[Resolved] frozen computer (some type of trojan?) help, please. :)

Here it is. Sorry I couldn't get the whole thing for you. Nothing else was highlighted in red during the longer scan and it appeared that it had gotten through almost all of the files.

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-06 07:09:54
Windows 5.1.2600 Service Pack 3
Running: gfmer.exe; Driver: C:\DOCUME~1\SONNGU~1\LOCALS~1\Temp\awrirpob.sys


—- System - GMER 1.0.15 —-

INT 0x62 ? 8A84DBF8
INT 0x63 ? 8A681F00
INT 0x82 ? 8A84DBF8
INT 0xA4 ? 8A681F00
INT 0xB4 ? 8A84DBF8
INT 0xB4 ? 8A84DBF8
INT 0xB4 ? 8A681F00
INT 0xB4 ? 8A84DBF8

Code 8A467460 ZwEnumerateKey
Code 8A52A2F0 ZwFlushInstructionCache
Code 8A3172EE IofCallDriver
Code 8A396676 IofCompleteRequest

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!IofCallDriver 804E13A7 5 Bytes JMP 8A3172F3
.text ntoskrnl.exe!IofCompleteRequest 804E17BD 5 Bytes JMP 8A39667B
.text ntoskrnl.exe!RtlNtStatusToDosErrorNoTeb + 2A3 80517600 6 Bytes [7A, 01, 00, C0, 0D, 00]
.text ntoskrnl.exe!RtlNtStatusToDosErrorNoTeb + 2AA 80517607 19 Bytes [00, 88, 01, 00, C0, 09, 00, …]
.text ntoskrnl.exe!RtlNtStatusToDosErrorNoTeb + 2BE 8051761B 10 Bytes [C0, 02, 00, 01, 00, 03, 02, …]
.text ntoskrnl.exe!RtlNtStatusToDosErrorNoTeb + 2C9 80517626 36 Bytes [01, 00, 1C, 02, 00, C0, 01, …]
.text ntoskrnl.exe!RtlNtStatusToDosErrorNoTeb + 2EE 8051764B 22 Bytes [C0, 01, 00, 01, 00, 30, 02, …]
.text …
.text ntoskrnl.exe!IoCancelIrp + C 80518485 5 Bytes [00, 56, 8B, 75, 08] {ADD [ESI-0x75], DL; JNZ 0xd}
.text ntoskrnl.exe!IoCancelIrp + 12 8051848B 45 Bytes [85, F5, 82, 00, 00, 8D, 45, …]
.text ntoskrnl.exe!IoCancelIrp + 40 805184B9 30 Bytes [00, 8A, 4D, FC, 88, 4E, 25, …]
.text ntoskrnl.exe!IoCancelIrp + 5F 805184D8 61 Bytes [80, 8A, D0, 8B, 46, 50, 3B, …]
.text ntoskrnl.exe!IoCancelIrp + 9D 80518516 2 Bytes [8A, 55]
.text …
.text ntoskrnl.exe!ExExtendZone + 4F 80518589 38 Bytes [33, C0, 5E, 5B, 5D, C2, 0C, …]
.text ntoskrnl.exe!ExExtendZone + 76 805185B0 8 Bytes CALL 8059DF8C \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!ExExtendZone + 7F 805185B9 8 Bytes [75, 08, 8A, D8, E8, CD, 59, …]
.text ntoskrnl.exe!ExExtendZone + 88 805185C2 60 Bytes [3A, C3, 0F, 85, 38, B1, FE, …]
.text ntoskrnl.exe!ExExtendZone + C5 805185FF 56 Bytes [01, 0F, 83, CC, 3E, FC, FF, …]
.text ntoskrnl.exe!IoBuildDeviceIoControlRequest + C 80518638 10 Bytes [8B, 45, 0C, 8A, 40, 30, 88, …]
.text ntoskrnl.exe!IoBuildDeviceIoControlRequest + 17 80518643 32 Bytes [57, FF, 75, E4, FF, 15, 88, …]
.text ntoskrnl.exe!IoBuildDeviceIoControlRequest + 38 80518664 46 Bytes [0F, 95, C1, 80, C1, 0E, 88, …]
.text ntoskrnl.exe!IoBuildDeviceIoControlRequest + 67 80518693 33 Bytes [83, F9, 03, 75, 0C, 8B, 4D, …]
.text ntoskrnl.exe!IoBuildDeviceIoControlRequest + 89 805186B5 77 Bytes [00, 89, 43, 50, B1, 01, FF, …]
.text …
.text ntoskrnl.exe!KeSetAffinityThread + F 8051888A 29 Bytes [8B, 55, 0C, 8B, 4D, 08, 8A, …]
.text ntoskrnl.exe!KeSetAffinityThread + 2D 805188A8 42 Bytes [3B, 4D, FC, 0F, 85, 16, 3A, …]
.text ntoskrnl.exe!KeSetAffinityThread + 58 805188D3 8 Bytes [89, 45, F8, 8B, 86, 38, 01, …]
.text ntoskrnl.exe!KeSetAffinityThread + 61 805188DC 35 Bytes [8B, 40, 10, 8B, 40, 5C, 23, …]
.text ntoskrnl.exe!KeSetAffinityThread + 86 80518901 167 Bytes [00, 75, 2F, 0F, B6, 46, 2D, …]
.text …
.text ntoskrnl.exe!PoUnregisterSystemState + 2 80518B78 45 Bytes [55, 8B, EC, 68, 00, 00, 00, …]
.text ntoskrnl.exe!KeInitializeMutex + B 80518BA6 64 Bytes [C6, 00, 02, C6, 40, 02, 08, …]
.text ntoskrnl.exe!IoAllocateAdapterChannel + 19 80518BE7 26 Bytes [75, 08, 89, 48, 20, 8B, 4D, …]
.text ntoskrnl.exe!IoAllocateAdapterChannel + 34 80518C02 19 Bytes [75, 14, FF, 75, 10, E8, 85, …]
.text ntoskrnl.exe!IoAllocateAdapterChannel + 49 80518C17 15 Bytes [89, 7D, FC, 33, C9, 83, 7D, …] {MOV [EBP-0x4], EDI; XOR ECX, ECX; CMP DWORD [EBP+0x8], 0x3; SETZ CL; PUSH ECX; PUSH EDI; PUSH EAX}
.text ntoskrnl.exe!IoAllocateAdapterChannel + 59 80518C27 18 Bytes [B4, DF, FD, FF, 83, 4D, FC, …]
.text ntoskrnl.exe!IoCsqInsertIrp + 1 80518C3A 81 Bytes [FF, 55, 8B, EC, 53, 8B, 5D, …]
