Need Help With Machine

MARTY1946 Topic Starter

Post #1July 22, 2010, 12:30 AM UTC

Hello All,

I am posting my HJT Logfile,
Please help with any problems
Thank You.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:25:22 PM, on 7/21/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AGI\core\3.0\AGCoreService.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\COMODO\BackUp\CmdBkSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Dick\My Documents\Downloads\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.concast.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://ak.imgag.com/imgag/kiw/toolbar/down…llerControl.cab
O16 - DPF: PackageCab - http://ak.imgag.com/imgag/cp/install/AxCtp2.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://pccheckup.dellfix.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/dcode/ActiveX/MSDcode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1125759480093
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…tDetection2.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AG Core Services (AGCoreService) - AG Interactive - C:\Program Files\AGI\core\3.0\AGCoreService.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: ComodoBackupService - COMODO - C:\Program Files\COMODO\BackUp\CmdBkSvc.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 9139 bytes

ken545

Post #2July 23, 2010, 2:47 AM UTC

Your HJT log is not showing anything bad but we don't use it much anymore , we have moved on to better detection scanners.

1. You have Comodo Internet Security that includes Anti virus software, you also have AVG installed, this wont work as two AVs will hamper system performance and sometimes cause issues, your call but you need to uninstall one.

2. Ask Toolbar, this needs to go as well, read this please

* It promotes its toolbars on sites targeted at kids.
* It promotes its toolbars through ads that appear to be part of other companies' sites.
* It promotes its toolbars through other companies' spyware.
* It is Installed without any disclosure whatsoever and without any consent from the user whatsoever.
* It solicits installations via "deceptive door openers" that do not accurately describe the offer; failing to affirmatively show a license agreement; linking to a EULA via an off-screen link.
* It makes confusing changes to user's browsers - increasing Ask's revenues while taking users to pages they didn't intend to visit.

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.

Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

MARTY1946

Post #3July 23, 2010, 7:23 AM UTC last edited July 23, 2010, 7:31 AM UTC

Good Morning Ken545 Thanks for your help!

1st Part:

OTL logfile created on: 7/23/2010 2:57:45 AM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Dick\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 62.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 68.00% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.76 Gb Total Space | 74.50 Gb Free Space | 66.66% Space Free | Partition Type: NTFS
Drive D: | 174.39 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: D30D6921
Current User Name: Dick
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Dick\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE (Microsoft Corporation)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
PRC - C:\Program Files\COMODO\BackUp\CmdBkSvc.exe (COMODO)
PRC - C:\Program Files\AGI\core\3.0\AGCoreService.exe (AG Interactive)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\SYSTEM32\hpzipm12.exe (HP)
PRC - C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe (Ulead Systems, Inc.)
PRC - C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe (Microsoft® Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Dick\My Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\SYSTEM32\guard32.dll (COMODO)
MOD - C:\WINDOWS\SYSTEM32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (GoogleDesktopManager-051210-111108) – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (cmdAgent) – C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV - (ComodoBackupService) – C:\Program Files\COMODO\BackUp\CmdBkSvc.exe (COMODO)
SRV - (AGCoreService) – C:\Program Files\AGI\core\3.0\AGCoreService.exe (AG Interactive)
SRV - (getPlus® Helper) getPlus® – C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (NOS Microsystems Ltd.)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (NMSAccessU) – C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
SRV - (Pml Driver HPZ12) – C:\WINDOWS\SYSTEM32\hpzipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (SDVC05) – C:\WINDOWS\System32\Drivers\SDVC05.sys File not found
DRV - (MTK) – C:\WINDOWS\System32\Drivers\mtk.sys File not found
DRV - (AvgTdiX) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (cmdGuard) – C:\WINDOWS\SYSTEM32\DRIVERS\cmdguard.sys (COMODO)
DRV - (Inspect) – C:\WINDOWS\System32\DRIVERS\inspect.sys (COMODO)
DRV - (cmdHlp) – C:\WINDOWS\SYSTEM32\DRIVERS\cmdhlp.sys (COMODO)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (tmcomm) – C:\WINDOWS\SYSTEM32\DRIVERS\tmcomm.sys (Trend Micro Inc.)
DRV - (Cdralw2k) – C:\WINDOWS\System32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (Cdr4_xp) – C:\WINDOWS\System32\drivers\cdr4_xp.sys (Sonic Solutions)
DRV - (amdagp) – C:\WINDOWS\System32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\System32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (nv) – C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (iAimFP4) – C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys (Intel® Corporation)
DRV - (iAimFP3) – C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys (Intel® Corporation)
DRV - (iAimTV4) – C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys (Intel® Corporation)
DRV - (iAimTV3) – C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys (Intel® Corporation)
DRV - (iAimTV1) – C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys (Intel® Corporation)
DRV - (iAimTV0) – C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys (Intel® Corporation)
DRV - (iAimFP0) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys (Intel® Corporation)
DRV - (iAimFP1) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys (Intel® Corporation)
DRV - (iAimFP2) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys (Intel® Corporation)
DRV - (i81x) – C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys (Intel® Corporation)
DRV - (omci) – C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Computer Corporation)
DRV - (bvrp_pci) – C:\WINDOWS\System32\drivers\bvrp_pci.sys ()
DRV - (IPFilter) – C:\WINDOWS\SYSTEM32\DRIVERS\ipfilter.sys (Microsoft Corporation)
DRV - (ati2mtaa) – C:\WINDOWS\SYSTEM32\DRIVERS\ati2mtaa.sys (ATI Technologies Inc.)
DRV - (Sparrow) – C:\WINDOWS\System32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\System32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\System32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\System32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\System32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (MODEMCSA) – C:\WINDOWS\SYSTEM32\DRIVERS\MODEMCSA.sys (Microsoft Corporation)
DRV - (ultra) – C:\WINDOWS\System32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\System32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\System32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\System32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\System32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\System32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\System32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\System32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\System32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\System32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (hsf_msft) – C:\WINDOWS\SYSTEM32\DRIVERS\HSF_MSFT.sys (Conexant)
DRV - (EL90XBC) – C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS (3Com Corporation)
DRV - (winachsf) – C:\WINDOWS\SYSTEM32\DRIVERS\hsf_cnxt.sys (Conexant Systems)
DRV - (SpeakerPhone) – C:\WINDOWS\SYSTEM32\DRIVERS\spkpnt.sys (Conexant Systems)
DRV - (K56) – C:\WINDOWS\SYSTEM32\DRIVERS\k56nt.sys (Conexant Systems)
DRV - (Fsks) – C:\WINDOWS\SYSTEM32\DRIVERS\fsksnt.sys (Conexant Systems)
DRV - (SoftFax) – C:\WINDOWS\SYSTEM32\DRIVERS\faxnt.sys (Conexant Systems)
DRV - (Tones) – C:\WINDOWS\SYSTEM32\DRIVERS\tonesnt.sys (Conexant Systems)
DRV - (Fallback) – C:\WINDOWS\SYSTEM32\DRIVERS\fallback.sys (Conexant Systems)
DRV - (basic2) – C:\WINDOWS\SYSTEM32\DRIVERS\basic2.sys (Conexant Systems)
DRV - (Rksample) – C:\WINDOWS\SYSTEM32\DRIVERS\rksample.sys (Conexant Systems)
DRV - (V124) – C:\WINDOWS\SYSTEM32\DRIVERS\v124nt.sys (Conexant Systems)

========== Standard Registry (SafeList) ==========

MARTY1946

Post #4July 23, 2010, 7:27 AM UTC

Post Continued:

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.concast.net/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://start.mozilla.org/firefox?client=firefox-a&rls;=org.mozilla:en-US:official"
FF - prefs.js..network.proxy.autoconfig_url: "http://overdrive.innernet.net/overdrive.pac"
FF - prefs.js..network.proxy.type: 4

FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/07/21 08:15:26 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\[removed]: C:\Program Files\AG Toolbar\Firefox\0.1 [2009/05/01 08:00:29 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2010/05/21 12:41:42 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/22 02:31:56 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/21 06:10:36 | 000,000,000 | —D | M]

[2008/10/23 09:24:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Mozilla\Extensions
[2010/07/11 20:38:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\0zeyryfe.Default User\extensions
[2005/12/11 12:30:45 | 000,000,000 | —D | M] (Firefox (default)) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\0zeyryfe.Default User\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2010/07/12 04:14:35 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\0zeyryfe.Default User\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2010/07/11 20:38:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\0zeyryfe.Default User\extensions\[removed]
[2010/07/22 21:40:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\ejszbwp1.Default User\extensions
[2009/11/10 20:06:28 | 000,000,000 | —D | M] (Winamp Toolbar) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\ejszbwp1.Default User\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2010/07/12 03:53:04 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\ejszbwp1.Default User\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/16 14:11:21 | 000,000,000 | —D | M] (Firefox Sync) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\ejszbwp1.Default User\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}
[2010/07/20 02:15:10 | 000,000,000 | —D | M] (WeatherBug) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\ejszbwp1.Default User\extensions\{3EC9C995-8072-4fc0-953E-4F30620D17F3}
[2010/02/18 10:46:57 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\ejszbwp1.Default User\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/07/12 03:53:03 | 000,000,000 | —D | M] (iMacros for Firefox) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\ejszbwp1.Default User\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2010/02/18 10:46:54 | 000,000,000 | —D | M] (Firefox Showcase) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\ejszbwp1.Default User\extensions\{89506680-e3f4-484c-a2c0-ed711d481eda}
[2010/07/07 05:25:00 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\ejszbwp1.Default User\extensions\{D2A6A719-7CBC-4594-85FD-C36AD881424F}
[2010/07/05 17:51:24 | 000,000,000 | —D | M] (Yoono) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\ejszbwp1.Default User\extensions\{d9284e50-81fc-11da-a72b-0800200c9a66}
[2010/07/17 10:58:28 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\ejszbwp1.Default User\extensions\{FBF6D7FB-F305-4445-BB3D-FEF66579A033}
[2010/07/05 17:51:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\ejszbwp1.Default User\extensions\feedly@devhd
[2010/07/05 17:51:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\ejszbwp1.Default User\extensions\[removed]
[2010/07/05 17:51:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\ejszbwp1.Default User\extensions\feedly@devhd\content\app\extension
[2010/07/12 04:02:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\hm7vtyjs.default\extensions
[2009/07/12 18:48:13 | 000,000,000 | —D | M] (Winamp Toolbar) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\hm7vtyjs.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2005/02/06 11:17:53 | 000,000,000 | —D | M] (Firefox (default)) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\hm7vtyjs.default\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2005/02/06 12:46:40 | 000,000,000 | —D | M] (BBCode) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\hm7vtyjs.default\extensions\{AE37D527-6604-461c-8102-975CF8053A2F}
[2010/07/12 04:14:34 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Dick\Application Data\Mozilla\Firefox\Profiles\hm7vtyjs.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2010/07/22 21:40:13 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2006/02/25 07:27:01 | 000,000,000 | —D | M] (SDI_Integrator) – C:\Program Files\Mozilla Firefox\extensions\{9d613b03-9b7c-4fa0-b2f8-32f7cc24873f}
[2002/09/27 08:59:00 | 000,090,112 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\NpPopup.dll
[2005/04/27 16:10:49 | 000,102,400 | —- | M] (RealNetworks) – C:\Program Files\Mozilla Firefox\plugins\npracplug.dll
[2005/06/13 01:12:00 | 000,098,304 | —- | M] (SkillJam Technologies) – C:\Program Files\Mozilla Firefox\plugins\npskilljamloader.dll
[2004/01/13 22:09:25 | 000,176,176 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2009/12/05 03:20:12 | 000,223,826 | R— | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 1001-search.info
O1 - Hosts: 127.0.0.1 www.1001-search.info
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 7882 more lines…
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (&Google;) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {11359F4A-B191-42D7-905A-594F8CF0387B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&Google;) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKCU..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe (Microsoft® Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe (Ulead Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} http://pccheckup.dellfix.com/sdccommon/download/tgctlcm.cab (Support.com Configuration Class)
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://support.microsoft.com/dcode/ActiveX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1125759480093 (MUWebControl Class)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/inst…tDetection2.cab (GMNRev Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} http://www.pandasoftware.com/activescan/as5/asinst.cab (Reg Error: Key error.)
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} http://ak.imgag.com/imgag/cp/install/Crusher.cab (Creative Toolbox Plug-in)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab (get_atlcom Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: CabBuilder http://ak.imgag.com/imgag/kiw/toolbar/down…llerControl.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: PackageCab http://ak.imgag.com/imgag/cp/install/AxCtp2.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - AppInit_DLLs: (C:\WINDOWS\system32\guard32.dll) - C:\WINDOWS\SYSTEM32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/01/10 14:24:32 | 000,000,488 | —- | M] () - C:\AUTOEXEC.BAK – [ NTFS ]
O32 - AutoRun File - [2010/02/18 10:36:48 | 000,000,590 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2009/01/03 17:49:52 | 000,000,375 | —- | M] () - C:\AUTOEXEC.LTN – [ NTFS ]
O32 - AutoRun File - [2009/02/12 00:08:51 | 000,000,045 | R— | M] () - D:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/07/22 02:23:04 | 000,000,000 | —D | C] – C:\Documents and Settings\Dick\My Documents\Dick's Finances
[2010/07/16 08:05:30 | 000,012,536 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2010/07/14 16:26:09 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[2010/07/12 06:49:44 | 000,000,000 | —D | C] – C:\Avenger
[2010/07/12 04:21:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Dick\Local Settings\Application Data\AskToolbar
[2010/07/12 04:09:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Desktop\Microsoft IntelliPoint
[2010/07/11 20:38:49 | 000,000,000 | —D | C] – C:\Program Files\Ask.com
[2010/07/11 20:37:55 | 000,000,000 | —D | C] – C:\Documents and Settings\Dick\Local Settings\Application Data\The Weather Channel
[2010/07/10 06:28:58 | 000,000,000 | —D | C] – C:\Program Files\Search Toolbar
[2010/07/09 04:52:53 | 000,000,000 | —D | C] – C:\Amazon Orders
[2010/07/07 06:31:09 | 000,000,000 | —D | C] – C:\Post 606 Website
[2010/07/07 05:53:27 | 000,674,280 | —- | C] (ScreenTime Media) – C:\WINDOWS\System32\nature_3120380.scr
[2010/07/07 05:53:27 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Screentime
[2010/07/07 05:52:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Dick\Local Settings\Application Data\Screentime
[2010/07/06 03:16:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Dick\My Documents\Todd Ryder
[2010/07/05 04:11:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Dick\Application Data\Process Hacker
[2010/07/05 04:10:50 | 000,000,000 | —D | C] – C:\Program Files\Process Hacker
[2010/07/04 19:20:44 | 000,000,000 | —D | C] – C:\Documents and Settings\Dick\My Documents\emmys Documents& Pics
[2010/07/02 05:56:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Dick\My Documents\Dell Dimension E510
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[1 C:\Documents and Settings\Dick\My Documents\*.tmp files -> C:\Documents and Settings\Dick\My Documents\*.tmp -> ]
[1 C:\Documents and Settings\Dick\*.tmp files -> C:\Documents and Settings\Dick\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/23 03:01:01 | 000,000,232 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010/07/23 02:32:10 | 000,001,170 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2010/07/23 02:31:04 | 000,000,436 | —- | M] () – C:\WINDOWS\tasks\RegCure Program Check.job
[2010/07/23 02:30:52 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/07/23 02:30:47 | 000,002,048 | –S- | M] () – C:\WINDOWS\BOOTSTAT.DAT
[2010/07/23 02:29:42 | 009,699,328 | —- | M] () – C:\Documents and Settings\Dick\ntuser.dat
[2010/07/23 02:29:36 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Dick\NTUSER.INI
[2010/07/23 02:10:40 | 000,000,000 | —- | M] () – C:\Documents and Settings\Dick\Local Settings\Application Data\prvlcl.dat
[2010/07/23 00:33:00 | 000,000,414 | —- | M] () – C:\WINDOWS\tasks\ParetoLogic Update Version2.job
[2010/07/23 00:04:14 | 000,000,022 | —- | M] () – C:\WINDOWS\popcinfot.dat
[2010/07/22 18:57:24 | 062,347,514 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/07/22 18:00:01 | 000,000,440 | —- | M] () – C:\WINDOWS\tasks\ParetoLogic Registration.job
[2010/07/22 04:42:38 | 000,002,515 | —- | M] () – C:\Documents and Settings\Dick\Desktop\Microsoft Word.lnk
[2010/07/22 04:13:00 | 000,000,370 | —- | M] () – C:\WINDOWS\tasks\RegCure.job
[2010/07/22 02:26:40 | 000,015,143 | —- | M] () – C:\Documents and Settings\Dick\My Documents\USAA Account.docx
[2010/07/21 05:56:57 | 000,000,226 | —- | M] () – C:\WINDOWS\wininit.ini
[2010/07/19 11:47:15 | 000,226,258 | —- | M] () – C:\Documents and Settings\Dick\My Documents\EMBARQ_WiFi_Wireless.pdf
[2010/07/19 05:24:12 | 000,000,326 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2010/07/17 15:45:55 | 001,431,981 | —- | M] () – C:\Documents and Settings\Dick\My Documents\Mr Coffee JWX27_43_56431310.pdf
[2010/07/17 10:40:27 | 000,000,022 | —- | M] () – C:\Documents and Settings\Dick\Desktop\DelIndex.BAT
[2010/07/16 08:05:33 | 000,243,024 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/07/16 08:05:30 | 000,012,536 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2010/07/16 08:04:22 | 000,216,400 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/07/16 04:47:13 | 000,150,528 | —- | M] () – C:\Documents and Settings\Dick\My Documents\One of the Better Ones.doc
[2010/07/15 04:53:55 | 000,000,264 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy Updater - Scheduled Task.job
[2010/07/12 18:28:17 | 000,261,697 | —- | M] () – C:\Documents and Settings\Dick\My Documents\Home Association CardsNEW Page 30.docx
[2010/07/12 18:24:02 | 000,002,473 | —- | M] () – C:\Documents and Settings\Dick\Desktop\Microsoft Excel.lnk
[2010/07/12 05:32:35 | 000,026,112 | —- | M] () – C:\Documents and Settings\Dick\My Documents\Electronic Cigarete.doc
[2010/07/12 03:56:22 | 000,001,062 | —- | M] () – C:\Documents and Settings\Dick\My Documents\cc_20100712_035614.reg
[2010/07/11 09:08:23 | 000,009,410 | —- | M] () – C:\Documents and Settings\Dick\My Documents\Todd Ryder.xlsx
[2010/07/11 06:58:07 | 000,014,852 | —- | M] () – C:\Documents and Settings\Dick\My Documents\USAA.docx
[2010/07/10 17:03:41 | 000,258,048 | —- | M] () – C:\Documents and Settings\Dick\My Documents\Did I Read this Right.doc
[2010/07/09 21:48:55 | 000,015,058 | —- | M] () – C:\Documents and Settings\Dick\My Documents\Your Names to be on the check.docx
[2010/07/09 06:39:27 | 000,263,862 | —- | M] () – C:\Documents and Settings\Dick\My Documents\Home Association CardsNEW Page 29.docx
[2010/07/08 16:39:16 | 000,262,856 | —- | M] () – C:\Documents and Settings\Dick\My Documents\Home Association CardsNEW Page 28.docx
[2010/07/08 06:07:31 | 000,001,854 | —- | M] () – C:\Documents and Settings\Dick\My Documents\cc_20100708_060723.reg
[2010/07/08 03:57:50 | 000,124,416 | —- | M] () – C:\Documents and Settings\Dick\My Documents\BETWEEN THE U.doc
[2010/07/07 17:24:52 | 000,014,909 | —- | M] () – C:\Documents and Settings\Dick\My Documents\HOME ASSOCIATION BOARD MINUTES.docx
[2010/07/07 08:28:29 | 000,026,338 | —- | M] () – C:\Documents and Settings\Dick\My Documents\Resume.docx
[2010/07/07 08:26:05 | 000,062,976 | —- | M] () – C:\Documents and Settings\Dick\My Documents\Resume.doc
[2010/07/07 05:53:27 | 000,674,280 | —- | M] (ScreenTime Media) – C:\WINDOWS\System32\nature_3120380.scr
[2010/07/07 04:39:42 | 000,000,288 | -H– | M] () – C:\WINDOWS\tasks\Microsoft_Hardware_Launch_IPoint_exe.job
[2010/07/06 03:48:52 | 000,042,496 | —- | M] () – C:\Documents and Settings\Dick\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/05 08:06:50 | 000,015,087 | —- | M] () – C:\Documents and Settings\Dick\My Documents\Richard G.docx
[2010/07/05 05:03:30 | 000,024,980 | —- | M] () – C:\Documents and Settings\Dick\My Documents\Brad Slaybaugh.docx
[2010/07/05 04:58:24 | 000,024,936 | —- | M] () – C:\Documents and Settings\Dick\My Documents\Dear Tim.docx
[2010/07/05 04:31:04 | 000,003,085 | —- | M] () – C:\Documents and Settings\Dick\Desktop\Penn State.jpg
[2010/07/05 04:28:30 | 000,009,145 | —- | M] () – C:\Documents and Settings\Dick\My Documents\July 2010 Budget.xlsx
[2010/07/05 04:10:51 | 000,001,677 | —- | M] () – C:\Documents and Settings\Dick\Desktop\Process Hacker.lnk
[2010/07/04 20:37:30 | 000,021,795 | —- | M] () – C:\Documents and Settings\Dick\My Documents\Mike Carrucoli.docx
[2010/07/03 04:25:46 | 000,496,264 | —- | M] () – C:\WINDOWS\System32\PERFH009.DAT
[2010/07/03 04:25:46 | 000,091,642 | —- | M] () – C:\WINDOWS\System32\PERFC009.DAT
[2010/07/03 04:25:45 | 000,599,752 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/07/01 06:28:48 | 000,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/06/30 06:34:32 | 000,003,838 | —- | M] () – C:\Documents and Settings\Dick\My Documents\cc_20100630_063418.reg
[2010/06/23 05:46:56 | 000,062,009 | —- | M] (Portrait Displays, Inc.) – C:\WINDOWS\System32\wpfb_ati2dvaa.dll
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]
[1 C:\Documents and Settings\Dick\My Documents\*.tmp files -> C:\Documents and Settings\Dick\My Documents\*.tmp -> ]
[1 C:\Documents and Settings\Dick\*.tmp files -> C:\Documents and Settings\Dick\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/22 02:26:40 | 000,015,143 | —- | C] () – C:\Documents and Settings\Dick\My Documents\USAA Account.docx
[2010/07/19 11:47:15 | 000,226,258 | —- | C] () – C:\Documents and Settings\Dick\My Documents\EMBARQ_WiFi_Wireless.pdf
[2010/07/17 15:45:54 | 001,431,981 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Mr Coffee JWX27_43_56431310.pdf
[2010/07/16 04:47:12 | 000,150,528 | —- | C] () – C:\Documents and Settings\Dick\My Documents\One of the Better Ones.doc
[2010/07/15 04:53:55 | 000,000,264 | —- | C] () – C:\WINDOWS\tasks\Spybot - Search & Destroy Updater - Scheduled Task.job
[2010/07/15 04:52:02 | 000,000,326 | —- | C] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2010/07/12 18:28:16 | 000,261,697 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Home Association CardsNEW Page 30.docx
[2010/07/12 05:32:34 | 000,026,112 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Electronic Cigarete.doc
[2010/07/12 03:56:16 | 000,001,062 | —- | C] () – C:\Documents and Settings\Dick\My Documents\cc_20100712_035614.reg
[2010/07/11 20:39:46 | 000,000,232 | —- | C] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010/07/11 08:41:53 | 000,009,410 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Todd Ryder.xlsx
[2010/07/11 06:58:07 | 000,014,852 | —- | C] () – C:\Documents and Settings\Dick\My Documents\USAA.docx
[2010/07/10 17:03:40 | 000,258,048 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Did I Read this Right.doc
[2010/07/09 21:48:52 | 000,015,058 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Your Names to be on the check.docx
[2010/07/09 06:14:55 | 000,263,862 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Home Association CardsNEW Page 29.docx
[2010/07/08 06:53:15 | 000,262,856 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Home Association CardsNEW Page 28.docx
[2010/07/08 06:07:26 | 000,001,854 | —- | C] () – C:\Documents and Settings\Dick\My Documents\cc_20100708_060723.reg
[2010/07/08 03:57:49 | 000,124,416 | —- | C] () – C:\Documents and Settings\Dick\My Documents\BETWEEN THE U.doc
[2010/07/07 17:23:59 | 000,014,909 | —- | C] () – C:\Documents and Settings\Dick\My Documents\HOME ASSOCIATION BOARD MINUTES.docx
[2010/07/07 08:28:28 | 000,026,338 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Resume.docx
[2010/07/07 04:37:50 | 000,000,288 | -H– | C] () – C:\WINDOWS\tasks\Microsoft_Hardware_Launch_IPoint_exe.job
[2010/07/06 03:20:59 | 000,080,790 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Copy of schizo19.jpg
[2010/07/06 03:20:59 | 000,079,595 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Copy of schizo21.jpg
[2010/07/06 03:20:59 | 000,073,197 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Copy of schizo22.jpg
[2010/07/05 08:06:50 | 000,015,087 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Richard G.docx
[2010/07/05 05:03:08 | 000,024,980 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Brad Slaybaugh.docx
[2010/07/05 04:58:24 | 000,024,936 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Dear Tim.docx
[2010/07/05 04:31:03 | 000,003,085 | —- | C] () – C:\Documents and Settings\Dick\Desktop\Penn State.jpg
[2010/07/05 04:27:43 | 000,009,145 | —- | C] () – C:\Documents and Settings\Dick\My Documents\July 2010 Budget.xlsx
[2010/07/05 04:10:51 | 000,001,677 | —- | C] () – C:\Documents and Settings\Dick\Desktop\Process Hacker.lnk
[2010/07/04 20:37:30 | 000,021,795 | —- | C] () – C:\Documents and Settings\Dick\My Documents\Mike Carrucoli.docx
[2010/07/04 19:07:12 | 000,002,473 | —- | C] () – C:\Documents and Settings\Dick\Desktop\Microsoft Excel.lnk
[2010/06/30 06:34:21 | 000,003,838 | —- | C] () – C:\Documents and Settings\Dick\My Documents\cc_20100630_063418.reg
[2010/04/14 08:12:46 | 000,000,130 | —- | C] () – C:\WINDOWS\cfplogvw.INI
[2010/02/18 10:31:28 | 000,000,042 | —- | C] () – C:\WINDOWS\System32\RegistryPatrolUpdates.ini
[2010/02/06 14:10:04 | 000,000,616 | —- | C] () – C:\WINDOWS\RegGenie.ini
[2010/02/06 12:22:48 | 000,000,032 | —- | C] () – C:\WINDOWS\CD_Start.INI
[2009/08/31 15:00:22 | 000,021,504 | —- | C] () – C:\WINDOWS\System32\WBCustomizer.dll
[2009/08/31 15:00:21 | 000,185,344 | —- | C] () – C:\WINDOWS\System32\MemWarp.dll
[2009/04/20 14:30:40 | 000,565,248 | R— | C] () – C:\WINDOWS\System32\hpotscl.dll
[2009/01/08 18:16:53 | 000,000,086 | —- | C] () – C:\WINDOWS\KINGCORN.INI
[2009/01/01 12:18:06 | 000,000,214 | —- | C] () – C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2007/09/27 11:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 11:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 11:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2007/08/22 10:28:25 | 000,063,488 | —- | C] () – C:\WINDOWS\xobglu16.dll
[2007/08/22 10:28:25 | 000,032,714 | —- | C] () – C:\WINDOWS\xobglu32.dll
[2007/08/08 20:26:08 | 000,000,340 | —- | C] () – C:\WINDOWS\QTW.INI
[2007/03/27 10:45:22 | 000,004,096 | —- | C] () – C:\WINDOWS\System32\sysres.dll
[2007/03/24 03:02:51 | 000,000,027 | —- | C] () – C:\WINDOWS\AtxTCBizControl03.ini
[2005/11/17 13:57:25 | 000,000,000 | —- | C] () – C:\WINDOWS\Versabook.INI
[2005/11/17 13:15:05 | 000,027,136 | —- | C] () – C:\WINDOWS\System32\VbMCHook.dll
[2005/03/02 08:34:06 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2004/12/31 11:11:49 | 000,000,032 | —- | C] () – C:\WINDOWS\thxcfg.ini
[2004/11/27 14:34:17 | 000,000,035 | —- | C] () – C:\WINDOWS\ulead32.ini
[2004/10/18 11:02:53 | 000,011,776 | —- | C] () – C:\WINDOWS\System32\ZPORT4AS.dll
[2004/07/27 18:44:36 | 000,000,000 | —- | C] () – C:\WINDOWS\VPC32.INI
[2004/07/22 16:36:32 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/07/19 10:34:18 | 000,005,632 | —- | C] () – C:\WINDOWS\System32\CNMVS0W.DLL
[2004/04/28 20:47:20 | 000,000,226 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/04/17 09:40:54 | 000,000,679 | —- | C] () – C:\WINDOWS\TSC.ini
[2004/04/17 09:40:53 | 000,071,749 | —- | C] () – C:\WINDOWS\HCExtOutput.dll
[2004/04/17 09:23:08 | 000,000,170 | —- | C] () – C:\WINDOWS\GetServer.ini
[2004/01/01 08:41:53 | 000,000,105 | —- | C] () – C:\WINDOWS\AtxTCBizPref03.ini
[2003/11/15 04:35:29 | 000,004,272 | —- | C] () – C:\WINDOWS\System32\drivers\bvrp_pci.sys
[2003/11/13 23:34:40 | 000,000,297 | —- | C] () – C:\WINDOWS\ER3.ini
[2003/10/12 23:08:31 | 000,000,004 | —- | C] () – C:\WINDOWS\uccspecb.sys
[2003/05/24 01:14:17 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2003/04/15 16:12:11 | 000,000,077 | —- | C] () – C:\WINDOWS\PrintWorkShop2003LE.ini
[2003/01/28 20:17:51 | 000,016,326 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2003/01/20 22:15:02 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/01/20 22:08:27 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/01/20 22:04:52 | 000,000,890 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/01/20 21:12:16 | 000,000,549 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2002/12/28 00:33:36 | 000,002,129 | —- | C] () – C:\WINDOWS\lexbar.ini
[2002/12/05 19:51:00 | 000,059,392 | R— | C] () – C:\WINDOWS\streamhlp.dll
[2002/04/11 14:47:52 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\msmscoin.dll
[2000/07/27 01:13:02 | 000,053,760 | —- | C] () – C:\WINDOWS\System32\zlib.dll
[1999/07/23 14:46:48 | 000,000,116 | —- | C] () – C:\WINDOWS\AuHCcup1.ini
[1999/07/23 11:53:20 | 000,129,536 | —- | C] () – C:\WINDOWS\AuHCcup1.dll

