What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

virus/trojan/malware

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi! I'm not sure what all we are infected with. Here is a copy of my latest Hijack This Log. Thank you for your help!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:17:43 PM, on 10/27/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Kodak\AiO\center\KodakSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Turtle Beach\AudioStation\tbaspi.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kodak\AiO\Center\EKDiscovery.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICLA.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,\\.\globalroot\systemroot\system32\userinit.exe,
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Conime] %windir%\system32\conime.exe
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - HKCU\..\Run: [EPSON Stylus Photo RX595 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICLA.EXE /FU "C:\WINDOWS\TEMP\E_SB2.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Event Reminder.lnk = C:\pmw\PMREMIND.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: bmnet.dll
O10 - Unknown file in Winsock LSP: bmnet.dll
O10 - Unknown file in Winsock LSP: bmnet.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1137464237562
O16 - DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} (WildfireActiveXHost Class) - http://games.bellsouth.net/Gh/Tumblebugs/axhost.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://hgtv3.view22.com/view22/app/view22rte.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://games.bellsouth.net/Gh/DeliciousWeb/zylomplayer.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.att.oberon-media.com/Gameshel…ronGameHost.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://games.bellsouth.net/Gh/FeedingFrenz…outLauncher.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{78D5FBE4-BADD-4888-9CEE-BAE7A1FE7A90}: NameServer = 68.94.156.1 68.94.157.1
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AT&T RcAppSvc (ATTRcAppSvc) - SmithMicro Inc. - C:\Program Files\AT&T\Communication Manager\RcAppSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak AiO Network Discovery Service - Eastman Kodak Company - C:\Program Files\Kodak\AiO\Center\EKDiscovery.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\AiO\center\KodakSvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: tbaspi - Unknown owner - C:\Program Files\Turtle Beach\AudioStation\tbaspi.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\TURTLE~1\AUDIOS~1\x10nets.exe

–
End of file - 7029 bytes
Post #2
Hello and welcome to WhatTheTech. Please follow these guidelines while we work on your PC:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please follow my instructions carefully and in the order they are posted.
  • Any underlined text in my posts indicates a clickable link.
  • You should print any instructions I give you for ease of use and reference.
  • If you have any questions at all, please stop and ask before proceeding.
🖼Click to load external image (Posted Image) Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
🖼Click to load external image (Posted Image) Please download Rootkit Unhooker and save it on your desktop.
  • Disable your security programs
  • Double click RKUnhookerLE.exe to run it
  • Click the Report tab, then click Scan
  • Check Drivers, Stealth Code, Files, and Code Hooks
  • Uncheck the rest, then click OK
  • When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  • Wait till the scanner has finished then go File > Save Report
  • Save the report somewhere you can find it. Click Close
  • Copy the entire contents of the report and paste it in your next reply.
Note - You may get this warning it is ok, just ignore it:

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

Please include the following in your next post:
  • DDS and Attach.txt logs
  • Rootkit Unhooker log
Post #3
Thank you for your assistance! I'm very eager to clean this up. Here are the scans you requested. FYI-when I started to run the Rootkit Unhooker there was a message that read 'Failed to enable debug priviledge, not critical issue-I clicked OK and the program continued. When I checked the Select Disks for Scan for the C:\ and clicked OK I got another message that said Error starting helper service-I clicked OK and the program continued. Do not know if this is info you need, just wanted to be sure. Thanks again for your help. DDS (Ver_10-10-21.02) - NTFSx86 Run by [removed] at 15:10:02.39 on Sat 10/30/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.127.23 [GMT -4:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\WINDOWS\system32\drivers\KodakCCS.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Kodak\AiO\center\KodakSvc.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Turtle Beach\AudioStation\tbaspi.exe C:\Program Files\Kodak\AiO\Center\EKDiscovery.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICLA.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\WINDOWS\system32\ntvdm.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\msiexec.exe C:\Documents and Settings\jimmy\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.att.net/ mSearch Bar = uInternet Connection Wizard,ShellNext = iexplore mWinlogon: Userinit=c:\windows\system32\userinit.exe,\\.\globalroot\systemroot\system32\userinit.exe, TB: Yahoo! Companion: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\ycomp5_5_7_1.dll EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [OM_Monitor] c:\program files\olympus\olympus master\Monitor.exe -NoStart uRun: [EPSON Stylus Photo RX595 Series] c:\windows\system32\spool\drivers\w32x86\3\e_faticla.exe /fu "c:\windows\temp\E_SB2.tmp" /EF "HKCU" uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Microsoft Works Update Detection] c:\program files\microsoft works\WkDetect.exe mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [Conime] %windir%\system32\conime.exe mRun: [EKIJ5000StatusMonitor] c:\windows\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe dRunOnce: [RunNarrator] Narrator.exe StartupFolder: c:\docume~1\jimmy\startm~1\programs\startup\eventr~1.lnk - c:\pmw\PMREMIND.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~2.lnk - c:\program files\microsoft office\office\OSA9.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\common files\microsoft shared\works shared\wkcalrem.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - c:\program files\bonjour\ExplorerPlugin.dll LSP: bmnet.dll DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137464237562 DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} - hxxp://games.bellsouth.net/Gh/Tumblebugs/axhost.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/flash/ultrashim.cab DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - hxxp://acs.pandasoftware.com/activescan/as5free/asinst.cab DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38145.8063657407 DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} - hxxp://www.microsoft.com/security/controls/Sasser/20/SassCln.CAB DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} - hxxp://hgtv3.view22.com/view22/app/view22rte.cab DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://games.bellsouth.net/Gh/DeliciousWeb/zylomplayer.cab DPF: {CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} - hxxp://games.att.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} - hxxp://games.bellsouth.net/Gh/FeedingFrenzy/SproutLauncher.cab ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\jimmy\applic~1\mozilla\firefox\profiles\oxgkpr22.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\kodak\aio\center\EKDiscovery.exe [2009-5-4 279960] R2 KodakSvc;Kodak AiO Device Service;c:\program files\kodak\aio\center\KodakSvc.exe [2009-4-17 32768] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-3-3 135664] S3 ATTRcAppSvc;AT&T; RcAppSvc;c:\program files\at&t;\communication manager\RcAppSvc.exe [2008-11-20 113152] S3 SWNC8U80;Sierra Wireless MUX NDIS Driver (UMTS80);c:\windows\system32\drivers\swnc8u80.sys [2008-8-20 168192] S3 SWUMX80;Sierra Wireless USB MUX Driver (UMTS80);c:\windows\system32\drivers\swumx80.sys [2008-8-20 142976] UnknownUnknown Normandy;Normandy; [x] =============== Created Last 30 ================ 2010-10-27 18:16:12 388096 —-a-r- c:\docume~1\jimmy\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe 2010-10-27 18:16:08 ——– d—–w- c:\program files\Trend Micro 2010-10-24 07:13:45 ——– d—–w- c:\windows\system32\XPSViewer 2010-10-24 07:12:47 89088 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll 2010-10-24 07:11:47 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2010-10-24 07:11:47 597504 ——w- c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe 2010-10-24 07:11:47 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2010-10-24 07:11:47 575488 ——w- c:\windows\system32\xpsshhdr.dll 2010-10-24 07:11:47 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll 2010-10-24 07:11:47 117760 ——w- c:\windows\system32\prntvpt.dll 2010-10-24 07:11:46 1676288 ——w- c:\windows\system32\xpssvcs.dll 2010-10-24 07:11:46 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll 2010-10-24 07:11:46 ——– d—–w- C:\916a60ceab285d5f6344 2010-10-15 17:51:05 954368 ——w- c:\windows\system32\dllcache\mfc40.dll 2010-10-15 17:51:04 953856 ——w- c:\windows\system32\dllcache\mfc40u.dll 2010-10-15 17:51:01 974848 ——w- c:\windows\system32\dllcache\mfc42.dll 2010-10-15 02:12:36 617472 ——w- c:\windows\system32\dllcache\comctl32.dll ==================== Find3M ==================== 2010-10-30 19:01:54 1409 —-a-w- c:\windows\QTFont.for 2010-09-18 16:23:26 974848 —-a-w- c:\windows\system32\mfc42u.dll 2010-09-18 06:53:25 974848 —-a-w- c:\windows\system32\mfc42.dll 2010-09-18 06:53:25 954368 —-a-w- c:\windows\system32\mfc40.dll 2010-09-18 06:53:25 953856 —-a-w- c:\windows\system32\mfc40u.dll 2010-09-10 05:58:08 916480 —-a-w- c:\windows\system32\wininet.dll 2010-09-10 05:58:06 43520 —-a-w- c:\windows\system32\licmgr10.dll 2010-09-10 05:58:06 1469440 ——w- c:\windows\system32\inetcpl.cpl 2010-09-01 11:51:14 285824 —-a-w- c:\windows\system32\atmfd.dll 2010-08-31 13:42:52 1852800 —-a-w- c:\windows\system32\win32k.sys 2010-08-27 08:02:29 119808 —-a-w- c:\windows\system32\t2embed.dll 2010-08-27 05:57:43 99840 —-a-w- c:\windows\system32\srvsvc.dll 2010-08-26 12:52:45 5120 —-a-w- c:\windows\system32\xpsp4res.dll 2010-08-23 16:12:04 617472 —-a-w- c:\windows\system32\comctl32.dll 2010-08-17 13:17:06 58880 —-a-w- c:\windows\system32\spoolsv.exe 2010-08-16 08:45:00 590848 —-a-w- c:\windows\system32\rpcrt4.dll 2005-05-30 01:00:00 774144 —-a-w- c:\program files\RngInterstitial.dll ============= FINISH: 15:11:42.78 =============== RkU Version: 3.8.388.590, Type LE (SR2) ============================================== OS Name: Windows XP Version 5.1.2600 (Service Pack 3) Number of processors #1 ============================================== >Drivers ============================================== 0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2189952 bytes (Microsoft Corporation, NT Kernel & System) 0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0xFBB32000 C:\WINDOWS\System32\DRIVERS\BCMSM.sys 1101824 bytes (Broadcom Corporation, Modem Device Driver) 0xFC34F000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver) 0xFBA40000 C:\WINDOWS\system32\drivers\smwdm.sys 520192 bytes (Analog Devices, Inc., SoundMAX Integrated Digital Audio ) 0xF85FB000 C:\WINDOWS\System32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0xFB96E000 C:\WINDOWS\System32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver) 0xF86E0000 C:\WINDOWS\System32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver) 0xF52D0000 C:\WINDOWS\System32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver) 0xBF012000 C:\WINDOWS\System32\ati2dvaa.dll 319488 bytes (ATI Technologies Inc., ATI RAGE 128 WindowsNT Display Driver) 0xFBD0C000 C:\WINDOWS\System32\DRIVERS\ati2mtaa.sys 299008 bytes (ATI Technologies Inc., ATI RAGE 128 Miniport Driver) 0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 286720 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver) 0xF87CB000 C:\WINDOWS\System32\Drivers\cdudf_xp.SYS 237568 bytes (Roxio, CD-UDF NT Filesystem Driver) 0xF8786000 C:\WINDOWS\System32\Drivers\UdfReadr_xp.SYS 208896 bytes (Roxio, CD-UDF NT Filesystem Reader Driver) 0xFC46D000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT) 0xF581B000 C:\WINDOWS\System32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0xFC322000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver) 0xF4DD1000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer) 0xF866B000 C:\WINDOWS\System32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0xF86B8000 C:\WINDOWS\System32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver) 0xF8825000 C:\WINDOWS\System32\DRIVERS\EXPORTIT.SYS 155648 bytes (Eastman Kodak Company, Kodak DC File System driver) 0xF85D5000 C:\WINDOWS\System32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator) 0xF4DFC000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver) 0xFBA1C000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0xFBCD4000 C:\WINDOWS\System32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0xFBAEC000 C:\WINDOWS\System32\DRIVERS\e100b325.sys 143360 bytes (Intel Corporation, NDIS 5 driver) 0xFBB0F000 C:\WINDOWS\System32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library) 0xF8696000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0x806EE000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0xFC405000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0xFC43D000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver) 0xFC308000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0xFBABF000 C:\WINDOWS\System32\Drivers\pwd_2k.SYS 102400 bytes (Roxio, Win2000 Framework for Packet Write Driver) 0xFC425000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver) 0xF84A5000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes 0xFC3DC000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0xFBA05000 C:\WINDOWS\System32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0xF564E000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper) 0xFBAD8000 C:\WINDOWS\System32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver) 0xFBCF8000 C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver) 0xF8739000 C:\WINDOWS\System32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver) 0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver) 0xFC3F3000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver) 0xFC45C000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0xFB9F4000 C:\WINDOWS\System32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler) 0xFC64C000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver) 0xFBDC5000 C:\WINDOWS\System32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0xFBDE5000 C:\WINDOWS\System32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver) 0xFBDD5000 C:\WINDOWS\System32\Drivers\Cdr4_xp.SYS 61440 bytes (Roxio, CDR4_XP CDR Helper) 0xFBD95000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0xFBDB5000 C:\WINDOWS\System32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver) 0xF5783000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter) 0xFC59C000 C:\WINDOWS\System32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB) 0xFC4FC000 C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll) 0xFC55C000 C:\WINDOWS\System32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver) 0xFBD85000 C:\WINDOWS\System32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0xFC4DC000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0xFBD65000 C:\WINDOWS\System32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0xFC50C000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter) 