \FileSystem\Ntfs IRP_MJ_WRITE                        816290B6
Device  \FileSystem\Ntfs IRP_MJ_QUERY_INFORMATION            816290B6
Device  \FileSystem\Ntfs IRP_MJ_SET_INFORMATION              816290B6
Device  \FileSystem\Ntfs IRP_MJ_QUERY_EA                     816290B6
Device  \FileSystem\Ntfs IRP_MJ_SET_EA                       816290B6
Device  \FileSystem\Ntfs IRP_MJ_FLUSH_BUFFERS                816290B6
Device  \FileSystem\Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION     816290B6
Device  \FileSystem\Ntfs IRP_MJ_SET_VOLUME_INFORMATION       816290B6
Device  \FileSystem\Ntfs IRP_MJ_DIRECTORY_CONTROL            816290B6
Device  \FileSystem\Ntfs IRP_MJ_FILE_SYSTEM_CONTROL          816290B6
Device  \FileSystem\Ntfs IRP_MJ_DEVICE_CONTROL               816290B6
Device  \FileSystem\Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL      816290B6
Device  \FileSystem\Ntfs IRP_MJ_SHUTDOWN                     816290B6
Device  \FileSystem\Ntfs IRP_MJ_LOCK_CONTROL                 816290B6
Device  \FileSystem\Ntfs IRP_MJ_CLEANUP                      816290B6
Device  \FileSystem\Ntfs IRP_MJ_CREATE_MAILSLOT              816290B6
Device  \FileSystem\Ntfs IRP_MJ_QUERY_SECURITY               816290B6
Device  \FileSystem\Ntfs IRP_MJ_SET_SECURITY                 816290B6
Device  \FileSystem\Ntfs IRP_MJ_POWER                        816290B6
Device  \FileSystem\Ntfs IRP_MJ_SYSTEM_CONTROL               816290B6
Device  \FileSystem\Ntfs IRP_MJ_DEVICE_CHANGE                816290B6
Device  \FileSystem\Ntfs IRP_MJ_QUERY_QUOTA                  816290B6
Device  \FileSystem\Ntfs IRP_MJ_SET_QUOTA                    816290B6
Device  \FileSystem\Ntfs IRP_MJ_PNP                          816290B6
Device  \FileSystem\Ntfs IRP_MJ_PNP_POWER                    816290B6
Device  \FileSystem\Mup IRP_MJ_CREATE                        816290B6
Device  \FileSystem\Mup IRP_MJ_CREATE_NAMED_PIPE             816290B6
Device  \FileSystem\Mup IRP_MJ_CLOSEIRP_MJ_READ              816290B6
Device  \FileSystem\Mup IRP_MJ_WRITE                         816290B6
Device  \FileSystem\Mup IRP_MJ_QUERY_INFORMATION             816290B6
Device  \FileSystem\Mup IRP_MJ_SET_INFORMATION               816290B6
Device  \FileSystem\Mup IRP_MJ_QUERY_EA                      816290B6
Device  \FileSystem\Mup IRP_MJ_SET_EA                        816290B6
Device  \FileSystem\Mup IRP_MJ_FLUSH_BUFFERS                 816290B6
Device  \FileSystem\Mup IRP_MJ_QUERY_VOLUME_INFORMATION      816290B6
Device  \FileSystem\Mup IRP_MJ_SET_VOLUME_INFORMATION        816290B6
Device  \FileSystem\Mup IRP_MJ_DIRECTORY_CONTROL             816290B6
Device  \FileSystem\Mup IRP_MJ_FILE_SYSTEM_CONTROL           816290B6
Device  \FileSystem\Mup IRP_MJ_DEVICE_CONTROL                816290B6
Device  \FileSystem\Mup IRP_MJ_INTERNAL_DEVICE_CONTROL       816290B6
Device  \FileSystem\Mup IRP_MJ_SHUTDOWN                      816290B6
Device  \FileSystem\Mup IRP_MJ_LOCK_CONTROL                  816290B6
Device  \FileSystem\Mup IRP_MJ_CLEANUP                       816290B6
Device  \FileSystem\Mup IRP_MJ_CREATE_MAILSLOT               816290B6
Device  \FileSystem\Mup IRP_MJ_QUERY_SECURITY                816290B6
Device  \FileSystem\Mup IRP_MJ_SET_SECURITY                  816290B6
Device  \FileSystem\Mup IRP_MJ_POWER                         816290B6
Device  \FileSystem\Mup IRP_MJ_SYSTEM_CONTROL                816290B6
Device  \FileSystem\Mup IRP_MJ_DEVICE_CHANGE                 816290B6
Device  \FileSystem\Mup IRP_MJ_QUERY_QUOTA                   816290B6
Device  \FileSystem\Mup IRP_MJ_SET_QUOTA                     816290B6
Device  \FileSystem\Mup IRP_MJ_PNP                           816290B6