========== LOP Check ==========

[2009/05/01 08:00:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AGI
[2009/06/22 23:27:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2009/11/09 10:54:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/03/11 13:07:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2003/01/20 22:06:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2003/01/29 07:10:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DelFin
[2009/04/12 19:40:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DriverCure
[2009/03/17 11:00:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft
[2009/04/12 18:14:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2008/12/16 16:20:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2009/01/05 09:46:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\POP VIEW TRAY 16
[2010/02/03 18:05:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap Games
[2010/07/07 05:53:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Screentime
[2009/04/09 10:03:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SupportSoft
[2008/12/21 13:33:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/11/09 19:09:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TreeCardGames
[2004/11/26 16:30:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2009/03/20 07:45:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/06/02 01:54:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/05/01 13:23:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\agi
[2008/02/09 12:16:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Aim
[2009/03/06 15:10:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Amazon
[2010/06/15 02:55:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Azureus
[2009/02/18 14:21:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Canneverbe_Limited
[2009/07/29 01:21:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/04/09 10:39:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\ComcastToolbar
[2004/11/26 19:59:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Common Files
[2009/01/07 13:27:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\DeepBurner
[2010/06/30 05:01:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\DisplayTune
[2009/04/12 18:18:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\DriverCure
[2009/02/18 12:27:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\GetRightToGo
[2009/06/24 08:47:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Image Zone Express
[2005/04/05 23:46:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Kazaa Lite
[2009/04/17 07:19:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Kingston
[2003/04/14 15:37:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Leadertech
[2010/02/22 14:55:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\NumusDiskBuilder
[2009/11/18 12:31:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Nvu
[2009/08/06 11:02:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Passware
[2009/04/20 10:15:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Printer Info Cache
[2010/07/05 09:03:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Process Hacker
[2004/08/18 17:32:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Systweak
[2009/05/01 08:00:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Temp
[2009/01/08 12:20:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Template
[2009/11/09 19:07:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\TreeCardGames
[2004/11/26 16:30:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Ulead Systems
[2010/03/07 11:33:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Uniblue
[2009/01/08 17:00:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Windows Desktop Search
[2009/01/08 17:11:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Dick\Application Data\Windows Search
[2010/07/22 18:00:01 | 000,000,440 | —- | M] () – C:\WINDOWS\Tasks\ParetoLogic Registration.job
[2010/07/23 00:33:00 | 000,000,414 | —- | M] () – C:\WINDOWS\Tasks\ParetoLogic Update Version2.job
[2010/07/23 02:31:04 | 000,000,436 | —- | M] () – C:\WINDOWS\Tasks\RegCure Program Check.job
[2010/07/22 04:13:00 | 000,000,370 | —- | M] () – C:\WINDOWS\Tasks\RegCure.job
[2010/07/23 03:01:01 | 000,000,232 | —- | M] () – C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2005/02/11 01:09:27 | 000,412,585 | —- | M] () – C:\ccsetup117.exe
[2008/12/16 00:50:30 | 003,889,824 | —- | M] (Comcast Cable Communications, LLC ) – C:\downloadable_install_wizard(4).exe
[2005/03/19 19:34:00 | 004,826,536 | —- | M] (Mozilla) – C:\Firefox Setup 1.0.2.exe
[2004/11/13 16:36:42 | 000,258,560 | —- | M] () – C:\ie-spyad.exe
[2005/01/15 08:43:33 | 006,537,888 | —- | M] (Microsoft Corporation ) – C:\MicrosoftAntiSpywareInstall.exe
[2005/03/12 09:11:34 | 002,513,056 | —- | M] (Javacool Software LLC ) – C:\spywareblastersetup33.exe
[2005/05/29 11:22:12 | 002,560,240 | —- | M] (Javacool Software LLC ) – C:\spywareblastersetup34.exe
[2003/04/07 01:28:28 | 000,058,368 | —- | M] (Soeperman Enterprises Ltd.) – C:\StartupList.exe
[2004/10/01 18:03:35 | 000,883,719 | —- | M] (McAfee Inc.) – C:\stinger.exe
[2005/10/31 11:56:00 | 000,700,416 | —- | M] (LimeWire) – C:\StubInstaller.exe
[2009/04/07 09:43:14 | 000,496,368 | —- | M] (Microsoft Corporation) – C:\WindowsXP-KB892050-v3-x86-ENU.exe
[2009/04/07 09:43:14 | 000,051,440 | —- | M] (Microsoft Corporation) – C:\WindowsXP-KB892050-v3-x86-Symbols-ENU.exe
[2004/10/06 16:37:10 | 005,827,728 | —- | M] () – C:\zlsSetup_51_033_000.exe
[2005/02/28 09:43:52 | 006,670,952 | —- | M] () – C:\zlsSetup_55_062_011.exe
[2006/06/22 13:00:01 | 013,707,688 | —- | M] () – C:\zlsSetup_65_722_000_en.exe

< MD5 for: AGP440.SYS >
[2004/09/15 21:27:23 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp2.cab:AGP440.sys
[2008/08/31 09:41:48 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp3.cab:AGP440.sys
[2004/09/15 21:27:23 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008/08/31 09:41:48 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\SYSTEM32\DLLCACHE\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\SYSTEM32\DRIVERS\AGP440.SYS
[2008/04/13 15:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\SYSTEM32\ReinstallBackups\0020\DriverFiles\i386\AGP440.SYS
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\SYSTEM32\ReinstallBackups\0058\DriverFiles\i386\AGP440.SYS
[2004/08/04 02:07:41 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2001/08/17 15:58:00 | 000,025,472 | —- | M] (Microsoft Corporation) MD5=65880045C51AA36184841CEE915A61DF – C:\I386\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2002/08/29 07:00:00 | 010,158,890 | —- | M] () .cab file – C:\I386\sp1.cab:atapi.sys
[2002/08/29 07:00:00 | 010,158,890 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp1.cab:atapi.sys
[2004/09/15 21:27:23 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp2.cab:atapi.sys
[2008/08/31 09:41:48 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp3.cab:atapi.sys
[2004/09/15 21:27:23 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2008/08/31 09:41:48 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2002/10/16 19:31:10 | 000,087,040 | —- | M] (Microsoft Corporation) MD5=3DF589B9A15FF9EF4AA499F98C1C16D5 – C:\I386\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\SYSTEM32\DRIVERS\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\SYSTEM32\ReinstallBackups\0063\DriverFiles\i386\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\SYSTEM32\ReinstallBackups\0064\DriverFiles\i386\atapi.sys
[2004/08/04 01:59:42 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 20:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 20:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\SYSTEM32\eventlog.dll
[2004/08/04 03:56:42 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
[2002/08/29 07:00:00 | 000,049,152 | —- | M] (Microsoft Corporation) MD5=BF3C8CF53C77B48206B39910B6D6CBCC – C:\I386\EVENTLOG.DLL

< MD5 for: IDECHNDR.SYS >
[2002/10/15 00:00:00 | 000,101,431 | —- | M] (Intel Corporation) MD5=7D2B8BE9E89628663C1FB571F7C34062 – C:\Program Files\intel\Intel Application Accelerator\Driver\IdeChnDr.sys
[2002/10/15 00:00:00 | 000,101,431 | —- | M] (Intel Corporation) MD5=7D2B8BE9E89628663C1FB571F7C34062 – C:\WINDOWS\SYSTEM32\DRIVERS\IdeChnDr.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 20:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 20:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\SYSTEM32\netlogon.dll
[2002/08/29 07:00:00 | 000,399,360 | —- | M] (Microsoft Corporation) MD5=3ADD563ED7A1C66E6F5E0F7A661AA96D – C:\I386\NETLOGON.DLL
[2004/08/04 03:56:44 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 03:56:44 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2002/08/29 07:00:00 | 000,174,592 | —- | M] (Microsoft Corporation) MD5=97418A5C642A5C748A28BD7CF6860B57 – C:\I386\SCECLI.DLL
[2008/04/13 20:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\SYSTEM32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2002/09/03 10:47:18 | 000,094,208 | —- | M] () – C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.SAV
[2002/09/03 10:47:18 | 000,602,112 | —- | M] () – C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.SAV
[2002/09/03 10:47:18 | 000,380,928 | —- | M] () – C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.SAV

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Dick\My Documents\spider.sav:SummaryInformation
< End of report >

ken545

Post #5July 23, 2010, 1:08 PM UTC

Good Morning, Still looking at two AVs and Ask Toolbar, I am also looking at Limewire, file sharing is not recommended as this is the latest way of getting infected, your downloading that file from an unknown source , its like playing Russian Roulette malwarewise. Not looking at anything bad, what symptoms are you experiencing to make you think your infected ?

MARTY1946

Post #6July 23, 2010, 3:30 PM UTC

Hi Ken,

I uninstalled Comodo and ASK toolbar. Where do I find limewire? I don't see it in the ADD/Remove program list. My daughter probably downloaded it for music files. My machine seemed to be running slow, and the hard drive was crunching away. Thanks Again. Marty

ken545

Post #7July 23, 2010, 3:46 PM UTC

Hi Marty,

I am assuming that Limewire was installed at one time , just looking at some left over entries .

Lets check for a rootkit that may not show on most scanners

Try running this program first in regular windows and if it gives you problems than try it in safemode..

To Enter Safemode

Go to Start> Shut off your Computer> Restart
As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
this will bring up a menu.
Use the Up and Down Arrow Keys to scroll up to Safemode
Then press the Enter Key on your Keyboard

Tutorial if you need it How to boot into Safemode

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double click GMER.exe.
[external image: Posted Image]
If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO, then use the following settings for a more complete scan..
In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
  [external image: Posted Image]
  Click the image to enlarge it
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
Save the log where you can easily find it, such as your desktop.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please copy and paste the report into your Post.

MARTY1946

Post #8July 24, 2010, 9:04 AM UTC

First Part
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-07-24 04:13:00
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Dick\LOCALS~1\Temp\pxdoapog.sys