0xFC61C000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver) 0xFBDA5000 C:\WINDOWS\System32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver) 0xFC4CC000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager) 0xFBD75000 C:\WINDOWS\System32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0xFC67C000 C:\WINDOWS\system32\drivers\dcfs2k.sys 40960 bytes (Eastman Kodak Company, Kodak DC File System Driver (NT)) 0xFC4BC000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver) 0xFC58C000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy) 0xFC57C000 C:\WINDOWS\System32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver) 0xFC5DC000 C:\WINDOWS\System32\DRIVERS\DcCam.sys 36864 bytes (Eastman Kodak Company, Kodak Digital Camera Driver) 0xFC4EC000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver) 0xFC53C000 C:\WINDOWS\System32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver) 0xFBD55000 C:\WINDOWS\System32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier) 0xFC5EC000 C:\WINDOWS\System32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver) 0xFC6BC000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver) 0xFC62C000 C:\WINDOWS\System32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0xFC85C000 C:\WINDOWS\system32\drivers\Afc.sys 32768 bytes (Arcsoft, Inc., Arcsoft® ASPI Shell) 0xFC83C000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver) 0xFC774000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver) 0xFC784000 C:\WINDOWS\System32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver) 0xFC834000 C:\WINDOWS\System32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0xFC844000 C:\WINDOWS\System32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver) 0xFC864000 C:\WINDOWS\System32\Drivers\MxlW2k.SYS 28672 bytes (MusicMatch, Inc., MusicMatch Access Layer KMD) 0xFC73C000 C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0xFC88C000 C:\WINDOWS\system32\DRIVERS\RimSerial.sys 28672 bytes (Research in Motion Ltd, RIM Virtual Serial Driver) 0xFC78C000 C:\WINDOWS\System32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver) 0xFC86C000 C:\WINDOWS\System32\Drivers\Cdralw2k.SYS 24576 bytes (Roxio, CDRAL for Windows 2000 Kernel Driver) 0xFC84C000 C:\WINDOWS\System32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver) 0xFC89C000 C:\WINDOWS\System32\Drivers\mmc_2K.SYS 24576 bytes (Roxio, CD-R/RW AddOn MMC Driver (W2K)) 0xFC854000 C:\WINDOWS\System32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver) 0xFC82C000 C:\WINDOWS\System32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0xFC764000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0xFC8BC000 C:\WINDOWS\System32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver) 0xFC76C000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver) 0xFC894000 C:\WINDOWS\System32\DRIVERS\omci.sys 20480 bytes (Dell Computer Corporation, OMCI Device Driver) 0xFC744000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager) 0xFC87C000 C:\WINDOWS\System32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library) 0xFC74C000 PxHelp20.sys 20480 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP) 0xFC884000 C:\WINDOWS\System32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver) 0xFC77C000 C:\WINDOWS\System32\Drivers\tcpipBM.SYS 20480 bytes (Bytemobile, Inc., Bytemobile Kernel Network Provider) 0xFC874000 C:\WINDOWS\System32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper) 0xFC79C000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver) 0xFC98C000 C:\WINDOWS\System32\Drivers\cdrbsdrv.SYS 16384 bytes (B.H.A Corporation, CD-ROM Filter Driver for Windows2000/xp) 0xFC2AF000 C:\WINDOWS\system32\drivers\MODEMCSA.sys 16384 bytes (Microsoft Corporation, Unimodem CSA Filter) 0xFC9B0000 C:\WINDOWS\System32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver) 0xF5A6C000 C:\WINDOWS\System32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver) 0xFC988000 C:\WINDOWS\System32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator) 0xFB9D0000 C:\WINDOWS\System32\DRIVERS\usbscan.sys 16384 bytes (Microsoft Corporation, USB Scanner Driver) 0xFC8CC000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver) 0xF88D2000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver) 0xFC954000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter) 0xFC99C000 C:\WINDOWS\System32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0xFC96C000 C:\WINDOWS\System32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0xFC974000 C:\WINDOWS\System32\drivers\ws2ifsl.sys 12288 bytes (Microsoft Corporation, Winsock2 IFS Layer) 0xFC9DE000 C:\WINDOWS\system32\drivers\aeaudio.sys 8192 bytes (Andrea Electronics Corporation, Andrea Audio Stub Driver) 0xFC9C0000 C:\WINDOWS\System32\Drivers\ASCTRM.SYS 8192 bytes (Windows ® 2000 DDK provider, TR Manager) 0xFC9EE000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver) 0xFCA06000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes 0xFC9EC000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver) 0xFC9BC000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0xFC9F0000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator) 0xFCA82000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver) 0xFC9F2000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport) 0xFC9E0000 C:\WINDOWS\System32\Drivers\RootMdm.sys 8192 bytes (Microsoft Corporation, Legacy Non-Pnp Modem Device Driver) 0xFC9E2000 C:\WINDOWS\System32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0xFC9E6000 C:\WINDOWS\System32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) 0xFC9BE000 C:\WINDOWS\System32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0xFCAEB000 C:\WINDOWS\System32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver) 0xFCADC000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk) 0xFCBCE000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver) 0xFCA84000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver) ============================================== >Stealth ============================================== 0x816C0000 LDT (IN GDT of Core 1) Modification, Base+0xC70, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x81940000 LDT (IN GDT of Core 1) Modification, Base+0xC98, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0xE2B881E4 LDT (IN GDT of Core 1) Modification, Base+0x048, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x80688056 LDT (IN GDT of Core 1) Modification, Base+0xA70, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1] 0xFF8881E3 LDT (IN GDT of Core 1) Modification, Base+0x900, DPL_SYSTEM, Rpl : 3, Type: CallGate32, Core [1] 0x81540000 LDT (IN GDT of Core 1) Modification, Base+0xC58, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x81640000 LDT (IN GDT of Core 1) Modification, Base+0xC68, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0xFF0081DE LDT (IN GDT of Core 1) Modification, Base+0xEB0, DPL_USER, Rpl : 2, Type: CallGate32, Core [1] 0xE2CE0000 LDT (IN GDT of Core 1) Modification, Base+0x138, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1] 0x78460A08 LDT (IN GDT of Core 1) Modification, Base+0x350, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0xFFE8FF80 LDT (IN GDT of Core 1) Modification, Base+0xD80, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1] 0xFFE0FF7F LDT (IN GDT of Core 1) Modification, Base+0xD88, DPL_SYSTEM, Rpl : 3, Type: CallGate32, Core [1] 0x81F881DE LDT (IN GDT of Core 1) Modification, Base+0xFC0, DPL_USER, Rpl : 2, Type: CallGate32, Core [1] 0x81F0FF7F LDT (IN GDT of Core 1) Modification, Base+0xFC8, DPL_USER, Rpl : 3, Type: CallGate32, Core [1] 0x812081DD LDT (IN GDT of Core 1) Modification, Base+0xC28, DPL_SYSTEM, Rpl : 1, Type: CallGate32, Core [1] 0x812C0000 LDT (IN GDT of Core 1) Modification, Base+0xC30, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1] 0x813C0000 LDT (IN GDT of Core 1) Modification, Base+0xC40, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1] 0x81540000 LDT (IN GDT of Core 1) Modification, Base+0xC58, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1] 0x816881DD LDT (IN GDT of Core 1) Modification, Base+0xC70, DPL_SYSTEM, Rpl : 1, Type: CallGate32, Core [1] 0x811C76B4 LDT (IN GDT of Core 1) Modification, Base+0xC88, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1] 0xFF080100 LDT (IN GDT of Core 1) Modification, Base+0xCE0, DPL_USER, Rpl : 0, Type: CallGate32, Core [1] 0xE13081CF LDT (IN GDT of Core 1) Modification, Base+0x5A8, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1] 0xFF580000 LDT (IN GDT of Core 1) Modification, Base+0x980, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x8158FF7D LDT (IN GDT of Core 1) Modification, Base+0xD10, DPL_INVALID, Rpl : 1, Type: CallGate32, Core [1] 0xFF9081D9 LDT (IN GDT of Core 1) Modification, Base+0xE10, DPL_SYSTEM, Rpl : 1, Type: CallGate32, Core [1] 0xE13081CF LDT (IN GDT of Core 1) Modification, Base+0x1D8, DPL_INVALID, Rpl : 3, Type: CallGate32, Core [1] 0x69460006 LDT (IN GDT of Core 1) Modification, Base+0x5D8, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1] 0xFF5881DE LDT (IN GDT of Core 1) Modification, Base+0x5E0, DPL_INVALID, Rpl : 2, Type: CallGate32, Core [1] 0x000F0000 LDT (IN GDT of Core 1) Modification, Base+0x6F8, DPL_SYSTEM, Rpl : 0, Type: CallGate32, Core [1] 0x005D0007 LDT (IN GDT of Core 1) Modification, Base+0x960, DPL_USER, Rpl : 3, Type: CallGate32, Core [1] 0x81CC0000 LDT (IN GDT of Core 1) Modification, Base+0xCD0, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x81DC0000 LDT (IN GDT of Core 1) Modification, Base+0xCE0, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0x81000900 LDT (IN GDT of Core 1) Modification, Base+0xE48, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] 0xFFB0FF78 LDT (IN GDT of Core 1) Modification, Base+0x128, DPL_INVALID, Rpl : 0, Type: CallGate32, Core [1] ============================================== >Files ============================================== ============================================== >Hooks ============================================== ntoskrnl.exe+0x00004AA2, Type: Inline - RelativeJump 0x804DBAA2–>804DBAA9 [ntoskrnl.exe] ntoskrnl.exe–>atoi, Type: EAT modification 0x80684C98–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>atol, Type: EAT modification 0x80684C9C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcCanIWrite, Type: EAT modification 0x80683714–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcCopyRead, Type: EAT modification 0x80683718–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcCopyWrite, Type: EAT modification 0x8068371C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcDeferWrite, Type: EAT modification 0x80683720–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcFastCopyRead, Type: EAT modification 0x80683724–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcFastCopyWrite, Type: EAT modification 0x80683728–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcFastMdlReadWait, Type: EAT modification 0x8068372C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcFastReadNotPossible, Type: EAT modification 0x80683730–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcFastReadWait, Type: EAT modification 0x80683734–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcFlushCache, Type: EAT modification 0x80683738–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcGetDirtyPages, Type: EAT modification 0x8068373C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcGetFileObjectFromBcb, Type: EAT modification 0x80683740–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcGetFileObjectFromSectionPtrs, Type: EAT modification 0x80683744–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcGetFlushedValidData, Type: EAT modification 0x80683748–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcGetLsnForFileObject, Type: EAT modification 0x8068374C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcInitializeCacheMap, Type: EAT modification 0x80683750–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcIsThereDirtyData, Type: EAT modification 0x80683754–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcMapData, Type: EAT modification 0x80683758–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcMdlRead, Type: EAT modification 0x8068375C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcMdlReadComplete, Type: EAT modification 0x80683760–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcMdlWriteAbort, Type: EAT modification 0x80683764–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcMdlWriteComplete, Type: EAT modification 0x80683768–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcPinMappedData, Type: EAT modification 0x8068376C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcPinRead, Type: EAT modification 0x80683770–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcPrepareMdlWrite, Type: EAT modification 0x80683774–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcPreparePinWrite, Type: EAT modification 0x80683778–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcPurgeCacheSection, Type: EAT modification 0x8068377C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcRemapBcb, Type: EAT modification 0x80683780–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcRepinBcb, Type: EAT modification 0x80683784–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcScheduleReadAhead, Type: EAT modification 0x80683788–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcSetAdditionalCacheAttributes, Type: EAT modification 0x8068378C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcSetBcbOwnerPointer, Type: EAT modification 0x80683790–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcSetDirtyPageThreshold, Type: EAT modification 0x80683794–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcSetDirtyPinnedData, Type: EAT modification 0x80683798–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcSetFileSizes, Type: EAT modification 0x8068379C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcSetLogHandleForFile, Type: EAT modification 0x806837A0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcSetReadAheadGranularity, Type: EAT modification 0x806837A4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcUninitializeCacheMap, Type: EAT modification 0x806837A8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcUnpinData, Type: EAT modification 0x806837AC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcUnpinDataForThread, Type: EAT modification 0x806837B0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcUnpinRepinnedBcb, Type: EAT modification 0x806837B4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcWaitForCurrentLazyWriterActivity, Type: EAT modification 0x806837B8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CcZeroData, Type: EAT modification 0x806837BC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CmRegisterCallback, Type: EAT modification 0x806837C0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>CmUnRegisterCallback, Type: EAT modification 0x806837C4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>DbgBreakPoint, Type: EAT modification 0x806837C8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>DbgBreakPointWithStatus, Type: EAT modification 0x806837CC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>DbgLoadImageSymbols, Type: EAT modification 0x806837D0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>DbgPrint, Type: EAT modification 0x806837D4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>DbgPrintEx, Type: EAT modification 0x806837D8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>DbgPrintReturnControlC, Type: EAT modification 0x806837DC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>DbgPrompt, Type: EAT modification 0x806837E0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>DbgQueryDebugFilterState, Type: EAT modification 