.text ntoskrnl.exe!IoCsqInsertIrp + 53 80518C8C 48 Bytes [75, 0C, 56, FF, 56, 14, 5F, …]
.text ntoskrnl.exe!IoCsqRemoveIrp + 1F 80518CBD 25 Bytes [0F, 84, B0, 38, 00, 00, 33, …]
.text ntoskrnl.exe!IoCsqRemoveIrp + 39 80518CD7 15 Bytes [83, 63, 04, 00, 83, 67, 4C, …] {AND DWORD [EBX+0x4], 0x0; AND DWORD [EDI+0x4c], 0x0; PUSH DWORD [EBP+0x8]; PUSH ESI; CALL [ESI+0x14]}
.text ntoskrnl.exe!IoCsqRemoveIrp + 49 80518CE7 6 Bytes [C7, 5F, 5E, 5B, 5D, C2]
.text ntoskrnl.exe!IoCsqRemoveIrp + 50 80518CEE 7 Bytes [00, 90, 90, 90, 90, 90, 8B]
.text ntoskrnl.exe!wcscat + 2 80518CF6 57 Bytes [55, 8B, EC, 8B, 45, 08, 66, …]
.text ntoskrnl.exe!wcscat + 3C 80518D30 7 Bytes [40, 18, 3D, 01, 03, 00, 00] {INC EAX; SBB [0x301], BH}
.text ntoskrnl.exe!wcscat + 44 80518D38 85 Bytes [8C, 2E, D1, FE, FF, 3D, 04, …]
.text ntoskrnl.exe!IoBuildSynchronousFsdRequest + 1D 80518D8E 21 Bytes [8B, F8, 85, FF, 74, 34, 8B, …]
.text ntoskrnl.exe!IoBuildSynchronousFsdRequest + 33 80518DA4 72 Bytes [8B, 57, 50, 81, C2, 10, 02, …]
.text ntoskrnl.exe!IoBuildSynchronousFsdRequest + 7C 80518DED 29 Bytes [84, AB, 93, FE, FF, 48, 0F, …]
.text ntoskrnl.exe!IoBuildSynchronousFsdRequest + 9A 80518E0B 29 Bytes [75, 05, B9, FF, FF, FF, 7F, …]
.text ntoskrnl.exe!IoBuildSynchronousFsdRequest + B8 80518E29 148 Bytes [40, FC, 89, 85, E4, FD, FF, …]
.text …
.text ntoskrnl.exe!ExNotifyCallback + 17 805190EF 15 Bytes [8D, 4E, 04, 89, 4D, FC, FF, …]
.text ntoskrnl.exe!ExNotifyCallback + 27 805190FF 58 Bytes [88, 45, 0B, 0F, 85, A4, FF, …]
.text ntoskrnl.exe!ExGetPreviousMode + 5 8051913A 18 Bytes [00, 8A, 80, 40, 01, 00, 00, …]
.text ntoskrnl.exe!ExGetPreviousMode + 19 8051914E 24 Bytes [0F, 85, F5, 25, 16, 00, C3, …]
.text ntoskrnl.exe!ExGetPreviousMode + 32 80519167 102 Bytes JMP 80515024 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!RtlMapSecurityErrorToNtStatus + 44 805191CE 94 Bytes [60, 80, 82, FB, 60, 80, 83, …]
.text ntoskrnl.exe!RtlMapSecurityErrorToNtStatus + A3 8051922D 180 Bytes [00, 00, 00, 0F, 84, EF, 17, …]
.text ntoskrnl.exe!PoRegisterSystemState + 49 805192E2 2 Bytes [BE, 29]
.text ntoskrnl.exe!PoRegisterSystemState + 4C 805192E5 105 Bytes [00, 00, 00, 0F, 85, 8C, CB, …]
.text ntoskrnl.exe!PoRegisterSystemState + B7 80519350 58 Bytes [85, 71, 2E, 01, 00, 8B, C7, …]
.text ntoskrnl.exe!PoRegisterSystemState + F2 8051938B 30 Bytes CALL 804E2405 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!PoRegisterSystemState + 111 805193AA 36 Bytes CALL 804E61A4 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text …
.text ntoskrnl.exe!RtlInsertElementGenericTableAvl + 58 80519437 3 Bytes JMP 80503349 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!RtlInsertElementGenericTableAvl + 5C 8051943B 69 Bytes JMP 805032DD \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!RtlInsertElementGenericTableAvl + A2 80519481 9 Bytes [CF, 3B, C8, 0F, 86, 88, 72, …] {IRET ; CMP ECX, EAX; JBE 0xfffffffffffd7291}
.text ntoskrnl.exe!RtlInsertElementGenericTableAvl + AC 8051948B 21 Bytes [DC, FE, 00, 00, 90, 90, 90, …]
.text ntoskrnl.exe!RtlInsertElementGenericTableAvl + C2 805194A1 1 Byte [55]
.text …
.text ntoskrnl.exe!RtlWalkFrameChain + 7 80519607 8 Bytes CALL 804E2E83 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!RtlWalkFrameChain + 10 80519610 19 Bytes [75, D8, 89, 75, E0, 33, DB, …] {JNZ 0xffffffffffffffda; MOV [EBP-0x20], ESI; XOR EBX, EBX; MOV [EBP-0x19], BL; CMP [EBP+0x10], EBX; JZ 0x12b}
.text ntoskrnl.exe!RtlWalkFrameChain + 24 80519624 18 Bytes [5D, FC, 83, 7D, 10, 01, 0F, …] {POP EBP; CLD ; CMP DWORD [EBP+0x10], 0x1; JNZ 0x9d; MOV EAX, FS:[0x124]}
.text ntoskrnl.exe!RtlWalkFrameChain + 37 80519637 63 Bytes [45, D0, 8B, B0, 34, 01, 00, …]
.text ntoskrnl.exe!RtlWalkFrameChain + 77 80519677 8 Bytes [89, 45, C4, 80, B8, 65, 01, …]
.text …
.text ntoskrnl.exe!IoInitializeIrp + 2 805197B6 20 Bytes [55, 8B, EC, 80, 3D, 1C, B8, …]
.text ntoskrnl.exe!IoInitializeIrp + 17 805197CB 15 Bytes [DB, 6B, 00, 00, 0F, B7, 4D, …]
.text ntoskrnl.exe!IoInitializeIrp + 27 805197DB 43 Bytes [FE, F3, AB, 8B, CA, 83, E1, …]
.text ntoskrnl.exe!IoInitializeIrp + 54 80519808 8 Bytes [88, 46, 26, 8D, 46, 10, 89, …]