—- System - GMER 1.0.15 —-

SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAcceptConnectPort [0x805891F1]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAccessCheck [0x805792D1]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAccessCheckAndAuditAlarm [0x8058C5E8]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAccessCheckByType [0x8058A52C]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAccessCheckByTypeAndAuditAlarm [0x80590AA6]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAccessCheckByTypeResultList [0x806383F2]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAccessCheckByTypeResultListAndAuditAlarm [0x8063A583]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAccessCheckByTypeResultListAndAuditAlarmByHandle [0x8063A5CC]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAddAtom [0x8057A8C4]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAddBootEntry [0x80649391]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAdjustGroupsToken [0x80637BAD]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAdjustPrivilegesToken [0x805900C4]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAlertResumeThread [0x8062FCF4]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAlertThread [0x8057ADAD]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAllocateLocallyUniqueId [0x80591876]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAllocateUserPhysicalPages [0x80626C4D]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAllocateUuids [0x805DD479]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAllocateVirtualMemory [0x80568FCA]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAreMappedFilesTheSame [0x805D9817]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwAssignProcessToJobObject [0x805A253D]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCallbackReturn [0x804E2CC4]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCancelDeviceWakeupRequest [0x8062C4AE]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCancelIoFile [0x805C9BB6]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCancelTimer [0x804ECFBC]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwClearEvent [0x80569676]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwClose [0x805678CD]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCloseObjectAuditAlarm [0x80590532]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCompactKeys [0x8064EC88]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCompareTokens [0x8058BA4E]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCompleteConnectPort [0x80589F39]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCompressKey [0x8064EEF5]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwConnectPort [0x8058C63A]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwContinue [0x804E2006]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateDebugObject [0x8065A3C6]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateDirectoryObject [0x805A2905]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateEvent [0x8056D752]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateEventPair [0x80649484]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateFile [0x8056CF98]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateIoCompletion [0x8058A785]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateJobObject [0x805AB234]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateJobSet [0x8063019F]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateKey [0x80570833]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateMailslotFile [0x805D9708]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateMutant [0x80578217]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateNamedPipeFile [0x8058412B]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreatePagingFile [0x805BBE63]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreatePort [0x80597609]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateProcess [0x805B14AC]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateProcessEx [0x8057FE4C]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateProfile [0x80649ABB]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateSection [0x805652B3]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateSemaphore [0x80572620]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateSymbolicLinkObject [0x8059F586]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateThread [0x80587A3C]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateTimer [0x8059E63D]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateToken [0x805A8BDA]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateWaitablePort [0x805DB1D4]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwDebugActiveProcess [0x8065B541]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwDebugContinue [0x8065B69B]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwDelayExecution [0x80566410]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwDeleteAtom [0x8058C4E9]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwDeleteFile [0x805D80BB]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwDeleteKey [0x80595316]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwDeleteObjectAuditAlarm [0x8063A627]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwDeleteValueKey [0x80592D64]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwDeviceIoControlFile [0x805883AA]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwDisplayString [0x805BF031]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwDuplicateObject [0x805717C5]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwDuplicateToken [0x8057D1CB]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwEnumerateKey [0x80570F41]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwEnumerateSystemEnvironmentValuesEx [0x80648E1F]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwEnumerateValueKey [0x80589A67]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwExtendSection [0x80625A74]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwFilterToken [0x805B0C90]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwFindAtom [0x8058BCDE]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwFlushBuffersFile [0x8058CB4D]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwFlushInstructionCache [0x80577873]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwFlushKey [0x805DC640]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwFlushVirtualMemory [0x8059AD24]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwFlushWriteBuffer [0x806274AF]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwFreeUserPhysicalPages [0x80627002]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwFreeVirtualMemory [0x805698F5]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwFsControlFile [0x8057AC95]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwGetContextThread [0x805E04D3]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwGetDevicePowerState [0x8062C4DB]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwGetPlugPlayEvent [0x8059FE35]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwGetWriteWatch [0x8053B775]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwImpersonateAnonymousToken [0x8059762D]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwImpersonateClientOfPort [0x8058B4BA]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwImpersonateThread [0x8057E821]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwInitializeRegistry [0x805A80E6]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwInitiatePowerAction [0x8062C293]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwIsProcessInJob [0x80630053]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwIsSystemResumeAutomatic [0x8062C4C1]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwListenPort [0x805AA775]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwLoadDriver [0x805A3B73]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwLoadKey [0x805AEE7B]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwLoadKey2 [0x805AECB8]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwLockFile [0x8058E224]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwLockProductActivationKeys [0x805B0E60]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwLockRegistryKey [0x805D0F87]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwLockVirtualMemory [0x805B02E2]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwMakePermanentObject [0x8059F9C2]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwMakeTemporaryObject [0x8059F93F]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwMapUserPhysicalPages [0x80626139]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwMapUserPhysicalPagesScatter [0x8062660D]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwMapViewOfSection [0x80573D41]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwNotifyChangeDirectoryFile [0x8059112F]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwNotifyChangeKey [0x8058EA94]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwNotifyChangeMultipleKeys [0x8058EB5D]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenDirectoryObject [0x80589E32]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenEvent [0x8057DEC7]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenEventPair [0x80649577]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenFile [0x8056CF33]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenIoCompletion [0x80616ADF]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenJobObject [0x806303F7]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenKey [0x80568D48]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenMutant [0x805782C5]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenObjectAuditAlarm [0x80595401]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenProcess [0x805719AC]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenProcessToken [0x8056E0CD]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenProcessTokenEx [0x8056E2C6]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenSection [0x805711B4]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenSemaphore [0x8059F042]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenSymbolicLinkObject [0x80589CFE]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenThread [0x8058E5C4]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenThreadToken [0x8056DB6A]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenThreadTokenEx [0x8056DADB]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenTimer [0x806493AD]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwPlugPlayControl [0x805DB394]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwPowerInformation [0x8059CA1E]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwPrivilegeCheck [0x805DDA4E]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwPrivilegeObjectAuditAlarm [0x805DD2E8]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwPrivilegedServiceAuditAlarm [0x805AA8B8]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwProtectVirtualMemory [0x80571E96]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwPulseEvent [0x805DB12C]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryAttributesFile [0x80574692]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryDebugFilterState [0x804F7E5D]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryDefaultLocale [0x80566B82]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryDefaultUILanguage [0x8057EC87]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryDirectoryFile [0x805722F6]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryDirectoryObject [0x8058458D]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryEaFile [0x80616D2C]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryEvent [0x80589EAF]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryFullAttributesFile [0x8057C9FA]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryInformationAtom [0x805D7798]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryInformationFile [0x80572E4F]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryInformationJobObject [0x80580A8D]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryInformationPort [0x80623543]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryInformationProcess [0x8056DD08]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryInformationThread [0x8056BC5D]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryInformationToken [0x8056E837]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryInstallUILanguage [0x8057E00B]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryIntervalProfile [0x80649F6B]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryIoCompletion [0x80616BA0]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryKey [0x80570C4A]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryMultipleValueKey [0x8064E66B]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryMutant [0x806498F0]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryObject [0x8057F694]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryOpenSubKeys [0x8064E875]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryPerformanceCounter [0x80567338]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryQuotaInformationFile [0x806175F3]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQuerySection [0x8057D6B6]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQuerySecurityObject [0x805DD8EE]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQuerySemaphore [0x806486EB]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQuerySymbolicLinkObject [0x80589B6F]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQuerySystemEnvironmentValue [0x80648E47]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQuerySystemEnvironmentValueEx [0x80648E0C]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQuerySystemInformation [0x8057BE20]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQuerySystemTime [0x8058A5B6]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryTimer [0x805873F2]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryTimerResolution [0x805841F3]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryValueKey [0x8056A1F9]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryVirtualMemory [0x8056E3C4]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryVolumeInformationFile [0x8056D1DB]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueueApcThread [0x8058A487]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwRaiseException [0x804E204E]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwRaiseHardError [0x80648427]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwReadFile [0x805742F7]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwReadFileScatter [0x805DA8DF]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwReadRequestData [0x8058B7FF]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwReadVirtualMemory [0x8057E4B8]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwRegisterThreadTerminatePort [0x80588189]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwReleaseMutant [0x8056647B]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwReleaseSemaphore [0x8058BFFA]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwRemoveIoCompletion [0x80566F99]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwRemoveProcessDebug [0x8065B616]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwRenameKey [0x8064EAEA]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwReplaceKey [0x8064F446]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwReplyPort [0x8057CEC4]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwReplyWaitReceivePort [0x8056BA04]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwReplyWaitReceivePortEx [0x8056B51C]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwReplyWaitReplyPort [0x80623622]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwRequestDeviceWakeup [0x8062C43B]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwRequestPort [0x805DD6A4]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwRequestWaitReplyPort [0x80576EC6]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwRequestWakeupLatency [0x8062C234]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwResetEvent [0x8059EC05]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwResetWriteWatch [0x8053BC0A]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwRestoreKey [0x8064EFDD]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwResumeProcess [0x8062FC94]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwResumeThread [0x805880AF]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSaveKey [0x8064F0DE]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSaveKeyEx [0x8064F1C9]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSaveMergedKeys [0x8064F2F6]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSecureConnectPort [0x805888DA]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetContextThread [0x8062E057]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetDebugFilterState [0x8065D15E]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetDefaultHardErrorPort [0x805D5707]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetDefaultLocale [0x805AE977]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetDefaultUILanguage [0x805AE91E]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetEaFile [0x8061727B]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetEvent [0x805696C5]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetEventBoostPriority [0x80575B6E]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetHighEventPair [0x80649877]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetHighWaitLowEventPair [0x80649797]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetInformationDebugObject [0x8065AFB7]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetInformationFile [0x80574B2A]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetInformationJobObject [0x805AB388]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetInformationKey [0x8064E1CE]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetInformationObject [0x8057DF3D]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetInformationProcess [0x8056DDD9]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetInformationThread [0x80575756]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetInformationToken [0x805A8772]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetIntervalProfile [0x80649A97]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetIoCompletion [0x8056BEF1]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetLdtEntries [0x8062ED77]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetLowEventPair [0x8064980B]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetLowWaitHighEventPair [0x80649723]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetQuotaInformationFile [0x806175C9]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetSecurityObject [0x8059B1F3]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetSystemEnvironmentValue [0x806490E4]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetSystemInformation [0x805A7C5F]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetSystemPowerState [0x80667A0B]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetSystemTime [0x80647D6F]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetThreadExecutionState [0x805E0242]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetTimer [0x804E57AB]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetTimerResolution [0x805E08C8]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetUuidSeed [0x805AAA9F]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetValueKey [0x80572A6E]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSetVolumeInformationFile [0x80617B0F]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwShutdownSystem [0x806474BB]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSignalAndWaitForSingleObject [0x80517381]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwStartProfile [0x80649D02]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwStopProfile [0x80649EBB]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSuspendProcess [0x8062FC39]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSuspendThread [0x805E053E]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwSystemDebugControl [0x8064A01B]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwTerminateJobObject [0x8063056D]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwTerminateProcess [0x805824CC]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwTerminateThread [0x8057BA6F]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwTestAlert [0x80587B96]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwTraceEvent [0x80545B28]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwTranslateFilePath [0x80648E33]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwUnloadDriver [0x80619F32]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwUnloadKey [0x8064DD32]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwUnloadKeyEx [0x8064DF63]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwUnlockFile [0x8058E384]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwUnlockVirtualMemory [0x80627525]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwUnmapViewOfSection [0x805738C6]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwVdmControl [0x805B7B07]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwWaitForDebugEvent [0x8065AD00]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwWaitForMultipleObjects [0x805666C6]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwWaitForSingleObject [0x8056617C]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwWaitHighEventPair [0x806496B7]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwWaitLowEventPair [0x8064964B]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwWriteFile [0x80574DD5]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwWriteFileGather [0x805DA515]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwWriteRequestData [0x8058B9EC]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwWriteVirtualMemory [0x8057E60A]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwYieldExecution [0x804F0EB6]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwCreateKeyedEvent [0x805CBE3D]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwOpenKeyedEvent [0x80581818]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwReleaseKeyedEvent [0x8064A48F]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwWaitForKeyedEvent [0x8064A72A]
SSDT \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) ZwQueryPortInformationProcess [0x8062D835]

INT 0x00 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DF350
INT 0x01 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DF4CB
INT 0x03 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DF89D
INT 0x04 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DFA20
INT 0x05 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DFB81
INT 0x06 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DFD02
INT 0x07 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E036A
INT 0x09 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E078F
INT 0x0A \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E08AC
INT 0x0B \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E09E9
INT 0x0C \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E0C42
INT 0x0D \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E0F38
INT 0x0E \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E1662
INT 0x0F \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E198F
INT 0x10 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E1AAC
INT 0x11 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E1BE2
INT 0x12 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E198F
INT 0x13 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E1D48
INT 0x14 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E198F
INT 0x15 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E198F
INT 0x16 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E198F
INT 0x17 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E198F
INT 0x18 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E198F
INT 0x19 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E198F
INT 0x1A \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E198F
INT 0x1B \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E198F
INT 0x1C \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E198F
INT 0x1D \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E198F
INT 0x1E \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E198F
INT 0x1F \WINDOWS\system32\hal.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 806EFFD0
INT 0x2A \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DEB92
INT 0x2B \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DEC95
INT 0x2C \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DEE34
INT 0x2D \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DF77C
INT 0x2E \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE631
INT 0x2F \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804E198F
INT 0x30 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDCF0
INT 0x31 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDCFA
INT 0x32 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDD04
INT 0x33 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDD0E
INT 0x34 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDD18
INT 0x35 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDD22
INT 0x36 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDD2C
INT 0x37 \WINDOWS\system32\hal.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 806EF728
INT 0x38 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDD40
INT 0x39 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDD4A
INT 0x3A \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDD54
INT 0x3B \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDD5E
INT 0x3C \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDD68
INT 0x3D \WINDOWS\system32\hal.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 806F0B70
INT 0x3E \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDD7C
INT 0x3F \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDD86
INT 0x40 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDD90
INT 0x41 \WINDOWS\system32\hal.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 806F09CC
INT 0x42 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDDA4
INT 0x43 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDDAE
INT 0x44 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDDB8
INT 0x45 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDDC2
INT 0x46 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDDCC
INT 0x47 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDDD6
INT 0x48 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDDE0
INT 0x49 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDDEA
INT 0x4A \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDDF4
INT 0x4B \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDDFE
INT 0x4C \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDE08
INT 0x4D \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDE12
INT 0x4E \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDE1C
INT 0x4F \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDE26
INT 0x50 \WINDOWS\system32\hal.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 806EF800
INT 0x51 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDE3A
INT 0x52 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDE44
INT 0x53 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDE4E
INT 0x54 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDE58
INT 0x55 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDE62
INT 0x56 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDE6C
INT 0x57 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDE76
INT 0x58 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDE80
INT 0x59 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDE8A
INT 0x5A \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDE94
INT 0x5B \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDE9E
INT 0x5C \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDEA8
INT 0x5D \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDEB2
INT 0x5E \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDEBC
INT 0x5F \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDEC6
INT 0x60 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDED0
INT 0x61 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDEDA
INT 0x62 atapi.sys (IDE/ATAPI Port Driver/Microsoft Corporation) F74C567E
INT 0x63 \SystemRoot\System32\DRIVERS\USBPORT.SYS (USB 1.1 & 2.0 Port Driver/Microsoft Corporation) B9C03E54
INT 0x64 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDEF8
INT 0x65 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDF02
INT 0x66 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDF0C
INT 0x67 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDF16
INT 0x68 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDF20
INT 0x69 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDF2A
INT 0x6A \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDF34
INT 0x6B \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDF3E
INT 0x6C \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDF48
INT 0x6D \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDF52
INT 0x6E \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDF5C
INT 0x6F \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDF66
INT 0x70 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDF70
INT 0x71 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDF7A
INT 0x72 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDF84
INT 0x73 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS (Video Port Driver/Microsoft Corporation) B9C0ECB8
INT 0x74 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDF98
INT 0x75 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFA2
INT 0x76 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFAC
INT 0x77 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFB6
INT 0x78 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFC0
INT 0x79 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFCA
INT 0x7A \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFD4
INT 0x7B \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFDE
INT 0x7C \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFE8
INT 0x7D \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFF2
INT 0x7E \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFFC
INT 0x7F \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE006
INT 0x80 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE010
INT 0x81 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE01A
INT 0x82 atapi.sys (IDE/ATAPI Port Driver/Microsoft Corporation) F74C567E
INT 0x83 \SystemRoot\system32\drivers\portcls.sys (Port Class (Class Driver for Port/Miniport Devices)/Microsoft Corporation) B9A2A954
INT 0x84 NDIS.sys (NDIS 5.1 wrapper driver/Microsoft Corporation) F7462E10
INT 0x85 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE042
INT 0x86 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE04C
INT 0x87 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE056
INT 0x88 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE060
INT 0x89 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE06A
INT 0x8A \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE074
INT 0x8B \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE07E
INT 0x8C \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE088
INT 0x8D \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE092
INT 0x8E \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE09C
INT 0x8F \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE0A6
INT 0x90 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE0B0
INT 0x91 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE0BA
INT 0x92 \SystemRoot\System32\DRIVERS\serial.sys (Serial Device Driver/Microsoft Corporation) BA7A89C0
INT 0x93 \SystemRoot\System32\DRIVERS\i8042prt.sys (i8042 Port Driver/Microsoft Corporation) BA7B8495
INT 0x94 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE0D8
INT 0x95 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE0E2
INT 0x96 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE0EC
INT 0x97 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE0F6
INT 0x98 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE100
INT 0x99 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE10A
INT 0x9A \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE114
INT 0x9B \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE11E
INT 0x9C \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE128
INT 0x9D \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE132
INT 0x9E \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE13C
INT 0x9F \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE146
INT 0xA0 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE150
INT 0xA1 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE15A
INT 0xA2 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE164
INT 0xA3 \SystemRoot\System32\DRIVERS\i8042prt.sys (i8042 Port Driver/Microsoft Corporation) BA7BFC90
INT 0xA4 \SystemRoot\System32\DRIVERS\USBPORT.SYS (USB 1.1 & 2.0 Port Driver/Microsoft Corporation) B9C03E54
INT 0xA5 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE182
INT 0xA6 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE18C
INT 0xA7 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE196
INT 0xA8 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1A0
INT 0xA9 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1AA
INT 0xAA \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1B4
INT 0xAB \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1BE
INT 0xAC \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1C8
INT 0xAD \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1D2
INT 0xAE \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1DC
INT 0xAF \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1E6
INT 0xB0 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1F0
INT 0xB1 ACPI.sys (ACPI Driver for NT/Microsoft Corporation) F75B331E
INT 0xB2 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE204
INT 0xB3 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE20E
INT 0xB4 \SystemRoot\System32\DRIVERS\USBPORT.SYS (USB 1.1 & 2.0 Port Driver/Microsoft Corporation) B9C03E54

MARTY1946

Post #9July 24, 2010, 9:07 AM UTC

Second Part INT 0x79 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFCA INT 0x7A \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFD4 INT 0x7B \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFDE INT 0x7C \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFE8 INT 0x7D \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFF2 INT 0x7E \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DDFFC INT 0x7F \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE006 INT 0x80 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE010 INT 0x81 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE01A INT 0x82 atapi.sys (IDE/ATAPI Port Driver/Microsoft Corporation) F74C567E INT 0x83 \SystemRoot\system32\drivers\portcls.sys (Port Class (Class Driver for Port/Miniport Devices)/Microsoft Corporation) B9A2A954 INT 0x84 NDIS.sys (NDIS 5.1 wrapper driver/Microsoft Corporation) F7462E10 INT 0x85 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE042 INT 0x86 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE04C INT 0x87 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE056 INT 0x88 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE060 INT 0x89 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE06A INT 0x8A \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE074 INT 0x8B \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE07E INT 0x8C \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE088 INT 0x8D \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE092 INT 0x8E \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE09C INT 0x8F \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE0A6 INT 0x90 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE0B0 INT 0x91 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE0BA INT 0x92 \SystemRoot\System32\DRIVERS\serial.sys (Serial Device Driver/Microsoft Corporation) BA7A89C0 INT 0x93 \SystemRoot\System32\DRIVERS\i8042prt.sys (i8042 Port Driver/Microsoft Corporation) BA7B8495 INT 0x94 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE0D8 INT 0x95 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE0E2 INT 0x96 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE0EC INT 0x97 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE0F6 INT 0x98 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE100 INT 0x99 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE10A INT 0x9A \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE114 INT 0x9B \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE11E INT 0x9C \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE128 INT 0x9D \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE132 INT 0x9E \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE13C INT 0x9F \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE146 INT 0xA0 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE150 INT 0xA1 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE15A INT 0xA2 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE164 INT 0xA3 \SystemRoot\System32\DRIVERS\i8042prt.sys (i8042 Port Driver/Microsoft Corporation) BA7BFC90 INT 0xA4 \SystemRoot\System32\DRIVERS\USBPORT.SYS (USB 1.1 & 2.0 Port Driver/Microsoft Corporation) B9C03E54 INT 0xA5 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE182 INT 0xA6 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE18C INT 0xA7 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE196 INT 0xA8 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1A0 INT 0xA9 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1AA INT 0xAA \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1B4 INT 0xAB \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1BE INT 0xAC \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1C8 INT 0xAD \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1D2 INT 0xAE \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1DC INT 0xAF \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1E6 INT 0xB0 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE1F0 INT 0xB1 ACPI.sys (ACPI Driver for NT/Microsoft Corporation) F75B331E INT 0xB2 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE204 INT 0xB3 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE20E INT 0xB4 \SystemRoot\System32\DRIVERS\USBPORT.SYS (USB 1.1 & 2.0 Port Driver/Microsoft Corporation) B9C03E54

MARTY1946

Post #10July 24, 2010, 9:10 AM UTC

Third Part INT 0xB5 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE222 INT 0xB6 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE22C INT 0xB7 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE236 INT 0xB8 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE240 INT 0xB9 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE24A INT 0xBA \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE254 INT 0xBB \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE25E INT 0xBC \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE268 INT 0xBD \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE272 INT 0xBE \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE27C INT 0xBF \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE286 INT 0xC0 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE290 INT 0xC1 \WINDOWS\system32\hal.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 806EF984 INT 0xC2 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE2A4 INT 0xC3 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE2AE INT 0xC4 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE2B8 INT 0xC5 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE2C2 INT 0xC6 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE2CC INT 0xC7 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE2D6 INT 0xC8 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE2E0 INT 0xC9 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE2EA INT 0xCA \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE2F4 INT 0xCB \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE2FE INT 0xCC \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE308 INT 0xCD \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE312 INT 0xCE \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE31C INT 0xCF \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE326 INT 0xD0 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE330 INT 0xD1 \WINDOWS\system32\hal.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 806EED34 INT 0xD2 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE344 INT 0xD3 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE34E INT 0xD4 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE358 INT 0xD5 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE362 INT 0xD6 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE36C INT 0xD7 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE376 INT 0xD8 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE380 INT 0xD9 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE38A INT 0xDA \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE394 INT 0xDB \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE39E INT 0xDC \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE3A8 INT 0xDD \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE3B2 INT 0xDE \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE3BC INT 0xDF \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE3C6 INT 0xE0 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE3D0 INT 0xE1 \WINDOWS\system32\hal.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 806EFF0C INT 0xE2 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE3E4 INT 0xE3 \WINDOWS\system32\hal.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 806EFC70 INT 0xE4 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE3F8 INT 0xE5 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE402 INT 0xE6 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE40C INT 0xE7 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE416 INT 0xE8 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE420 INT 0xE9 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE42A INT 0xEA \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE434 INT 0xEB \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE43E INT 0xEC \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE448 INT 0xED \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE452 INT 0xEE \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE459 INT 0xEF \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE460 INT 0xF0 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE467 INT 0xF1 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE46E INT 0xF2 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE475 INT 0xF3 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE47C INT 0xF4 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE483 INT 0xF5 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE48A INT 0xF6 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE491 INT 0xF7 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE498 INT 0xF8 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE49F INT 0xF9 \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE4A6 INT 0xFA \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE4AD INT 0xFB \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE4B4 INT 0xFC \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE4BB INT 0xFD \WINDOWS\system32\hal.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 806F0464 INT 0xFE \WINDOWS\system32\hal.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 806F0604 INT 0xFF \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804DE4D0