0x806837E4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>DbgSetDebugFilterState, Type: EAT modification 0x806837E8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExAcquireFastMutexUnsafe, Type: EAT modification 0x80683628–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExAcquireResourceExclusiveLite, Type: EAT modification 0x806837EC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExAcquireResourceSharedLite, Type: EAT modification 0x806837F0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExAcquireRundownProtection, Type: EAT modification 0x8068362C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExAcquireRundownProtectionEx, Type: EAT modification 0x80683630–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExAcquireSharedStarveExclusive, Type: EAT modification 0x806837F4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExAcquireSharedWaitForExclusive, Type: EAT modification 0x806837F8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExAllocateFromPagedLookasideList, Type: EAT modification 0x806837FC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExAllocatePool, Type: EAT modification 0x80683800–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExAllocatePoolWithQuota, Type: EAT modification 0x80683804–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExAllocatePoolWithQuotaTag, Type: EAT modification 0x80683808–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExAllocatePoolWithTag, Type: EAT modification 0x8068380C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExAllocatePoolWithTagPriority, Type: EAT modification 0x80683810–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExConvertExclusiveToSharedLite, Type: EAT modification 0x80683814–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExCreateCallback, Type: EAT modification 0x80683818–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExDeleteNPagedLookasideList, Type: EAT modification 0x8068381C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExDeletePagedLookasideList, Type: EAT modification 0x80683820–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExDeleteResourceLite, Type: EAT modification 0x80683824–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExDesktopObjectType, Type: EAT modification 0x80683828–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExDisableResourceBoostLite, Type: EAT modification 0x8068382C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExEnumHandleTable, Type: EAT modification 0x80683830–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExEventObjectType, Type: EAT modification 0x80683834–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExExtendZone, Type: EAT modification 0x80683838–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExfAcquirePushLockExclusive, Type: EAT modification 0x80683668–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExfAcquirePushLockShared, Type: EAT modification 0x8068366C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>Exfi386InterlockedDecrementLong, Type: EAT modification 0x80683690–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>Exfi386InterlockedExchangeUlong, Type: EAT modification 0x80683694–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>Exfi386InterlockedIncrementLong, Type: EAT modification 0x80683698–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExfInterlockedAddUlong, Type: EAT modification 0x80683670–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExfInterlockedCompareExchange64, Type: EAT modification 0x80683674–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExfInterlockedInsertHeadList, Type: EAT modification 0x80683678–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExfInterlockedInsertTailList, Type: EAT modification 0x8068367C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExfInterlockedPopEntryList, Type: EAT modification 0x80683680–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExfInterlockedPushEntryList, Type: EAT modification 0x80683684–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExfInterlockedRemoveHeadList, Type: EAT modification 0x80683688–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExFreePool, Type: EAT modification 0x8068383C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExFreePoolWithTag, Type: EAT modification 0x80683840–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExFreeToPagedLookasideList, Type: EAT modification 0x80683844–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExfReleasePushLock, Type: EAT modification 0x8068368C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExGetCurrentProcessorCounts, Type: EAT modification 0x80683848–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExGetCurrentProcessorCpuUsage, Type: EAT modification 0x8068384C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExGetExclusiveWaiterCount, Type: EAT modification 0x80683850–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExGetPreviousMode, Type: EAT modification 0x80683854–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExGetSharedWaiterCount, Type: EAT modification 0x80683858–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>Exi386InterlockedDecrementLong, Type: EAT modification 0x806838F8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>Exi386InterlockedExchangeUlong, Type: EAT modification 0x806838FC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>Exi386InterlockedIncrementLong, Type: EAT modification 0x80683900–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInitializeNPagedLookasideList, Type: EAT modification 0x8068385C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInitializePagedLookasideList, Type: EAT modification 0x80683860–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInitializeResourceLite, Type: EAT modification 0x80683864–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInitializeRundownProtection, Type: EAT modification 0x80683634–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInitializeZone, Type: EAT modification 0x80683868–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedAddLargeInteger, Type: EAT modification 0x8068386C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedAddLargeStatistic, Type: EAT modification 0x80683638–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedAddUlong, Type: EAT modification 0x80683870–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedCompareExchange64, Type: EAT modification 0x8068363C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedDecrementLong, Type: EAT modification 0x80683874–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedExchangeUlong, Type: EAT modification 0x80683878–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedExtendZone, Type: EAT modification 0x8068387C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedFlushSList, Type: EAT modification 0x80683640–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedIncrementLong, Type: EAT modification 0x80683880–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedInsertHeadList, Type: EAT modification 0x80683884–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedInsertTailList, Type: EAT modification 0x80683888–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedPopEntryList, Type: EAT modification 0x8068388C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedPopEntrySList, Type: EAT modification 0x80683644–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedPushEntryList, Type: EAT modification 0x80683890–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedPushEntrySList, Type: EAT modification 0x80683648–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExInterlockedRemoveHeadList, Type: EAT modification 0x80683894–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExIsProcessorFeaturePresent, Type: EAT modification 0x80683898–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExIsResourceAcquiredExclusiveLite, Type: EAT modification 0x8068389C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExIsResourceAcquiredSharedLite, Type: EAT modification 0x806838A0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExLocalTimeToSystemTime, Type: EAT modification 0x806838A4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExNotifyCallback, Type: EAT modification 0x806838A8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExQueryPoolBlockSize, Type: EAT modification 0x806838AC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExQueueWorkItem, Type: EAT modification 0x806838B0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExRaiseAccessViolation, Type: EAT modification 0x806838B4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExRaiseDatatypeMisalignment, Type: EAT modification 0x806838B8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExRaiseException, Type: EAT modification 0x806838BC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExRaiseHardError, Type: EAT modification 0x806838C0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExRaiseStatus, Type: EAT modification 0x806838C4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExRegisterCallback, Type: EAT modification 0x806838C8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExReinitializeResourceLite, Type: EAT modification 0x806838CC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExReInitializeRundownProtection, Type: EAT modification 0x8068364C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExReleaseFastMutexUnsafe, Type: EAT modification 0x80683650–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExReleaseResourceForThreadLite, Type: EAT modification 0x806838D0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExReleaseResourceLite, Type: EAT modification 0x80683654–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExReleaseRundownProtection, Type: EAT modification 0x80683658–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExReleaseRundownProtectionEx, Type: EAT modification 0x8068365C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExRundownCompleted, Type: EAT modification 0x80683660–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExSemaphoreObjectType, Type: EAT modification 0x806838D4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExSetResourceOwnerPointer, Type: EAT modification 0x806838D8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExSetTimerResolution, Type: EAT modification 0x806838DC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExSystemExceptionFilter, Type: EAT modification 0x806838E0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExSystemTimeToLocalTime, Type: EAT modification 0x806838E4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExUnregisterCallback, Type: EAT modification 0x806838E8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExUuidCreate, Type: EAT modification 0x806838EC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExVerifySuite, Type: EAT modification 0x806838F0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExWaitForRundownProtectionRelease, Type: EAT modification 0x80683664–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ExWindowStationObjectType, Type: EAT modification 0x806838F4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlAcquireFileExclusive, Type: EAT modification 0x80683904–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlAddLargeMcbEntry, Type: EAT modification 0x80683908–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlAddMcbEntry, Type: EAT modification 0x8068390C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlAddToTunnelCache, Type: EAT modification 0x80683910–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlAllocateFileLock, Type: EAT modification 0x80683914–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlAllocatePool, Type: EAT modification 0x80683918–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlAllocatePoolWithQuota, Type: EAT modification 0x8068391C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlAllocatePoolWithQuotaTag, Type: EAT modification 0x80683920–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlAllocatePoolWithTag, Type: EAT modification 0x80683924–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlAllocateResource, Type: EAT modification 0x80683928–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlAreNamesEqual, Type: EAT modification 0x8068392C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlBalanceReads, Type: EAT modification 0x80683930–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlCheckLockForReadAccess, Type: EAT modification 0x80683934–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlCheckLockForWriteAccess, Type: EAT modification 0x80683938–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlCheckOplock, Type: EAT modification 0x8068393C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlCopyRead, Type: EAT modification 0x80683940–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlCopyWrite, Type: EAT modification 0x80683944–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlCreateSectionForDataScan, Type: EAT modification 0x80683948–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlCurrentBatchOplock, Type: EAT modification 0x8068394C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlDeleteKeyFromTunnelCache, Type: EAT modification 0x80683950–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlDeleteTunnelCache, Type: EAT modification 0x80683954–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlDeregisterUncProvider, Type: EAT modification 0x80683958–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlDissectDbcs, Type: EAT modification 0x8068395C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlDissectName, Type: EAT modification 0x80683960–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlDoesDbcsContainWildCards, Type: EAT modification 0x80683964–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlDoesNameContainWildCards, Type: EAT modification 0x80683968–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlFastCheckLockForRead, Type: EAT modification 0x8068396C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlFastCheckLockForWrite, Type: EAT modification 0x80683970–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlFastUnlockAll, Type: EAT modification 0x80683974–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlFastUnlockAllByKey, Type: EAT modification 0x80683978–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlFastUnlockSingle, Type: EAT modification 0x8068397C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlFindInTunnelCache, Type: EAT modification 0x80683980–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlFreeFileLock, Type: EAT modification 0x80683984–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlGetFileSize, Type: EAT modification 0x80683988–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlGetNextFileLock, Type: EAT modification 0x8068398C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlGetNextLargeMcbEntry, Type: EAT modification 0x80683990–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlGetNextMcbEntry, Type: EAT modification 0x80683994–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlIncrementCcFastReadNotPossible, Type: EAT modification 0x8068399C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlIncrementCcFastReadNoWait, Type: EAT modification 0x80683998–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlIncrementCcFastReadResourceMiss, Type: EAT modification 0x806839A0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlIncrementCcFastReadWait, Type: EAT modification 0x806839A4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlInitializeFileLock, Type: EAT modification 0x806839A8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlInitializeLargeMcb, Type: EAT modification 0x806839AC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlInitializeMcb, Type: EAT modification 