Device  \FileSystem\Mup IRP_MJ_PNP_POWER                     816290B6
Device  \Driver\Serial IRP_MJ_CREATE                         816290B6
Device  \Driver\Serial IRP_MJ_CREATE_NAMED_PIPE              816290B6
Device  \Driver\Serial IRP_MJ_CLOSEIRP_MJ_READ               816290B6
Device  \Driver\Serial IRP_MJ_WRITE                          816290B6
Device  \Driver\Serial IRP_MJ_QUERY_INFORMATION              816290B6
Device  \Driver\Serial IRP_MJ_SET_INFORMATION                816290B6
Device  \Driver\Serial IRP_MJ_QUERY_EA                       816290B6
Device  \Driver\Serial IRP_MJ_SET_EA                         816290B6
Device  \Driver\Serial IRP_MJ_FLUSH_BUFFERS                  816290B6
Device  \Driver\Serial IRP_MJ_QUERY_VOLUME_INFORMATION       816290B6
Device  \Driver\Serial IRP_MJ_SET_VOLUME_INFORMATION         816290B6
Device  \Driver\Serial IRP_MJ_DIRECTORY_CONTROL              816290B6
Device  \Driver\Serial IRP_MJ_FILE_SYSTEM_CONTROL            816290B6
Device  \Driver\Serial IRP_MJ_DEVICE_CONTROL                 816290B6
Device  \Driver\Serial IRP_MJ_INTERNAL_DEVICE_CONTROL        816290B6
Device  \Driver\Serial IRP_MJ_SHUTDOWN                       816290B6
Device  \Driver\Serial IRP_MJ_LOCK_CONTROL                   816290B6
Device  \Driver\Serial IRP_MJ_CLEANUP                        816290B6
Device  \Driver\Serial IRP_MJ_CREATE_MAILSLOT                816290B6
Device  \Driver\Serial IRP_MJ_QUERY_SECURITY                 816290B6
Device  \Driver\Serial IRP_MJ_SET_SECURITY                   816290B6
Device  \Driver\Serial IRP_MJ_POWER                          816290B6
Device  \Driver\Serial IRP_MJ_SYSTEM_CONTROL                 816290B6
Device  \Driver\Serial IRP_MJ_DEVICE_CHANGE                  816290B6
Device  \Driver\Serial IRP_MJ_QUERY_QUOTA                    816290B6
Device  \Driver\Serial IRP_MJ_SET_QUOTA                      816290B6
Device  \Driver\Serial IRP_MJ_PNP                            816290B6
Device  \Driver\Serial IRP_MJ_PNP_POWER                      816290B6
Device  \FileSystem\RAW IRP_MJ_CREATE                        816290B6
Device  \FileSystem\RAW IRP_MJ_CREATE_NAMED_PIPE             816290B6
Device  \FileSystem\RAW IRP_MJ_CLOSEIRP_MJ_READ              816290B6
Device  \FileSystem\RAW IRP_MJ_WRITE                         816290B6
Device  \FileSystem\RAW IRP_MJ_QUERY_INFORMATION             816290B6
Device  \FileSystem\RAW IRP_MJ_SET_INFORMATION               816290B6
Device  \FileSystem\RAW IRP_MJ_QUERY_EA                      816290B6
Device  \FileSystem\RAW IRP_MJ_SET_EA                        816290B6
Device  \FileSystem\RAW IRP_MJ_FLUSH_BUFFERS                 816290B6
Device  \FileSystem\RAW IRP_MJ_QUERY_VOLUME_INFORMATION      816290B6
Device  \FileSystem\RAW IRP_MJ_SET_VOLUME_INFORMATION        816290B6
Device  \FileSystem\RAW IRP_MJ_DIRECTORY_CONTROL             816290B6
Device  \FileSystem\RAW IRP_MJ_FILE_SYSTEM_CONTROL           816290B6
Device  \FileSystem\RAW IRP_MJ_DEVICE_CONTROL                816290B6
Device  \FileSystem\RAW IRP_MJ_INTERNAL_DEVICE_CONTROL       816290B6
Device  \FileSystem\RAW IRP_MJ_SHUTDOWN                      816290B6
Device  \FileSystem\RAW IRP_MJ_LOCK_CONTROL                  816290B6
Device  \FileSystem\RAW IRP_MJ_CLEANUP                       816290B6
Device  \FileSystem\RAW IRP_MJ_CREATE_MAILSLOT               816290B6
Device  \FileSystem\RAW IRP_MJ_QUERY_SECURITY                816290B6
Device  \FileSystem\RAW IRP_MJ_SET_SECURITY                  816290B6
Device  \FileSystem\RAW IRP_MJ_POWER                         816290B6
Device  \FileSystem\RAW IRP_MJ_SYSTEM_CONTROL                816290B6
Device  \FileSystem\RAW IRP_MJ_DEVICE_CHANGE                 816290B6