.text ntoskrnl.exe!IoInitializeIrp + 5D 80519811 5 Bytes [89, 00, 0F, BE, C3] {MOV [EAX], EAX; MOVSX EAX, BL}
.text …
.text ntoskrnl.exe!KeSetIdealProcessorThread + 2A 80519856 16 Bytes [00, 88, 86, BA, 01, 00, 00, …]
.text ntoskrnl.exe!KeSetIdealProcessorThread + 3B 80519867 3 Bytes [C0, 23, 56] {SHL BYTE [EBX], 0x56}
.text ntoskrnl.exe!KeSetIdealProcessorThread + 3F 8051986B 4 Bytes [8B, 80, CC, 04]
.text ntoskrnl.exe!KeSetIdealProcessorThread + 44 80519870 23 Bytes [00, 8B, 00, 8A, 4D, FF, 89, …]
.text ntoskrnl.exe!KeSetIdealProcessorThread + 5C 80519888 34 Bytes [00, 90, 90, 90, 90, 90, 90, …]
.text ntoskrnl.exe!_stricmp + A 805198AB 6 Bytes [EC, 57, 56, 53, 8B, 75]
.text ntoskrnl.exe!_stricmp + 11 805198B2 56 Bytes [8B, 7D, 08, B0, FF, 8B, FF, …]
.text ntoskrnl.exe!_stricmp + 4A 805198EB 24 Bytes [0F, BE, C0, 5B, 5E, 5F, C9, …]
.text ntoskrnl.exe!_stricmp + 63 80519904 11 Bytes [85, C0, 75, 53, 8B, 14, B5, …] {TEST EAX, EAX; JNZ 0x57; MOV EDX, [ESI*4-0x7fa9dc40]}
.text ntoskrnl.exe!_stricmp + 6F 80519910 21 Bytes [42, 0C, 57, 33, FF, 47, 8B, …]
.text …
.text ntoskrnl.exe!MmUnlockPagableImageSection + 13 8051A176 50 Bytes [00, 8B, 89, 00, 00, 30, C0, …]
.text ntoskrnl.exe!MmUnlockPagableImageSection + 46 8051A1A9 70 Bytes [8B, F2, C1, EE, 0A, B9, FC, …]
.text ntoskrnl.exe!MmUnlockPagableImageSection + 8D 8051A1F0 1 Byte [88]
.text ntoskrnl.exe!MmUnlockPagableImageSection + 8D 8051A1F0 107 Bytes [88, 45, 0B, 8B, 06, 8B, 0D, …]
.text ntoskrnl.exe!MmUnlockPagableImageSection + F9 8051A25C 135 Bytes [8D, 43, 34, 39, 00, 74, F2, …]
.text …
.text ntoskrnl.exe!PoSetSystemState + 15 8051A472 2 Bytes [75, 08] {JNZ 0xa}
.text ntoskrnl.exe!PoSetSystemState + 18 8051A475 2 Bytes CALL 80519207 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!PoSetSystemState + 1C 8051A479 11 Bytes CALL 805191E5 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!PoSetSystemState + 2A 8051A487 44 Bytes [90, 90, 83, 3D, 84, 90, 56, …]
.text ntoskrnl.exe!PoSetSystemState + 57 8051A4B4 26 Bytes [C0, 75, 1C, 21, 05, 60, C4, …]
.text …
.text ntoskrnl.exe!KeAreApcsDisabled + 28 8051AE8C 39 Bytes [C7, 83, F8, FF, 74, 1C, C7, …]
.text ntoskrnl.exe!KeAreApcsDisabled + 50 8051AEB4 6 Bytes [00, 89, 1D, 24, 34, 56] {ADD [ECX+0x5634241d], CL}
.text ntoskrnl.exe!KeAreApcsDisabled + 57 8051AEBB 12 Bytes [EB, E4, 90, 90, 90, 90, 90, …]
.text ntoskrnl.exe!KeAreApcsDisabled + 64 8051AEC8 19 Bytes [8D, 88, 28, 04, 00, 00, E8, …]
.text ntoskrnl.exe!KeAreApcsDisabled + 78 8051AEDC 31 Bytes [C6, 05, 94, BC, 55, 80, 01, …]
.text …
.text ntoskrnl.exe!KeInsertHeadQueue + A 8051AF65 59 Bytes [15, 88, 80, 4D, 80, 8B, 55, …]
.text ntoskrnl.exe!KeInsertHeadQueue + 46 8051AFA1 56 Bytes [0C, 01, 0F, 84, EF, 2E, 00, …]
.text ntoskrnl.exe!KeInsertHeadQueue + 7F 8051AFDA 18 Bytes [C6, F6, 40, 0D, 40, 57, 0F, …]
.text ntoskrnl.exe!KeInsertHeadQueue + 92 8051AFED 93 Bytes [15, 10, 79, 55, 80, FF, 05, …]
.text ntoskrnl.exe!KeInsertHeadQueue + F0 8051B04B 54 Bytes [00, 3B, 05, 40, 34, 56, 80, …]
.text …
.text ntoskrnl.exe!ZwSignalAndWaitForSingleObject + 44 8051C3AD 14 Bytes [00, 00, 00, 53, 8D, 45, E0, …]
.text ntoskrnl.exe!ZwSignalAndWaitForSingleObject + 53 8051C3BC 60 Bytes [10, 00, FF, 75, 0C, E8, 93, …]
.text ntoskrnl.exe!ZwSignalAndWaitForSingleObject + 90 8051C3F9 24 Bytes [45, BC, F7, D0, A8, 02, 75, …]
.text ntoskrnl.exe!ZwSignalAndWaitForSingleObject + AA 8051C413 12 Bytes [57, FF, 75, 10, FF, 75, E4, …]
.text ntoskrnl.exe!ZwSignalAndWaitForSingleObject + B7 8051C420 52 Bytes [FB, FF, 8B, F0, 89, 75, C8, …]
.text …
.text ntoskrnl.exe!IoSetFileOrigin + D 8051C7D7 19 Bytes [00, C0, 0F, 84, 47, 3E, 00, …] {ADD AL, AL; JZ 0x3e4f; MOV ESI, [EBP+0x8]; MOV ECX, [ESI+0x2c]; MOV EDX, 0x1000000}
.text ntoskrnl.exe!IoSetFileOrigin + 21 8051C7EB 22 Bytes [CA, 75, 07, 0B, CA, 89, 4E, …]
.text ntoskrnl.exe!IoSetFileOrigin + 38 8051C802 8 Bytes [51, 04, 89, 10, E9, 51, D4, …] {PUSH ECX; ADD AL, 0x89; ADC CL, CH; PUSH ECX; AAM 0xfb}
.text ntoskrnl.exe!IoSetFileOrigin + 41 8051C80B 11 Bytes [8B, 45, F8, 83, C0, 40, E9, …] {MOV EAX, [EBP-0x8]; ADD EAX, 0x40; JMP 0xfffffffffffca50f}