0x806839B0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlInitializeOplock, Type: EAT modification 0x806839B4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlInitializeTunnelCache, Type: EAT modification 0x806839B8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlInsertPerFileObjectContext, Type: EAT modification 0x806839BC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlInsertPerStreamContext, Type: EAT modification 0x806839C0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlIsDbcsInExpression, Type: EAT modification 0x806839C4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlIsFatDbcsLegal, Type: EAT modification 0x806839C8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlIsHpfsDbcsLegal, Type: EAT modification 0x806839CC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlIsNameInExpression, Type: EAT modification 0x806839D0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlIsNtstatusExpected, Type: EAT modification 0x806839D4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlIsPagingFile, Type: EAT modification 0x806839D8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlIsTotalDeviceFailure, Type: EAT modification 0x806839DC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlLegalAnsiCharacterArray, Type: EAT modification 0x806839E0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlLookupLargeMcbEntry, Type: EAT modification 0x806839E4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlLookupLastLargeMcbEntry, Type: EAT modification 0x806839E8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlLookupLastLargeMcbEntryAndIndex, Type: EAT modification 0x806839EC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlLookupLastMcbEntry, Type: EAT modification 0x806839F0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlLookupMcbEntry, Type: EAT modification 0x806839F4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlLookupPerFileObjectContext, Type: EAT modification 0x806839F8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlLookupPerStreamContextInternal, Type: EAT modification 0x806839FC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlMdlRead, Type: EAT modification 0x80683A00–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlMdlReadComplete, Type: EAT modification 0x80683A04–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlMdlReadCompleteDev, Type: EAT modification 0x80683A08–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlMdlReadDev, Type: EAT modification 0x80683A0C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlMdlWriteComplete, Type: EAT modification 0x80683A10–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlMdlWriteCompleteDev, Type: EAT modification 0x80683A14–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlNormalizeNtstatus, Type: EAT modification 0x80683A18–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlNotifyChangeDirectory, Type: EAT modification 0x80683A1C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlNotifyCleanup, Type: EAT modification 0x80683A20–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlNotifyFilterChangeDirectory, Type: EAT modification 0x80683A24–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlNotifyFilterReportChange, Type: EAT modification 0x80683A28–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlNotifyFullChangeDirectory, Type: EAT modification 0x80683A2C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlNotifyFullReportChange, Type: EAT modification 0x80683A30–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlNotifyInitializeSync, Type: EAT modification 0x80683A34–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlNotifyReportChange, Type: EAT modification 0x80683A38–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlNotifyUninitializeSync, Type: EAT modification 0x80683A3C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlNotifyVolumeEvent, Type: EAT modification 0x80683A40–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlNumberOfRunsInLargeMcb, Type: EAT modification 0x80683A44–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlNumberOfRunsInMcb, Type: EAT modification 0x80683A48–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlOplockFsctrl, Type: EAT modification 0x80683A4C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlOplockIsFastIoPossible, Type: EAT modification 0x80683A50–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlPostPagingFileStackOverflow, Type: EAT modification 0x80683A54–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlPostStackOverflow, Type: EAT modification 0x80683A58–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlPrepareMdlWrite, Type: EAT modification 0x80683A5C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlPrepareMdlWriteDev, Type: EAT modification 0x80683A60–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlPrivateLock, Type: EAT modification 0x80683A64–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlProcessFileLock, Type: EAT modification 0x80683A68–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlRegisterFileSystemFilterCallbacks, Type: EAT modification 0x80683A6C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlRegisterUncProvider, Type: EAT modification 0x80683A70–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlReleaseFile, Type: EAT modification 0x80683A74–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlRemoveLargeMcbEntry, Type: EAT modification 0x80683A78–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlRemoveMcbEntry, Type: EAT modification 0x80683A7C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlRemovePerFileObjectContext, Type: EAT modification 0x80683A80–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlRemovePerStreamContext, Type: EAT modification 0x80683A84–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlResetLargeMcb, Type: EAT modification 0x80683A88–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlSplitLargeMcb, Type: EAT modification 0x80683A8C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlSyncVolumes, Type: EAT modification 0x80683A90–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlTeardownPerStreamContexts, Type: EAT modification 0x80683A94–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlTruncateLargeMcb, Type: EAT modification 0x80683A98–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlTruncateMcb, Type: EAT modification 0x80683A9C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlUninitializeFileLock, Type: EAT modification 0x80683AA0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlUninitializeLargeMcb, Type: EAT modification 0x80683AA4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlUninitializeMcb, Type: EAT modification 0x80683AA8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>FsRtlUninitializeOplock, Type: EAT modification 0x80683AAC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>HalDispatchTable, Type: EAT modification 0x80683AB0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>HalExamineMBR, Type: EAT modification 0x8068369C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>HalPrivateDispatchTable, Type: EAT modification 0x80683AB4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>HeadlessDispatch, Type: EAT modification 0x80683AB8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InbvAcquireDisplayOwnership, Type: EAT modification 0x80683ABC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InbvCheckDisplayOwnership, Type: EAT modification 0x80683AC0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InbvDisplayString, Type: EAT modification 0x80683AC4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InbvEnableBootDriver, Type: EAT modification 0x80683AC8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InbvEnableDisplayString, Type: EAT modification 0x80683ACC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InbvInstallDisplayStringFilter, Type: EAT modification 0x80683AD0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InbvIsBootDriverInstalled, Type: EAT modification 0x80683AD4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InbvNotifyDisplayOwnershipLost, Type: EAT modification 0x80683AD8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InbvResetDisplay, Type: EAT modification 0x80683ADC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InbvSetScrollRegion, Type: EAT modification 0x80683AE0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InbvSetTextColor, Type: EAT modification 0x80683AE4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InbvSolidColorFill, Type: EAT modification 0x80683AE8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InitSafeBootMode, Type: EAT modification 0x80683AEC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InterlockedCompareExchange, Type: EAT modification 0x806836A0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InterlockedDecrement, Type: EAT modification 0x806836A4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InterlockedExchange, Type: EAT modification 0x806836A8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InterlockedExchangeAdd, Type: EAT modification 0x806836AC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InterlockedIncrement, Type: EAT modification 0x806836B0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InterlockedPopEntrySList, Type: EAT modification 0x806836B4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>InterlockedPushEntrySList, Type: EAT modification 0x806836B8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAcquireCancelSpinLock, Type: EAT modification 0x80683AF0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAcquireRemoveLockEx, Type: EAT modification 0x80683AF4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAcquireVpbSpinLock, Type: EAT modification 0x80683AF8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAdapterObjectType, Type: EAT modification 0x80683AFC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAllocateAdapterChannel, Type: EAT modification 0x80683B00–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAllocateController, Type: EAT modification 0x80683B04–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAllocateDriverObjectExtension, Type: EAT modification 0x80683B08–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAllocateErrorLogEntry, Type: EAT modification 0x80683B0C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAllocateIrp, Type: EAT modification 0x80683B10–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAllocateMdl, Type: EAT modification 0x80683B14–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAllocateWorkItem, Type: EAT modification 0x80683B18–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAssignDriveLetters, Type: EAT modification 0x806836BC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAssignResources, Type: EAT modification 0x80683B1C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAttachDevice, Type: EAT modification 0x80683B20–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAttachDeviceByPointer, Type: EAT modification 0x80683B24–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAttachDeviceToDeviceStack, Type: EAT modification 0x80683B28–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoAttachDeviceToDeviceStackSafe, Type: EAT modification 0x80683B2C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoBuildAsynchronousFsdRequest, Type: EAT modification 0x80683B30–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoBuildDeviceIoControlRequest, Type: EAT modification 0x80683B34–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoBuildPartialMdl, Type: EAT modification 0x80683B38–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoBuildSynchronousFsdRequest, Type: EAT modification 0x80683B3C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCallDriver, Type: EAT modification 0x80683B40–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCancelFileOpen, Type: EAT modification 0x80683B44–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCancelIrp, Type: EAT modification 0x80683B48–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCheckDesiredAccess, Type: EAT modification 0x80683B4C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCheckEaBufferValidity, Type: EAT modification 0x80683B50–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCheckFunctionAccess, Type: EAT modification 0x80683B54–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCheckQuerySetFileInformation, Type: EAT modification 0x80683B58–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCheckQuerySetVolumeInformation, Type: EAT modification 0x80683B5C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCheckQuotaBufferValidity, Type: EAT modification 0x80683B60–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCheckShareAccess, Type: EAT modification 0x80683B64–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCompleteRequest, Type: EAT modification 0x80683B68–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoConnectInterrupt, Type: EAT modification 0x80683B6C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCreateController, Type: EAT modification 0x80683B70–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCreateDevice, Type: EAT modification 0x80683B74–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCreateDisk, Type: EAT modification 0x80683B78–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCreateDriver, Type: EAT modification 0x80683B7C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCreateFile, Type: EAT modification 0x80683B80–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCreateFileSpecifyDeviceObjectHint, Type: EAT modification 0x80683B84–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCreateNotificationEvent, Type: EAT modification 0x80683B88–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCreateStreamFileObject, Type: EAT modification 0x80683B8C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCreateStreamFileObjectEx, Type: EAT modification 0x80683B90–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCreateStreamFileObjectLite, Type: EAT modification 0x80683B94–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCreateSymbolicLink, Type: EAT modification 0x80683B98–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCreateSynchronizationEvent, Type: EAT modification 0x80683B9C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCreateUnprotectedSymbolicLink, Type: EAT modification 0x80683BA0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCsqInitialize, Type: EAT modification 0x80683BA4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCsqInsertIrp, Type: EAT modification 0x80683BA8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCsqRemoveIrp, Type: EAT modification 0x80683BAC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoCsqRemoveNextIrp, Type: EAT modification 0x80683BB0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoDeleteController, Type: EAT modification 0x80683BB4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoDeleteDevice, Type: EAT modification 0x80683BB8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoDeleteDriver, Type: EAT modification 0x80683BBC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoDeleteSymbolicLink, Type: EAT modification 0x80683BC0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoDetachDevice, Type: EAT modification 0x80683BC4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoDeviceHandlerObjectSize, Type: EAT modification 0x80683BC8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoDeviceHandlerObjectType, Type: EAT modification 0x80683BCC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoDeviceObjectType, Type: EAT modification 0x80683BD0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoDisconnectInterrupt, Type: EAT modification 0x80683BD4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoDriverObjectType, Type: EAT modification 