Device  \FileSystem\RAW IRP_MJ_QUERY_QUOTA                   816290B6
Device  \FileSystem\RAW IRP_MJ_SET_QUOTA                     816290B6
Device  \FileSystem\RAW IRP_MJ_PNP                           816290B6
Device  \FileSystem\RAW IRP_MJ_PNP_POWER                     816290B6
Device  \Driver\Parport IRP_MJ_CREATE                        816290B6
Device  \Driver\Parport IRP_MJ_CREATE_NAMED_PIPE             816290B6
Device  \Driver\Parport IRP_MJ_CLOSEIRP_MJ_READ              816290B6
Device  \Driver\Parport IRP_MJ_WRITE                         816290B6
Device  \Driver\Parport IRP_MJ_QUERY_INFORMATION             816290B6
Device  \Driver\Parport IRP_MJ_SET_INFORMATION               816290B6
Device  \Driver\Parport IRP_MJ_QUERY_EA                      816290B6
Device  \Driver\Parport IRP_MJ_SET_EA                        816290B6
Device  \Driver\Parport IRP_MJ_FLUSH_BUFFERS                 816290B6
Device  \Driver\Parport IRP_MJ_QUERY_VOLUME_INFORMATION      816290B6
Device  \Driver\Parport IRP_MJ_SET_VOLUME_INFORMATION        816290B6
Device  \Driver\Parport IRP_MJ_DIRECTORY_CONTROL             816290B6
Device  \Driver\Parport IRP_MJ_FILE_SYSTEM_CONTROL           816290B6
Device  \Driver\Parport IRP_MJ_DEVICE_CONTROL                816290B6
Device  \Driver\Parport IRP_MJ_INTERNAL_DEVICE_CONTROL       816290B6
Device  \Driver\Parport IRP_MJ_SHUTDOWN                      816290B6
Device  \Driver\Parport IRP_MJ_LOCK_CONTROL                  816290B6
Device  \Driver\Parport IRP_MJ_CLEANUP                       816290B6
Device  \Driver\Parport IRP_MJ_CREATE_MAILSLOT               816290B6
Device  \Driver\Parport IRP_MJ_QUERY_SECURITY                816290B6
Device  \Driver\Parport IRP_MJ_SET_SECURITY                  816290B6
Device  \Driver\Parport IRP_MJ_POWER                         816290B6
Device  \Driver\Parport IRP_MJ_SYSTEM_CONTROL                816290B6
Device  \Driver\Parport IRP_MJ_DEVICE_CHANGE                 816290B6
Device  \Driver\Parport IRP_MJ_QUERY_QUOTA                   816290B6
Device  \Driver\Parport IRP_MJ_SET_QUOTA                     816290B6
Device  \Driver\Parport IRP_MJ_PNP                           816290B6
Device  \Driver\Parport IRP_MJ_PNP_POWER                     816290B6
Device  \Driver\ParVdm IRP_MJ_CREATE                         816290B6
Device  \Driver\ParVdm IRP_MJ_CREATE_NAMED_PIPE              816290B6
Device  \Driver\ParVdm IRP_MJ_CLOSEIRP_MJ_READ               816290B6
Device  \Driver\ParVdm IRP_MJ_WRITE                          816290B6
Device  \Driver\ParVdm IRP_MJ_QUERY_INFORMATION              816290B6
Device  \Driver\ParVdm IRP_MJ_SET_INFORMATION                816290B6
Device  \Driver\ParVdm IRP_MJ_QUERY_EA                       816290B6
Device  \Driver\ParVdm IRP_MJ_SET_EA                         816290B6
Device  \Driver\ParVdm IRP_MJ_FLUSH_BUFFERS                  816290B6
Device  \Driver\ParVdm IRP_MJ_QUERY_VOLUME_INFORMATION       816290B6
Device  \Driver\ParVdm IRP_MJ_SET_VOLUME_INFORMATION         816290B6
Device  \Driver\ParVdm IRP_MJ_DIRECTORY_CONTROL              816290B6
Device  \Driver\ParVdm IRP_MJ_FILE_SYSTEM_CONTROL            816290B6
Device  \Driver\ParVdm IRP_MJ_DEVICE_CONTROL                 816290B6
Device  \Driver\ParVdm IRP_MJ_INTERNAL_DEVICE_CONTROL        816290B6
Device  \Driver\ParVdm IRP_MJ_SHUTDOWN                       816290B6
Device  \Driver\ParVdm IRP_MJ_LOCK_CONTROL                   816290B6
Device  \Driver\ParVdm IRP_MJ_CLEANUP                        816290B6
Device  \Driver\ParVdm IRP_MJ_CREATE_MAILSLOT                816290B6
Device  \Driver\ParVdm IRP_MJ_QUERY_SECURITY                 816290B6
Device  \Driver\ParVdm IRP_MJ_SET_SECURITY                   816290B6
