Backdoor.Agent in HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Shell

Hajaku

aswMBR version 0.9.9.1532 Copyright(c) 2011 AVAST Software
Run date: 2012-01-27 20:02:21
-----------------------------
20:02:21.186 OS Version: Windows 6.0.6002 Service Pack 2
20:02:21.186 Number of processors: 4 586 0x203
20:02:21.189 ComputerName: TUAN-PC UserName: Tuan
20:02:25.943 Initialize success
20:03:06.967 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005c
20:03:06.970 Disk 0 Vendor: WDC_WD64 01.0 Size: 610480MB BusType: 8
20:03:06.996 Disk 0 MBR read successfully
20:03:07.000 Disk 0 MBR scan
20:03:07.004 Disk 0 unknown MBR code
20:03:07.008 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 597009 MB offset 63
20:03:07.050 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 13468 MB offset 1222675020
20:03:07.057 Disk 0 scanning sectors +1250258625
20:03:07.134 Disk 0 scanning C:\Windows\system32\drivers
20:03:20.389 Service scanning
20:03:22.258 Modules scanning
20:03:39.249 Disk 0 trace - called modules:
20:03:39.311 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys
20:03:39.318 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87245ac8]
20:03:39.327 3 CLASSPNP.SYS[807388b3] -> nt!IofCallDriver -> [0x8663e700]
20:03:39.335 5 acpi.sys[806156bc] -> nt!IofCallDriver -> \Device\0000005c[0x861e4c90]
20:03:39.343 Scan finished successfully
20:03:59.058 Disk 0 MBR has been saved successfully to "C:\Users\Tuan\Desktop\MBR.dat"
20:03:59.066 The log file has been saved successfully to "C:\Users\Tuan\Desktop\aswMBR.txt"