MARTY1946

Post #11July 24, 2010, 9:13 AM UTC

Fourth Part SYSENTER \WINDOWS\system32\ntoskrnl.exe 804DE6F0 —- Kernel code sections - GMER 1.0.15 —- .text ntoskrnl.exe!RtlPrefetchMemoryNonTemporal 804DB03D 1 Byte [90] .text ntoskrnl.exe!KiDispatchInterrupt + 22E 804DBAA2 18 Bytes [E0, 25, 7F, FF, FF, FF, 0F, …] .text ntoskrnl.exe!KiDispatchInterrupt + 246 804DBABA 1 Byte [00] .text ntoskrnl.exe!ZwYieldExecution + C76 804DE8EA 1 Byte [06] .text hal.dll!HalBeginSystemInterrupt + 9C7 806F1673 1 Byte [19] .text hal.dll!HalBeginSystemInterrupt + 9C7 806F1673 10 Bytes [19, 00, 5F, 4F, 50, 82, 54, …] {SBB [EAX], EAX; POP EDI; DEC EDI; PUSH EAX; ADC BYTE [EAX+EAX*4+0xb], 0x3e} .text hal.dll!HalBeginSystemInterrupt + 9D2 806F167E 1 Byte [40] .text hal.dll!HalBeginSystemInterrupt + 9D8 806F1684 7 Bytes [01, 01, 46, 32, 8D, 02, 0F] .text hal.dll!HalBeginSystemInterrupt + 9E0 806F168C 6 Bytes [12, 32, 4C, 02, 99, 0E] .text … —- User code sections - GMER 1.0.15 —- .text C:\WINDOWS\system32\SearchIndexer.exe[108] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation) .text C:\Program Files\AGI\core\3.0\AGCoreService.exe[216] agcore.dll 00B391E2 1 Byte [40] .text C:\Program Files\Mozilla Firefox\plugin-container.exe[236] USER32.dll!TrackPopupMenu 7E46531E 5 Bytes JMP 10449A84 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] OUTLOOK.EXE!StdCoCreateInstance@20 + 39E0C 3004C42C 4 Bytes [9C, 96, 33, 3C] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes JMP 32605164 C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll (2007 Microsoft Office component/Microsoft Corporation) .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 330B9D32 C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll (2007 Microsoft Office component/Microsoft Corporation) .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] mso.dll!_MsoFSetTooltips@4 + 1EA1B2 32A8D2A8 4 Bytes [4B, D1, 3C, 3C] {DEC EBX; SAR DWORD [ESP+EDI], 0x1} .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] olmapi32.dll!HrConvertUnicodeToString8Ex@32 + 2A221 38FAFCDC 2 Bytes [DD, 56] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] olmapi32.dll!HrConvertUnicodeToString8Ex@32 + 2A224 38FAFCDF 1 Byte [3C] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] OLEAUT32.DLL!SysFreeString 77124880 5 Bytes JMP 32630C4A C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll (2007 Microsoft Office component/Microsoft Corporation) .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] OLEAUT32.DLL!VariantClear 771248F0 5 Bytes JMP 3263ABA8 C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll (2007 Microsoft Office component/Microsoft Corporation) .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] OLEAUT32.DLL!SysAllocStringByteLen 77124C35 5 Bytes JMP 3268E927 C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll (2007 Microsoft Office component/Microsoft Corporation) .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] OLEAUT32.DLL!VariantChangeType 77126BBB 5 Bytes JMP 3266DA33 C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll (2007 Microsoft Office component/Microsoft Corporation) .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] riched20.dll!IID_ITextHost2 + 4AB4 3A7DEA84 4 Bytes [48, 6A, 58, 3C] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] wwlib.dll!FMain + 22CC69 31471210 4 Bytes [FB, 5B, 51, 3C] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] oart.dll!?OdfFunctionsEntry@Art@@YGAAVIOdfFunctions@1@XZ + 5633B 3AAF2EC4 4 Bytes [04, 57, 51, 3C] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] contab32.dll!ABProviderInit + 2706 38353E08 4 Bytes [CC, DD, A6, 3C] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] MSMAPI32.DLL!HrDispatchNotifications@4 + 74 38ED1B88 4 Bytes [FD, 0A, B6, 3C] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] mspst32.dll!MSProviderInit + 16DBB 38D88DF4 4 Bytes [50, 5A, B2, 3C] {PUSH EAX; POP EDX; MOV DL, 0x3c} .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] COLLEA~1.DLL!DllUnregisterServer + FFFFE641 39A4227C 4 Bytes [3A, 52, F5, 3C] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] OMSMAIN.DLL!DllGetClassObject + FFFCA16F 3D429660 4 Bytes [F5, BB, C2, 3C] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] UMOUTL~1.DLL!DllUnregisterServer + FFFEF499 34E82788 4 Bytes [BA, 89, C3, 3C] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] OUTLACCT.DLL!DllGetClassObject + F91 38512540 4 Bytes [9A, B9, 84, 44] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] outlrpc.dll!MAPIRevokeMoniker@4 + FFFFCF90 3833358C 4 Bytes [A4, 49, 26, 48] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] exsec32.dll!HrWrapMessageForSecurityEx2@24 + 58C 389741C8 4 Bytes [9C, 55, 2F, 48] {PUSHF ; PUSH EBP; DAS ; DEC EAX} .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] rtfhtml.dll!HrCreateMHTMLConverter + 1A79 3846114C 4 Bytes [7D, 11, 2C, 48] {JGE 0x13; SUB AL, 0x48} .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] MSPTLS.DLL!FsDestroyMemory + FFF8E3DF 6BDC10AC 4 Bytes [40, E4, 21, 48] {INC EAX; IN AL, 0x21; DEC EAX} .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] msproof6.dll!DllGetClassObject + FFFE5E50 403945A8 4 Bytes [73, 6A, 23, 6B] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] OGL.DLL!GdipSetStringFormatDigitSubstitution + A63E 3BD66DFC 4 Bytes [8C, 88, 15, F1] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3044] NLSDATA0009.DLL!NlsLangDataCall + 51A62 0BB25E64 4 Bytes [B5, 0A, FC, C1] UPX1 C:\Documents and Settings\Dick\Desktop\gmer.exe[3500] C:\Documents and Settings\Dick\Desktop\gmer.exe entry point in "UPX1" section [0x004B3F40] .text C:\Program Files\Mozilla Firefox\firefox.exe[3552] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation) .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] OUTLOOK.EXE!StdCoCreateInstance@20 + 39E0C 3004C42C 4 Bytes [C0, 43, BC, 8A] {ROL BYTE [EBX-0x44], 0x8a} .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes JMP 32605164 C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll (2007 Microsoft Office component/Microsoft Corporation) .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 330B9D32 C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll (2007 Microsoft Office component/Microsoft Corporation) .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] mso.dll!_MsoFSetTooltips@4 + 1EA1B2 32A8D2A8 4 Bytes [43, AE, FE, 8A] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] olmapi32.dll!HrConvertUnicodeToString8Ex@32 + 2A221 38FAFCDC 4 Bytes [4D, 29, EA, 8A] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] OLEAUT32.DLL!SysFreeString 77124880 5 Bytes JMP 32630C4A C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll (2007 Microsoft Office component/Microsoft Corporation) .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] OLEAUT32.DLL!VariantClear 771248F0 5 Bytes JMP 3263ABA8 C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll (2007 Microsoft Office component/Microsoft Corporation) .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] OLEAUT32.DLL!SysAllocStringByteLen 77124C35 5 Bytes JMP 3268E927 C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll (2007 Microsoft Office component/Microsoft Corporation) .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] OLEAUT32.DLL!VariantChangeType 77126BBB 5 Bytes JMP 3266DA33 C:\Program Files\Common Files\Microsoft Shared\office12\mso.dll (2007 Microsoft Office component/Microsoft Corporation) .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] riched20.dll!IID_ITextHost2 + 4AB4 3A7DEA84 4 Bytes [F5, 6C, 86, 8A] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] wwlib.dll!FMain + 22CC69 31471210 4 Bytes [9B, FB, 42, 8A] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] oart.dll!?OdfFunctionsEntry@Art@@YGAAVIOdfFunctions@1@XZ + 5633B 3AAF2EC4 4 Bytes [36, 86, 42, 8A] {XCHG SS:[EDX-0x76], AL} .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] contab32.dll!ABProviderInit + 2706 38353E08 4 Bytes [D4, FF, FB, 9D] {AAM 0xff; STI ; POPF } .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] MSMAPI32.DLL!HrDispatchNotifications@4 + 74 38ED1B88 4 Bytes [6C, 3A, 7F, 9C] {INSB ; CMP BH, [EDI-0x64]} .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] mspst32.dll!MSProviderInit + 16DBB 38D88DF4 4 Bytes [5A, 9B, 77, 9C] {POP EDX; WAIT ; JA 0xffffffffffffffa0} .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] COLLEA~1.DLL!DllUnregisterServer + FFFFE641 39A4227C 4 Bytes [A9, 31, F7, 9E] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] OMSMAIN.DLL!DllGetClassObject + FFFCA16F 3D429660 4 Bytes [D0, 1F, 25, 9E] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] UMOUTL~1.DLL!DllUnregisterServer + FFFEF499 34E82788 4 Bytes CALL 9F86520E .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] OUTLACCT.DLL!DllGetClassObject + F92 38512541 3 Bytes [B5, 59, 93] {MOV CH, 0x59; XCHG EBX, EAX} .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] rtfhtml.dll!HrCreateMHTMLConverter + 1A79 3846114C 4 Bytes [F7, F2, E2, 92] {DIV EDX; LOOP 0xffffffffffffff96} .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] outlrpc.dll!MAPIRevokeMoniker@4 + FFFFCF90 3833358C 4 Bytes [C2, F2, D2, BD] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] exsec32.dll!HrWrapMessageForSecurityEx2@24 + 58C 389741C8 4 Bytes [11, 6E, C4, BD] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] MSPTLS.DLL!FsDestroyMemory + FFF8E3DF 6BDC10AC 4 Bytes [7C, 89, A4, BD] .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] msproof6.dll!DllGetClassObject + FFFE5E50 403945A8 4 Bytes [B7, 62, B0, AE] {MOV BH, 0x62; MOV AL, 0xae} .text C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE[3844] OGL.DLL!GdipSetStringFormatDigitSubstitution + A63E 3BD66DFC 4 Bytes [1D, 11, CC, 18] —- Devices - GMER 1.0.15 —- Device \FileSystem\Ntfs \Ntfs Ntfs.sys (NT File System Driver/Microsoft Corporation) Device \FileSystem\Ntfs \Ntfs ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Ntfs \Ntfs ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Ntfs \Ntfs ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Fastfat \FatCdrom Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation) Device \FileSystem\Fastfat \FatCdrom ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Fastfat \FatCdrom Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation) Device \FileSystem\Fastfat \FatCdrom ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Mup \Dfs Mup.sys (Multiple UNC Provider driver/Microsoft Corporation) Device \Driver\NDIS \Device\Ndis NDIS.sys (NDIS 5.1 wrapper driver/Microsoft Corporation) Device \Driver\KSecDD \Device\KsecDD KSecDD.sys (Kernel Security Support Provider Interface/Microsoft Corporation) Device \Driver\KSecDD \Device\KsecDD ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000032 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000032 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000032 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\00000019 Device \Device\00000025 Device \Driver\Beep \Device\Beep Beep.SYS (BEEP Driver/Microsoft Corporation) Device \Driver\Beep \Device\Beep ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\Fsks \Device\FSKS0 fsksnt.sys (FSKsNT driver/Conexant Systems) Device \Driver\Fsks \Device\FSKS0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PSched \Device\{AC1E6519-3F19-49E3-B126-58571467722D} NDIS.sys (NDIS 5.1 wrapper driver/Microsoft Corporation) Device \Device\{2704AAF9-B8A5-4216-8D8A-90772BA56B47} Device \Driver\PnpManager \Device\00000033 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000033 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000033 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\00000026 Device \Driver\AFS2K \Device\OAKAFSUI AFS2K.SYS (Audio File System/Oak Technology Inc.) Device \Driver\AFS2K \Device\OAKAFSUI ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\NetBIOS \Device\Netbios netbios.sys (NetBIOS interface driver/Microsoft Corporation) Device \FileSystem\NetBIOS \Device\Netbios ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\Tcpip \Device\Ip tcpip.sys (TCP/IP Protocol Driver/Microsoft Corporation) Device \Driver\swenum \Device\KSENUM#00000001 swenum.sys (Plug and Play Software Device Enumerator/Microsoft Corporation) Device \Driver\swenum \Device\KSENUM#00000001 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000034 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000034 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000034 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\00000027 Device \Driver\TermDD \Device\RDP_CONSOLE0 termdd.sys (Terminal Server Driver/Microsoft Corporation) Device \Device\00000040 Device \Driver\swenum \Device\KSENUM#00000002 swenum.sys (Plug and Play Software Device Enumerator/Microsoft Corporation) Device \Driver\swenum \Device\KSENUM#00000002 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\Kbdclass \Device\KeyboardClass0 kbdclass.sys (Keyboard Class Driver/Microsoft Corporation) Device \Driver\Kbdclass \Device\KeyboardClass0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000035 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000035 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000035 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\00000028 Device \Device\00000041 Device \Driver\TermDD \Device\RDP_CONSOLE1 termdd.sys (Terminal Server Driver/Microsoft Corporation) Device \Device\Video0 Device \Driver\Fips \Device\Fips Fips.SYS (FIPS Crypto Driver/Microsoft Corporation) Device \Driver\Fips \Device\Fips ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\tmcomm \Device\TmComm tmcomm.sys (TrendMicro Common Module/Trend Micro Inc.) Device \Driver\tmcomm \Device\TmComm ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\Kbdclass \Device\KeyboardClass1 kbdclass.sys (Keyboard Class Driver/Microsoft Corporation) Device \Driver\Kbdclass \Device\KeyboardClass1 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\00000036 Device \Device\00000029 Device \Device\00000042 Device \Device\Video1 Device \Driver\NDProxy \Device\NDProxy NDProxy.SYS (NDIS Proxy/Microsoft Corporation) Device \Driver\NDProxy \Device\NDProxy ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\0000000a Device \Driver\ACPI \Device\00000043 ACPI.sys (ACPI Driver for NT/Microsoft Corporation) Device \Driver\ACPI \Device\00000050 ACPI.sys (ACPI Driver for NT/Microsoft Corporation) Device \Driver\Mouclass \Device\PointerClass0 mouclass.sys (Mouse Class Driver/Microsoft Corporation) Device \Driver\Mouclass \Device\PointerClass0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\omci \Device\OMCI omci.sys (OMCI Device Driver/Dell Computer Corporation) Device \Driver\omci \Device\OMCI ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\Serial \Device\Serial0 serial.sys (Serial Device Driver/Microsoft Corporation) Device \Driver\Serial \Device\Serial0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\Video2 Device \Driver\PnpManager \Device\00000037 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000037 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000037 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\0000000b Device \Driver\ACPI \Device\00000044 ACPI.sys (ACPI Driver for NT/Microsoft Corporation) Device \Driver\Mouclass \Device\PointerClass1 mouclass.sys (Mouse Class Driver/Microsoft Corporation) Device \Driver\Mouclass \Device\PointerClass1 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\Processor Device \Driver\usbuhci \Device\USBPDO-0 USBPORT.SYS (USB 1.1 & 2.0 Port Driver/Microsoft Corporation) Device \Driver\usbuhci \Device\USBPDO-0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\Video3 Device \Driver\PnpManager \Device\00000038 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000038 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000038 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\ACPI \Device\00000051 ACPI.sys (ACPI Driver for NT/Microsoft Corporation) Device \Driver\PnpManager \Device\00000039 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000039 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000039 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\WMIxWDM \Device\WMIDataDevice ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\WMIxWDM \Device\WMIDataDevice ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\WMIxWDM \Device\WMIDataDevice ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\AvgLdx86 \Device\AvgAviLdrDev avgldx86.sys (AVG AVI Loader Driver/AVG Technologies CZ, s.r.o.) Device \Driver\AvgLdx86 \Device\AvgAviLdrDev ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\0000000c Device \FileSystem\RAW \Device\RawTape ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\RAW \Device\RawTape ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\RAW \Device\RawTape ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\ACPI \Device\00000045 ACPI.sys (ACPI Driver for NT/Microsoft Corporation) Device \Driver\usbuhci \Device\USBPDO-1 USBPORT.SYS (USB 1.1 & 2.0 Port Driver/Microsoft Corporation) Device \Driver\usbuhci \Device\USBPDO-1 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\ACPI \Device\00000052 ACPI.sys (ACPI Driver for NT/Microsoft Corporation) Device \Device\FloppyPDO0 Device \Device\0000000d Device \Device\0000001a Device \Device\NTPNP_PCI0000 Device \Driver\ACPI \Device\00000046 ACPI.sys (ACPI Driver for NT/Microsoft Corporation) Device \Driver\RasPppoe \Device\{6943D1AA-D5E1-4BD2-B1FF-017EC8318C5A} NDIS.sys (NDIS 5.1 wrapper driver/Microsoft Corporation) Device \Driver\ACPI \Device\00000053 ACPI.sys (ACPI Driver for NT/Microsoft Corporation) Device \Driver\usbuhci \Device\USBPDO-2 USBPORT.SYS (USB 1.1 & 2.0 Port Driver/Microsoft Corporation) Device \Driver\usbuhci \Device\USBPDO-2 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\MRxDAV \Device\WebDavRedirector mrxdav.sys (Windows NT WebDav Minirdr/Microsoft Corporation) Device \FileSystem\MRxDAV \Device\WebDavRedirector ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\0000000e Device \Device\0000001b Device \Device\NTPNP_PCI0001 Device \Device\00000047 Device \Driver\Point32 \Device\Point32Filter point32.sys (Point32.sys/Microsoft Corporation) Device \Driver\ACPI \Device\00000054 ACPI.sys (ACPI Driver for NT/Microsoft Corporation) Device \Driver\usbehci \Device\USBPDO-3 USBPORT.SYS (USB 1.1 & 2.0 Port Driver/Microsoft Corporation) Device \Driver\usbehci \Device\USBPDO-3 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\usbccgp \Device\00000060 usbccgp.sys (USB Common Class Generic Parent Driver/Microsoft Corporation) Device \Driver\usbccgp \Device\00000060 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\SoftFax \Device\FAX0 faxnt.sys (FaxNT driver/Conexant Systems) Device \Driver\SoftFax \Device\FAX0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\usbscan \Device\Usbscan0 usbscan.sys (USB Scanner Driver/Microsoft Corporation) Device \Driver\usbscan \Device\Usbscan0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\RasAcd \Device\RasAcd rasacd.sys (RAS Automatic Connection Driver/Microsoft Corporation) Device \Driver\RasAcd \Device\RasAcd ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\IpNat \Device\IPNAT ipnat.sys (IP Network Address Translator/Microsoft Corporation) Device \Driver\IpNat \Device\IPNAT ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\0000000f Device \Device\0000001c Device \Driver\ACPI \Device\00000048 ACPI.sys (ACPI Driver for NT/Microsoft Corporation) Device \Device\00000055 Device \Driver\PCI \Device\NTPNP_PCI0002 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PCI \Device\NTPNP_PCI0002 pci.sys (NT Plug and Play PCI Enumerator/Microsoft Corporation) Device \Device\00000061 Device \Driver\usbhub \Device\USBPDO-4 usbhub.sys (Default Hub Driver for USB/Microsoft Corporation) Device \Driver\usbhub \Device\USBPDO-4 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PSched \Device\PSched NDIS.sys (NDIS 5.1 wrapper driver/Microsoft Corporation) Device \Driver\Tcpip \Device\Tcp tcpip.sys (TCP/IP Protocol Driver/Microsoft Corporation) Device \Device\NTPNP_PCI0010 Device \Driver\Parport \Device\ParallelPort0 parport.sys (Parallel Port Driver/Microsoft Corporation) Device \Driver\Parport \Device\ParallelPort0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\0000001d Device \Driver\isapnp \Device\00000049 isapnp.sys (PNP ISA Bus Driver/Microsoft Corporation) Device \Driver\isapnp \Device\00000049 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\{2182AD70-1F02-4986-B634-598881DF556C} Device \Driver\PCI \Device\NTPNP_PCI0003 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PCI \Device\NTPNP_PCI0003 pci.sys (NT Plug and Play PCI Enumerator/Microsoft Corporation) Device \Driver\i2omgmt \Device\I2OExec i2omgmt.SYS (I2O Utility Filter/Microsoft Corporation) Device \Driver\i2omgmt \Device\I2OExec ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\usbccgp \Device\00000062 usbccgp.sys (USB Common Class Generic Parent Driver/Microsoft Corporation) Device \Driver\usbccgp \Device\00000062 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\ParVdm \Device\ParallelVdm0 ParVdm.SYS (VDM Parallel Driver/Microsoft Corporation) Device \Driver\ParVdm \Device\ParallelVdm0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\SpeakerPhone \Device\SPKPHONE0 spkpnt.sys (SpkpNT driver/Conexant Systems) Device \Driver\SpeakerPhone \Device\SPKPHONE0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\V124 \Device\V1240 v124nt.sys (V124NT driver/Conexant Systems) Device \Driver\V124 \Device\V1240 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\AvgTdiX \Device\AvgTdi avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) Device \Device\0000001e Device \Device\0000002a Device \Driver\Modem \Device\00000057 Modem.SYS (Modem Device Driver/Microsoft Corporation) Device \Driver\Modem \Device\00000057 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PCI \Device\NTPNP_PCI0004 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PCI \Device\NTPNP_PCI0004 pci.sys (NT Plug and Play PCI Enumerator/Microsoft Corporation) Device \Driver\PCI \Device\NTPNP_PCI0011 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PCI \Device\NTPNP_PCI0011 pci.sys (NT Plug and Play PCI Enumerator/Microsoft Corporation) Device \Device\00000063 Device \Driver\PCI \Device\NTPNP_PCI0012 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PCI \Device\NTPNP_PCI0012 pci.sys (NT Plug and Play PCI Enumerator/Microsoft Corporation) Device \FileSystem\AvgMfx86 \Device\Avg7Rs avgmfx86.sys (AVG Resident Shield Minifilter Driver/AVG Technologies CZ, s.r.o.) Device \FileSystem\AvgMfx86 \Device\Avg7Rs ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\0000001f Device \Device\0000002b Device \Driver\Rksample \Device\RKSAMPLE0 rksample.sys (Rksample WDM driver/Conexant Systems) Device \Driver\Rksample \Device\RKSAMPLE0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\00000058 Device \Driver\PCI \Device\NTPNP_PCI0005 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PCI \Device\NTPNP_PCI0005 pci.sys (NT Plug and Play PCI Enumerator/Microsoft Corporation) Device \Driver\USBSTOR \Device\00000064 USBSTOR.SYS (USB Mass Storage Class Driver/Microsoft Corporation) Device \Driver\USBSTOR \Device\00000064 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\Ftdisk \Device\HarddiskVolume1 ftdisk.sys (FT Disk Driver/Microsoft Corporation) Device \Driver\Ftdisk \Device\HarddiskVolume1 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\Http\Filter Device \Device\Http\AppPool Device \Device\Http\Control Device \Driver\Ftdisk \Device\HarddiskVolume2 ftdisk.sys (FT Disk Driver/Microsoft Corporation) Device \Driver\Ftdisk \Device\HarddiskVolume2 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\Tones \Device\TONES0 tonesnt.sys (TonesNT driver/Conexant Systems) Device \Driver\Tones \Device\TONES0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\Cdrom \Device\CdRom0 CLASSPNP.SYS (SCSI Class System Dll/Microsoft Corporation) Device \Driver\Cdrom \Device\CdRom0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\sysaudio \Device\sysaudio ks.sys (Kernel CSA Library/Microsoft Corporation) Device \Driver\sysaudio \Device\sysaudio ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\sysaudio \Device\sysaudio sysaudio.sys (System Audio WDM Filter/Microsoft Corporation) Device \Device\i Device \Driver\PCI \Device\NTPNP_PCI0013 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PCI \Device\NTPNP_PCI0013 pci.sys (NT Plug and Play PCI Enumerator/Microsoft Corporation) Device \Driver\usbhub \Device\00000059 usbhub.sys (Default Hub Driver for USB/Microsoft Corporation) Device \Driver\usbhub \Device\00000059 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Rdbss \Device\FsWrap rdbss.sys (Redirected Drive Buffering SubSystem Driver/Microsoft Corporation) Device \FileSystem\Rdbss \Device\FsWrap ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\TermDD \Device\Termdd termdd.sys (Terminal Server Driver/Microsoft Corporation) Device \Driver\Cdrom \Device\CdRom1 CLASSPNP.SYS (SCSI Class System Dll/Microsoft Corporation) Device \Driver\Cdrom \Device\CdRom1 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 atapi.sys (IDE/ATAPI Port Driver/Microsoft Corporation) Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\atapi \Device\Ide\IdePort0 atapi.sys (IDE/ATAPI Port Driver/Microsoft Corporation) Device \Driver\atapi \Device\Ide\IdePort0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 atapi.sys (IDE/ATAPI Port Driver/Microsoft Corporation) Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PCIIde \Device\Ide\PciIde0Channel0-0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PCIIde \Device\Ide\PciIde0Channel0-0 PCIIDEX.SYS (PCI IDE Bus Driver Extension/Microsoft Corporation) Device \Driver\atapi \Device\Ide\IdePort1 atapi.sys (IDE/ATAPI Port Driver/Microsoft Corporation) Device \Driver\atapi \Device\Ide\IdePort1 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PCIIde \Device\Ide\PciIde0Channel1-1 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PCIIde \Device\Ide\PciIde0Channel1-1 PCIIDEX.SYS (PCI IDE Bus Driver Extension/Microsoft Corporation) Device \Device\Ide\PciIde0 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f atapi.sys (IDE/ATAPI Port Driver/Microsoft Corporation) Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PCI \Device\NTPNP_PCI0007 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PCI \Device\NTPNP_PCI0007 pci.sys (NT Plug and Play PCI Enumerator/Microsoft Corporation) Device \Driver\Parport \Device\Parallel0 parport.sys (Parallel Port Driver/Microsoft Corporation) Device \Driver\Parport \Device\Parallel0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\0000003b ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\0000003b ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\0000003b ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\USBSTOR \Device\00000067 USBSTOR.SYS (USB Mass Storage Class Driver/Microsoft Corporation) Device \Driver\USBSTOR \Device\00000067 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PxHelp20 \Device\PxHelperDevice0 PxHelp20.sys (Px Engine Device Driver for Windows 2000/XP/Sonic Solutions) Device \Driver\HPZipr12 \Device\00000068 HPZipr12.sys (IEEE-1284.4-1999 Print Class Driver/HP) Device \Driver\HPZipr12 \Device\00000068 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\E100B \Device\{420CB2DC-791E-4051-BEFB-41CC49A9AB4B} NDIS.sys (NDIS 5.1 wrapper driver/Microsoft Corporation) Device \Driver\ACPI_HAL \Device\0000003e ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\ACPI_HAL \Device\0000003e hal.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) Device \Driver\PSched \Device\{776D9AE0-DFBD-446F-8EE8-FF6E7A37EDD4} NDIS.sys (NDIS 5.1 wrapper driver/Microsoft Corporation) Device \Driver\NetBT \Device\NetBt_Wins_Export netbt.sys (MBT Transport driver/Microsoft Corporation) Device \Driver\NetBT \Device\NetBt_Wins_Export ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\ACPI \Device\0000003f ACPI.sys (ACPI Driver for NT/Microsoft Corporation) Device \Driver\NetBT \Device\NetBT_Tcpip_{420CB2DC-791E-4051-BEFB-41CC49A9AB4B} netbt.sys (MBT Transport driver/Microsoft Corporation) Device \Driver\NetBT \Device\NetBT_Tcpip_{420CB2DC-791E-4051-BEFB-41CC49A9AB4B} ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\NetBT \Device\NetbiosSmb netbt.sys (MBT Transport driver/Microsoft Corporation) Device \Driver\NetBT \Device\NetbiosSmb ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\pxdoapog \Device\pxdoapog pxdoapog.sys Device \Driver\pxdoapog \Device\pxdoapog ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\swenum \Device\KSENUM#0000000d swenum.sys (Plug and Play Software Device Enumerator/Microsoft Corporation) Device \Driver\swenum \Device\KSENUM#0000000d ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\basic2 \Device\HSFHWDRV0 basic2.sys (NTRksample driver/Conexant Systems) Device \Driver\basic2 \Device\HSFHWDRV0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\usbhub \Device\0000005a usbhub.sys (Default Hub Driver for USB/Microsoft Corporation) Device \Driver\usbhub \Device\0000005a ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\MountMgr \Device\MountPointManager MountMgr.sys (Mount Manager/Microsoft Corporation) Device \Driver\MountMgr \Device\MountPointManager ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\ACPI \Device\0000004e ACPI.sys (ACPI Driver for NT/Microsoft Corporation) Device \Driver\smwdm \Device\Smwdm0 smwdm.sys (SoundMAX Integrated Digital Audio /Analog Devices, Inc.) Device \Driver\smwdm \Device\Smwdm0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\usbhub \Device\0000005b usbhub.sys (Default Hub Driver for USB/Microsoft Corporation) Device \Driver\usbhub \Device\0000005b ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\usbhub \Device\0000005c usbhub.sys (Default Hub Driver for USB/Microsoft Corporation) Device \Driver\usbhub \Device\0000005c ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Mup \Device\Mup Mup.sys (Multiple UNC Provider driver/Microsoft Corporation) Device \Driver\K56 \Device\K560 k56nt.sys (K56NT driver/Conexant Systems) Device \Driver\K56 \Device\K560 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Srv \Device\LanmanServer srv.sys (Server driver/Microsoft Corporation) Device \Driver\Wanarp \Device\WANARP wanarp.sys (MS Remote Access and Routing ARP Driver/Microsoft Corporation) Device \Driver\Tcpip \Device\Udp tcpip.sys (TCP/IP Protocol Driver/Microsoft Corporation) Device \Driver\HPZipr12 \Device\DOT4_001 HPZipr12.sys (IEEE-1284.4-1999 Print Class Driver/HP) Device \Driver\HPZipr12 \Device\DOT4_001 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\Harddisk0\DP(1)0x7e00-0x1f58a00+1 Device \Driver\Disk \Device\Harddisk0\DR0 CLASSPNP.SYS (SCSI Class System Dll/Microsoft Corporation) Device \Driver\Disk \Device\Harddisk0\DR0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Device\Harddisk0\DP(2)0x1f60800-0x1bf0797a00+2 Device \Driver\Tcpip \Device\RawIp tcpip.sys (TCP/IP Protocol Driver/Microsoft Corporation) Device \Driver\NdisWan \Device\NdisWanIp NDIS.sys (NDIS 5.1 wrapper driver/Microsoft Corporation) Device \Driver\usbccgp \Device\0000005e usbccgp.sys (USB Common Class Generic Parent Driver/Microsoft Corporation) Device \Driver\usbccgp \Device\0000005e ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\Disk \Device\Harddisk1\DR3 CLASSPNP.SYS (SCSI Class System Dll/Microsoft Corporation) Device \Driver\Disk \Device\Harddisk1\DR3 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\Disk \Device\Harddisk1\DP(1)0-0+4 CLASSPNP.SYS (SCSI Class System Dll/Microsoft Corporation) Device \Driver\Disk \Device\Harddisk1\DP(1)0-0+4 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000002 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000002 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000002 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PptpMiniport \Device\{09AB34D2-50BF-44C8-BB37-7E152750FFD2} NDIS.sys (NDIS 5.1 wrapper driver/Microsoft Corporation) Device \FileSystem\RAW \Device\RawDisk ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\RAW \Device\RawDisk ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\RAW \Device\RawDisk ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\usbccgp \Device\0000005f usbccgp.sys (USB Common Class Generic Parent Driver/Microsoft Corporation) Device \Driver\usbccgp \Device\0000005f ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\AsyncMac \Device\ASYNCMAC NDIS.sys (NDIS 5.1 wrapper driver/Microsoft Corporation) Device \Driver\Null \Device\Null Null.SYS (NULL Driver/Microsoft Corporation) Device \Driver\Null \Device\Null ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\usbuhci \Device\USBFDO-0 USBPORT.SYS (USB 1.1 & 2.0 Port Driver/Microsoft Corporation) Device \Driver\usbuhci \Device\USBFDO-0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\IPSec \Device\IPSEC ipsec.sys (IPSec Driver/Microsoft Corporation) Device \Driver\IPSec \Device\IPSEC ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\Ptilink \Device\ParTechInc0 ptilink.sys (Parallel Technologies DirectParallel IO Library/Parallel Technologies, Inc.) Device \Driver\Ptilink \Device\ParTechInc0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\usbuhci \Device\USBFDO-1 USBPORT.SYS (USB 1.1 & 2.0 Port Driver/Microsoft Corporation) Device \Driver\usbuhci \Device\USBFDO-1 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation) Device \Driver\usbuhci \Device\USBFDO-2 USBPORT.SYS (USB 1.1 & 2.0 Port Driver/Microsoft Corporation) Device \Driver\usbuhci \Device\USBFDO-2 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\Tcpip \Device\IPMULTICAST tcpip.sys (TCP/IP Protocol Driver/Microsoft Corporation) Device \Driver\NdisWan \Device\NdisWan NDIS.sys (NDIS 5.1 wrapper driver/Microsoft Corporation) Device \Driver\NdisTapi \Device\NdisTapi ndistapi.sys (NDIS 3.0 connection wrapper driver/Microsoft Corporation) Device \Driver\NdisTapi \Device\NdisTapi ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\MRxSmb \Device\LanmanRedirector mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation) Device \Driver\usbehci \Device\USBFDO-3 USBPORT.SYS (USB 1.1 & 2.0 Port Driver/Microsoft Corporation) Device \Driver\usbehci \Device\USBFDO-3 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\Gpc \Device\Gpc msgpc.sys (MS General Packet Classifier/Microsoft Corporation) Device \FileSystem\Npfs \Device\NamedPipe Npfs.SYS (NPFS Driver/Microsoft Corporation) Device \FileSystem\Npfs \Device\NamedPipe ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\AsyncMac \Device\{1084CE54-EB1A-492A-87D7-43A1DCF8AE4B} NDIS.sys (NDIS 5.1 wrapper driver/Microsoft Corporation) Device \Driver\Ftdisk \Device\FtControl ftdisk.sys (FT Disk Driver/Microsoft Corporation) Device \Driver\Ftdisk \Device\FtControl ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Msfs \Device\Mailslot Msfs.SYS (Mailslot driver/Microsoft Corporation) Device \FileSystem\Msfs \Device\Mailslot ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\Fallback \Device\FALLBACK0 fallback.sys (Fallback driver/Conexant Systems) Device \Driver\Fallback \Device\FALLBACK0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\AFD \Device\Afd afd.sys (Ancillary Function Driver for WinSock/Microsoft Corporation) Device \Driver\winachsf \Device\Winachsf0 HSF_CNXT.sys (WinACHSF driver/Conexant Systems) Device \Driver\winachsf \Device\Winachsf0 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\RAW \Device\RawCdRom ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\RAW \Device\RawCdRom ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\RAW \Device\RawCdRom ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\Ndisuio \Device\Ndisuio ndisuio.sys (NDIS User mode I/O Driver/Microsoft Corporation) Device \Driver\Ndisuio \Device\Ndisuio ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\HPZid412 \Device\HPZID412PRINT_HPZ1 HPZid412.sys (IEEE-1284.4-1999 Driver (Windows 2000)/HP) Device \Driver\HPZid412 \Device\HPZID412PRINT_HPZ1 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000031 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000031 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \Driver\PnpManager \Device\00000031 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Mup \Device\WinDfs\Root Mup.sys (Multiple UNC Provider driver/Microsoft Corporation) Device \FileSystem\Fastfat \Fat Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation) Device \FileSystem\Fastfat \Fat ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Fastfat \Fat Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation) Device \FileSystem\Fastfat \Fat ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)