Device  \Driver\ParVdm IRP_MJ_POWER                          816290B6
Device  \Driver\ParVdm IRP_MJ_SYSTEM_CONTROL                 816290B6
Device  \Driver\ParVdm IRP_MJ_DEVICE_CHANGE                  816290B6
Device  \Driver\ParVdm IRP_MJ_QUERY_QUOTA                    816290B6
Device  \Driver\ParVdm IRP_MJ_SET_QUOTA                      816290B6
Device  \Driver\ParVdm IRP_MJ_PNP                            816290B6
Device  \Driver\ParVdm IRP_MJ_PNP_POWER                      816290B6
Device  \FileSystem\Rdbss IRP_MJ_CREATE                      816290B6
Device  \FileSystem\Rdbss IRP_MJ_CREATE_NAMED_PIPE           816290B6
Device  \FileSystem\Rdbss IRP_MJ_CLOSEIRP_MJ_READ            816290B6
Device  \FileSystem\Rdbss IRP_MJ_WRITE                       816290B6
Device  \FileSystem\Rdbss IRP_MJ_QUERY_INFORMATION           816290B6
Device  \FileSystem\Rdbss IRP_MJ_SET_INFORMATION             816290B6
Device  \FileSystem\Rdbss IRP_MJ_QUERY_EA                    816290B6
Device  \FileSystem\Rdbss IRP_MJ_SET_EA                      816290B6
Device  \FileSystem\Rdbss IRP_MJ_FLUSH_BUFFERS               816290B6
Device  \FileSystem\Rdbss IRP_MJ_QUERY_VOLUME_INFORMATION    816290B6
Device  \FileSystem\Rdbss IRP_MJ_SET_VOLUME_INFORMATION      816290B6
Device  \FileSystem\Rdbss IRP_MJ_DIRECTORY_CONTROL           816290B6
Device  \FileSystem\Rdbss IRP_MJ_FILE_SYSTEM_CONTROL         816290B6
Device  \FileSystem\Rdbss IRP_MJ_DEVICE_CONTROL              816290B6
Device  \FileSystem\Rdbss IRP_MJ_INTERNAL_DEVICE_CONTROL     816290B6
Device  \FileSystem\Rdbss IRP_MJ_SHUTDOWN                    816290B6
Device  \FileSystem\Rdbss IRP_MJ_LOCK_CONTROL                816290B6
Device  \FileSystem\Rdbss IRP_MJ_CLEANUP                     816290B6
Device  \FileSystem\Rdbss IRP_MJ_CREATE_MAILSLOT             816290B6
Device  \FileSystem\Rdbss IRP_MJ_QUERY_SECURITY              816290B6
Device  \FileSystem\Rdbss IRP_MJ_SET_SECURITY                816290B6
Device  \FileSystem\Rdbss IRP_MJ_POWER                       816290B6
Device  \FileSystem\Rdbss IRP_MJ_SYSTEM_CONTROL              816290B6
Device  \FileSystem\Rdbss IRP_MJ_DEVICE_CHANGE               816290B6
Device  \FileSystem\Rdbss IRP_MJ_QUERY_QUOTA                 816290B6
Device  \FileSystem\Rdbss IRP_MJ_SET_QUOTA                   816290B6
Device  \FileSystem\Rdbss IRP_MJ_PNP                         816290B6
Device  \FileSystem\Rdbss IRP_MJ_PNP_POWER                   816290B6
Device  \Driver\Parallel IRP_MJ_CREATE                       816290B6
Device  \Driver\Parallel IRP_MJ_CREATE_NAMED_PIPE            816290B6
Device  \Driver\Parallel IRP_MJ_CLOSEIRP_MJ_READ             816290B6
Device  \Driver\Parallel IRP_MJ_WRITE                        816290B6
Device  \Driver\Parallel IRP_MJ_QUERY_INFORMATION            816290B6
Device  \Driver\Parallel IRP_MJ_SET_INFORMATION              816290B6
Device  \Driver\Parallel IRP_MJ_QUERY_EA                     816290B6
Device  \Driver\Parallel IRP_MJ_SET_EA                       816290B6
Device  \Driver\Parallel IRP_MJ_FLUSH_BUFFERS                816290B6
Device  \Driver\Parallel IRP_MJ_QUERY_VOLUME_INFORMATION     816290B6
Device  \Driver\Parallel IRP_MJ_SET_VOLUME_INFORMATION       816290B6
Device  \Driver\Parallel IRP_MJ_DIRECTORY_CONTROL            816290B6
Device  \Driver\Parallel IRP_MJ_FILE_SYSTEM_CONTROL          816290B6
Device  \Driver\Parallel IRP_MJ_DEVICE_CONTROL               816290B6
Device  \Driver\Parallel IRP_MJ_INTERNAL_DEVICE_CONTROL      816290B6
Device  \Driver\Parallel IRP_MJ_SHUTDOWN                     816290B6
Device  \Driver\Parallel IRP_MJ_LOCK_CONTROL                 816290B6
Device  \Driver\Parallel IRP_MJ_CLEANUP                      816290B6