.text ntoskrnl.exe!IoSetFileOrigin + 4D 8051C817 7 Bytes JMP 804F5930 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text …
.text ntoskrnl.exe!CcDeferWrite + 15 8052F79A 15 Bytes [3B, C3, 75, 0E, FF, 75, 14, …]
.text ntoskrnl.exe!CcDeferWrite + 25 8052F7AA 1 Byte [00]
.text ntoskrnl.exe!CcDeferWrite + 25 8052F7AA 34 Bytes [00, 00, 8B, 55, 18, 8B, 4D, …]
.text ntoskrnl.exe!CcDeferWrite + 48 8052F7CD 98 Bytes [FC, 02, 66, C7, 40, 02, 28, …]
.text ntoskrnl.exe!CcDeferWrite + AB 8052F830 103 Bytes [5B, 5D, C2, 18, 00, 90, 90, …]
.text ntoskrnl.exe!CcRepinBcb + 13 8052F898 1 Byte [00]
.text ntoskrnl.exe!CcRepinBcb + 13 8052F898 22 Bytes [00, 00, 8D, 55, F4, FF, 15, …]
.text ntoskrnl.exe!CcRepinBcb + 2A 8052F8AF 4 Bytes [5E, C9, C2, 04]
.text ntoskrnl.exe!CcRepinBcb + 2F 8052F8B4 45 Bytes [CC, CC, CC, CC, CC, CC, CC, …]
.text ntoskrnl.exe!CcRepinBcb + 5D 8052F8E2 1 Byte [00]
.text …
.text ntoskrnl.exe!CcUnpinRepinnedBcb + 1C 8052FA40 1 Byte [00]
.text ntoskrnl.exe!CcUnpinRepinnedBcb + 1C 8052FA40 75 Bytes [00, 00, F6, 40, 6D, 02, 74, …]
.text ntoskrnl.exe!CcUnpinRepinnedBcb + 68 8052FA8C 7 Bytes [00, 80, 74, 10, 81, FF, 54] {ADD [EAX-0x7eef8c], AL; PUSH ESP}
.text ntoskrnl.exe!CcUnpinRepinnedBcb + 70 8052FA94 149 Bytes [00, C0, 74, 08, 81, FF, 33, …]
.text ntoskrnl.exe!CcIsThereDirtyData + 13 8052FB2A 111 Bytes [6A, 05, 59, FF, D7, 8B, 35, …]
.text ntoskrnl.exe!CcIsThereDirtyData + 83 8052FB9A 23 Bytes [75, 9E, 32, DB, 6A, 05, 8A, …]
.text ntoskrnl.exe!CcIsThereDirtyData + 9B 8052FBB2 53 Bytes CALL 4D1FC883
.text ntoskrnl.exe!CcGetLsnForFileObject + 28 8052FBE8 1 Byte [00]
.text ntoskrnl.exe!CcGetLsnForFileObject + 28 8052FBE8 17 Bytes [00, 00, 57, 8D, 8E, B8, 00, …]
.text ntoskrnl.exe!CcGetLsnForFileObject + 3A 8052FBFA 183 Bytes [8D, 7E, 10, 8B, 07, 83, E8, …]
.text ntoskrnl.exe!CcGetLsnForFileObject + F2 8052FCB2 1 Byte [00]
.text ntoskrnl.exe!CcGetLsnForFileObject + F2 8052FCB2 103 Bytes [00, 00, EB, 1E, 8B, 06, A8, …]
.text ntoskrnl.exe!CcSetDirtyPageThreshold + 1A 8052FD1A 19 Bytes [00, 8B, 48, 0C, F6, 41, 04, …]
.text ntoskrnl.exe!CcSetDirtyPageThreshold + 2E 8052FD2E 27 Bytes [CC, CC, CC, CC, CC, CC, 90, …]
.text ntoskrnl.exe!CcGetFileObjectFromSectionPtrs + 11 8052FD4A 23 Bytes [8B, 4D, 08, 8B, 49, 04, 85, …]
.text ntoskrnl.exe!CcGetFileObjectFromSectionPtrs + 29 8052FD62 92 Bytes [8B, C6, 5E, 5D, C2, 04, 00, …]
.text ntoskrnl.exe!CcGetFileObjectFromBcb + 49 8052FDC0 13 Bytes [90, 90, 8B, FF, 55, 8B, EC, …]
.text ntoskrnl.exe!CcGetFileObjectFromBcb + 57 8052FDCE 100 Bytes [53, 8B, 5D, 08, 8B, 43, 14, …]
.text ntoskrnl.exe!CcGetFileObjectFromBcb + BC 8052FE33 42 Bytes [14, 8D, 45, F0, 50, 57, E8, …]
.text ntoskrnl.exe!CcGetFileObjectFromBcb + E7 8052FE5E 53 Bytes [FF, 4F, 04, 8A, D8, 75, 44, …]
.text ntoskrnl.exe!CcGetFileObjectFromBcb + 11D 8052FE94 5 Bytes [00, A3, C4, F6, 55]
.text …
.text ntoskrnl.exe!CcMdlWriteAbort + 1D 8052FF0C 9 Bytes [74, 04, C6, 45, FF, 01, 80, …]
.text ntoskrnl.exe!CcMdlWriteAbort + 27 8052FF16 35 Bytes [8B, 1F, 74, 06, 57, E8, 75, …]
.text ntoskrnl.exe!CcMdlWriteAbort + 4B 8052FF3A 20 Bytes [FF, 4E, 04, 8A, D8, 75, 44, …]
.text ntoskrnl.exe!CcMdlWriteAbort + 60 8052FF4F 17 Bytes [8B, 08, 8B, 50, 04, 89, 0A, …]
.text ntoskrnl.exe!CcMdlWriteAbort + 72 8052FF61 14 Bytes [C0, F6, 55, 80, 89, 48, 04, …]
.text …
.text ntoskrnl.exe!CcPrepareMdlWrite + 7 8052FFAA 103 Bytes CALL 804E2E83 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!CcPrepareMdlWrite + 6F 80530012 59 Bytes [00, 8D, 4D, E0, 51, 8D, 4D, …]
.text ntoskrnl.exe!CcPrepareMdlWrite + AB 8053004E 5 Bytes [00, B8, FF, 0F, 00]
.text ntoskrnl.exe!CcPrepareMdlWrite + B1 80530054 7 Bytes [85, F8, 75, 10, 81, 7D, E0]
.text ntoskrnl.exe!CcPrepareMdlWrite + B9 8053005C 1 Byte [10]
.text …
.text ntoskrnl.exe!CcWaitForCurrentLazyWriterActivity + F 805302E0 1 Byte [00]
.text ntoskrnl.exe!CcWaitForCurrentLazyWriterActivity + F 805302E0 7 Bytes [00, 00, 8B, B8, 48, 05, 00]
.text ntoskrnl.exe!CcWaitForCurrentLazyWriterActivity + 17 805302E8 31 Bytes [FF, 47, 0C, 8B, CF, 89, 45, …]
.text ntoskrnl.exe!CcWaitForCurrentLazyWriterActivity + 37 80530308 41 Bytes [00, FF, 47, 0C, 8B, CF, E8, …]