MARTY1946

Post #12July 24, 2010, 9:16 AM UTC

Fifth Part AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer Fs_Rec.SYS (File System Recognizer Driver/Microsoft Corporation) Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Filters\FltMgrMsg Device \FileSystem\Filters\SystemRestore Device \FileSystem\FltMgr \FileSystem\Filters\FltMgr fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer Fs_Rec.SYS (File System Recognizer Driver/Microsoft Corporation) Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer Fs_Rec.SYS (File System Recognizer Driver/Microsoft Corporation) Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer Fs_Rec.SYS (File System Recognizer Driver/Microsoft Corporation) Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer Fs_Rec.SYS (File System Recognizer Driver/Microsoft Corporation) Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Cdfs \Cdfs Cdfs.SYS (CD-ROM File System Driver/Microsoft Corporation) Device \FileSystem\Cdfs \Cdfs ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) Device \FileSystem\Cdfs \Cdfs ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) —- Modules - GMER 1.0.15 —- Module \WINDOWS\system32\ntoskrnl.exe (NT Kernel & System/Microsoft Corporation) 804D7000-806EDA80 (2189952 bytes) Module \WINDOWS\system32\hal.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 806EE000-8070E300 (131840 bytes) Module \WINDOWS\system32\KDCOM.DLL (Kernel Debugger HW Extension DLL/Microsoft Corporation) F7987000-F7989000 (8192 bytes) Module \WINDOWS\system32\BOOTVID.dll (VGA Boot Driver/Microsoft Corporation) F7897000-F789A000 (12288 bytes) Module ACPI.sys (ACPI Driver for NT/Microsoft Corporation) F75A8000-F75D6000 (188416 bytes) Module \WINDOWS\System32\DRIVERS\WMILIB.SYS (WMILIB WMI support library Dll/Microsoft Corporation) F7989000-F798B000 (8192 bytes) Module pci.sys (NT Plug and Play PCI Enumerator/Microsoft Corporation) F7597000-F75A8000 (69632 bytes) Module isapnp.sys (PNP ISA Bus Driver/Microsoft Corporation) F75F7000-F7601000 (40960 bytes) Module pciide.sys (Generic PCI IDE Bus Driver/Microsoft Corporation) F7A4F000-F7A50000 (4096 bytes) Module \WINDOWS\System32\DRIVERS\PCIIDEX.SYS (PCI IDE Bus Driver Extension/Microsoft Corporation) F7707000-F770E000 (28672 bytes) Module MountMgr.sys (Mount Manager/Microsoft Corporation) F7607000-F7612000 (45056 bytes) Module ftdisk.sys (FT Disk Driver/Microsoft Corporation) F74D8000-F74F7000 (126976 bytes) Module PartMgr.sys (Partition Manager/Microsoft Corporation) F770F000-F7714000 (20480 bytes) Module VolSnap.sys (Volume Shadow Copy Driver/Microsoft Corporation) F7617000-F7624000 (53248 bytes) Module atapi.sys (IDE/ATAPI Port Driver/Microsoft Corporation) F74C0000-F74D8000 (98304 bytes) Module disk.sys (PnP Disk Driver/Microsoft Corporation) F7627000-F7630000 (36864 bytes) Module \WINDOWS\System32\DRIVERS\CLASSPNP.SYS (SCSI Class System Dll/Microsoft Corporation) F7637000-F7644000 (53248 bytes) Module fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) F74A0000-F74C0000 (131072 bytes) Module sr.sys (System Restore Filesystem Filter Driver/Microsoft Corporation) F748E000-F74A0000 (73728 bytes) Module PxHelp20.sys (Px Engine Device Driver for Windows 2000/XP/Sonic Solutions) F7647000-F7651000 (40960 bytes) Module KSecDD.sys (Kernel Security Support Provider Interface/Microsoft Corporation) F7477000-F748E000 (94208 bytes) Module Ntfs.sys (NT File System Driver/Microsoft Corporation) F7B52000-F7BDF000 (577536 bytes) Module NDIS.sys (NDIS 5.1 wrapper driver/Microsoft Corporation) F744A000-F7477000 (184320 bytes) Module Mup.sys (Multiple UNC Provider driver/Microsoft Corporation) F7430000-F744A000 (106496 bytes) Module agp440.sys (440 NT AGP Filter/Microsoft Corporation) F7657000-F7662000 (45056 bytes) Module \SystemRoot\System32\DRIVERS\intelppm.sys (Processor Device Driver/Microsoft Corporation) F74F7000-F7500000 (36864 bytes) Module \SystemRoot\System32\DRIVERS\ati2mtaa.sys (ATI RAGE 128 Miniport Driver/ATI Technologies Inc.) B9C21000-B9C6A000 (299008 bytes) Module \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS (Video Port Driver/Microsoft Corporation) B9C0D000-B9C21000 (81920 bytes) Module \SystemRoot\System32\DRIVERS\usbuhci.sys (UHCI USB Miniport Driver/Microsoft Corporation) F7807000-F780D000 (24576 bytes) Module \SystemRoot\System32\DRIVERS\USBPORT.SYS (USB 1.1 & 2.0 Port Driver/Microsoft Corporation) B9BE9000-B9C0D000 (147456 bytes) Module \SystemRoot\System32\DRIVERS\usbehci.sys (EHCI eUSB Miniport Driver/Microsoft Corporation) F780F000-F7817000 (32768 bytes) Module \SystemRoot\system32\DRIVERS\basic2.sys (NTRksample driver/Conexant Systems) B9BD8000-B9BE9000 (69632 bytes) Module \SystemRoot\system32\DRIVERS\SOAR.SYS (Soar driver/Conexant Systems) BA7C8000-BA7D3000 (45056 bytes) Module \SystemRoot\system32\DRIVERS\rksample.sys (Rksample WDM driver/Conexant Systems) BA146000-BA155000 (61440 bytes) Module \SystemRoot\System32\DRIVERS\HSF_CNXT.sys (WinACHSF driver/Conexant Systems) B9B51000-B9BD8000 (552960 bytes) Module \SystemRoot\System32\DRIVERS\AmosNt.SYS (AmosNT driver/Conexant Systems) B9B2B000-B9B51000 (155648 bytes) Module \SystemRoot\System32\Drivers\Modem.SYS (Modem Device Driver/Microsoft Corporation) F7817000-F781F000 (32768 bytes) Module \SystemRoot\System32\DRIVERS\e100b325.sys (NDIS 5 driver/Intel Corporation) B9B08000-B9B2B000 (143360 bytes) Module \SystemRoot\System32\DRIVERS\fdc.sys (Floppy Disk Controller Driver/Microsoft Corporation) F781F000-F7826000 (28672 bytes) Module \SystemRoot\System32\DRIVERS\i8042prt.sys (i8042 Port Driver/Microsoft Corporation) BA7B8000-BA7C5000 (53248 bytes) Module \SystemRoot\System32\DRIVERS\kbdclass.sys (Keyboard Class Driver/Microsoft Corporation) F7727000-F772D000 (24576 bytes) Module \SystemRoot\system32\DRIVERS\point32.sys (Point32.sys/Microsoft Corporation) F772F000-F7735000 (24576 bytes) Module \SystemRoot\System32\DRIVERS\mouclass.sys (Mouse Class Driver/Microsoft Corporation) F7737000-F773D000 (24576 bytes) Module \SystemRoot\System32\DRIVERS\serial.sys (Serial Device Driver/Microsoft Corporation) BA7A8000-BA7B8000 (65536 bytes) Module \SystemRoot\System32\DRIVERS\serenum.sys (Serial Port Enumerator/Microsoft Corporation) BA7EC000-BA7F0000 (16384 bytes) Module \SystemRoot\System32\DRIVERS\parport.sys (Parallel Port Driver/Microsoft Corporation) B9AF4000-B9B08000 (81920 bytes) Module \SystemRoot\System32\DRIVERS\cdrom.sys (SCSI CD-ROM Driver/Microsoft Corporation) BA798000-BA7A8000 (65536 bytes) Module \SystemRoot\System32\DRIVERS\imapi.sys (IMAPI Kernel Driver/Microsoft Corporation) BA788000-BA793000 (45056 bytes) Module \SystemRoot\System32\DRIVERS\redbook.sys (Redbook Audio Filter Driver/Microsoft Corporation) BA778000-BA787000 (61440 bytes) Module \SystemRoot\System32\DRIVERS\ks.sys (Kernel CSA Library/Microsoft Corporation) B9AD1000-B9AF4000 (143360 bytes) Module \SystemRoot\system32\drivers\smwdm.sys (SoundMAX Integrated Digital Audio /Analog Devices, Inc.) B9A4D000-B9AD1000 (540672 bytes) Module \SystemRoot\system32\drivers\portcls.sys (Port Class (Class Driver for Port/Miniport Devices)/Microsoft Corporation) B9A29000-B9A4D000 (147456 bytes) Module \SystemRoot\system32\drivers\drmk.sys (Microsoft Kernel DRM Descrambler Filter/Microsoft Corporation) BA768000-BA777000 (61440 bytes) Module \SystemRoot\system32\drivers\aeaudio.sys (Andrea Audio Stub Driver/Andrea Electronics Corporation) F79B1000-F79B3000 (8192 bytes) Module \SystemRoot\System32\DRIVERS\audstub.sys (AudStub Driver/Microsoft Corporation) BA32E000-BA32F000 (4096 bytes) Module \SystemRoot\System32\DRIVERS\rasl2tp.sys (RAS L2TP mini-port/call-manager driver/Microsoft Corporation) BA758000-BA765000 (53248 bytes) Module \SystemRoot\System32\DRIVERS\ndistapi.sys (NDIS 3.0 connection wrapper driver/Microsoft Corporation) BA7E4000-BA7E7000 (12288 bytes) Module \SystemRoot\System32\DRIVERS\ndiswan.sys (MS PPP Framing Driver (Strong Encryption)/Microsoft Corporation) B9A12000-B9A29000 (94208 bytes) Module \SystemRoot\System32\DRIVERS\raspppoe.sys (RAS PPPoE mini-port/call-manager driver/Microsoft Corporation) BA748000-BA753000 (45056 bytes) Module \SystemRoot\System32\DRIVERS\raspptp.sys (Peer-to-Peer Tunneling Protocol/Microsoft Corporation) BA738000-BA744000 (49152 bytes) Module \SystemRoot\System32\DRIVERS\TDI.SYS (TDI Wrapper/Microsoft Corporation) F773F000-F7744000 (20480 bytes) Module \SystemRoot\System32\DRIVERS\psched.sys (MS QoS Packet Scheduler/Microsoft Corporation) B9A01000-B9A12000 (69632 bytes) Module \SystemRoot\System32\DRIVERS\msgpc.sys (MS General Packet Classifier/Microsoft Corporation) F7677000-F7680000 (36864 bytes) Module \SystemRoot\System32\DRIVERS\ptilink.sys (Parallel Technologies DirectParallel IO Library/Parallel Technologies, Inc.) F7747000-F774C000 (20480 bytes) Module \SystemRoot\System32\DRIVERS\raspti.sys (PTI DirectParallel® mini-port/call-manager driver/Microsoft Corporation) F774F000-F7754000 (20480 bytes) Module \SystemRoot\System32\DRIVERS\termdd.sys (Terminal Server Driver/Microsoft Corporation) BA136000-BA140000 (40960 bytes) Module \SystemRoot\System32\DRIVERS\swenum.sys (Plug and Play Software Device Enumerator/Microsoft Corporation) F79B5000-F79B7000 (8192 bytes) Module \SystemRoot\System32\DRIVERS\update.sys (Update Driver/Microsoft Corporation) B997B000-B99D9000 (385024 bytes) Module \SystemRoot\System32\DRIVERS\omci.sys (OMCI Device Driver/Dell Computer Corporation) F7757000-F775C000 (20480 bytes) Module \SystemRoot\System32\DRIVERS\mssmbios.sys (System Management BIOS Driver/Microsoft Corporation) BA71F000-BA723000 (16384 bytes) Module \SystemRoot\System32\Drivers\NDProxy.SYS (NDIS Proxy/Microsoft Corporation) BA126000-BA130000 (40960 bytes) Module \SystemRoot\System32\DRIVERS\usbhub.sys (Default Hub Driver for USB/Microsoft Corporation) BA116000-BA125000 (61440 bytes) Module \SystemRoot\System32\DRIVERS\USBD.SYS (Universal Serial Bus Driver/Microsoft Corporation) F79BB000-F79BD000 (8192 bytes) Module \SystemRoot\System32\DRIVERS\flpydisk.sys (Floppy Driver/Microsoft Corporation) F777F000-F7784000 (20480 bytes) Module \SystemRoot\System32\Drivers\i2omgmt.SYS (I2O Utility Filter/Microsoft Corporation) F7917000-F791A000 (12288 bytes) Module \SystemRoot\System32\Drivers\AFS2K.SYS (Audio File System/Oak Technology Inc.) BA0E6000-BA0F0000 (40960 bytes) Module \SystemRoot\System32\Drivers\Fs_Rec.SYS (File System Recognizer Driver/Microsoft Corporation) F79BD000-F79BF000 (8192 bytes) Module \SystemRoot\System32\Drivers\Null.SYS (NULL Driver/Microsoft Corporation) F7A88000-F7A89000 (4096 bytes) Module \SystemRoot\System32\Drivers\Beep.SYS (BEEP Driver/Microsoft Corporation) F79BF000-F79C1000 (8192 bytes) Module \SystemRoot\System32\drivers\vga.sys (VGA/Super VGA Video Driver/Microsoft Corporation) F778F000-F7795000 (24576 bytes) Module \SystemRoot\System32\Drivers\mnmdd.SYS (Frame buffer simulator/Microsoft Corporation) F79C1000-F79C3000 (8192 bytes) Module \SystemRoot\System32\DRIVERS\RDPCDD.sys (RDP Miniport/Microsoft Corporation) F79C3000-F79C5000 (8192 bytes) Module \SystemRoot\System32\Drivers\Msfs.SYS (Mailslot driver/Microsoft Corporation) F7797000-F779C000 (20480 bytes) Module \SystemRoot\System32\Drivers\Npfs.SYS (NPFS Driver/Microsoft Corporation) F779F000-F77A7000 (32768 bytes) Module \SystemRoot\System32\DRIVERS\rasacd.sys (RAS Automatic Connection Driver/Microsoft Corporation) F791B000-F791E000 (12288 bytes) Module \SystemRoot\System32\DRIVERS\ipsec.sys (IPSec Driver/Microsoft Corporation) B6843000-B6856000 (77824 bytes) Module \SystemRoot\System32\DRIVERS\tcpip.sys (TCP/IP Protocol Driver/Microsoft Corporation) B67EA000-B6843000 (364544 bytes) Module \SystemRoot\System32\Drivers\avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) B67B0000-B67EA000 (237568 bytes) Module \SystemRoot\System32\DRIVERS\ipnat.sys (IP Network Address Translator/Microsoft Corporation) B678A000-B67B0000 (155648 bytes) Module \SystemRoot\System32\DRIVERS\wanarp.sys (MS Remote Access and Routing ARP Driver/Microsoft Corporation) BA0D6000-BA0DF000 (36864 bytes) Module \SystemRoot\System32\DRIVERS\usbccgp.sys (USB Common Class Generic Parent Driver/Microsoft Corporation) F77A7000-F77AF000 (32768 bytes) Module \SystemRoot\System32\DRIVERS\netbt.sys (MBT Transport driver/Microsoft Corporation) B66C2000-B66EA000 (163840 bytes) Module \SystemRoot\System32\drivers\ws2ifsl.sys (Winsock2 IFS Layer/Microsoft Corporation) F793B000-F793E000 (12288 bytes) Module \SystemRoot\System32\drivers\afd.sys (Ancillary Function Driver for WinSock/Microsoft Corporation) B66A0000-B66C2000 (139264 bytes) Module \SystemRoot\System32\DRIVERS\netbios.sys (NetBIOS interface driver/Microsoft Corporation) BA0B6000-BA0BF000 (36864 bytes) Module \SystemRoot\System32\DRIVERS\rdbss.sys (Redirected Drive Buffering SubSystem Driver/Microsoft Corporation) B6675000-B66A0000 (176128 bytes) Module \SystemRoot\System32\DRIVERS\mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation) B6605000-B6675000 (458752 bytes) Module \SystemRoot\System32\Drivers\Fips.SYS (FIPS Crypto Driver/Microsoft Corporation) F76A7000-F76B2000 (45056 bytes) Module \SystemRoot\System32\DRIVERS\usbscan.sys (USB Scanner Driver/Microsoft Corporation) F793F000-F7943000 (16384 bytes) Module \SystemRoot\System32\DRIVERS\usbprint.sys (USB Printer driver/Microsoft Corporation) F77AF000-F77B6000 (28672 bytes) Module \SystemRoot\System32\DRIVERS\HPZius12.sys (1284.4<->Usb Datalink Driver (Windows 2000)/HP) F77B7000-F77BD000 (24576 bytes) Module \SystemRoot\System32\DRIVERS\USBSTOR.SYS (USB Mass Storage Class Driver/Microsoft Corporation) F77BF000-F77C6000 (28672 bytes) Module \SystemRoot\System32\Drivers\avgmfx86.sys (AVG Resident Shield Minifilter Driver/AVG Technologies CZ, s.r.o.) F77C7000-F77CD000 (24576 bytes) Module \SystemRoot\System32\Drivers\avgldx86.sys (AVG AVI Loader Driver/AVG Technologies CZ, s.r.o.) B65D1000-B6605000 (212992 bytes) Module \SystemRoot\System32\DRIVERS\HPZid412.sys (IEEE-1284.4-1999 Driver (Windows 2000)/HP) F76B7000-F76C4000 (53248 bytes) Module \SystemRoot\System32\DRIVERS\HPZipr12.sys (IEEE-1284.4-1999 Print Class Driver/HP) BA7FC000-BA800000 (16384 bytes) Module \SystemRoot\System32\Drivers\Cdfs.SYS (CD-ROM File System Driver/Microsoft Corporation) F7557000-F7567000 (65536 bytes) Module \SystemRoot\System32\Drivers\dump_atapi.sys B6132000-B614A000 (98304 bytes) Module \SystemRoot\System32\Drivers\dump_WMILIB.SYS F7A09000-F7A0B000 (8192 bytes) Module \SystemRoot\System32\win32k.sys (Multi-User Win32 Driver/Microsoft Corporation) BF800000-BF9C4000 (1851392 bytes) Module \SystemRoot\System32\drivers\Dxapi.sys (DirectX API Driver/Microsoft Corporation) B616A000-B616D000 (12288 bytes) Module \SystemRoot\System32\watchdog.sys (Watchdog Driver/Microsoft Corporation) B68DE000-B68E3000 (20480 bytes) Module \SystemRoot\System32\drivers\dxg.sys (DirectX Graphics Driver/Microsoft Corporation) BF000000-BF012000 (73728 bytes) Module \SystemRoot\System32\drivers\dxgthk.sys (DirectX Graphics Driver Thunk/Microsoft Corporation) F7A69000-F7A6A000 (4096 bytes) Module \SystemRoot\System32\ati2dvaa.dll (ATI RAGE 128 WindowsNT Display Driver/ATI Technologies Inc.) BF012000-BF060000 (319488 bytes) Module \SystemRoot\System32\ATMFD.DLL (Windows NT OpenType/Type 1 Font Driver/Adobe Systems Incorporated) BFFA0000-BFFE6000 (286720 bytes) Module \SystemRoot\System32\DRIVERS\ndisuio.sys (NDIS User mode I/O Driver/Microsoft Corporation) B402A000-B402E000 (16384 bytes) Module \SystemRoot\System32\Drivers\Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation) B3CFE000-B3D22000 (147456 bytes) Module \SystemRoot\system32\drivers\wdmaud.sys (MMSYSTEM Wave/Midi API mapper/Microsoft Corporation) B3BF9000-B3C0E000 (86016 bytes) Module \SystemRoot\system32\drivers\sysaudio.sys (System Audio WDM Filter/Microsoft Corporation) B3DFA000-B3E09000 (61440 bytes) Module \SystemRoot\System32\DRIVERS\mrxdav.sys (Windows NT WebDav Minirdr/Microsoft Corporation) B3A36000-B3A63000 (184320 bytes) Module \SystemRoot\System32\Drivers\ParVdm.SYS (VDM Parallel Driver/Microsoft Corporation) F79DB000-F79DD000 (8192 bytes) Module \SystemRoot\system32\DRIVERS\fallback.sys (Fallback driver/Conexant Systems) B37E7000-B382E000 (290816 bytes) Module \SystemRoot\system32\DRIVERS\fsksnt.sys (FSKsNT driver/Conexant Systems) B37CA000-B37E7000 (118784 bytes) Module \SystemRoot\system32\DRIVERS\k56nt.sys (K56NT driver/Conexant Systems) B3742000-B37A2000 (393216 bytes) Module \SystemRoot\system32\DRIVERS\faxnt.sys (FaxNT driver/Conexant Systems) B3649000-B367A000 (200704 bytes) Module \SystemRoot\system32\DRIVERS\spkpnt.sys (SpkpNT driver/Conexant Systems) B3637000-B3649000 (73728 bytes) Module \SystemRoot\System32\DRIVERS\srv.sys (Server driver/Microsoft Corporation) B3540000-B3597000 (356352 bytes) Module \??\C:\WINDOWS\system32\drivers\tmcomm.sys (TrendMicro Common Module/Trend Micro Inc.) B34D8000-B34F0000 (98304 bytes) Module \SystemRoot\system32\DRIVERS\tonesnt.sys (TonesNT driver/Conexant Systems) B3722000-B372F000 (53248 bytes) Module \SystemRoot\system32\DRIVERS\v124nt.sys (V124NT driver/Conexant Systems) B3410000-B3488000 (491520 bytes) Module \SystemRoot\System32\Drivers\HTTP.sys (HTTP Protocol Stack/Microsoft Corporation) B2EF7000-B2F38000 (266240 bytes) Module \SystemRoot\System32\DRIVERS\asyncmac.sys (MS Remote Access serial network driver/Microsoft Corporation) B3208000-B320C000 (16384 bytes) Module \??\C:\DOCUME~1\Dick\LOCALS~1\Temp\pxdoapog.sys (GMER) B28A1000-B28B8000 (94208 bytes) Module \WINDOWS\SYSTEM32\ntdll.dll (NT Layer DLL/Microsoft Corporation) 7C900000-7C9B2000 (729088 bytes)