Device  \Driver\Parallel IRP_MJ_CREATE_MAILSLOT              816290B6
Device  \Driver\Parallel IRP_MJ_QUERY_SECURITY               816290B6
Device  \Driver\Parallel IRP_MJ_SET_SECURITY                 816290B6
Device  \Driver\Parallel IRP_MJ_POWER                        816290B6
Device  \Driver\Parallel IRP_MJ_SYSTEM_CONTROL               816290B6
Device  \Driver\Parallel IRP_MJ_DEVICE_CHANGE                816290B6
Device  \Driver\Parallel IRP_MJ_QUERY_QUOTA                  816290B6
Device  \Driver\Parallel IRP_MJ_SET_QUOTA                    816290B6
Device  \Driver\Parallel IRP_MJ_PNP                          816290B6
Device  \Driver\Parallel IRP_MJ_PNP_POWER                    816290B6
Device  \Driver\Ptilink IRP_MJ_CREATE                        816290B6
Device  \Driver\Ptilink IRP_MJ_CREATE_NAMED_PIPE             816290B6
Device  \Driver\Ptilink IRP_MJ_CLOSEIRP_MJ_READ              816290B6
Device  \Driver\Ptilink IRP_MJ_WRITE                         816290B6
Device  \Driver\Ptilink IRP_MJ_QUERY_INFORMATION             816290B6
Device  \Driver\Ptilink IRP_MJ_SET_INFORMATION               816290B6
Device  \Driver\Ptilink IRP_MJ_QUERY_EA                      816290B6
Device  \Driver\Ptilink IRP_MJ_SET_EA                        816290B6
Device  \Driver\Ptilink IRP_MJ_FLUSH_BUFFERS                 816290B6
Device  \Driver\Ptilink IRP_MJ_QUERY_VOLUME_INFORMATION      816290B6
Device  \Driver\Ptilink IRP_MJ_SET_VOLUME_INFORMATION        816290B6
Device  \Driver\Ptilink IRP_MJ_DIRECTORY_CONTROL             816290B6
Device  \Driver\Ptilink IRP_MJ_FILE_SYSTEM_CONTROL           816290B6
Device  \Driver\Ptilink IRP_MJ_DEVICE_CONTROL                816290B6
Device  \Driver\Ptilink IRP_MJ_INTERNAL_DEVICE_CONTROL       816290B6
Device  \Driver\Ptilink IRP_MJ_SHUTDOWN                      816290B6
Device  \Driver\Ptilink IRP_MJ_LOCK_CONTROL                  816290B6
Device  \Driver\Ptilink IRP_MJ_CLEANUP                       816290B6
Device  \Driver\Ptilink IRP_MJ_CREATE_MAILSLOT               816290B6
Device  \Driver\Ptilink IRP_MJ_QUERY_SECURITY                816290B6
Device  \Driver\Ptilink IRP_MJ_SET_SECURITY                  816290B6
Device  \Driver\Ptilink IRP_MJ_POWER                         816290B6
Device  \Driver\Ptilink IRP_MJ_SYSTEM_CONTROL                816290B6
Device  \Driver\Ptilink IRP_MJ_DEVICE_CHANGE                 816290B6
Device  \Driver\Ptilink IRP_MJ_QUERY_QUOTA                   816290B6
Device  \Driver\Ptilink IRP_MJ_SET_QUOTA                     816290B6
Device  \Driver\Ptilink IRP_MJ_PNP                           816290B6
Device  \Driver\Ptilink IRP_MJ_PNP_POWER                     816290B6
Device  \FileSystem\MRxSmb IRP_MJ_CREATE                     816290B6
Device  \FileSystem\MRxSmb IRP_MJ_CREATE_NAMED_PIPE          816290B6
Device  \FileSystem\MRxSmb IRP_MJ_CLOSEIRP_MJ_READ           816290B6
Device  \FileSystem\MRxSmb IRP_MJ_WRITE                      816290B6
Device  \FileSystem\MRxSmb IRP_MJ_QUERY_INFORMATION          816290B6
Device  \FileSystem\MRxSmb IRP_MJ_SET_INFORMATION            816290B6
Device  \FileSystem\MRxSmb IRP_MJ_QUERY_EA                   816290B6
Device  \FileSystem\MRxSmb IRP_MJ_SET_EA                     816290B6
Device  \FileSystem\MRxSmb IRP_MJ_FLUSH_BUFFERS              816290B6
Device  \FileSystem\MRxSmb IRP_MJ_QUERY_VOLUME_INFORMATION   816290B6
Device  \FileSystem\MRxSmb IRP_MJ_SET_VOLUME_INFORMATION     816290B6
Device  \FileSystem\MRxSmb IRP_MJ_DIRECTORY_CONTROL          816290B6
Device  \FileSystem\MRxSmb IRP_MJ_FILE_SYSTEM_CONTROL        816290B6
Device  \FileSystem\MRxSmb IRP_MJ_DEVICE_CONTROL             816290B6
Device  \FileSystem\MRxSmb IRP_MJ_INTERNAL_DEVICE_CONTROL    816290B6