0x80683BD8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoEnqueueIrp, Type: EAT modification 0x80683BDC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoEnumerateDeviceObjectList, Type: EAT modification 0x80683BE0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoEnumerateRegisteredFiltersList, Type: EAT modification 0x80683BE4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoFastQueryNetworkAttributes, Type: EAT modification 0x80683BE8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IofCallDriver, Type: EAT modification 0x806836CC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IofCompleteRequest, Type: EAT modification 0x806836D0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoFileObjectType, Type: EAT modification 0x80683BEC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoForwardAndCatchIrp, Type: EAT modification 0x80683BF0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoForwardIrpSynchronously, Type: EAT modification 0x80683BF4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoFreeController, Type: EAT modification 0x80683BF8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoFreeErrorLogEntry, Type: EAT modification 0x80683BFC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoFreeIrp, Type: EAT modification 0x80683C00–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoFreeMdl, Type: EAT modification 0x80683C04–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoFreeWorkItem, Type: EAT modification 0x80683C08–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetAttachedDevice, Type: EAT modification 0x80683C0C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetAttachedDeviceReference, Type: EAT modification 0x80683C10–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetBaseFileSystemDeviceObject, Type: EAT modification 0x80683C14–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetBootDiskInformation, Type: EAT modification 0x80683C18–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetConfigurationInformation, Type: EAT modification 0x80683C1C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetCurrentProcess, Type: EAT modification 0x80683C20–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetDeviceAttachmentBaseRef, Type: EAT modification 0x80683C24–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetDeviceInterfaceAlias, Type: EAT modification 0x80683C28–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetDeviceInterfaces, Type: EAT modification 0x80683C2C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetDeviceObjectPointer, Type: EAT modification 0x80683C30–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetDeviceProperty, Type: EAT modification 0x80683C34–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetDeviceToVerify, Type: EAT modification 0x80683C38–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetDiskDeviceObject, Type: EAT modification 0x80683C3C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetDmaAdapter, Type: EAT modification 0x80683C40–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetDriverObjectExtension, Type: EAT modification 0x80683C44–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetFileObjectGenericMapping, Type: EAT modification 0x80683C48–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetInitialStack, Type: EAT modification 0x80683C4C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetLowerDeviceObject, Type: EAT modification 0x80683C50–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetRelatedDeviceObject, Type: EAT modification 0x80683C54–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetRequestorProcess, Type: EAT modification 0x80683C58–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetRequestorProcessId, Type: EAT modification 0x80683C5C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetRequestorSessionId, Type: EAT modification 0x80683C60–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetStackLimits, Type: EAT modification 0x80683C64–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoGetTopLevelIrp, Type: EAT modification 0x80683C68–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoInitializeCrashDump, Type: EAT modification 0x80683C6C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoInitializeIrp, Type: EAT modification 0x80683C70–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoInitializeRemoveLockEx, Type: EAT modification 0x80683C74–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoInitializeTimer, Type: EAT modification 0x80683C78–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoInvalidateDeviceRelations, Type: EAT modification 0x80683C7C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoInvalidateDeviceState, Type: EAT modification 0x80683C80–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoIsFileOriginRemote, Type: EAT modification 0x80683C84–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoIsOperationSynchronous, Type: EAT modification 0x80683C88–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoIsSystemThread, Type: EAT modification 0x80683C8C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoIsValidNameGraftingBuffer, Type: EAT modification 0x80683C90–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoIsWdmVersionAvailable, Type: EAT modification 0x80683C94–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoMakeAssociatedIrp, Type: EAT modification 0x80683C98–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoOpenDeviceInterfaceRegistryKey, Type: EAT modification 0x80683C9C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoOpenDeviceRegistryKey, Type: EAT modification 0x80683CA0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoPageRead, Type: EAT modification 0x80683CA4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoPnPDeliverServicePowerNotification, Type: EAT modification 0x80683CA8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoQueryDeviceDescription, Type: EAT modification 0x80683CAC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoQueryFileDosDeviceName, Type: EAT modification 0x80683CB0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoQueryFileInformation, Type: EAT modification 0x80683CB4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoQueryVolumeInformation, Type: EAT modification 0x80683CB8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoQueueThreadIrp, Type: EAT modification 0x80683CBC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoQueueWorkItem, Type: EAT modification 0x80683CC0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoRaiseHardError, Type: EAT modification 0x80683CC4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoRaiseInformationalHardError, Type: EAT modification 0x80683CC8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReadDiskSignature, Type: EAT modification 0x80683CCC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReadOperationCount, Type: EAT modification 0x80683CD0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReadPartitionTable, Type: EAT modification 0x806836C0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReadPartitionTableEx, Type: EAT modification 0x80683CD4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReadTransferCount, Type: EAT modification 0x80683CD8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoRegisterBootDriverReinitialization, Type: EAT modification 0x80683CDC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoRegisterDeviceInterface, Type: EAT modification 0x80683CE0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoRegisterDriverReinitialization, Type: EAT modification 0x80683CE4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoRegisterFileSystem, Type: EAT modification 0x80683CE8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoRegisterFsRegistrationChange, Type: EAT modification 0x80683CEC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoRegisterLastChanceShutdownNotification, Type: EAT modification 0x80683CF0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoRegisterPlugPlayNotification, Type: EAT modification 0x80683CF4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoRegisterShutdownNotification, Type: EAT modification 0x80683CF8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReleaseCancelSpinLock, Type: EAT modification 0x80683CFC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReleaseRemoveLockAndWaitEx, Type: EAT modification 0x80683D00–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReleaseRemoveLockEx, Type: EAT modification 0x80683D04–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReleaseVpbSpinLock, Type: EAT modification 0x80683D08–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoRemoveShareAccess, Type: EAT modification 0x80683D0C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReportDetectedDevice, Type: EAT modification 0x80683D10–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReportHalResourceUsage, Type: EAT modification 0x80683D14–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReportResourceForDetection, Type: EAT modification 0x80683D18–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReportResourceUsage, Type: EAT modification 0x80683D1C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReportTargetDeviceChange, Type: EAT modification 0x80683D20–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReportTargetDeviceChangeAsynchronous, Type: EAT modification 0x80683D24–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoRequestDeviceEject, Type: EAT modification 0x80683D28–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoReuseIrp, Type: EAT modification 0x80683D2C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSetCompletionRoutineEx, Type: EAT modification 0x80683D30–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSetDeviceInterfaceState, Type: EAT modification 0x80683D34–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSetDeviceToVerify, Type: EAT modification 0x80683D38–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSetFileOrigin, Type: EAT modification 0x80683D3C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSetHardErrorOrVerifyDevice, Type: EAT modification 0x80683D40–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSetInformation, Type: EAT modification 0x80683D44–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSetIoCompletion, Type: EAT modification 0x80683D48–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSetPartitionInformation, Type: EAT modification 0x806836C4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSetPartitionInformationEx, Type: EAT modification 0x80683D4C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSetShareAccess, Type: EAT modification 0x80683D50–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSetStartIoAttributes, Type: EAT modification 0x80683D54–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSetSystemPartition, Type: EAT modification 0x80683D58–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSetThreadHardErrorMode, Type: EAT modification 0x80683D5C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSetTopLevelIrp, Type: EAT modification 0x80683D60–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoStartNextPacket, Type: EAT modification 0x80683D64–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoStartNextPacketByKey, Type: EAT modification 0x80683D68–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoStartPacket, Type: EAT modification 0x80683D6C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoStartTimer, Type: EAT modification 0x80683D70–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoStatisticsLock, Type: EAT modification 0x80683D74–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoStopTimer, Type: EAT modification 0x80683D78–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSynchronousInvalidateDeviceRelations, Type: EAT modification 0x80683D7C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoSynchronousPageWrite, Type: EAT modification 0x80683D80–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoThreadToProcess, Type: EAT modification 0x80683D84–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoUnregisterFileSystem, Type: EAT modification 0x80683D88–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoUnregisterFsRegistrationChange, Type: EAT modification 0x80683D8C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoUnregisterPlugPlayNotification, Type: EAT modification 0x80683D90–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoUnregisterShutdownNotification, Type: EAT modification 0x80683D94–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoUpdateShareAccess, Type: EAT modification 0x80683D98–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoValidateDeviceIoControlAccess, Type: EAT modification 0x80683D9C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoVerifyPartitionTable, Type: EAT modification 0x80683DA0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoVerifyVolume, Type: EAT modification 0x80683DA4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoVolumeDeviceToDosName, Type: EAT modification 0x80683DA8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWMIAllocateInstanceIds, Type: EAT modification 0x80683DAC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWMIDeviceObjectToInstanceName, Type: EAT modification 0x80683DB0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWMIExecuteMethod, Type: EAT modification 0x80683DB4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWMIHandleToInstanceName, Type: EAT modification 0x80683DB8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWMIOpenBlock, Type: EAT modification 0x80683DBC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWMIQueryAllData, Type: EAT modification 0x80683DC0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWMIQueryAllDataMultiple, Type: EAT modification 0x80683DC4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWMIQuerySingleInstance, Type: EAT modification 0x80683DC8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWMIQuerySingleInstanceMultiple, Type: EAT modification 0x80683DCC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWMIRegistrationControl, Type: EAT modification 0x80683DD0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWMISetNotificationCallback, Type: EAT modification 0x80683DD4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWMISetSingleInstance, Type: EAT modification 0x80683DD8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWMISetSingleItem, Type: EAT modification 0x80683DDC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWMISuggestInstanceName, Type: EAT modification 0x80683DE0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWMIWriteEvent, Type: EAT modification 0x80683DE4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWriteErrorLogEntry, Type: EAT modification 0x80683DE8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWriteOperationCount, Type: EAT modification 0x80683DEC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWritePartitionTable, Type: EAT modification 0x806836C8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWritePartitionTableEx, Type: EAT modification 0x80683DF0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>IoWriteTransferCount, Type: EAT modification 0x80683DF4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>isdigit, Type: EAT modification 0x80684CA0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>islower, Type: EAT modification 0x80684CA4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>isprint, Type: EAT modification 0x80684CA8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>isspace, Type: EAT modification 0x80684CAC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>isupper, Type: EAT modification 0x80684CB0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>isxdigit, Type: EAT modification 