.text ntoskrnl.exe!CcWaitForCurrentLazyWriterActivity + 61 80530332 65 Bytes [C0, EB, 6E, C6, 46, 0C, 04, …]
.text …
.text ntoskrnl.exe!FsRtlIncrementCcFastReadNoWait + 5 805305B3 18 Bytes [00, FF, 80, E0, 04, 00, 00, …] {ADD BH, BH; AND AL, 0x4; ADD [EAX], AL; RET ; INT 3 ; INT 3 ; INT 3 ; INT 3 ; INT 3 ; NOP ; NOP ; NOP ; NOP ; NOP }
.text ntoskrnl.exe!FsRtlIncrementCcFastReadResourceMiss + 1 805305C6 171 Bytes [05, D0, F5, 55, 80, C3, CC, …]
.text ntoskrnl.exe!FsRtlLookupLastLargeMcbEntryAndIndex + 13 80530672 6 Bytes [0E, FF, 15, 18, 81, 4D]
.text ntoskrnl.exe!FsRtlLookupLastLargeMcbEntryAndIndex + 1A 80530679 52 Bytes [33, D2, 89, 55, FC, 8B, 46, …]
.text ntoskrnl.exe!FsRtlLookupLastLargeMcbEntryAndIndex + 4F 805306AE 15 Bytes [41, F8, 03, 41, FC, 2B, C2, …]
.text ntoskrnl.exe!FsRtlLookupLastLargeMcbEntryAndIndex + 5F 805306BE 40 Bytes [8B, 4E, 10, 8B, 44, C1, F8, …]
.text ntoskrnl.exe!FsRtlLookupLastLargeMcbEntryAndIndex + 88 805306E7 333 Bytes [38, FF, 0F, 95, C1, 49, 89, …]
.text ntoskrnl.exe!FsRtlSplitLargeMcb + 1A 80530835 60 Bytes [83, 65, FC, 00, 8D, 45, E0, …]
.text ntoskrnl.exe!FsRtlSplitLargeMcb + 57 80530872 271 Bytes [8B, 4A, F8, 3B, 4D, 0C, 75, …]
.text ntoskrnl.exe!FsRtlSplitLargeMcb + 167 80530982 17 Bytes [15, 1C, 81, 4D, 80, C3, FF, …]
.text ntoskrnl.exe!FsRtlSplitLargeMcb + 179 80530994 26 Bytes [CC, CC, CC, CC, CC, CC, CC, …]
.text ntoskrnl.exe!FsRtlTruncateMcb + B 805309AF 54 Bytes CALL 804F8FA9 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!FsRtlAddMcbEntry + 1F 805309E6 35 Bytes [CC, CC, CC, CC, CC, 90, 90, …]
.text ntoskrnl.exe!FsRtlRemoveMcbEntry + 1A 80530A0A 3 Bytes [83, 65, FC]
.text ntoskrnl.exe!FsRtlRemoveMcbEntry + 1E 80530A0E 39 Bytes [FF, 75, 10, FF, 75, 0C, 56, …]
.text ntoskrnl.exe!FsRtlRemoveMcbEntry + 46 80530A36 17 Bytes [15, 1C, 81, 4D, 80, C3, 90, …]
.text ntoskrnl.exe!FsRtlRemoveMcbEntry + 58 80530A48 23 Bytes [30, 0A, 53, 80, CC, CC, CC, …]
.text ntoskrnl.exe!FsRtlLookupMcbEntry + A 80530A60 71 Bytes [75, 18, 8B, 75, 14, 6A, 00, …]
.text ntoskrnl.exe!FsRtlLookupMcbEntry + 52 80530AA8 51 Bytes [CC, CC, CC, CC, CC, CC, CC, …]
.text ntoskrnl.exe!FsRtlLookupMcbEntry + 86 80530ADC 43 Bytes [85, C0, 53, 56, 57, 74, 62, …]
.text ntoskrnl.exe!FsRtlLookupMcbEntry + B2 80530B08 69 Bytes [75, 2A, 8B, 58, 10, 0B, 58, …]
.text ntoskrnl.exe!FsRtlLookupMcbEntry + F8 80530B4E 84 Bytes [CC, CC, CC, CC, CC, CC, CC, …]
.text …
.text ntoskrnl.exe!FsRtlAllocatePool + 11 80530F5C 152 Bytes CALL 80551005 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!FsRtlAllocatePoolWithQuotaTag + 7 80530FF5 23 Bytes [75, 10, FF, 75, 0C, FF, 75, …]
.text ntoskrnl.exe!FsRtlAllocatePoolWithQuotaTag + 1F 8053100D 4 Bytes CALL 804E31AC \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!FsRtlAllocatePoolWithQuotaTag + 24 80531012 51 Bytes [8B, C6, 5E, 5D, C2, 0C, 00, …]
.text ntoskrnl.exe!FsRtlAllocatePoolWithQuotaTag + 58 80531046 50 Bytes CALL 804E81B3 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!FsRtlAllocatePoolWithQuotaTag + 8C 8053107A 27 Bytes [1B, C0, 25, 20, 01, 00, C0, …]
.text …
.text ntoskrnl.exe!FsRtlCreateSectionForDataScan + 24 805318BF 17 Bytes [00, 3B, F7, 0F, 84, 76, 01, …]
.text ntoskrnl.exe!FsRtlCreateSectionForDataScan + 36 805318D1 12 Bytes [00, F7, 45, 28, FF, FF, 7F, …]
.text ntoskrnl.exe!FsRtlCreateSectionForDataScan + 43 805318DE 19 Bytes CALL 804E8472 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!FsRtlCreateSectionForDataScan + 57 805318F2 122 Bytes CALL 8057DCB0 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!FsRtlCreateSectionForDataScan + D2 8053196D 72 Bytes [C0, EB, 32, 83, 7D, F4, 03, …]
.text …
.text ntoskrnl.exe!FsRtlLookupPerFileObjectContext + 6B 80531AD2 27 Bytes [3B, C1, 74, 0F, EB, F3, EB, …]
.text ntoskrnl.exe!FsRtlLookupPerFileObjectContext + 87 80531AEE 65 Bytes [C7, 5B, 5E, 5F, 5D, C2, 0C, …]
.text ntoskrnl.exe!FsRtlRemovePerFileObjectContext + 30 80531B30 166 Bytes [8B, 55, 10, 3B, D7, 74, 22, …]
.text ntoskrnl.exe!FsRtlInsertPerFileObjectContext + D 80531BD7 36 Bytes [DF, 75, 0A, B8, 0D, 00, 00, …]
.text ntoskrnl.exe!FsRtlInsertPerFileObjectContext + 32 80531BFC 60 Bytes [F0, 3B, F7, 75, 65, 68, 46, …]