Device  \FileSystem\MRxSmb IRP_MJ_SHUTDOWN                   816290B6
Device  \FileSystem\MRxSmb IRP_MJ_LOCK_CONTROL               816290B6
Device  \FileSystem\MRxSmb IRP_MJ_CLEANUP                    816290B6
Device  \FileSystem\MRxSmb IRP_MJ_CREATE_MAILSLOT            816290B6
Device  \FileSystem\MRxSmb IRP_MJ_QUERY_SECURITY             816290B6
Device  \FileSystem\MRxSmb IRP_MJ_SET_SECURITY               816290B6
Device  \FileSystem\MRxSmb IRP_MJ_POWER                      816290B6
Device  \FileSystem\MRxSmb IRP_MJ_SYSTEM_CONTROL             816290B6
Device  \FileSystem\MRxSmb IRP_MJ_DEVICE_CHANGE              816290B6
Device  \FileSystem\MRxSmb IRP_MJ_QUERY_QUOTA                816290B6
Device  \FileSystem\MRxSmb IRP_MJ_SET_QUOTA                  816290B6
Device  \FileSystem\MRxSmb IRP_MJ_PNP                        816290B6
Device  \FileSystem\MRxSmb IRP_MJ_PNP_POWER                  816290B6
Device  \FileSystem\Npfs IRP_MJ_CREATE                       816290B6
Device  \FileSystem\Npfs IRP_MJ_CREATE_NAMED_PIPE            816290B6
Device  \FileSystem\Npfs IRP_MJ_CLOSEIRP_MJ_READ             816290B6
Device  \FileSystem\Npfs IRP_MJ_WRITE                        816290B6
Device  \FileSystem\Npfs IRP_MJ_QUERY_INFORMATION            816290B6
Device  \FileSystem\Npfs IRP_MJ_SET_INFORMATION              816290B6
Device  \FileSystem\Npfs IRP_MJ_QUERY_EA                     816290B6
Device  \FileSystem\Npfs IRP_MJ_SET_EA                       816290B6
Device  \FileSystem\Npfs IRP_MJ_FLUSH_BUFFERS                816290B6
Device  \FileSystem\Npfs IRP_MJ_QUERY_VOLUME_INFORMATION     816290B6
Device  \FileSystem\Npfs IRP_MJ_SET_VOLUME_INFORMATION       816290B6
Device  \FileSystem\Npfs IRP_MJ_DIRECTORY_CONTROL            816290B6
Device  \FileSystem\Npfs IRP_MJ_FILE_SYSTEM_CONTROL          816290B6
Device  \FileSystem\Npfs IRP_MJ_DEVICE_CONTROL               816290B6
Device  \FileSystem\Npfs IRP_MJ_INTERNAL_DEVICE_CONTROL      816290B6
Device  \FileSystem\Npfs IRP_MJ_SHUTDOWN                     816290B6
Device  \FileSystem\Npfs IRP_MJ_LOCK_CONTROL                 816290B6
Device  \FileSystem\Npfs IRP_MJ_CLEANUP                      816290B6
Device  \FileSystem\Npfs IRP_MJ_CREATE_MAILSLOT              816290B6
Device  \FileSystem\Npfs IRP_MJ_QUERY_SECURITY               816290B6
Device  \FileSystem\Npfs IRP_MJ_SET_SECURITY                 816290B6
Device  \FileSystem\Npfs IRP_MJ_POWER                        816290B6
Device  \FileSystem\Npfs IRP_MJ_SYSTEM_CONTROL               816290B6
Device  \FileSystem\Npfs IRP_MJ_DEVICE_CHANGE                816290B6
Device  \FileSystem\Npfs IRP_MJ_QUERY_QUOTA                  816290B6
Device  \FileSystem\Npfs IRP_MJ_SET_QUOTA                    816290B6
Device  \FileSystem\Npfs IRP_MJ_PNP                          816290B6
Device  \FileSystem\Npfs IRP_MJ_PNP_POWER                    816290B6
Device  \FileSystem\Msfs IRP_MJ_CREATE                       816290B6
Device  \FileSystem\Msfs IRP_MJ_CREATE_NAMED_PIPE            816290B6
Device  \FileSystem\Msfs IRP_MJ_CLOSEIRP_MJ_READ             816290B6
Device  \FileSystem\Msfs IRP_MJ_WRITE                        816290B6
Device  \FileSystem\Msfs IRP_MJ_QUERY_INFORMATION            816290B6
Device  \FileSystem\Msfs IRP_MJ_SET_INFORMATION              816290B6
Device  \FileSystem\Msfs IRP_MJ_QUERY_EA                     816290B6
Device  \FileSystem\Msfs IRP_MJ_SET_EA                       816290B6
Device  \FileSystem\Msfs IRP_MJ_FLUSH_BUFFERS                816290B6
Device  \FileSystem\Msfs IRP_MJ_QUERY_VOLUME_INFORMATION     816290B6
Device  \FileSystem\Msfs IRP_MJ_SET_VOLUME_INFORMATION       816290B6
Device  \FileSystem\Msfs IRP_MJ_DIRECTORY_CONTROL            816290B6