MARTY1946

Post #13July 24, 2010, 9:20 AM UTC

Sixth Part —- Processes - GMER 1.0.15 —- Process System Idle 0 Process System 4 Process C:\WINDOWS\system32\SearchIndexer.exe (Microsoft Windows Search Indexer/Microsoft Corporation) 108 Library C:\WINDOWS\system32\SearchIndexer.exe (Microsoft Windows Search Indexer/Microsoft Corporation) 0x01000000 Library C:\WINDOWS\system32\ntdll.dll (NT Layer DLL/Microsoft Corporation) 0x7C900000 Library C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation) 0x7C800000 Library C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation) 0x77DD0000 Library C:\WINDOWS\system32\RPCRT4.dll (Remote Procedure Call Runtime/Microsoft Corporation) 0x77E70000 Library C:\WINDOWS\system32\Secur32.dll (Security Support Provider Interface/Microsoft Corporation) 0x77FE0000 Library C:\WINDOWS\system32\USER32.dll (Windows XP USER API Client DLL/Microsoft Corporation) 0x7E410000 Library C:\WINDOWS\system32\GDI32.dll (GDI Client DLL/Microsoft Corporation) 0x77F10000 Library C:\WINDOWS\system32\msvcrt.dll (Windows NT CRT DLL/Microsoft Corporation) 0x77C10000 Library C:\WINDOWS\system32\ole32.dll (Microsoft OLE for Windows/Microsoft Corporation) 0x774E0000 Library C:\WINDOWS\system32\OLEAUT32.dll (Microsoft Corporation) 0x77120000 Library C:\WINDOWS\system32\WTSAPI32.dll (Windows Terminal Server SDK APIs/Microsoft Corporation) 0x76F50000 Library C:\WINDOWS\system32\WINSTA.dll (Winstation Library/Microsoft Corporation) 0x76360000 Library C:\WINDOWS\system32\NETAPI32.dll (Net Win32 API DLL/Microsoft Corporation) 0x5B860000 Library C:\WINDOWS\system32\TQUERY.DLL (tquery.dll/Microsoft Corporation) 0x60000000 Library C:\WINDOWS\system32\PROPSYS.dll (Microsoft Property System/Microsoft Corporation) 0x00400000 Library C:\WINDOWS\system32\WINTRUST.dll (Microsoft Trust Verification APIs/Microsoft Corporation) 0x76C30000 Library C:\WINDOWS\system32\CRYPT32.dll (Crypto API32/Microsoft Corporation) 0x77A80000 Library C:\WINDOWS\system32\MSASN1.dll (ASN.1 Runtime APIs/Microsoft Corporation) 0x77B20000 Library C:\WINDOWS\system32\IMAGEHLP.dll (Windows NT Image Helper/Microsoft Corporation) 0x76C90000 Library C:\WINDOWS\system32\SHLWAPI.dll (Shell Light-weight Utility Library/Microsoft Corporation) 0x77F60000 Library C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation) 0x7C9C0000 Library C:\WINDOWS\system32\USERENV.dll (Userenv/Microsoft Corporation) 0x769C0000 Library C:\WINDOWS\system32\MPR.dll (Multiple Provider Router DLL/Microsoft Corporation) 0x71B20000 Library C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation) 0x004C0000 Library C:\WINDOWS\system32\PSAPI.DLL (Process Status Helper/Microsoft Corporation) 0x76BF0000 Library C:\WINDOWS\system32\WSOCK32.dll (Windows Socket 32-Bit DLL/Microsoft Corporation) 0x71AD0000 Library C:\WINDOWS\system32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation) 0x71AB0000 Library C:\WINDOWS\system32\WS2HELP.dll (Windows Socket 2.0 Helper for Windows NT/Microsoft Corporation) 0x71AA0000 Library C:\WINDOWS\system32\dbghelp.dll (Windows Image Helper/Microsoft Corporation) 0x59A60000 Library C:\WINDOWS\system32\VERSION.dll (Version Checking and File Installation Libraries/Microsoft Corporation) 0x77C00000 Library C:\WINDOWS\system32\IMM32.DLL (Windows XP IMM32 API Client DLL/Microsoft Corporation) 0x76390000 Library C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll (User Experience Controls Library/Microsoft Corporation) 0x773D0000 Library C:\WINDOWS\system32\comctl32.dll (Common Controls Library/Microsoft Corporation) 0x5D090000 Library C:\WINDOWS\system32\xpsp2res.dll (Service Pack 2 Messages/Microsoft Corporation) 0x00CB0000 Library C:\WINDOWS\system32\CLBCATQ.DLL (Microsoft Corporation) 0x76FD0000 Library C:\WINDOWS\system32\COMRes.dll (Microsoft Corporation) 0x77050000 Library C:\WINDOWS\system32\Msidle.dll (User Idle Monitor/Microsoft Corporation) 0x74F50000 Library C:\WINDOWS\system32\uxtheme.dll (Microsoft UxTheme Library/Microsoft Corporation) 0x5AD70000 Library C:\WINDOWS\system32\query.dll (Content Index Utility DLL/Microsoft Corporation) 0x7D9A0000 Library C:\WINDOWS\system32\XmlLite.dll (Microsoft XmlLite Library/Microsoft Corporation) 0x47060000 Library C:\WINDOWS\system32\en-us\tQuery.dll.mui (tquery.dll/Microsoft Corporation) 0x10000000 Library C:\WINDOWS\system32\esent.dll (Server Database Storage Engine/Microsoft Corporation) 0x606B0000 Library C:\WINDOWS\system32\msscb.dll (msscb.dll/Microsoft Corporation) 0x00B90000 Library C:\WINDOWS\system32\NTMARTA.DLL (Windows NT MARTA provider/Microsoft Corporation) 0x77690000 Library C:\WINDOWS\system32\SAMLIB.dll (SAM Library DLL/Microsoft Corporation) 0x71BF0000 Library C:\WINDOWS\system32\WLDAP32.dll (Win32 LDAP API DLL/Microsoft Corporation) 0x76F60000 Library C:\WINDOWS\system32\perfproc.dll (Windows System Process Performance Objects DLL/Microsoft Corporation) 0x5E750000 Library C:\WINDOWS\system32\mssprxy.dll (Microsoft Search Proxy/Microsoft Corporation) 0x0D7C0000 Library C:\WINDOWS\system32\LangWrbk.dll (English wordbreaker/Microsoft Corporation) 0x62C70000 Library C:\WINDOWS\system32\infosoft.dll (Wordbreaker and stemmer dll/Microsoft Corporation) 0x665D0000 Library C:\WINDOWS\system32\SETUPAPI.dll (Windows Setup API/Microsoft Corporation) 0x77920000 Library C:\WINDOWS\system32\msi.dll (Windows Installer/Microsoft Corporation) 0x7D1E0000 Library C:\WINDOWS\system32\SXS.DLL (Fusion 2.5/Microsoft Corporation) 0x7E720000 Library C:\WINDOWS\system32\msv1_0.dll (Microsoft Authentication Package v1.0/Microsoft Corporation) 0x77C70000 Library C:\WINDOWS\system32\cryptdll.dll (Cryptography Manager/Microsoft Corporation) 0x76790000 Library C:\WINDOWS\system32\iphlpapi.dll (IP Helper API/Microsoft Corporation) 0x76D60000 Process C:\Program Files\AGI\core\3.0\AGCoreService.exe (AGCoreService/AG Interactive) 216 Library C:\Program Files\AGI\core\3.0\AGCoreService.exe (AGCoreService/AG Interactive) 0x00400000 Library C:\WINDOWS\system32\ntdll.dll (NT Layer DLL/Microsoft Corporation) 0x7C900000 Library C:\WINDOWS\system32\mscoree.dll (Microsoft .NET Runtime Execution Engine/Microsoft Corporation) 0x79000000 Library C:\WINDOWS\system32\KERNEL32.dll (Windows NT BASE API Client DLL/Microsoft Corporation) 0x7C800000 Library C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation) 0x77DD0000 Library C:\WINDOWS\system32\RPCRT4.dll (Remote Procedure Call Runtime/Microsoft Corporation) 0x77E70000 Library C:\WINDOWS\system32\Secur32.dll (Security Support Provider Interface/Microsoft Corporation) 0x77FE0000 Library C:\WINDOWS\system32\SHLWAPI.dll (Shell Light-weight Utility Library/Microsoft Corporation) 0x77F60000 Library C:\WINDOWS\system32\GDI32.dll (GDI Client DLL/Microsoft Corporation) 0x77F10000 Library C:\WINDOWS\system32\USER32.dll (Windows XP USER API Client DLL/Microsoft Corporation) 0x7E410000 Library C:\WINDOWS\system32\msvcrt.dll (Windows NT CRT DLL/Microsoft Corporation) 0x77C10000 Library C:\WINDOWS\system32\IMM32.DLL (Windows XP IMM32 API Client DLL/Microsoft Corporation) 0x76390000 Library c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll (Microsoft .NET Runtime Common Language Runtime - WorkStation/Microsoft Corporation) 0x79E70000 Library C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll (Microsoft® C Runtime Library/Microsoft Corporation) 0x78130000 Library C:\WINDOWS\system32\shell32.dll (Windows Shell Common Dll/Microsoft Corporation) 0x7C9C0000 Library C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll (User Experience Controls Library/Microsoft Corporation) 0x773D0000 Library C:\WINDOWS\system32\comctl32.dll (Common Controls Library/Microsoft Corporation) 0x5D090000 Library C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\7124a40b9998f7b63c86bd1a2125ce26\mscorlib.ni.dll (Microsoft Common Language Runtime Class Library/Microsoft Corporation) 0x790C0000 Library C:\WINDOWS\system32\ole32.dll (Microsoft OLE for Windows/Microsoft Corporation) 0x774E0000 Library c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll (Microsoft .NET Runtime Just-In-Time Compiler/Microsoft Corporation) 0x79060000 Library C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\37217abe2c5164e59aba251860f4c79e\System.ni.dll (.NET Framework/Microsoft Corporation) 0x7A440000 Library C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\5adb0f89d469632511aed9d88cfe05c4\System.ServiceProcess.ni.dll (.NET Framework/Microsoft Corporation) 0x67A20000 Library C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\39e4f9a276fb12125d8a1444d8b65a84\System.Configuration.Install.ni.dll (.NET Framework/Microsoft Corporation) 0x649E0000 Library C:\WINDOWS\system32\rsaenh.dll (Microsoft Enhanced Cryptographic Provider/Microsoft Corporation) 0x68000000 Library C:\WINDOWS\assembly\GAC_MSIL\agcore\1.0.0.0__4b827ebe229d539f\agcore.dll (agcore/AG Interactive) 0x00B20000 Library C:\WINDOWS\system32\shfolder.dll (Shell Folder Service/Microsoft Corporation) 0x76780000 Library C:\WINDOWS\system32\wtsapi32.dll (Windows Terminal Server SDK APIs/Microsoft Corporation) 0x76F50000 Library C:\WINDOWS\system32\WINSTA.dll (Winstation Library/Microsoft Corporation) 0x76360000 Library C:\WINDOWS\system32\NETAPI32.dll (Net Win32 API DLL/Microsoft Corporation) 0x5B860000 Library C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\631b3eba1ba5bd3c3f027f34011cadeb\System.Configuration.ni.dll (System.Configuration.dll/Microsoft Corporation) 0x64890000 Library C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\563a54b98adb70fae862974042298348\System.Xml.ni.dll (.NET Framework/Microsoft Corporation) 0x637A0000 Library C:\WINDOWS\system32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation) 0x71AB0000 Library C:\WINDOWS\system32\WS2HELP.dll (Windows Socket 2.0 Helper for Windows NT/Microsoft Corporation) 0x71AA0000 Library C:\WINDOWS\system32\rasapi32.dll (Remote Access API/Microsoft Corporation) 0x76EE0000 Library C:\WINDOWS\system32\rasman.dll (Remote Access Connection Manager/Microsoft Corporation) 0x76E90000 Library C:\WINDOWS\system32\TAPI32.dll (Microsoft® Windows™ Telephony API Client DLL/Microsoft Corporation) 0x76EB0000 Library C:\WINDOWS\system32\rtutils.dll (Routing Utilities/Microsoft Corporation) 0x76E80000 Library C:\WINDOWS\system32\WINMM.dll (MCI API DLL/Microsoft Corporation) 0x76B40000 Library C:\WINDOWS\system32\msv1_0.dll (Microsoft Authentication Package v1.0/Microsoft Corporation) 0x77C70000 Library C:\WINDOWS\system32\cryptdll.dll (Cryptography Manager/Microsoft Corporation) 0x76790000 Library C:\WINDOWS\system32\iphlpapi.dll (IP Helper API/Microsoft Corporation) 0x76D60000 Library C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\d987cf1de4ba688da92e212a374232c2\System.Web.ni.dll (System.Web.dll/Microsoft Corporation) 0x65F20000 Library C:\WINDOWS\system32\mswsock.dll (Microsoft Windows Sockets 2.0 Service Provider/Microsoft Corporation) 0x71A50000 Library C:\WINDOWS\system32\hnetcfg.dll (Home Networking Configuration Manager/Microsoft Corporation) 0x03410000 Library C:\WINDOWS\System32\wshtcpip.dll (Windows Sockets Helper DLL/Microsoft Corporation) 0x71A90000 Library C:\WINDOWS\system32\DNSAPI.dll (DNS Client API DLL/Microsoft Corporation) 0x76F20000 Library C:\WINDOWS\System32\winrnr.dll (LDAP RnR Provider DLL/Microsoft Corporation) 0x76FB0000 Library C:\WINDOWS\system32\WLDAP32.dll (Win32 LDAP API DLL/Microsoft Corporation) 0x76F60000 Library C:\Program Files\Bonjour\mdnsNSP.dll (Bonjour Namespace Provider/Apple Inc.) 0x16080000 Library C:\WINDOWS\system32\rasadhlp.dll (Remote Access AutoDial Helper/Microsoft Corporation) 0x76FC0000 Library C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\e9edc5cd12ebb513b4a3c53cb4640771\System.EnterpriseServices.ni.dll (Microsoft .NET Services Support Infrastructure/Microsoft Corporation) 0x673F0000 Process C:\Program Files\Mozilla Firefox\plugin-container.exe (Plugin Container for Firefox/Mozilla Corporation) 236 Library C:\Program Files\Mozilla Firefox\plugin-container.exe (Plugin Container for Firefox/Mozilla Corporation) 0x00400000 Library C:\WINDOWS\system32\ntdll.dll (NT Layer DLL/Microsoft Corporation) 0x7C900000 Library C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation) 0x7C800000 Library C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) 0x10000000 Library C:\Program Files\Mozilla Firefox\sqlite3.dll (SQLite Database Library/sqlite.org) 0x00290000 Library C:\Program Files\Mozilla Firefox\MOZCRT19.dll (User-Generated Microsoft ® C/C++ Runtime Library/Mozilla Foundation) 0x78130000 Library C:\WINDOWS\system32\msvcrt.dll (Windows NT CRT DLL/Microsoft Corporation) 0x77C10000 Library C:\Program Files\Mozilla Firefox\js3250.dll 0x00410000 Library C:\Program Files\Mozilla Firefox\nspr4.dll (NSPR Library/Mozilla Foundation) 0x00310000 Library C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation) 0x77DD0000 Library C:\WINDOWS\system32\RPCRT4.dll (Remote Procedure Call Runtime/Microsoft Corporation) 0x77E70000 Library C:\WINDOWS\system32\Secur32.dll (Security Support Provider Interface/Microsoft Corporation) 0x77FE0000 Library C:\WINDOWS\system32\WSOCK32.dll (Windows Socket 32-Bit DLL/Microsoft Corporation) 0x71AD0000 Library C:\WINDOWS\system32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation) 0x71AB0000 Library C:\WINDOWS\system32\WS2HELP.dll (Windows Socket 2.0 Helper for Windows NT/Microsoft Corporation) 0x71AA0000 Library C:\WINDOWS\system32\WINMM.dll (MCI API DLL/Microsoft Corporation) 0x76B40000 Library C:\WINDOWS\system32\GDI32.dll (GDI Client DLL/Microsoft Corporation) 0x77F10000 Library C:\WINDOWS\system32\USER32.dll (Windows XP USER API Client DLL/Microsoft Corporation) 0x7E410000 Library C:\Program Files\Mozilla Firefox\smime3.dll (NSS S/MIME Library/Mozilla Foundation) 0x00340000 Library C:\Program Files\Mozilla Firefox\nss3.dll (NSS Base Library/Mozilla Foundation) 0x00360000 Library C:\Program Files\Mozilla Firefox\nssutil3.dll (NSS Utility Library/Mozilla Foundation) 0x00510000 Library C:\Program Files\Mozilla Firefox\plc4.dll (PLC Library/Mozilla Foundation) 0x00530000 Library C:\Program Files\Mozilla Firefox\plds4.dll (PLDS Library/Mozilla Foundation) 0x00540000 Library C:\Program Files\Mozilla Firefox\ssl3.dll (NSS SSL Library/Mozilla Foundation) 0x00550000 Library C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation) 0x7C9C0000 Library C:\WINDOWS\system32\SHLWAPI.dll (Shell Light-weight Utility Library/Microsoft Corporation) 0x77F60000 Library C:\WINDOWS\system32\ole32.dll (Microsoft OLE for Windows/Microsoft Corporation) 0x774E0000 Library C:\WINDOWS\system32\VERSION.dll (Version Checking and File Installation Libraries/Microsoft Corporation) 0x77C00000 Library C:\WINDOWS\system32\WINSPOOL.DRV (Windows Spooler Driver/Microsoft Corporation) 0x73000000 Library C:\WINDOWS\system32\COMDLG32.dll (Common Dialogs DLL/Microsoft Corporation) 0x763B0000 Library C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll (User Experience Controls Library/Microsoft Corporation) 0x773D0000 Library C:\WINDOWS\system32\IMM32.dll (Windows XP IMM32 API Client DLL/Microsoft Corporation) 0x76390000 Library C:\WINDOWS\system32\MSIMG32.dll (GDIEXT Client DLL/Microsoft Corporation) 0x76380000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000 Library C:\WINDOWS\system32\OLEAUT32.dll (Microsoft Corporation) 0x77120000 Library C:\Program Files\Mozilla Firefox\MOZCPP19.dll (User-Generated Microsoft ® C/C++ Runtime Library/Mozilla Foundation) 0x7C420000 Library C:\WINDOWS\system32\uxtheme.dll (Microsoft UxTheme Library/Microsoft Corporation) 0x5AD70000 Library C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll 0x00EB0000 Library C:\WINDOWS\system32\WININET.dll (Internet Extensions for Win32/Microsoft Corporation) 0x63000000 Library C:\WINDOWS\system32\Normaliz.dll (Unicode Normalization DLL/Microsoft Corporation) 0x01430000 Library C:\WINDOWS\system32\urlmon.dll (OLE32 Extensions for Win32/Microsoft Corporation) 0x1A400000 Library C:\WINDOWS\system32\iertutil.dll (Run time utility for Internet Explorer/Microsoft Corporation) 0x5DCA0000 Library C:\WINDOWS\system32\CRYPT32.dll (Crypto API32/Microsoft Corporation) 0x77A80000 Library C:\WINDOWS\system32\MSASN1.dll (ASN.1 Runtime APIs/Microsoft Corporation) 0x77B20000 Library C:\WINDOWS\system32\DSOUND.dll (DirectSound/Microsoft Corporation) 0x73F10000 Library C:\WINDOWS\system32\mscms.dll (Microsoft Color Matching System DLL/Microsoft Corporation) 0x73B30000 Library C:\WINDOWS\system32\CLBCATQ.DLL (Microsoft Corporation) 0x76FD0000 Library C:\WINDOWS\system32\COMRes.dll (Microsoft Corporation) 0x77050000 Library C:\WINDOWS\System32\mlang.dll (Multi Language Support DLL/Microsoft Corporation) 0x75CF0000 Library C:\WINDOWS\system32\schannel.dll (TLS / SSL Security Provider/Microsoft Corporation) 0x767F0000 Library C:\WINDOWS\system32\NETAPI32.dll (Net Win32 API DLL/Microsoft Corporation) 0x5B860000 Library C:\WINDOWS\system32\USERENV.dll (Userenv/Microsoft Corporation) 0x769C0000 Library C:\WINDOWS\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation) 0x77B40000 Library C:\WINDOWS\system32\msctfime.ime (Microsoft Text Frame Work Service IME/Microsoft Corporation) 0x755C0000 Library C:\WINDOWS\system32\WINTRUST.dll (Microsoft Trust Verification APIs/Microsoft Corporation) 0x76C30000 Library C:\WINDOWS\system32\IMAGEHLP.dll (Windows NT Image Helper/Microsoft Corporation) 0x76C90000 Library C:\WINDOWS\system32\wdmaud.drv (WDM Audio driver mapper/Microsoft Corporation) 0x72D20000 Library C:\WINDOWS\system32\msacm32.drv (Microsoft Sound Mapper/Microsoft Corporation) 0x72D10000 Library C:\WINDOWS\system32\MSACM32.dll (Microsoft ACM Audio Filter/Microsoft Corporation) 0x77BE0000 Library C:\WINDOWS\system32\midimap.dll (Microsoft MIDI Mapper/Microsoft Corporation) 0x77BD0000 Process C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google Desktop/Google) 368 Library C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google Desktop/Google) 0x00400000 Library C:\WINDOWS\system32\ntdll.dll (NT Layer DLL/Microsoft Corporation) 0x7C900000 Library C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation) 0x7C800000 Library C:\Program Files\Google\Google Desktop Search\GoogleServices.DLL (Google Desktop/Google) 0x05000000 Library C:\Program Files\Google\Google Desktop Search\GoogleDesktopCommon.dll (Google Desktop/Google) 0x42000000 Library C:\WINDOWS\system32\SHLWAPI.dll (Shell Light-weight Utility Library/Microsoft Corporation) 0x77F60000 Library C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation) 0x77DD0000 Library C:\WINDOWS\system32\RPCRT4.dll (Remote Procedure Call Runtime/Microsoft Corporation) 0x77E70000 Library C:\WINDOWS\system32\Secur32.dll (Security Support Provider Interface/Microsoft Corporation) 0x77FE0000 Library C:\WINDOWS\system32\GDI32.dll (GDI Client DLL/Microsoft Corporation) 0x77F10000 Library C:\WINDOWS\system32\USER32.dll (Windows XP USER API Client DLL/Microsoft Corporation) 0x7E410000 Library C:\WINDOWS\system32\msvcrt.dll (Windows NT CRT DLL/Microsoft Corporation) 0x77C10000 Library C:\WINDOWS\system32\ole32.dll (Microsoft OLE for Windows/Microsoft Corporation) 0x774E0000 Library C:\WINDOWS\system32\OLEAUT32.dll (Microsoft Corporation) 0x77120000 Library C:\WINDOWS\system32\WININET.dll (Internet Extensions for Win32/Microsoft Corporation) 0x63000000 Library C:\WINDOWS\system32\Normaliz.dll (Unicode Normalization DLL/Microsoft Corporation) 0x00350000 Library C:\WINDOWS\system32\urlmon.dll (OLE32 Extensions for Win32/Microsoft Corporation) 0x1A400000 Library C:\WINDOWS\system32\iertutil.dll (Run time utility for Internet Explorer/Microsoft Corporation) 0x5DCA0000 Library C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll (User Experience Controls Library/Microsoft Corporation) 0x773D0000 Library C:\WINDOWS\system32\IMM32.dll (Windows XP IMM32 API Client DLL/Microsoft Corporation) 0x76390000 Library C:\WINDOWS\system32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation) 0x71AB0000 Library C:\WINDOWS\system32\WS2HELP.dll (Windows Socket 2.0 Helper for Windows NT/Microsoft Corporation) 0x71AA0000 Library C:\WINDOWS\system32\USERENV.dll (Userenv/Microsoft Corporation) 0x769C0000 Library C:\WINDOWS\system32\PSAPI.DLL (Process Status Helper/Microsoft Corporation) 0x76BF0000 Library C:\Program Files\Google\Google Desktop Search\GoogleDesktopResources_en.dll (Google Desktop/Google) 0x62000000 Library C:\WINDOWS\system32\uxtheme.dll (Microsoft UxTheme Library/Microsoft Corporation) 0x5AD70000 Library C:\WINDOWS\system32\wtsapi32.dll (Windows Terminal Server SDK APIs/Microsoft Corporation) 0x76F50000 Library C:\WINDOWS\system32\WINSTA.dll (Winstation Library/Microsoft Corporation) 0x76360000 Library C:\WINDOWS\system32\NETAPI32.dll (Net Win32 API DLL/Microsoft Corporation) 0x5B860000 Library C:\WINDOWS\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation) 0x77B40000 Library C:\WINDOWS\system32\msctfime.ime (Microsoft Text Frame Work Service IME/Microsoft Corporation) 0x755C0000 Library C:\WINDOWS\system32\mswsock.dll (Microsoft Windows Sockets 2.0 Service Provider/Microsoft Corporation) 0x71A50000 Library C:\WINDOWS\system32\hnetcfg.dll (Home Networking Configuration Manager/Microsoft Corporation) 0x662B0000 Library C:\WINDOWS\System32\wshtcpip.dll (Windows Sockets Helper DLL/Microsoft Corporation) 0x71A90000 Library C:\Program Files\Google\Google Desktop Search\GoogleDesktopAPI2.dll (Google Desktop/Google) 0x60000000 Library C:\WINDOWS\system32\CLBCATQ.DLL (Microsoft Corporation) 0x76FD0000 Library C:\WINDOWS\system32\COMRes.dll (Microsoft Corporation) 0x77050000 Library C:\WINDOWS\system32\VERSION.dll (Version Checking and File Installation Libraries/Microsoft Corporation) 0x77C00000 Library C:\WINDOWS\system32\SXS.DLL (Fusion 2.5/Microsoft Corporation) 0x7E720000 Library C:\WINDOWS\system32\xpsp2res.dll (Service Pack 2 Messages/Microsoft Corporation) 0x01000000 Library C:\WINDOWS\system32\shell32.dll (Windows Shell Common Dll/Microsoft Corporation) 0x7C9C0000 Library C:\WINDOWS\system32\rsaenh.dll (Microsoft Enhanced Cryptographic Provider/Microsoft Corporation) 0x68000000 Library C:\Program Files\Google\Google Desktop Search\GoogleDesktopHyper.dll (Google Desktop/Google) 0x4D000000 Library C:\WINDOWS\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x74D90000 Library C:\WINDOWS\system32\ACTXPRXY.DLL (ActiveX Interface Marshaling Library/Microsoft Corporation) 0x71D40000 Library C:\WINDOWS\system32\SETUPAPI.dll (Windows Setup API/Microsoft Corporation) 0x77920000 Library C:\WINDOWS\system32\asycfilt.dll (Microsoft Corporation) 0x708F0000 Library C:\WINDOWS\system32\LINKINFO.dll (Windows Volume Tracking/Microsoft Corporation) 0x76980000 Library C:\WINDOWS\system32\ntshrui.dll (Shell extensions for sharing/Microsoft Corporation) 0x76990000 Library C:\WINDOWS\system32\ATL.DLL (ATL Module for Windows XP (Unicode)/Microsoft Corporation) 0x76B20000 Library C:\Program Files\Google\Google Desktop Search\GoogleDesktopMail.dll (Google Desktop/Google) 0x4C000000 Library C:\WINDOWS\System32\IPHLPAPI.DLL (IP Helper API/Microsoft Corporation) 0x76D60000 Library C:\WINDOWS\system32\MPRAPI.dll (Windows NT MP Router Administration DLL/Microsoft Corporation) 0x76D40000 Library C:\WINDOWS\system32\ACTIVEDS.dll (ADs Router Layer DLL/Microsoft Corporation) 0x77CC0000 Library C:\WINDOWS\system32\adsldpc.dll (ADs LDAP Provider C DLL/Microsoft Corporation) 0x76E10000 Library C:\WINDOWS\system32\WLDAP32.dll (Win32 LDAP API DLL/Microsoft Corporation) 0x76F60000 Library C:\WINDOWS\system32\rtutils.dll (Routing Utilities/Microsoft Corporation) 0x76E80000 Library C:\WINDOWS\system32\SAMLIB.dll (SAM Library DLL/Microsoft Corporation) 0x71BF0000 Library C:\WINDOWS\system32\RASAPI32.dll (Remote Access API/Microsoft Corporation) 0x76EE0000 Library C:\WINDOWS\system32\rasman.dll (Remote Access Connection Manager/Microsoft Corporation) 0x76E90000 Library C:\WINDOWS\system32\TAPI32.dll (Microsoft® Windows™ Telephony API Client DLL/Microsoft Corporation) 0x76EB0000 Library C:\WINDOWS\system32\WINMM.dll (MCI API DLL/Microsoft Corporation) 0x76B40000 Library C:\WINDOWS\system32\msv1_0.dll (Microsoft Authentication Package v1.0/Microsoft Corporation) 0x77C70000 Library C:\WINDOWS\system32\cryptdll.dll (Cryptography Manager/Microsoft Corporation) 0x76790000 Library C:\WINDOWS\system32\sensapi.dll (SENS Connectivity API DLL/Microsoft Corporation) 0x722B0000 Library C:\WINDOWS\system32\CRYPT32.dll (Crypto API32/Microsoft Corporation) 0x77A80000 Library C:\WINDOWS\system32\MSASN1.dll (ASN.1 Runtime APIs/Microsoft Corporation) 0x77B20000 Library C:\WINDOWS\system32\wintrust.dll (Microsoft Trust Verification APIs/Microsoft Corporation) 0x76C30000 Library C:\WINDOWS\system32\IMAGEHLP.dll (Windows NT Image Helper/Microsoft Corporation) 0x76C90000 Library C:\WINDOWS\system32\schannel.dll (TLS / SSL Security Provider/Microsoft Corporation) 0x767F0000 Library C:\WINDOWS\system32\rasadhlp.dll (Remote Access AutoDial Helper/Microsoft Corporation) 0x76FC0000 Library C:\WINDOWS\system32\DNSAPI.dll (DNS Client API DLL/Microsoft Corporation) 0x76F20000 Library C:\WINDOWS\System32\winrnr.dll (LDAP RnR Provider DLL/Microsoft Corporation) 0x76FB0000 Library C:\Program Files\Bonjour\mdnsNSP.dll (Bonjour Namespace Provider/Apple Inc.) 0x16080000 Library C:\Program Files\Google\Google Desktop Search\gzlib.dll 0x45000000 Library C:\WINDOWS\system32\dssenh.dll (Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider/Microsoft Corporation) 0x68100000 Process C:\WINDOWS\System32\alg.exe (Application Layer Gateway Service/Microsoft Corporation) 372 Library C:\WINDOWS\System32\alg.exe (Application Layer Gateway Service/Microsoft Corporation) 0x01000000 Library C:\WINDOWS\system32\ntdll.dll (NT Layer DLL/Microsoft Corporation) 0x7C900000 Library C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation) 0x7C800000 Library C:\WINDOWS\system32\msvcrt.dll (Windows NT CRT DLL/Microsoft Corporation) 0x77C10000 Library C:\WINDOWS\System32\ATL.DLL (ATL Module for Windows XP (Unicode)/Microsoft Corporation) 0x76B20000 Library C:\WINDOWS\system32\USER32.dll (Windows XP USER API Client DLL/Microsoft Corporation) 0x7E410000 Library C:\WINDOWS\system32\GDI32.dll (GDI Client DLL/Microsoft Corporation) 0x77F10000 Library C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation) 0x77DD0000 Library C:\WINDOWS\system32\RPCRT4.dll (Remote Procedure Call Runtime/Microsoft Corporation) 0x77E70000 Library C:\WINDOWS\system32\Secur32.dll (Security Support Provider Interface/Microsoft Corporation) 0x77FE0000 Library C:\WINDOWS\system32\ole32.dll (Microsoft OLE for Windows/Microsoft Corporation) 0x774E0000 Library C:\WINDOWS\system32\OLEAUT32.dll (Microsoft Corporation) 0x77120000 Library C:\WINDOWS\System32\WSOCK32.dll (Windows Socket 32-Bit DLL/Microsoft Corporation) 0x71AD0000 Library C:\WINDOWS\System32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation) 0x71AB0000 Library C:\WINDOWS\System32\WS2HELP.dll (Windows Socket 2.0 Helper for Windows NT/Microsoft Corporation) 0x71AA0000 Library C:\WINDOWS\System32\MSWSOCK.DLL (Microsoft Windows Sockets 2.0 Service Provider/Microsoft Corporation) 0x71A50000 Library C:\WINDOWS\System32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) 0x5CB70000 Library C:\WINDOWS\AppPatch\AcGenral.DLL (Windows Compatibility DLL/Microsoft Corporation) 0x6F880000 Library C:\WINDOWS\System32\WINMM.dll (MCI API DLL/Microsoft Corporation) 0x76B40000 Library C:\WINDOWS\System32\MSACM32.dll (Microsoft ACM Audio Filter/Microsoft Corporation) 0x77BE0000 Library C:\WINDOWS\system32\VERSION.dll (Version Checking and File Installation Libraries/Microsoft Corporation) 0x77C00000 Library C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation) 0x7C9C0000 Library C:\WINDOWS\system32\SHLWAPI.dll (Shell Light-weight Utility Library/Microsoft Corporation) 0x77F60000 Library C:\WINDOWS\system32\USERENV.dll (Userenv/Microsoft Corporation) 0x769C0000 Library C:\WINDOWS\System32\UxTheme.dll (Microsoft UxTheme Library/Microsoft Corporation) 0x5AD70000 Library C:\WINDOWS\system32\IMM32.DLL (Windows XP IMM32 API Client DLL/Microsoft Corporation) 0x76390000 Library C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll (User Experience Controls Library/Microsoft Corporation) 0x773D0000 Library C:\WINDOWS\system32\comctl32.dll (Common Controls Library/Microsoft Corporation) 0x5D090000 Library C:\WINDOWS\System32\CLBCATQ.DLL (Microsoft Corporation) 0x76FD0000 Library C:\WINDOWS\System32\COMRes.dll (Microsoft Corporation) 0x77050000 Library C:\WINDOWS\System32\xpsp2res.dll (Service Pack 2 Messages/Microsoft Corporation) 0x00700000 Library C:\WINDOWS\system32\hnetcfg.dll (Home Networking Configuration Manager/Microsoft Corporation) 0x662B0000 Library C:\WINDOWS\System32\wshtcpip.dll (Windows Sockets Helper DLL/Microsoft Corporation) 0x71A90000 Process C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe (HpqSRmon/Hewlett-Packard) 468 Library C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe (HpqSRmon/Hewlett-Packard) 0x00400000 Library C:\WINDOWS\system32\ntdll.dll (NT Layer DLL/Microsoft Corporation) 0x7C900000 Library C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation) 0x7C800000 Library C:\WINDOWS\system32\WTSAPI32.dll (Windows Terminal Server SDK APIs/Microsoft Corporation) 0x76F50000 Library C:\WINDOWS\system32\msvcrt.dll (Windows NT CRT DLL/Microsoft Corporation) 0x77C10000 Library C:\WINDOWS\system32\WINSTA.dll (Winstation Library/Microsoft Corporation) 0x76360000 Library C:\WINDOWS\system32\NETAPI32.dll (Net Win32 API DLL/Microsoft Corporation) 0x5B860000 Library C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation) 0x77DD0000 Library C:\WINDOWS\system32\RPCRT4.dll (Remote Procedure Call Runtime/Microsoft Corporation) 0x77E70000 Library C:\WINDOWS\system32\Secur32.dll (Security Support Provider Interface/Microsoft Corporation) 0x77FE0000 Library C:\WINDOWS\system32\USER32.dll (Windows XP USER API Client DLL/Microsoft Corporation) 0x7E410000 Library C:\WINDOWS\system32\GDI32.dll (GDI Client DLL/Microsoft Corporation) 0x77F10000 Library C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation) 0x7C9C0000 Library C:\WINDOWS\system32\SHLWAPI.dll (Shell Light-weight Utility Library/Microsoft Corporation) 0x77F60000 Library C:\WINDOWS\system32\ole32.dll (Microsoft OLE for Windows/Microsoft Corporation) 0x774E0000 Library C:\WINDOWS\system32\OLEAUT32.dll (Microsoft Corporation) 0x77120000 Library C:\WINDOWS\system32\IMM32.DLL (Windows XP IMM32 API Client DLL/Microsoft Corporation) 0x76390000 Library C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll (User Experience Controls Library/Microsoft Corporation) 0x773D0000 Library C:\WINDOWS\system32\comctl32.dll (Common Controls Library/Microsoft Corporation) 0x5D090000 Library C:\WINDOWS\system32\uxtheme.dll (Microsoft UxTheme Library/Microsoft Corporation) 0x5AD70000 Library C:\WINDOWS\system32\CLBCATQ.DLL (Microsoft Corporation) 0x76FD0000 Library C:\WINDOWS\system32\COMRes.dll (Microsoft Corporation) 0x77050000 Library C:\WINDOWS\system32\VERSION.dll (Version Checking and File Installation Libraries/Microsoft Corporation) 0x77C00000 Library C:\WINDOWS\system32\xpsp2res.dll (Service Pack 2 Messages/Microsoft Corporation) 0x00960000 Library C:\WINDOWS\System32\sti.dll (Still Image Devices client DLL /Microsoft Corporation) 0x73BA0000 Library C:\WINDOWS\System32\CFGMGR32.dll (Configuration Manager Forwarder DLL/Microsoft Corporation) 0x74AE0000 Library C:\WINDOWS\System32\setupapi.DLL (Windows Setup API/Microsoft Corporation) 0x77920000 Library C:\WINDOWS\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation) 0x77B40000 Library C:\WINDOWS\system32\msctfime.ime (Microsoft Text Frame Work Service IME/Microsoft Corporation) 0x755C0000 Process C:\PROGRA~1\AVG\AVG9\avgtray.exe (AVG Tray Monitor/AVG Technologies CZ, s.r.o.) 484 Library C:\PROGRA~1\AVG\AVG9\avgtray.exe (AVG Tray Monitor/AVG Technologies CZ, s.r.o.) 0x00400000 Library C:\WINDOWS\system32\ntdll.dll (NT Layer DLL/Microsoft Corporation) 0x7C900000 Library C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation) 0x7C800000 Library C:\WINDOWS\system32\MSVFW32.dll (Microsoft Video for Windows DLL/Microsoft Corporation) 0x75A70000 Library C:\WINDOWS\system32\USER32.dll (Windows XP USER API Client DLL/Microsoft Corporation) 0x7E410000 Library C:\WINDOWS\system32\GDI32.dll (GDI Client DLL/Microsoft Corporation) 0x77F10000 Library C:\WINDOWS\system32\WINMM.dll (MCI API DLL/Microsoft Corporation) 0x76B40000 Library C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation) 0x77DD0000 Library C:\WINDOWS\system32\RPCRT4.dll (Remote Procedure Call Runtime/Microsoft Corporation) 0x77E70000 Library C:\WINDOWS\system32\Secur32.dll (Security Support Provider Interface/Microsoft Corporation) 0x77FE0000 Library C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation) 0x7C9C0000 Library C:\WINDOWS\system32\msvcrt.dll (Windows NT CRT DLL/Microsoft Corporation) 0x77C10000 Library C:\WINDOWS\system32\SHLWAPI.dll (Shell Light-weight Utility Library/Microsoft Corporation) 0x77F60000 Library C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll (User Experience Controls Library/Microsoft Corporation) 0x773D0000 Library C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\MFC80U.DLL (MFCDLL Shared Library - Retail Version/Microsoft Corporation) 0x782E0000 Library C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll (Microsoft® C Runtime Library/Microsoft Corporation) 0x78130000 Library C:\WINDOWS\system32\MSIMG32.dll (GDIEXT Client DLL/Microsoft Corporation) 0x76380000 Library C:\WINDOWS\system32\ole32.dll (Microsoft OLE for Windows/Microsoft Corporation) 0x774E0000 Library C:\WINDOWS\system32\OLEAUT32.dll (Microsoft Corporation) 0x77120000 Library C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCP80.dll (Microsoft® C++ Runtime Library/Microsoft Corporation) 0x7C420000 Library C:\WINDOWS\system32\VERSION.dll (Version Checking and File Installation Libraries/Microsoft Corporation) 0x77C00000 Library C:\WINDOWS\system32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation) 0x71AB0000 Library C:\WINDOWS\system32\WS2HELP.dll (Windows Socket 2.0 Helper for Windows NT/Microsoft Corporation) 0x71AA0000 Library C:\WINDOWS\system32\IMM32.DLL (Windows XP IMM32 API Client DLL/Microsoft Corporation) 0x76390000 Library C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\MFC80ENU.DLL (MFC Language Specific Resources/Microsoft Corporation) 0x5D360000 Library C:\Program Files\AVG\AVG9\avglogx.dll (AVG Logging Library/AVG Technologies CZ, s.r.o.) 0x6BC50000 Library C:\Program Files\AVG\AVG9\avgcfgx.dll (AVG Configuration Module/AVG Technologies CZ, s.r.o.) 0x6A920000 Library C:\Program Files\AVG\AVG9\avglngx.dll (AVG Language Module/AVG Technologies CZ, s.r.o.) 0x6BBD0000 Library C:\WINDOWS\system32\uxtheme.dll (Microsoft UxTheme Library/Microsoft Corporation) 0x5AD70000 Library C:\Program Files\AVG\AVG9\AVGUIRES.DLL (AVG User Interface Resource Library/AVG Technologies CZ, s.r.o.) 0x6D0B0000 Library C:\WINDOWS\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation) 0x77B40000 Library C:\WINDOWS\system32\msctfime.ime (Microsoft Text Frame Work Service IME/Microsoft Corporation) 0x755C0000