.text ntoskrnl.exe!FsRtlInsertPerFileObjectContext + 6F 80531C39 14 Bytes [8D, 46, 20, 56, 53, 89, 40, …]
.text ntoskrnl.exe!FsRtlInsertPerFileObjectContext + 7E 80531C48 177 Bytes [85, C0, 7D, 1A, 57, 56, E8, …]
.text ntoskrnl.exe!FsRtlInsertPerFileObjectContext + 130 80531CFA 50 Bytes [CC, CC, CC, CC, CC, CC, CC, …]
.text …
.text ntoskrnl.exe!FsRtlPostStackOverflow + 8 80531D90 64 Bytes [75, 10, FF, 75, 0C, FF, 75, …]
.text ntoskrnl.exe!FsRtlPostPagingFileStackOverflow + 27 80531DD2 4 Bytes [90, 90, 90, 90] {NOP ; NOP ; NOP ; NOP }
.text ntoskrnl.exe!FsRtlPostPagingFileStackOverflow + 2C 80531DD7 28 Bytes [8B, FF, 55, 8B, EC, 83, EC, …]
.text ntoskrnl.exe!FsRtlPostPagingFileStackOverflow + 49 80531DF4 92 Bytes [F4, 89, 4D, F8, 89, 18, 89, …]
.text ntoskrnl.exe!FsRtlPostPagingFileStackOverflow + A6 80531E51 52 Bytes [89, 40, 04, 89, 00, E8, D1, …]
.text ntoskrnl.exe!FsRtlPostPagingFileStackOverflow + DB 80531E86 88 Bytes [4D, F4, 89, 01, 39, 5F, 04, …]
.text …
.text ntoskrnl.exe!InbvResetDisplay + 7 80531FFA 62 Bytes [74, 13, 83, 3D, 84, B4, 55, …]
.text ntoskrnl.exe!InbvResetDisplay + 46 80532039 34 Bytes [5D, C2, 18, 00, CC, CC, CC, …]
.text ntoskrnl.exe!InbvResetDisplay + 69 8053205C 24 Bytes JMP 8050D004 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!InbvSolidColorFill 80532077 24 Bytes [8B, FF, 55, 8B, EC, 51, 51, …]
.text ntoskrnl.exe!InbvSolidColorFill + 19 80532090 91 Bytes CALL 8050B473 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!InbvSolidColorFill + 75 805320EC 10 Bytes CALL 8050B52A \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!InbvSolidColorFill + 80 805320F7 96 Bytes [90, CC, CC, CC, CC, CC, CC, …]
.text ntoskrnl.exe!InbvSetTextColor + 55 80532158 45 Bytes CALL 8054C5D0 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!InbvSetTextColor + 83 80532186 45 Bytes [8B, 45, 0C, A3, 34, 09, 56, …]
.text ntoskrnl.exe!InbvSetTextColor + B1 805321B4 132 Bytes [CC, CC, CC, CC, CC, CC, 90, …]
.text ntoskrnl.exe!InbvSetScrollRegion + 1A 80532239 42 Bytes [CC, CC, CC, CC, CC, 90, 90, …]
.text ntoskrnl.exe!InbvSetScrollRegion + 47 80532266 265 Bytes [90, 90, 8B, FF, 55, 8B, EC, …]
.text ntoskrnl.exe!IoCheckQuerySetFileInformation + 37 80532370 27 Bytes [C0, 5D, C2, 0C, 00, 90, 90, …]
.text ntoskrnl.exe!IoCheckQuerySetVolumeInformation + 9 8053238C 150 Bytes [B9, A4, 24, 62, 80, 75, 05, …]
.text ntoskrnl.exe!IoGetInitialStack + 6 80532424 99 Bytes [8B, 40, 18, C3, CC, CC, CC, …]
.text ntoskrnl.exe!IoRaiseInformationalHardError + 1 80532488 112 Bytes [FF, 55, 8B, EC, 8B, 4D, 10, …]
.text ntoskrnl.exe!IoRaiseInformationalHardError + 72 805324F9 92 Bytes [3D, 34, 0E, 56, 80, 19, 0F, …]
.text ntoskrnl.exe!IoRaiseInformationalHardError + CF 80532556 17 Bytes [4B, 0C, 66, 8B, 0F, 66, 89, …]
.text ntoskrnl.exe!IoRaiseInformationalHardError + E2 80532569 63 Bytes JMP 0BF91870
.text ntoskrnl.exe!IoRaiseInformationalHardError + 122 805325A9 5 Bytes [56, 68, A8, 0A, 57]
.text …
.text ntoskrnl.exe!IoCallDriver + 6 80532828 10 Bytes [55, 0C, 8B, 4D, 08, FF, 15, …]
.text ntoskrnl.exe!IoCallDriver + 11 80532833 105 Bytes [5D, C2, 08, 00, CC, CC, CC, …]
.text ntoskrnl.exe!IoCompleteRequest + 5C 8053289D 10 Bytes [00, 8B, 37, EB, 31, 8D, 46, …]
.text ntoskrnl.exe!IoCompleteRequest + 67 805328A8 33 Bytes [F6, C5, 40, 8B, 36, 74, 24, …]
.text ntoskrnl.exe!IoCompleteRequest + 89 805328CA 77 Bytes CALL 804F28ED \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!IoSetSystemPartition + D 80532918 67 Bytes [53, 56, 8B, 75, 08, 57, 89, …]
.text ntoskrnl.exe!IoSetSystemPartition + 51 8053295C 18 Bytes [D0, 8D, 45, CC, 50, 66, C7, …]
.text ntoskrnl.exe!IoSetSystemPartition + 66 80532971 23 Bytes [74, 00, 66, C7, 45, E2, 75, …]
.text ntoskrnl.exe!IoSetSystemPartition + 7E 80532989 62 Bytes [66, C7, 45, D4, 0A, 00, E8, …]
.text ntoskrnl.exe!IoSetSystemPartition + BD 805329C8 23 Bytes [66, C7, 45, E0, 73, 00, 66, …]
.text …
.text ntoskrnl.exe!IoValidateDeviceIoControlAccess + 46 80532B26 161 Bytes [EB, 05, B8, 0D, 00, 00, C0, …]
.text ntoskrnl.exe!IoValidateDeviceIoControlAccess + E8 80532BC8 3 Bytes JMP EC5D8904