Device  \FileSystem\Msfs IRP_MJ_FILE_SYSTEM_CONTROL          816290B6
Device  \FileSystem\Msfs IRP_MJ_DEVICE_CONTROL               816290B6
Device  \FileSystem\Msfs IRP_MJ_INTERNAL_DEVICE_CONTROL      816290B6
Device  \FileSystem\Msfs IRP_MJ_SHUTDOWN                     816290B6
Device  \FileSystem\Msfs IRP_MJ_LOCK_CONTROL                 816290B6
Device  \FileSystem\Msfs IRP_MJ_CLEANUP                      816290B6
Device  \FileSystem\Msfs IRP_MJ_CREATE_MAILSLOT              816290B6
Device  \FileSystem\Msfs IRP_MJ_QUERY_SECURITY               816290B6
Device  \FileSystem\Msfs IRP_MJ_SET_SECURITY                 816290B6
Device  \FileSystem\Msfs IRP_MJ_POWER                        816290B6
Device  \FileSystem\Msfs IRP_MJ_SYSTEM_CONTROL               816290B6
Device  \FileSystem\Msfs IRP_MJ_DEVICE_CHANGE                816290B6
Device  \FileSystem\Msfs IRP_MJ_QUERY_QUOTA                  816290B6
Device  \FileSystem\Msfs IRP_MJ_SET_QUOTA                    816290B6
Device  \FileSystem\Msfs IRP_MJ_PNP                          816290B6
Device  \FileSystem\Msfs IRP_MJ_PNP_POWER                    816290B6
Device  \Driver\AFD IRP_MJ_CREATE                            816290B6
Device  \Driver\AFD IRP_MJ_CREATE_NAMED_PIPE                 816290B6
Device  \Driver\AFD IRP_MJ_CLOSEIRP_MJ_READ                  816290B6
Device  \Driver\AFD IRP_MJ_WRITE                             816290B6
Device  \Driver\AFD IRP_MJ_QUERY_INFORMATION                 816290B6
Device  \Driver\AFD IRP_MJ_SET_INFORMATION                   816290B6
Device  \Driver\AFD IRP_MJ_QUERY_EA                          816290B6
Device  \Driver\AFD IRP_MJ_SET_EA                            816290B6
Device  \Driver\AFD IRP_MJ_FLUSH_BUFFERS                     816290B6
Device  \Driver\AFD IRP_MJ_QUERY_VOLUME_INFORMATION          816290B6
Device  \Driver\AFD IRP_MJ_SET_VOLUME_INFORMATION            816290B6
Device  \Driver\AFD IRP_MJ_DIRECTORY_CONTROL                 816290B6
Device  \Driver\AFD IRP_MJ_FILE_SYSTEM_CONTROL               816290B6
Device  \Driver\AFD IRP_MJ_DEVICE_CONTROL                    816290B6
Device  \Driver\AFD IRP_MJ_INTERNAL_DEVICE_CONTROL           816290B6
Device  \Driver\AFD IRP_MJ_SHUTDOWN                          816290B6
Device  \Driver\AFD IRP_MJ_LOCK_CONTROL                      816290B6
Device  \Driver\AFD IRP_MJ_CLEANUP                           816290B6
Device  \Driver\AFD IRP_MJ_CREATE_MAILSLOT                   816290B6
Device  \Driver\AFD IRP_MJ_QUERY_SECURITY                    816290B6
Device  \Driver\AFD IRP_MJ_SET_SECURITY                      816290B6
Device  \Driver\AFD IRP_MJ_POWER                             816290B6
Device  \Driver\AFD IRP_MJ_SYSTEM_CONTROL                    816290B6
Device  \Driver\AFD IRP_MJ_DEVICE_CHANGE                     816290B6
Device  \Driver\AFD IRP_MJ_QUERY_QUOTA                       816290B6
Device  \Driver\AFD IRP_MJ_SET_QUOTA                         816290B6
Device  \Driver\AFD IRP_MJ_PNP                               816290B6
Device  \Driver\AFD IRP_MJ_PNP_POWER                         816290B6
Device  \FileSystem\Fastfat IRP_MJ_CREATE                    816290B6
Device  \FileSystem\Fastfat IRP_MJ_CREATE_NAMED_PIPE         816290B6
Device  \FileSystem\Fastfat IRP_MJ_CLOSEIRP_MJ_READ          816290B6
Device  \FileSystem\Fastfat IRP_MJ_WRITE                     816290B6
Device  \FileSystem\Fastfat IRP_MJ_QUERY_INFORMATION         816290B6
Device  \FileSystem\Fastfat IRP_MJ_SET_INFORMATION           816290B6
Device  \FileSystem\Fastfat IRP_MJ_QUERY_EA                  816290B6
Device  \FileSystem\Fastfat IRP_MJ_SET_EA                    816290B6
Device  \FileSystem\Fastfat IRP_MJ_FLUSH_BUFFERS             816290B6