MARTY1946

Post #14July 24, 2010, 9:22 AM UTC

Seventh Part Process C:\WINDOWS\System32\smss.exe (Windows NT Session Manager/Microsoft Corporation) 540 Library C:\WINDOWS\System32\smss.exe (Windows NT Session Manager/Microsoft Corporation) 0x48580000 Library C:\WINDOWS\system32\ntdll.dll (NT Layer DLL/Microsoft Corporation) 0x7C900000 Process C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Watchdog Service/AVG Technologies CZ, s.r.o.) 596 Library C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Watchdog Service/AVG Technologies CZ, s.r.o.) 0x00400000 Library C:\WINDOWS\system32\ntdll.dll (NT Layer DLL/Microsoft Corporation) 0x7C900000 Library C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation) 0x7C800000 Library C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation) 0x77DD0000 Library C:\WINDOWS\system32\RPCRT4.dll (Remote Procedure Call Runtime/Microsoft Corporation) 0x77E70000 Library C:\WINDOWS\system32\Secur32.dll (Security Support Provider Interface/Microsoft Corporation) 0x77FE0000 Library C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll (Microsoft® C Runtime Library/Microsoft Corporation) 0x78130000 Library C:\WINDOWS\system32\msvcrt.dll (Windows NT CRT DLL/Microsoft Corporation) 0x77C10000 Library C:\WINDOWS\system32\USER32.dll (Windows XP USER API Client DLL/Microsoft Corporation) 0x7E410000 Library C:\WINDOWS\system32\GDI32.dll (GDI Client DLL/Microsoft Corporation) 0x77F10000 Library C:\WINDOWS\system32\IMM32.DLL (Windows XP IMM32 API Client DLL/Microsoft Corporation) 0x76390000 Library C:\Program Files\AVG\AVG9\avglogx.dll (AVG Logging Library/AVG Technologies CZ, s.r.o.) 0x6BC50000 Library C:\Program Files\AVG\AVG9\avgwd.dll (AVG Watchdog Module/AVG Technologies CZ, s.r.o.) 0x6D740000 Library C:\WINDOWS\system32\ole32.dll (Microsoft OLE for Windows/Microsoft Corporation) 0x774E0000 Library C:\WINDOWS\system32\OLEAUT32.dll (Microsoft Corporation) 0x77120000 Library C:\Program Files\AVG\AVG9\avgcfgx.dll (AVG Configuration Module/AVG Technologies CZ, s.r.o.) 0x6A920000 Library C:\WINDOWS\system32\VERSION.dll (Version Checking and File Installation Libraries/Microsoft Corporation) 0x77C00000 Library C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation) 0x7C9C0000 Library C:\WINDOWS\system32\SHLWAPI.dll (Shell Light-weight Utility Library/Microsoft Corporation) 0x77F60000 Library C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll (User Experience Controls Library/Microsoft Corporation) 0x773D0000 Library C:\WINDOWS\system32\comctl32.dll (Common Controls Library/Microsoft Corporation) 0x5D090000 Library C:\Program Files\AVG\AVG9\avgamnot.dll (AVG Event Notification Library/AVG Technologies CZ, s.r.o.) 0x6A5B0000 Library C:\Program Files\AVG\AVG9\avgsched.dll (AVG Scheduler Module/AVG Technologies CZ, s.r.o.) 0x6C250000 Library C:\WINDOWS\system32\SensAPI.DLL (SENS Connectivity API DLL/Microsoft Corporation) 0x722B0000 Library C:\Program Files\AVG\AVG9\avgwdwsc.dll (AVG Windows Security Center Module/AVG Technologies CZ, s.r.o.) 0x6D930000 Library C:\Program Files\AVG\AVG9\avglngx.dll (AVG Language Module/AVG Technologies CZ, s.r.o.) 0x6BBD0000 Library C:\WINDOWS\system32\uxtheme.dll (Microsoft UxTheme Library/Microsoft Corporation) 0x5AD70000 Library C:\WINDOWS\system32\CLBCATQ.DLL (Microsoft Corporation) 0x76FD0000 Library C:\WINDOWS\system32\COMRes.dll (Microsoft Corporation) 0x77050000 Library C:\WINDOWS\System32\wbem\wbemprox.dll (WMI/Microsoft Corporation) 0x74EF0000 Library C:\WINDOWS\System32\wbem\wbemcomn.dll (WMI/Microsoft Corporation) 0x75290000 Library C:\WINDOWS\system32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation) 0x71AB0000 Library C:\WINDOWS\system32\WS2HELP.dll (Windows Socket 2.0 Helper for Windows NT/Microsoft Corporation) 0x71AA0000 Library C:\WINDOWS\system32\xpsp2res.dll (Service Pack 2 Messages/Microsoft Corporation) 0x02D40000 Library C:\WINDOWS\System32\wbem\wbemsvc.dll (WMI/Microsoft Corporation) 0x74ED0000 Library C:\WINDOWS\System32\wbem\fastprox.dll (WMI/Microsoft Corporation) 0x75690000 Library C:\WINDOWS\system32\MSVCP60.dll (Microsoft ® C++ Runtime Library/Microsoft Corporation) 0x76080000 Library C:\WINDOWS\system32\NTDSAPI.dll (NT5DS/Microsoft Corporation) 0x767A0000 Library C:\WINDOWS\system32\DNSAPI.dll (DNS Client API DLL/Microsoft Corporation) 0x76F20000 Library C:\WINDOWS\system32\NETAPI32.dll (Net Win32 API DLL/Microsoft Corporation) 0x5B860000 Library C:\WINDOWS\system32\WLDAP32.dll (Win32 LDAP API DLL/Microsoft Corporation) 0x76F60000 Process C:\WINDOWS\system32\csrss.exe (Client Server Runtime Process/Microsoft Corporation) 604 Library C:\WINDOWS\system32\csrss.exe (Client Server Runtime Process/Microsoft Corporation) 0x4A680000 Library C:\WINDOWS\system32\ntdll.dll (NT Layer DLL/Microsoft Corporation) 0x7C900000 Library C:\WINDOWS\system32\CSRSRV.dll (Client Server Runtime Process/Microsoft Corporation) 0x75B40000 Library C:\WINDOWS\system32\basesrv.dll (Windows NT BASE API Server DLL/Microsoft Corporation) 0x75B50000 Library C:\WINDOWS\system32\winsrv.dll (Windows Server DLL/Microsoft Corporation) 0x75B60000 Library C:\WINDOWS\system32\GDI32.dll (GDI Client DLL/Microsoft Corporation) 0x77F10000 Library C:\WINDOWS\system32\KERNEL32.dll (Windows NT BASE API Client DLL/Microsoft Corporation) 0x7C800000 Library C:\WINDOWS\system32\USER32.dll (Windows XP USER API Client DLL/Microsoft Corporation) 0x7E410000 Library C:\WINDOWS\system32\sxs.dll (Fusion 2.5/Microsoft Corporation) 0x7E720000 Library C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation) 0x77DD0000 Library C:\WINDOWS\system32\RPCRT4.dll (Remote Procedure Call Runtime/Microsoft Corporation) 0x77E70000 Library C:\WINDOWS\system32\Secur32.dll (Security Support Provider Interface/Microsoft Corporation) 0x77FE0000 Library C:\WINDOWS\system32\Apphelp.dll (Application Compatibility Client Library/Microsoft Corporation) 0x77B40000 Library C:\WINDOWS\system32\VERSION.dll (Version Checking and File Installation Libraries/Microsoft Corporation) 0x77C00000 Process C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation) 628 Library C:\WINDOWS\system32\winlogon.exe (Windows NT Logon Application/Microsoft Corporation) 0x01000000 Library C:\WINDOWS\system32\ntdll.dll (NT Layer DLL/Microsoft Corporation) 0x7C900000 Library C:\WINDOWS\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation) 0x7C800000 Library C:\WINDOWS\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation) 0x77DD0000 Library C:\WINDOWS\system32\RPCRT4.dll (Remote Procedure Call Runtime/Microsoft Corporation) 0x77E70000 Library C:\WINDOWS\system32\Secur32.dll (Security Support Provider Interface/Microsoft Corporation) 0x77FE0000 Library C:\WINDOWS\system32\AUTHZ.dll (Authorization Framework/Microsoft Corporation) 0x776C0000 Library C:\WINDOWS\system32\msvcrt.dll (Windows NT CRT DLL/Microsoft Corporation) 0x77C10000 Library C:\WINDOWS\system32\CRYPT32.dll (Crypto API32/Microsoft Corporation) 0x77A80000 Library C:\WINDOWS\system32\MSASN1.dll (ASN.1 Runtime APIs/Microsoft Corporation) 0x77B20000 Library C:\WINDOWS\system32\USER32.dll (Windows XP USER API Client DLL/Microsoft Corporation) 0x7E410000 Library C:\WINDOWS\system32\GDI32.dll (GDI Client DLL/Microsoft Corporation) 0x77F10000 Library C:\WINDOWS\system32\NDdeApi.dll (Network DDE Share Management APIs/Microsoft Corporation) 0x75940000 Library C:\WINDOWS\system32\PROFMAP.dll (Userenv/Microsoft Corporation) 0x75930000 Library C:\WINDOWS\system32\NETAPI32.dll (Net Win32 API DLL/Microsoft Corporation) 0x5B860000 Library C:\WINDOWS\system32\USERENV.dll (Userenv/Microsoft Corporation) 0x769C0000 Library C:\WINDOWS\system32\PSAPI.DLL (Process Status Helper/Microsoft Corporation) 0x76BF0000 Library C:\WINDOWS\system32\REGAPI.dll (Registry Configuration APIs/Microsoft Corporation) 0x76BC0000 Library C:\WINDOWS\system32\SETUPAPI.dll (Windows Setup API/Microsoft Corporation) 0x77920000 Library C:\WINDOWS\system32\VERSION.dll (Version Checking and File Installation Libraries/Microsoft Corporation) 0x77C00000 Library C:\WINDOWS\system32\WINSTA.dll (Winstation Library/Microsoft Corporation) 0x76360000 Library C:\WINDOWS\system32\WINTRUST.dll (Microsoft Trust Verification APIs/Microsoft Corporation) 0x76C30000 Library C:\WINDOWS\system32\IMAGEHLP.dll (Windows NT Image Helper/Microsoft Corporation) 0x76C90000 Library C:\WINDOWS\system32\WS2_32.dll (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation) 0x71AB0000 Library C:\WINDOWS\system32\WS2HELP.dll (Windows Socket 2.0 Helper for Windows NT/Microsoft Corporation) 0x71AA0000 Library C:\WINDOWS\system32\IMM32.DLL (Windows XP IMM32 API Client DLL/Microsoft Corporation) 0x76390000 Library C:\WINDOWS\system32\MSGINA.dll (Windows NT Logon GINA DLL/Microsoft Corporation) 0x75970000 Library C:\WINDOWS\system32\COMCTL32.dll (Common Controls Library/Microsoft Corporation) 0x5D090000 Library C:\WINDOWS\system32\ODBC32.dll (Microsoft Data Access - ODBC Driver Manager/Microsoft Corporation) 0x74320000 Library C:\WINDOWS\system32\comdlg32.dll (Common Dialogs DLL/Microsoft Corporation) 0x763B0000 Library C:\WINDOWS\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation) 0x7C9C0000 Library C:\WINDOWS\system32\SHLWAPI.dll (Shell Light-weight Utility Library/Microsoft Corporation) 0x77F60000 Library C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll (User Experience Controls Library/Microsoft Corporation) 0x773D0000 Library C:\WINDOWS\system32\odbcint.dll (Microsoft Data Access - ODBC Resources/Microsoft Corporation) 0x00930000 Library C:\WINDOWS\system32\SHSVCS.dll (Windows Shell Services Dll/Microsoft Corporation) 0x776E0000 Library C:\WINDOWS\system32\sfc.dll (Windows File Protection/Microsoft Corporation) 0x76BB0000 Library C:\WINDOWS\system32\sfc_os.dll (Windows File Protection/Microsoft Corporation) 0x76C60000 Library C:\WINDOWS\system32\ole32.dll (Microsoft OLE for Windows/Microsoft Corporation) 0x774E0000 Library C:\WINDOWS\system32\Apphelp.dll (Application Compatibility Client Library/Microsoft Corporation) 0x77B40000 Library C:\WINDOWS\system32\msctfime.ime (Microsoft Text Frame Work Service IME/Microsoft Corporation) 0x755C0000 Library C:\WINDOWS\system32\WINSCARD.DLL (Microsoft Smart Card API/Microsoft Corporation) 0x723D0000 Library C:\WINDOWS\system32\WTSAPI32.dll (Windows Terminal Server SDK APIs/Microsoft Corporation) 0x76F50000 Library C:\WINDOWS\system32\sxs.dll (Fusion 2.5/Microsoft Corporation) 0x7E720000 Library C:\WINDOWS\system32\uxtheme.dll (Microsoft UxTheme Library/Microsoft Corporation) 0x5AD70000 Library C:\WINDOWS\system32\WINMM.dll (MCI API DLL/Microsoft Corporation) 0x76B40000 Library C:\WINDOWS\system32\avgrsstx.dll (AVG Resident Shield Starter/AVG Technologies CZ, s.r.o.) 0x6C1B0000 Library C:\WINDOWS\system32\cscdll.dll (Offline Network Agent/Microsoft Corporation) 0x76600000 Library C:\WINDOWS\system32\WlNotify.dll (Common DLL to receive Winlogon notifications/Microsoft Corporation) 0x75950000 Library C:\WINDOWS\system32\MPR.dll (Multiple Provider Router DLL/Microsoft Corporation) 0x71B20000 Library C:\WINDOWS\system32\WINSPOOL.DRV (Windows Spooler Driver/Microsoft Corporation) 0x73000000 Library C:\WINDOWS\system32\rsaenh.dll (Microsoft Enhanced Cryptographic Provider/Microsoft Corporation) 0x68000000 Library C:\WINDOWS\system32\WgaLogon.dll (Windows Genuine Advantage Notification/Microsoft Corporation) 0x011D0000 Library C:\WINDOWS\system32\OLEAUT32.dll (Microsoft Corporation) 0x77120000 Library C:\WINDOWS\system32\NTMARTA.DLL (Windows NT MARTA provider/Microsoft Corporation) 0x77690000 Library C:\WINDOWS\system32\SAMLIB.dll (SAM Library DLL/Microsoft Corporation) 0x71BF0000 Library C:\WINDOWS\system32\WLDAP32.dll (Win32 LDAP API DLL/Microsoft Corporation) 0x76F60000 Library C:\WINDOWS\system32\CLBCATQ.DLL (Microsoft Corporation) 0x76FD0000 Library C:\WINDOWS\system32\COMRes.dll (Microsoft Corporation) 0x77050000 Library C:\WINDOWS\system32\cscui.dll (Client Side Caching UI/Microsoft Corporation) 0x77A20000 Library C:\WINDOWS\system32\xpsp2res.dll (Service Pack 2 Messages/Microsoft Corporation) 0x013D0000 Library C:\WINDOWS\system32\msv1_0.dll (Microsoft Authentication Package v1.0/Microsoft Corporation) 0x77C70000 Library C:\WINDOWS\system32\cryptdll.dll (Cryptography Manager/Microsoft Corporation) 0x76790000 Library C:\WINDOWS\system32\iphlpapi.dll (IP Helper API/Microsoft Corporation) 0x76D60000 Library C:\WINDOWS\system32\wdmaud.drv (WDM Audio driver mapper/Microsoft Corporation) 0x72D20000 Library C:\WINDOWS\system32\msacm32.drv (Microsoft Sound Mapper/Microsoft Corporation) 0x72D10000 Library C:\WINDOWS\system32\MSACM32.dll (Microsoft ACM Audio Filter/Microsoft Corporation) 0x77BE0000 Library C:\WINDOWS\system32\midimap.dll (Microsoft MIDI Mapper/Microsoft Corporation) 0x77BD0000

ken545

Post #15July 24, 2010, 9:22 AM UTC

Looks OK,

Run these and post the logs

No log report for this one

Download TFC to your desktop

Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

Please download Malwarebytes from Here or Here

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Post the report please

Please run this free online virus scanner from ESET

Note: You will need to use Internet explorer for this scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is ticked, and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic

Post the report for Malwarebytes and the ESET scanner

✨ Ask AI

Ask AI