.text ntoskrnl.exe!IoValidateDeviceIoControlAccess + ED 80532BCD 5 Bytes [F4, 89, 45, F0, 8B]
.text ntoskrnl.exe!IoValidateDeviceIoControlAccess + F3 80532BD3 5 Bytes [57, 89, 06, 89, 70]
.text ntoskrnl.exe!IoValidateDeviceIoControlAccess + F9 80532BD9 5 Bytes [8B, F9, 75, 0C, E9]
.text …
.text ntoskrnl.exe!IoAttachDeviceByPointer + 2 80532C92 13 Bytes [55, 8B, EC, FF, 75, 0C, FF, …]
.text ntoskrnl.exe!IoAttachDeviceByPointer + 10 80532CA0 12 Bytes [F7, D8, 1B, C0, 25, F2, FF, …]
.text ntoskrnl.exe!IoAttachDeviceByPointer + 1D 80532CAD 209 Bytes [C0, 5D, C2, 08, 00, 90, 90, …]
.text ntoskrnl.exe!IoAttachDeviceByPointer + F0 80532D80 147 Bytes [8B, F7, 33, DB, 2B, F0, 39, …]
.text ntoskrnl.exe!IoAttachDeviceByPointer + 184 80532E14 77 Bytes [D1, FF, 45, 0C, 83, C3, 08, …]
.text …
.text ntoskrnl.exe!KeCapturePersistentThreadState + 10 8053372F 13 Bytes [33, F6, 3B, DE, 89, 45, FC, …]
.text ntoskrnl.exe!KeCapturePersistentThreadState + 1E 8053373D 13 Bytes [00, 00, 39, 75, 0C, 75, 09, …] {ADD [EAX], AL; CMP [EBP+0xc], ESI; JNZ 0x10; MOV EAX, FS:[0x124]}
.text ntoskrnl.exe!KeCapturePersistentThreadState + 2C 8053374B 6 Bytes [45, 0C, 57, 33, C0, B9]
.text ntoskrnl.exe!KeCapturePersistentThreadState + 33 80533752 39 Bytes [40, 00, 00, 8B, FB, F3, AB, …]
.text ntoskrnl.exe!KeCapturePersistentThreadState + 5B 8053377A 14 Bytes CALL 41D38CAF
.text …
.text ntoskrnl.exe!IoVolumeDeviceToDosName + 6 80534DA8 3 Bytes [EC, 3C, 02] {IN AL, DX ; CMP AL, 0x2}
.text ntoskrnl.exe!IoVolumeDeviceToDosName + A 80534DAC 60 Bytes [00, A1, 60, A3, 55, 80, 53, …]
.text ntoskrnl.exe!IoVolumeDeviceToDosName + 47 80534DE9 4 Bytes [02, 00, 00, 56]
.text ntoskrnl.exe!IoVolumeDeviceToDosName + 4C 80534DEE 90 Bytes [85, F4, FD, FF, FF, 50, 53, …]
.text ntoskrnl.exe!IoVolumeDeviceToDosName + A7 80534E49 37 Bytes [FF, 3B, C3, 0F, 8C, DE, 01, …]
.text …
.text ntoskrnl.exe!IoRequestDeviceEject + E 805357F3 14 Bytes [8B, 40, 14, 33, D2, 3B, C2, …]
.text ntoskrnl.exe!IoRequestDeviceEject + 1D 80535802 30 Bytes [52, 68, E1, 49, 62, 80, 51, …]
.text ntoskrnl.exe!IoRequestDeviceEject + 3C 80535821 410 Bytes [CC, CC, CC, CC, CC, CC, 90, …]
.text ntoskrnl.exe!IoRequestDeviceEject + 1D7 805359BC 7 Bytes [00, 00, 53, E8, 3C, 6A, FA]
.text ntoskrnl.exe!IoRequestDeviceEject + 1DF 805359C4 7 Bytes [8D, 45, 08, 50, E8, C3, FE]
.text …
.text ntoskrnl.exe!KdEnableDebugger + 1C 80535FBA 50 Bytes [75, 25, 80, 3D, 4C, BA, 55, …]
.text ntoskrnl.exe!KdEnableDebugger + 4F 80535FED 54 Bytes [4D, 80, C9, C3, CC, CC, CC, …]
.text ntoskrnl.exe!KdPowerTransition + 29 80536024 36 Bytes [8B, C6, 5E, 5D, C2, 04, 00, …]
.text ntoskrnl.exe!KdPowerTransition + 4E 80536049 1 Byte [0C]
.text ntoskrnl.exe!KdPowerTransition + 4E 80536049 165 Bytes CALL 80688A3F \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!KdPowerTransition + F4 805360EF 84 Bytes [74, 1E, 38, 05, FC, 36, 55, …]
.text ntoskrnl.exe!KdPowerTransition + 149 80536144 51 Bytes [D0, 69, 80, F6, 46, F8, 0A, …]
.text …
.text ntoskrnl.exe!KeSetDmaIoCoherency + 49 80536370 71 Bytes [45, 08, 3B, C1, 73, 09, 8B, …]
.text ntoskrnl.exe!KeSetDmaIoCoherency + 91 805363B8 8 Bytes [FF, 55, 8B, EC, 64, A1, 20, …]
.text ntoskrnl.exe!KeSetDmaIoCoherency + 9B 805363C2 69 Bytes [8B, 40, 04, 8B, 48, 44, 64, …]
.text ntoskrnl.exe!KeAcquireInterruptSpinLock + 1 80536408 18 Bytes [FF, 55, 8B, EC, 53, 56, 8B, …] {CALL [EBP-0x75]; IN AL, DX ; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0x8]; MOV CL, [ESI+0x29]; CALL [0x804d802c]}
.text ntoskrnl.exe!KeAcquireInterruptSpinLock + 14 8053641B 133 Bytes CALL 804E2403 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!KeReleaseInterruptSpinLock + 6B 805364A1 128 Bytes [00, 00, 8B, F0, 80, BE, 65, …]
.text ntoskrnl.exe!KeReleaseInterruptSpinLock + ED 80536523 25 Bytes [CC, CC, CC, CC, CC, CC, CC, …]
.text ntoskrnl.exe!KeReleaseInterruptSpinLock + 107 8053653D 182 Bytes [55, 8B, EC, 8B, 4D, 08, 0F, …]
.text ntoskrnl.exe!KeReleaseInterruptSpinLock + 1BE 805365F4 45 Bytes [83, 4D, FC, FF, 83, 4D, FC, …]
.text ntoskrnl.exe!KeReleaseInterruptSpinLock + 1EE 80536624 7 Bytes [9A, 65, 53, 80, A3, 65, 53] {CALL FAR 0x5365:0xa3805365}