0x80684CB4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KdDebuggerEnabled, Type: EAT modification 0x80683DF8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KdDebuggerNotPresent, Type: EAT modification 0x80683DFC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KdDisableDebugger, Type: EAT modification 0x80683E00–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KdEnableDebugger, Type: EAT modification 0x80683E04–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KdEnteredDebugger, Type: EAT modification 0x80683E08–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KdPollBreakIn, Type: EAT modification 0x80683E0C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KdPowerTransition, Type: EAT modification 0x80683E10–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>Ke386CallBios, Type: EAT modification 0x80683E14–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>Ke386IoSetAccessProcess, Type: EAT modification 0x80683E18–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>Ke386QueryIoAccessMap, Type: EAT modification 0x80683E1C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>Ke386SetIoAccessMap, Type: EAT modification 0x80683E20–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeAcquireInStackQueuedSpinLockAtDpcLevel, Type: EAT modification 0x806836D4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeAcquireInterruptSpinLock, Type: EAT modification 0x80683E24–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeAcquireSpinLockAtDpcLevel, Type: EAT modification 0x80683E28–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeAddSystemServiceTable, Type: EAT modification 0x80683E2C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeAreApcsDisabled, Type: EAT modification 0x80683E30–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeAttachProcess, Type: EAT modification 0x80683E34–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeBugCheck, Type: EAT modification 0x80683E38–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeBugCheckEx, Type: EAT modification 0x80683E3C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeCancelTimer, Type: EAT modification 0x80683E40–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeCapturePersistentThreadState, Type: EAT modification 0x80683E44–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeClearEvent, Type: EAT modification 0x80683E48–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeConnectInterrupt, Type: EAT modification 0x80683E4C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeDcacheFlushCount, Type: EAT modification 0x80683E50–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeDelayExecutionThread, Type: EAT modification 0x80683E54–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeDeregisterBugCheckCallback, Type: EAT modification 0x80683E58–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeDeregisterBugCheckReasonCallback, Type: EAT modification 0x80683E5C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeDetachProcess, Type: EAT modification 0x80683E60–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeDisconnectInterrupt, Type: EAT modification 0x80683E64–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeEnterCriticalRegion, Type: EAT modification 0x80683E68–>81727CDC [unknown_code_page] ntoskrnl.exe–>KeEnterKernelDebugger, Type: EAT modification 0x80683E6C–>814F7045 [unknown_code_page] ntoskrnl.exe–>KefAcquireSpinLockAtDpcLevel, Type: EAT modification 0x806836E0–>804E0D80 [ntoskrnl.exe] ntoskrnl.exe–>KeFindConfigurationEntry, Type: EAT modification 0x80683E70–>805B719F [ntoskrnl.exe] ntoskrnl.exe–>KeFindConfigurationNextEntry, Type: EAT modification 0x80683E74–>808C705C [unknown_code_page] ntoskrnl.exe–>KeFlushEntireTb, Type: EAT modification 0x80683E78–>80A9703F [unknown_code_page] ntoskrnl.exe–>KeFlushQueuedDpcs, Type: EAT modification 0x80683E7C–>80877043 [unknown_code_page] ntoskrnl.exe–>KefReleaseSpinLockFromDpcLevel, Type: EAT modification 0x806836E4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeGetCurrentThread, Type: EAT modification 0x80683E80–>80A4705C [unknown_code_page] ntoskrnl.exe–>KeGetPreviousMode, Type: EAT modification 0x80683E84–>809B7049 [unknown_code_page] ntoskrnl.exe–>KeGetRecommendedSharedDataAlignment, Type: EAT modification 0x80683E88–>809C7044 [unknown_code_page] ntoskrnl.exe–>KeI386AbiosCall, Type: EAT modification 0x80683E8C–>80A07057 [unknown_code_page] ntoskrnl.exe–>KeI386AllocateGdtSelectors, Type: EAT modification 0x80683E90–>80C0705C [unknown_code_page] ntoskrnl.exe–>KeI386Call16BitCStyleFunction, Type: EAT modification 0x80683E94–>80C07079 [unknown_code_page] ntoskrnl.exe–>KeI386Call16BitFunction, Type: EAT modification 0x80683E98–>80B27074 [unknown_code_page] ntoskrnl.exe–>KeI386FlatToGdtSelector, Type: EAT modification 0x80683E9C–>8080706D [unknown_code_page] ntoskrnl.exe–>KeI386GetLid, Type: EAT modification 0x80683EA0–>80A97032 [unknown_code_page] ntoskrnl.exe–>KeI386MachineType, Type: EAT modification 0x80683EA4–>80BF7064 [unknown_code_page] ntoskrnl.exe–>KeI386ReleaseGdtSelectors, Type: EAT modification 0x80683EA8–>80C37069 [unknown_code_page] ntoskrnl.exe–>KeI386ReleaseLid, Type: EAT modification 0x80683EAC–>80BF7065 [unknown_code_page] ntoskrnl.exe–>KeI386SetGdtSelector, Type: EAT modification 0x80683EB0–>80A97073 [unknown_code_page] ntoskrnl.exe–>KeIcacheFlushCount, Type: EAT modification 0x80683EB4–>80997051 [unknown_code_page] ntoskrnl.exe–>KeInitializeApc, Type: EAT modification 0x80683EB8–>807D7031 [unknown_code_page] ntoskrnl.exe–>KeInitializeDeviceQueue, Type: EAT modification 0x80683EBC–>809B7057 [unknown_code_page] ntoskrnl.exe–>KeInitializeDpc, Type: EAT modification 0x80683EC0–>807B7054 [unknown_code_page] ntoskrnl.exe–>KeInitializeEvent, Type: EAT modification 0x80683EC4–>80A67053 [unknown_code_page] ntoskrnl.exe–>KeInitializeInterrupt, Type: EAT modification 0x80683EC8–>804D7053 [ntoskrnl.exe] ntoskrnl.exe–>KeInitializeMutant, Type: EAT modification 0x80683ECC–>A043E200 [unknown_code_page] ntoskrnl.exe–>KeInitializeMutex, Type: EAT modification 0x80683ED0–>820E9756 [unknown_code_page] ntoskrnl.exe–>KeInitializeQueue, Type: EAT modification 0x80683ED4–>A943C30E [unknown_code_page] ntoskrnl.exe–>KeInitializeSemaphore, Type: EAT modification 0x80683ED8–>8210116F [unknown_code_page] ntoskrnl.exe–>KeInitializeTimer, Type: EAT modification 0x80683EE0–>8218E866 [unknown_code_page] ntoskrnl.exe–>KeInitializeTimerEx, Type: EAT modification 0x80683EE4–>804D7020 [ntoskrnl.exe] ntoskrnl.exe–>KeInsertByKeyDeviceQueue, Type: EAT modification 0x80683EE8–>814FF920 [unknown_code_page] ntoskrnl.exe–>KeInsertDeviceQueue, Type: EAT modification 0x80683EEC–>804D7010 [ntoskrnl.exe] ntoskrnl.exe–>KeInsertHeadQueue, Type: EAT modification 0x80683EF0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeInsertQueue, Type: EAT modification 0x80683EF4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeInsertQueueApc, Type: EAT modification 0x80683EF8–>804D711F [ntoskrnl.exe] ntoskrnl.exe–>KeInsertQueueDpc, Type: EAT modification 0x80683EFC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeIsAttachedProcess, Type: EAT modification 0x80683F00–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeIsExecutingDpc, Type: EAT modification 0x80683F04–>EEFC0CC0 [unknown_code_page] ntoskrnl.exe–>KeLeaveCriticalRegion, Type: EAT modification 0x80683F08–>804D7011 [ntoskrnl.exe] ntoskrnl.exe–>KeLoaderBlock, Type: EAT modification 0x80683F0C–>804D7030 [ntoskrnl.exe] ntoskrnl.exe–>KeNumberProcessors, Type: EAT modification 0x80683F10–>804D7070 [ntoskrnl.exe] ntoskrnl.exe–>KeProfileInterrupt, Type: EAT modification 0x80683F14–>80657000 [ntoskrnl.exe] ntoskrnl.exe–>KeProfileInterruptWithSource, Type: EAT modification 0x80683F18–>804E7000 [ntoskrnl.exe] ntoskrnl.exe–>KePulseEvent, Type: EAT modification 0x80683F1C–>804D7056 [ntoskrnl.exe] ntoskrnl.exe–>KeQueryActiveProcessors, Type: EAT modification 0x80683F20–>804E7018 [ntoskrnl.exe] ntoskrnl.exe–>KeQueryInterruptTime, Type: EAT modification 0x80683F24–>804D7AEB [ntoskrnl.exe] ntoskrnl.exe–>KeQueryPriorityThread, Type: EAT modification 0x80683F28–>8B387000 [unknown_code_page] ntoskrnl.exe–>KeQueryRuntimeThread, Type: EAT modification 0x80683F2C–>A043E200 [unknown_code_page] ntoskrnl.exe–>KeQuerySystemTime, Type: EAT modification 0x80683F30–>820E9756 [unknown_code_page] ntoskrnl.exe–>KeQueryTickCount, Type: EAT modification 0x80683F34–>A043E200 [unknown_code_page] ntoskrnl.exe–>KeQueryTimeIncrement, Type: EAT modification 0x80683F38–>820E9756 [unknown_code_page] ntoskrnl.exe–>KeRaiseUserException, Type: EAT modification 0x80683F3C–>A043E200 [unknown_code_page] ntoskrnl.exe–>KeReadStateEvent, Type: EAT modification 0x80683F40–>820E9756 [unknown_code_page] ntoskrnl.exe–>KeReadStateMutex, Type: EAT modification 0x80683F48–>821010DA [unknown_code_page] ntoskrnl.exe–>KeReadStateQueue, Type: EAT modification 0x80683F4C–>804E1000 [ntoskrnl.exe] ntoskrnl.exe–>KeReadStateSemaphore, Type: EAT modification 0x80683F50–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeReadStateTimer, Type: EAT modification 0x80683F54–>804E0D80 [ntoskrnl.exe] ntoskrnl.exe–>KeRegisterBugCheckCallback, Type: EAT modification 0x80683F58–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeRegisterBugCheckReasonCallback, Type: EAT modification 0x80683F5C–>804D7020 [ntoskrnl.exe] ntoskrnl.exe–>KeReleaseInStackQueuedSpinLockFromDpcLevel, Type: EAT modification 0x806836D8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeReleaseInterruptSpinLock, Type: EAT modification 0x80683F60–>809E730A [unknown_code_page] ntoskrnl.exe–>KeReleaseMutant, Type: EAT modification 0x80683F64–>807E704C [unknown_code_page] ntoskrnl.exe–>KeReleaseMutex, Type: EAT modification 0x80683F68–>80857030 [unknown_code_page] ntoskrnl.exe–>KeReleaseSemaphore, Type: EAT modification 0x80683F6C–>807B7030 [unknown_code_page] ntoskrnl.exe–>KeReleaseSpinLockFromDpcLevel, Type: EAT modification 0x80683F70–>80A67053 [unknown_code_page] ntoskrnl.exe–>KeRemoveByKeyDeviceQueue, Type: EAT modification 0x80683F74–>804D7053 [ntoskrnl.exe] ntoskrnl.exe–>KeRemoveByKeyDeviceQueueIfBusy, Type: EAT modification 0x80683F78–>804D7080 [ntoskrnl.exe] ntoskrnl.exe–>KeRemoveDeviceQueue, Type: EAT modification 0x80683F7C–>804D7048 [ntoskrnl.exe] ntoskrnl.exe–>KeRemoveEntryDeviceQueue, Type: EAT modification 0x80683F80–>808D7001 [unknown_code_page] ntoskrnl.exe–>KeRemoveQueue, Type: EAT modification 0x80683F84–>80507000 [ntoskrnl.exe] ntoskrnl.exe–>KeRemoveQueueDpc, Type: EAT modification 0x80683F88–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeRemoveSystemServiceTable, Type: EAT modification 0x80683F8C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeResetEvent, Type: EAT modification 0x80683F90–>804D7009 [ntoskrnl.exe] ntoskrnl.exe–>KeRestoreFloatingPointState, Type: EAT modification 0x80683F94–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeRevertToUserAffinityThread, Type: EAT modification 0x80683F98–>804D7040 [ntoskrnl.exe] ntoskrnl.exe–>KeRundownQueue, Type: EAT modification 0x80683F9C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeSaveFloatingPointState, Type: EAT modification 0x80683FA0–>804E1000 [ntoskrnl.exe] ntoskrnl.exe–>KeSaveStateForHibernate, Type: EAT modification 0x80683FA4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeServiceDescriptorTable, Type: EAT modification 0x80683FA8–>804E0D80 [ntoskrnl.exe] ntoskrnl.exe–>KeSetAffinityThread, Type: EAT modification 0x80683FAC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeSetBasePriorityThread, Type: EAT modification 0x80683FB0–>804E0D80 [ntoskrnl.exe] ntoskrnl.exe–>KeSetDmaIoCoherency, Type: EAT modification 0x80683FB4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeSetEvent, Type: EAT modification 0x80683FB8–>D5867A31 [unknown_code_page] ntoskrnl.exe–>KeSetIdealProcessorThread, Type: EAT modification 0x80683FC0–>804D6FFF [unknown_code_page] ntoskrnl.exe–>KeSetImportanceDpc, Type: EAT modification 0x80683FC4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeSetKernelStackSwapEnable, Type: EAT modification 0x80683FC8–>804D7020 [ntoskrnl.exe] ntoskrnl.exe–>KeSetPriorityThread, Type: EAT modification 0x80683FCC–>804D7220 [ntoskrnl.exe] ntoskrnl.exe–>KeSetProfileIrql, Type: EAT modification 0x80683FD0–>804D7201 [ntoskrnl.exe] ntoskrnl.exe–>KeSetSystemAffinityThread, Type: EAT modification 0x80683FD4–>854D7000 [unknown_code_page] ntoskrnl.exe–>KeSetTargetProcessorDpc, Type: EAT modification 0x80683FD8–>804D7020 [ntoskrnl.exe] ntoskrnl.exe–>KeSetTimeIncrement, Type: EAT modification 0x80683FDC–>804D7220 [ntoskrnl.exe] ntoskrnl.exe–>KeSetTimer, Type: EAT modification 0x80683FE0–>804D7048 [ntoskrnl.exe] ntoskrnl.exe–>KeSetTimerEx, Type: EAT modification 0x80683FE4–>808D7001 [unknown_code_page] ntoskrnl.exe–>KeSetTimeUpdateNotifyRoutine, Type: EAT modification 0x806836DC–>804D7080 [ntoskrnl.exe] ntoskrnl.exe–>KeStackAttachProcess, Type: EAT modification 0x80683FE8–>80507000 [ntoskrnl.exe] ntoskrnl.exe–>KeSynchronizeExecution, Type: EAT modification 0x80683FEC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeTerminateThread, Type: EAT modification 0x80683FF0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeTickCount, Type: EAT modification 0x80683FF4–>804D7009 [ntoskrnl.exe] ntoskrnl.exe–>KeUnstackDetachProcess, Type: EAT modification 0x80683FF8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeUpdateRunTime, Type: EAT modification 0x80683FFC–>804D7040 [ntoskrnl.exe] ntoskrnl.exe–>KeUpdateSystemTime, Type: EAT modification 0x80684000–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeUserModeCallback, Type: EAT modification 0x80684004–>804E1000 [ntoskrnl.exe] ntoskrnl.exe–>KeWaitForMultipleObjects, Type: EAT modification 0x80684008–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KeWaitForMutexObject, Type: EAT modification 0x8068400C–>804E0D80 [ntoskrnl.exe] ntoskrnl.exe–>KeWaitForSingleObject, Type: EAT modification 0x80684010–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KiAcquireSpinLock, Type: EAT modification 0x806836E8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KiBugCheckData, Type: EAT modification 0x80684014–>804D6FFF [unknown_code_page] ntoskrnl.exe–>KiCoprocessorError, Type: EAT modification 0x80684018–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KiDeliverApc, Type: EAT modification 0x8068401C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KiDispatchInterrupt, Type: EAT modification 0x80684020–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KiEnableTimerWatchdog, Type: EAT modification 0x80684024–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>Kii386SpinOnSpinLock, Type: EAT modification 0x80683710–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KiIpiServiceRoutine, Type: EAT modification 0x80684028–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KiReleaseSpinLock, Type: EAT modification 0x806836EC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>KiUnexpectedInterrupt, Type: EAT modification 0x8068402C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>LdrAccessResource, Type: EAT modification 0x80684030–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>LdrEnumResources, Type: EAT modification 0x80684034–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>LdrFindResourceDirectory_U, Type: EAT modification 0x80684038–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>LdrFindResource_U, Type: EAT modification 0x8068403C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>LpcPortObjectType, Type: EAT modification 0x80684040–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>LpcRequestPort, Type: EAT modification 0x80684044–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>LpcRequestWaitReplyPort, Type: EAT modification 0x80684048–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>LsaCallAuthenticationPackage, Type: EAT modification 