Device  \FileSystem\Fastfat IRP_MJ_QUERY_VOLUME_INFORMATION  816290B6
Device  \FileSystem\Fastfat IRP_MJ_SET_VOLUME_INFORMATION    816290B6
Device  \FileSystem\Fastfat IRP_MJ_DIRECTORY_CONTROL         816290B6
Device  \FileSystem\Fastfat IRP_MJ_FILE_SYSTEM_CONTROL       816290B6
Device  \FileSystem\Fastfat IRP_MJ_DEVICE_CONTROL            816290B6
Device  \FileSystem\Fastfat IRP_MJ_INTERNAL_DEVICE_CONTROL   816290B6
Device  \FileSystem\Fastfat IRP_MJ_SHUTDOWN                  816290B6
Device  \FileSystem\Fastfat IRP_MJ_LOCK_CONTROL              816290B6
Device  \FileSystem\Fastfat IRP_MJ_CLEANUP                   816290B6
Device  \FileSystem\Fastfat IRP_MJ_CREATE_MAILSLOT           816290B6
Device  \FileSystem\Fastfat IRP_MJ_QUERY_SECURITY            816290B6
Device  \FileSystem\Fastfat IRP_MJ_SET_SECURITY              816290B6
Device  \FileSystem\Fastfat IRP_MJ_POWER                     816290B6
Device  \FileSystem\Fastfat IRP_MJ_SYSTEM_CONTROL            816290B6
Device  \FileSystem\Fastfat IRP_MJ_DEVICE_CHANGE             816290B6
Device  \FileSystem\Fastfat IRP_MJ_QUERY_QUOTA               816290B6
Device  \FileSystem\Fastfat IRP_MJ_SET_QUOTA                 816290B6
Device  \FileSystem\Fastfat IRP_MJ_PNP                       816290B6
Device  \FileSystem\Fastfat IRP_MJ_PNP_POWER                 816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_CREATE                     816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_CREATE_NAMED_PIPE          816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_CLOSEIRP_MJ_READ           816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_WRITE                      816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_QUERY_INFORMATION          816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_SET_INFORMATION            816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_QUERY_EA                   816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_SET_EA                     816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_FLUSH_BUFFERS              816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_QUERY_VOLUME_INFORMATION   816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_SET_VOLUME_INFORMATION     816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_DIRECTORY_CONTROL          816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_FILE_SYSTEM_CONTROL        816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_DEVICE_CONTROL             816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_INTERNAL_DEVICE_CONTROL    816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_SHUTDOWN                   816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_LOCK_CONTROL               816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_CLEANUP                    816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_CREATE_MAILSLOT            816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_QUERY_SECURITY             816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_SET_SECURITY               816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_POWER                      816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_SYSTEM_CONTROL             816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_DEVICE_CHANGE              816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_QUERY_QUOTA                816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_SET_QUOTA                  816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_PNP                        816290B6
Device  \FileSystem\Fs_Rec IRP_MJ_PNP_POWER                  816290B6