.text …
.text ntoskrnl.exe!KeEnterKernelDebugger + 47 80536872 71 Bytes [90, 90, 90, 90, 90, 8B, FF, …]
.text ntoskrnl.exe!KeDeregisterBugCheckCallback + 43 805368BA 40 Bytes [FF, 15, 30, 80, 4D, 80, 5E, …]
.text ntoskrnl.exe!KeDeregisterBugCheckCallback + 6C 805368E3 13 Bytes [B8, 78, 25, 56, 80, 89, 45, …]
.text ntoskrnl.exe!KeDeregisterBugCheckCallback + 7A 805368F1 78 Bytes [85, DB, 0F, 84, 88, 00, 00, …]
.text ntoskrnl.exe!KeDeregisterBugCheckCallback + C9 80536940 19 Bytes [C1, 80, 7B, 1C, 01, 75, 33, …]
.text ntoskrnl.exe!KeDeregisterBugCheckCallback + DD 80536954 63 Bytes [51, 52, FF, D6, C6, 43, 1C, …]
.text …
.text ntoskrnl.exe!KeDeregisterBugCheckReasonCallback + 49 805369E8 29 Bytes [5E, 8A, C3, 5B, C9, C2, 04, …]
.text ntoskrnl.exe!KeDeregisterBugCheckReasonCallback + 67 80536A06 9 Bytes CALL 804E2E83 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
.text ntoskrnl.exe!KeDeregisterBugCheckReasonCallback + 71 80536A10 14 Bytes [89, 45, DC, 8B, 1D, 70, 25, …]
.text ntoskrnl.exe!KeDeregisterBugCheckReasonCallback + 81 80536A20 6 Bytes [00, 83, 3D, 74, 25, 56] {ADD [EBX+0x5625743d], AL}
.text ntoskrnl.exe!KeDeregisterBugCheckReasonCallback + 89 80536A28 3 Bytes [0F, 84, A6]
.text …
PAGE ntoskrnl.exe!ZwEnumerateKey 80578E14 5 Bytes JMP 8A467464
PAGE ntoskrnl.exe!ZwFlushInstructionCache 80587BFB 5 Bytes JMP 8A52A2F4
? spdx.sys The system cannot find the file specified. !
.text USBPORT.SYS!DllUnload BA58B8AC 5 Bytes JMP 8A6814E0

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Internet Explorer\Iexplore.exe[212] WININET.dll!HttpAddRequestHeadersA 771C40D2 5 Bytes JMP 00A9000C
.text C:\Program Files\Internet Explorer\Iexplore.exe[212] WININET.dll!HttpAddRequestHeadersW 771CEF34 5 Bytes JMP 00B4000A

—- Modules - GMER 1.0.15 —-

Module \systemroot\system32\drivers\H8SRTfhdyemtbqx.sys (*** hidden *** ) BA237000-BA254000 (118784 bytes)
—- Processes - GMER 1.0.15 —-

Library \\?\globalroot\systemroot\system32\H8SRTdnpsmkndyu.dll (*** hidden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [212] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTdnpsmkndyu.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [988] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTdnpsmkndyu.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1116] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTdnpsmkndyu.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1176] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTdnpsmkndyu.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1228] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTdnpsmkndyu.dll (*** hidden *** ) @ C:\WINDOWS\Explorer.EXE [1752] 0x10000000

—- Services - GMER 1.0.15 —-

Service C:\WINDOWS\system32\drivers\H8SRTfhdyemtbqx.sys (*** hidden *** ) [SYSTEM] H8SRTd.sys <– ROOTKIT !!!

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTfhdyemtbqx.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTfhdyemtbqx.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTbpkkdibquj.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTdldwwqgixx.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTdnpsmkndyu.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRThrnaoylhti.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x7C 0x46 0x21 0x5E …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xE9 0xA9 0xCA 0xAF …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x19 0xF2 0x63 0x1D …
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTfhdyemtbqx.sys
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTfhdyemtbqx.sys
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTbpkkdibquj.dll
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTdldwwqgixx.dat
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTdnpsmkndyu.dll
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRThrnaoylhti.dll
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x7C 0x46 0x21 0x5E …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xE9 0xA9 0xCA 0xAF …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x19 0xF2 0x63 0x1D …

—- EOF - GMER 1.0.15 —-