0x8068404C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>LsaDeregisterLogonProcess, Type: EAT modification 0x80684050–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>LsaFreeReturnBuffer, Type: EAT modification 0x80684054–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>LsaLogonUser, Type: EAT modification 0x80684058–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>LsaLookupAuthenticationPackage, Type: EAT modification 0x8068405C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>LsaRegisterLogonProcess, Type: EAT modification 0x80684060–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>mbstowcs, Type: EAT modification 0x80684CB8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>mbtowc, Type: EAT modification 0x80684CBC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>memchr, Type: EAT modification 0x80684CC0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>memcpy, Type: EAT modification 0x80684CC4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>memmove, Type: EAT modification 0x80684CC8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>memset, Type: EAT modification 0x80684CCC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>Mm64BitPhysicalAddress, Type: EAT modification 0x80684064–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>MmAddPhysicalMemory, Type: EAT modification 0x80684068–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>MmAddVerifierThunks, Type: EAT modification 0x8068406C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>MmAdjustWorkingSetSize, Type: EAT modification 0x80684070–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>MmAdvanceMdl, Type: EAT modification 0x80684074–>80927045 [unknown_code_page] ntoskrnl.exe–>MmAllocateContiguousMemory, Type: EAT modification 0x80684078–>805B71DA [ntoskrnl.exe] ntoskrnl.exe–>MmAllocateContiguousMemorySpecifyCache, Type: EAT modification 0x8068407C–>808C705C [unknown_code_page] ntoskrnl.exe–>MmAllocateMappingAddress, Type: EAT modification 0x80684080–>80A9703F [unknown_code_page] ntoskrnl.exe–>MmAllocateNonCachedMemory, Type: EAT modification 0x80684084–>80877043 [unknown_code_page] ntoskrnl.exe–>MmAllocatePagesForMdl, Type: EAT modification 0x80684088–>80A4705C [unknown_code_page] ntoskrnl.exe–>MmBuildMdlForNonPagedPool, Type: EAT modification 0x8068408C–>809B7049 [unknown_code_page] ntoskrnl.exe–>MmCanFileBeTruncated, Type: EAT modification 0x80684090–>809C7044 [unknown_code_page] ntoskrnl.exe–>MmCommitSessionMappedView, Type: EAT modification 0x80684094–>80A07057 [unknown_code_page] ntoskrnl.exe–>MmCreateMdl, Type: EAT modification 0x80684098–>80C0705C [unknown_code_page] ntoskrnl.exe–>MmCreateSection, Type: EAT modification 0x8068409C–>80C07079 [unknown_code_page] ntoskrnl.exe–>MmDisableModifiedWriteOfSection, Type: EAT modification 0x806840A0–>80B27074 [unknown_code_page] ntoskrnl.exe–>MmFlushImageSection, Type: EAT modification 0x806840A4–>8080706D [unknown_code_page] ntoskrnl.exe–>MmForceSectionClosed, Type: EAT modification 0x806840A8–>80A97032 [unknown_code_page] ntoskrnl.exe–>MmFreeContiguousMemory, Type: EAT modification 0x806840AC–>80BF7064 [unknown_code_page] ntoskrnl.exe–>MmFreeContiguousMemorySpecifyCache, Type: EAT modification 0x806840B0–>80C37069 [unknown_code_page] ntoskrnl.exe–>MmFreeMappingAddress, Type: EAT modification 0x806840B4–>80BF7065 [unknown_code_page] ntoskrnl.exe–>MmFreeNonCachedMemory, Type: EAT modification 0x806840B8–>80A97073 [unknown_code_page] ntoskrnl.exe–>MmFreePagesFromMdl, Type: EAT modification 0x806840BC–>80997051 [unknown_code_page] ntoskrnl.exe–>MmGetPhysicalAddress, Type: EAT modification 0x806840C0–>807F7031 [unknown_code_page] ntoskrnl.exe–>MmGetPhysicalMemoryRanges, Type: EAT modification 0x806840C4–>80837031 [unknown_code_page] ntoskrnl.exe–>MmGetSystemRoutineAddress, Type: EAT modification 0x806840C8–>807B7030 [unknown_code_page] ntoskrnl.exe–>MmGetVirtualForPhysical, Type: EAT modification 0x806840CC–>80A67053 [unknown_code_page] ntoskrnl.exe–>MmGrowKernelStack, Type: EAT modification 0x806840D0–>804D7053 [ntoskrnl.exe] ntoskrnl.exe–>MmHighestUserAddress, Type: EAT modification 0x806840D4–>9DE18800 [unknown_code_page] ntoskrnl.exe–>MmIsAddressValid, Type: EAT modification 0x806840D8–>820E9756 [unknown_code_page] ntoskrnl.exe–>MmIsDriverVerifying, Type: EAT modification 0x806840DC–>A9462568 [unknown_code_page] ntoskrnl.exe–>MmIsNonPagedSystemAddressValid, Type: EAT modification 0x806840E0–>8210116F [unknown_code_page] ntoskrnl.exe–>MmIsThisAnNtAsSystem, Type: EAT modification 0x806840E8–>8218E866 [unknown_code_page] ntoskrnl.exe–>MmIsVerifierEnabled, Type: EAT modification 0x806840EC–>804D7020 [ntoskrnl.exe] ntoskrnl.exe–>MmLockPagableDataSection, Type: EAT modification 0x806840F0–>814FF920 [unknown_code_page] ntoskrnl.exe–>MmLockPagableImageSection, Type: EAT modification 0x806840F4–>804D7010 [ntoskrnl.exe] ntoskrnl.exe–>MmLockPagableSectionByHandle, Type: EAT modification 0x806840F8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>MmMapIoSpace, Type: EAT modification 0x806840FC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>MmMapLockedPages, Type: EAT modification 0x80684100–>804D711F [ntoskrnl.exe] ntoskrnl.exe–>MmMapLockedPagesSpecifyCache, Type: EAT modification 0x80684104–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>MmMapLockedPagesWithReservedMapping, Type: EAT modification 0x80684108–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>MmMapMemoryDumpMdl, Type: EAT modification 0x8068410C–>EEFC13D8 [unknown_code_page] ntoskrnl.exe–>MmMapUserAddressesToPage, Type: EAT modification 0x80684110–>804D7011 [ntoskrnl.exe] ntoskrnl.exe–>MmMapVideoDisplay, Type: EAT modification 0x80684114–>804D7030 [ntoskrnl.exe] ntoskrnl.exe–>MmMapViewInSessionSpace, Type: EAT modification 0x80684118–>804D7070 [ntoskrnl.exe] ntoskrnl.exe–>MmMapViewInSystemSpace, Type: EAT modification 0x8068411C–>80657000 [ntoskrnl.exe] ntoskrnl.exe–>MmMapViewOfSection, Type: EAT modification 0x80684120–>804E7000 [ntoskrnl.exe] ntoskrnl.exe–>MmMarkPhysicalMemoryAsBad, Type: EAT modification 0x80684124–>804D7058 [ntoskrnl.exe] ntoskrnl.exe–>MmMarkPhysicalMemoryAsGood, Type: EAT modification 0x80684128–>804E7018 [ntoskrnl.exe] ntoskrnl.exe–>MmPageEntireDriver, Type: EAT modification 0x8068412C–>804D7AEB [ntoskrnl.exe] ntoskrnl.exe–>MmPrefetchPages, Type: EAT modification 0x80684130–>8B387000 [unknown_code_page] ntoskrnl.exe–>MmProbeAndLockPages, Type: EAT modification 0x80684134–>9DE18800 [unknown_code_page] ntoskrnl.exe–>MmProbeAndLockProcessPages, Type: EAT modification 0x80684138–>820E9756 [unknown_code_page] ntoskrnl.exe–>MmProbeAndLockSelectedPages, Type: EAT modification 0x8068413C–>9DE18800 [unknown_code_page] ntoskrnl.exe–>MmProtectMdlSystemAddress, Type: EAT modification 0x80684140–>820E9756 [unknown_code_page] ntoskrnl.exe–>MmQuerySystemSize, Type: EAT modification 0x80684144–>9DE18800 [unknown_code_page] ntoskrnl.exe–>MmRemovePhysicalMemory, Type: EAT modification 0x80684148–>820E9756 [unknown_code_page] ntoskrnl.exe–>MmSectionObjectType, Type: EAT modification 0x80684150–>821010DA [unknown_code_page] ntoskrnl.exe–>MmSecureVirtualMemory, Type: EAT modification 0x80684154–>804E0000 [ntoskrnl.exe] ntoskrnl.exe–>MmSetAddressRangeModified, Type: EAT modification 0x80684158–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>MmSetBankedSection, Type: EAT modification 0x8068415C–>804DF180 [ntoskrnl.exe] ntoskrnl.exe–>MmSizeOfMdl, Type: EAT modification 0x80684160–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>MmSystemRangeStart, Type: EAT modification 0x80684164–>804D7020 [ntoskrnl.exe] ntoskrnl.exe–>MmTrimAllSystemPagableMemory, Type: EAT modification 0x80684168–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>MmUnlockPagableImageSection, Type: EAT modification 0x8068416C–>809E730B [unknown_code_page] ntoskrnl.exe–>MmUnlockPages, Type: EAT modification 0x80684170–>807E704C [unknown_code_page] ntoskrnl.exe–>MmUnmapIoSpace, Type: EAT modification 0x80684174–>80A47030 [unknown_code_page] ntoskrnl.exe–>MmUnmapLockedPages, Type: EAT modification 0x80684178–>80A1704E [unknown_code_page] ntoskrnl.exe–>MmUnmapReservedMapping, Type: EAT modification 0x8068417C–>80A0702E [unknown_code_page] ntoskrnl.exe–>MmUnmapVideoDisplay, Type: EAT modification 0x80684180–>80A07059 [unknown_code_page] ntoskrnl.exe–>MmUnmapViewInSessionSpace, Type: EAT modification 0x80684184–>804D7080 [ntoskrnl.exe] ntoskrnl.exe–>MmUnmapViewInSystemSpace, Type: EAT modification 0x80684188–>804D7048 [ntoskrnl.exe] ntoskrnl.exe–>MmUnmapViewOfSection, Type: EAT modification 0x8068418C–>808D7001 [unknown_code_page] ntoskrnl.exe–>MmUnsecureVirtualMemory, Type: EAT modification 0x80684190–>80507000 [ntoskrnl.exe] ntoskrnl.exe–>MmUserProbeAddress, Type: EAT modification 0x80684194–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NlsAnsiCodePage, Type: EAT modification 0x80684198–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NlsLeadByteInfo, Type: EAT modification 0x8068419C–>804D7008 [ntoskrnl.exe] ntoskrnl.exe–>NlsMbCodePageTag, Type: EAT modification 0x806841A0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NlsMbOemCodePageTag, Type: EAT modification 0x806841A4–>804D7040 [ntoskrnl.exe] ntoskrnl.exe–>NlsOemCodePage, Type: EAT modification 0x806841A8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NlsOemLeadByteInfo, Type: EAT modification 0x806841AC–>804E0000 [ntoskrnl.exe] ntoskrnl.exe–>NtAddAtom, Type: EAT modification 0x806841B0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtAdjustPrivilegesToken, Type: EAT modification 0x806841B4–>804DF180 [ntoskrnl.exe] ntoskrnl.exe–>NtAllocateLocallyUniqueId, Type: EAT modification 0x806841B8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtAllocateUuids, Type: EAT modification 0x806841BC–>804DF180 [ntoskrnl.exe] ntoskrnl.exe–>NtAllocateVirtualMemory, Type: EAT modification 0x806841C0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtBuildNumber, Type: EAT modification 0x806841C4–>9EF07931 [unknown_code_page] ntoskrnl.exe–>NtConnectPort, Type: EAT modification 0x806841CC–>804D6FFF [unknown_code_page] ntoskrnl.exe–>NtCreateEvent, Type: EAT modification 0x806841D0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtCreateFile, Type: EAT modification 0x806841D4–>804D7020 [ntoskrnl.exe] ntoskrnl.exe–>NtCreateSection, Type: EAT modification 0x806841D8–>804D7220 [ntoskrnl.exe] ntoskrnl.exe–>NtDeleteAtom, Type: EAT modification 0x806841DC–>804D7201 [ntoskrnl.exe] ntoskrnl.exe–>NtDeleteFile, Type: EAT modification 0x806841E0–>854D7000 [unknown_code_page] ntoskrnl.exe–>NtDeviceIoControlFile, Type: EAT modification 0x806841E4–>804D7020 [ntoskrnl.exe] ntoskrnl.exe–>NtDuplicateObject, Type: EAT modification 0x806841E8–>804D7220 [ntoskrnl.exe] ntoskrnl.exe–>NtDuplicateToken, Type: EAT modification 0x806841EC–>804D7080 [ntoskrnl.exe] ntoskrnl.exe–>NtFindAtom, Type: EAT modification 0x806841F0–>804D7048 [ntoskrnl.exe] ntoskrnl.exe–>NtFreeVirtualMemory, Type: EAT modification 0x806841F4–>808D7001 [unknown_code_page] ntoskrnl.exe–>NtFsControlFile, Type: EAT modification 0x806841F8–>80507000 [ntoskrnl.exe] ntoskrnl.exe–>NtGlobalFlag, Type: EAT modification 0x806841FC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtLockFile, Type: EAT modification 0x80684200–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtMakePermanentObject, Type: EAT modification 0x80684204–>804D7008 [ntoskrnl.exe] ntoskrnl.exe–>NtMapViewOfSection, Type: EAT modification 0x80684208–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtNotifyChangeDirectoryFile, Type: EAT modification 0x8068420C–>804D7040 [ntoskrnl.exe] ntoskrnl.exe–>NtOpenFile, Type: EAT modification 0x80684210–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtOpenProcess, Type: EAT modification 0x80684214–>804E0000 [ntoskrnl.exe] ntoskrnl.exe–>NtOpenProcessToken, Type: EAT modification 0x80684218–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtOpenProcessTokenEx, Type: EAT modification 0x8068421C–>804DF180 [ntoskrnl.exe] ntoskrnl.exe–>NtOpenThread, Type: EAT modification 0x80684220–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtOpenThreadToken, Type: EAT modification 0x80684224–>804DF180 [ntoskrnl.exe] ntoskrnl.exe–>NtOpenThreadTokenEx, Type: EAT modification 0x80684228–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtQueryEaFile, Type: EAT modification 0x80684230–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtQueryInformationAtom, Type: EAT modification 0x80684234–>804D6FFF [unknown_code_page] ntoskrnl.exe–>NtQueryInformationFile, Type: EAT modification 0x80684238–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtQueryInformationProcess, Type: EAT modification 0x8068423C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtQueryInformationThread, Type: EAT modification 0x80684240–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtQueryInformationToken, Type: EAT modification 0x80684244–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtQueryQuotaInformationFile, Type: EAT modification 0x80684248–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtQuerySecurityObject, Type: EAT modification 0x8068424C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtQuerySystemInformation, Type: EAT modification 0x80684250–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtQueryVolumeInformationFile, Type: EAT modification 0x80684254–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtReadFile, Type: EAT modification 0x80684258–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtRequestPort, Type: EAT modification 0x8068425C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtRequestWaitReplyPort, Type: EAT modification 0x80684260–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtSetEaFile, Type: EAT modification 0x80684264–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtSetEvent, Type: EAT modification 0x80684268–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtSetInformationFile, Type: EAT modification 0x8068426C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtSetInformationProcess, Type: EAT modification 0x80684270–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtSetInformationThread, Type: EAT modification 0x80684274–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtSetQuotaInformationFile, Type: EAT modification 0x80684278–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtSetSecurityObject, Type: EAT modification 0x8068427C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtSetVolumeInformationFile, Type: EAT modification 0x80684280–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtShutdownSystem, Type: EAT modification 0x80684284–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtTraceEvent, Type: EAT modification 0x80684288–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtUnlockFile, Type: EAT modification 0x8068428C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtVdmControl, Type: EAT modification 0x80684290–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtWaitForSingleObject, Type: EAT modification 0x80684294–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>NtWriteFile, Type: EAT modification 0x80684298–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ObAssignSecurity, Type: EAT modification 0x8068429C–>80927045 [unknown_code_page] ntoskrnl.exe–>ObCheckCreateObjectAccess, Type: EAT modification 0x806842A0–>805B7111 [ntoskrnl.exe] ntoskrnl.exe–>ObCheckObjectAccess, Type: EAT modification 0x806842A4–>808C705C [unknown_code_page] ntoskrnl.exe–>ObCloseHandle, Type: EAT modification 0x806842A8–>80A9703F [unknown_code_page] ntoskrnl.exe–>ObCreateObject, Type: EAT modification 0x806842AC–>80877043 [unknown_code_page] ntoskrnl.exe–>ObCreateObjectType, Type: EAT modification 0x806842B0–>80A4705C [unknown_code_page] ntoskrnl.exe–>ObDereferenceObject, Type: EAT modification 0x806842B4–>809B7049 [unknown_code_page] ntoskrnl.exe–>ObDereferenceSecurityDescriptor, Type: EAT modification 0x806842B8–>809C7044 [unknown_code_page] ntoskrnl.exe–>ObfDereferenceObject, Type: EAT modification 0x806836F0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ObFindHandleForObject, Type: EAT modification 0x806842BC–>80A07057 [unknown_code_page] ntoskrnl.exe–>ObfReferenceObject, Type: EAT modification 0x806836F4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ObGetObjectSecurity, Type: EAT modification 0x806842C0–>80C0705C [unknown_code_page] ntoskrnl.exe–>ObInsertObject, Type: EAT modification 0x806842C4–>80C07079 [unknown_code_page] ntoskrnl.exe–>ObIsDosDeviceLocallyMapped, Type: EAT modification 0x806842C8–>80B27074 [unknown_code_page] ntoskrnl.exe–>ObLogSecurityDescriptor, Type: EAT modification 0x806842CC–>8080706D [unknown_code_page] ntoskrnl.exe–>ObMakeTemporaryObject, Type: EAT modification 0x806842D0–>80A97032 [unknown_code_page] ntoskrnl.exe–>ObOpenObjectByName, Type: EAT modification 0x806842D4–>80BF7064 [unknown_code_page] ntoskrnl.exe–>ObOpenObjectByPointer, Type: EAT modification 0x806842D8–>80C37069 [unknown_code_page] ntoskrnl.exe–>ObQueryNameString, Type: EAT modification 0x806842DC–>80BF7065 [unknown_code_page] ntoskrnl.exe–>ObQueryObjectAuditingByHandle, Type: EAT modification 0x806842E0–>80A97073 [unknown_code_page] ntoskrnl.exe–>ObReferenceObjectByHandle, Type: EAT modification 0x806842E4–>80997051 [unknown_code_page] ntoskrnl.exe–>ObReferenceObjectByName, Type: EAT modification 0x806842E8–>807F7031 [unknown_code_page] ntoskrnl.exe–>ObReferenceObjectByPointer, Type: EAT modification 0x806842EC–>807D7034 [unknown_code_page] ntoskrnl.exe–>ObReferenceSecurityDescriptor, Type: EAT modification 0x806842F0–>80A0702E [unknown_code_page] ntoskrnl.exe–>ObReleaseObjectSecurity, Type: EAT modification 0x806842F4–>80A07059 [unknown_code_page] ntoskrnl.exe–>ObSetHandleAttributes, Type: EAT modification 0x806842F8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ObSetSecurityDescriptorInfo, Type: EAT modification 0x806842FC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ObSetSecurityObjectByPointer, Type: EAT modification 0x80684300–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PfxFindPrefix, Type: EAT modification 0x80684304–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PfxInitialize, Type: EAT modification 0x80684308–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PfxInsertPrefix, Type: EAT modification 0x8068430C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PfxRemovePrefix, Type: EAT modification 0x80684310–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PoCallDriver, Type: EAT modification 0x80684314–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PoCancelDeviceNotify, Type: EAT modification 0x80684318–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PoQueueShutdownWorkItem, Type: EAT modification 0x8068431C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PoRegisterDeviceForIdleDetection, Type: EAT modification 0x80684320–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PoRegisterDeviceNotify, Type: EAT modification 0x80684324–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PoRegisterSystemState, Type: EAT modification 0x80684328–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PoRequestPowerIrp, Type: EAT modification 0x8068432C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PoRequestShutdownEvent, Type: EAT modification 0x80684330–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PoSetHiberRange, Type: EAT modification 0x80684334–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PoSetPowerState, Type: EAT modification 0x80684338–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PoSetSystemState, Type: EAT modification 0x8068433C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PoShutdownBugCheck, Type: EAT modification 0x80684340–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PoStartNextPowerIrp, Type: EAT modification 0x80684344–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PoUnregisterSystemState, Type: EAT modification 0x80684348–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ProbeForRead, Type: EAT modification 0x8068434C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ProbeForWrite, Type: EAT modification 0x80684350–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsAssignImpersonationToken, Type: EAT modification 0x80684354–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsChargePoolQuota, Type: EAT modification 0x80684358–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsChargeProcessNonPagedPoolQuota, Type: EAT modification 0x8068435C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsChargeProcessPagedPoolQuota, Type: EAT modification 0x80684360–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsChargeProcessPoolQuota, Type: EAT modification 0x80684364–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsCreateSystemProcess, Type: EAT modification 0x80684368–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsCreateSystemThread, Type: EAT modification 0x8068436C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsDereferenceImpersonationToken, Type: EAT modification 0x80684370–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsDereferencePrimaryToken, Type: EAT modification 0x80684374–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsDisableImpersonation, Type: EAT modification 0x80684378–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsEstablishWin32Callouts, Type: EAT modification 0x8068437C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetContextThread, Type: EAT modification 0x80684380–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetCurrentProcess, Type: EAT modification 0x80684384–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetCurrentProcessId, Type: EAT modification 0x80684388–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetCurrentProcessSessionId, Type: EAT modification 0x8068438C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetCurrentThread, Type: EAT modification 0x80684390–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetCurrentThreadId, Type: EAT modification 0x80684394–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetCurrentThreadPreviousMode, Type: EAT modification 0x80684398–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetCurrentThreadStackBase, Type: EAT modification 0x8068439C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetCurrentThreadStackLimit, Type: EAT modification 0x806843A0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetJobLock, Type: EAT modification 0x806843A4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetJobSessionId, Type: EAT modification 0x806843A8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetJobUIRestrictionsClass, Type: EAT modification 0x806843AC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessCreateTimeQuadPart, Type: EAT modification 0x806843B0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessDebugPort, Type: EAT modification 0x806843B4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessExitProcessCalled, Type: EAT modification 0x806843B8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessExitStatus, Type: EAT modification 0x806843BC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessExitTime, Type: EAT modification 0x806843C0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessId, Type: EAT modification 0x806843C4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessImageFileName, Type: EAT modification 0x806843C8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessInheritedFromUniqueProcessId, Type: EAT modification 0x806843CC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessJob, Type: EAT modification 0x806843D0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessPeb, Type: EAT modification 0x806843D4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessPriorityClass, Type: EAT modification 0x806843D8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessSectionBaseAddress, Type: EAT modification 0x806843DC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessSecurityPort, Type: EAT modification 0x806843E0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessSessionId, Type: EAT modification 0x806843E4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessWin32Process, Type: EAT modification 0x806843E8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetProcessWin32WindowStation, Type: EAT modification 0x806843EC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetThreadFreezeCount, Type: EAT modification 0x806843F0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetThreadHardErrorsAreDisabled, Type: EAT modification 0x806843F4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetThreadId, Type: EAT modification 0x806843F8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetThreadProcess, Type: EAT modification 0x806843FC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetThreadProcessId, Type: EAT modification 0x80684400–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetThreadSessionId, Type: EAT modification 0x80684404–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetThreadTeb, Type: EAT modification 0x80684408–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetThreadWin32Thread, Type: EAT modification 0x8068440C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsGetVersion, Type: EAT modification 0x80684410–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsImpersonateClient, Type: EAT modification 0x80684414–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsInitialSystemProcess, Type: EAT modification 0x80684418–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsIsProcessBeingDebugged, Type: EAT modification 0x8068441C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsIsSystemThread, Type: EAT modification 0x80684420–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsIsThreadImpersonating, Type: EAT modification 0x80684424–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsIsThreadTerminating, Type: EAT modification 0x80684428–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsJobType, Type: EAT modification 0x8068442C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsLookupProcessByProcessId, Type: EAT modification 0x80684430–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsLookupProcessThreadByCid, Type: EAT modification 0x80684434–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsLookupThreadByThreadId, Type: EAT modification 0x80684438–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsProcessType, Type: EAT modification 0x8068443C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsReferenceImpersonationToken, Type: EAT modification 0x80684440–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsReferencePrimaryToken, Type: EAT modification 0x80684444–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsRemoveCreateThreadNotifyRoutine, Type: EAT modification 0x80684448–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsRemoveLoadImageNotifyRoutine, Type: EAT modification 0x8068444C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsRestoreImpersonation, Type: EAT modification 0x80684450–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsReturnPoolQuota, Type: EAT modification 0x80684454–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsReturnProcessNonPagedPoolQuota, Type: EAT modification 0x80684458–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsReturnProcessPagedPoolQuota, Type: EAT modification 0x8068445C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsRevertThreadToSelf, Type: EAT modification 0x80684460–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsRevertToSelf, Type: EAT modification 0x80684464–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsSetContextThread, Type: EAT modification 0x80684468–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsSetCreateProcessNotifyRoutine, Type: EAT modification 0x8068446C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsSetCreateThreadNotifyRoutine, Type: EAT modification 0x80684470–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsSetJobUIRestrictionsClass, Type: EAT modification 0x80684474–>80CE7009 [unknown_code_page] ntoskrnl.exe–>PsSetLegoNotifyRoutine, Type: EAT modification 0x80684478–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsSetLoadImageNotifyRoutine, Type: EAT modification 0x8068447C–>805271C0 [ntoskrnl.exe] ntoskrnl.exe–>PsSetProcessPriorityByClass, Type: EAT modification 0x80684480–>825E0228 [unknown_code_page] ntoskrnl.exe–>PsSetProcessPriorityClass, Type: EAT modification 0x80684484–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsSetProcessSecurityPort, Type: EAT modification 0x80684488–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsSetProcessWin32Process, Type: EAT modification 0x8068448C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsSetProcessWindowStation, Type: EAT modification 0x80684490–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsSetThreadHardErrorsAreDisabled, Type: EAT modification 0x80684494–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsSetThreadWin32Thread, Type: EAT modification 0x80684498–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsTerminateSystemThread, Type: EAT modification 0x8068449C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>PsThreadType, Type: EAT modification 0x806844A0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>qsort, Type: EAT modification 0x80684CD0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>rand, Type: EAT modification 0x80684CD4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>READ_REGISTER_BUFFER_UCHAR, Type: EAT modification 0x806844A4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>READ_REGISTER_BUFFER_ULONG, Type: EAT modification 0x806844A8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>READ_REGISTER_BUFFER_USHORT, Type: EAT modification 0x806844AC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>READ_REGISTER_UCHAR, Type: EAT modification 0x806844B0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>READ_REGISTER_ULONG, Type: EAT modification 0x806844B4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>READ_REGISTER_USHORT, Type: EAT modification 0x806844B8–>81727C3C [unknown_code_page] ntoskrnl.exe–>RtlAbsoluteToSelfRelativeSD, Type: EAT modification 0x806844BC–>80927004 [unknown_code_page] ntoskrnl.exe–>RtlAddAccessAllowedAce, Type: EAT modification 0x806844C0–>8055714C [ntoskrnl.exe] ntoskrnl.exe–>RtlAddAccessAllowedAceEx, Type: EAT modification 0x806844C4–>80614998 [ntoskrnl.exe] ntoskrnl.exe–>RtlAddAce, Type: EAT modification 0x806844C8–>80B67070 [unknown_code_page] ntoskrnl.exe–>RtlAddAtomToAtomTable, Type: EAT modification 0x806844CC–>808F7070 [unknown_code_page] ntoskrnl.exe–>RtlAddRange, Type: EAT modification 0x806844D0–>807B704D [unknown_code_page] ntoskrnl.exe–>RtlAllocateHeap, Type: EAT modification 0x806844D4–>80A67053 [unknown_code_page] ntoskrnl.exe–>RtlAnsiCharToUnicodeChar, Type: EAT modification 0x806844D8–>804D7053 [ntoskrnl.exe] ntoskrnl.exe–>RtlAnsiStringToUnicodeSize, Type: EAT modification 0x806844DC–>80517005 [ntoskrnl.exe] ntoskrnl.exe–>RtlAnsiStringToUnicodeString, Type: EAT modification 0x806844E0–>80557148 [ntoskrnl.exe] ntoskrnl.exe–>RtlAppendAsciizToString, Type: EAT modification 0x806844E4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlAppendStringToString, Type: EAT modification 0x806844E8–>F1F9B0B4 [unknown_code_page] ntoskrnl.exe–>RtlAppendUnicodeStringToString, Type: EAT modification 0x806844EC–>805C5EE0 [ntoskrnl.exe] ntoskrnl.exe–>RtlAppendUnicodeToString, Type: EAT modification 0x806844F0–>825DE2C0 [unknown_code_page] ntoskrnl.exe–>RtlAreAllAccessesGranted, Type: EAT modification 0x806844F4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlAreAnyAccessesGranted, Type: EAT modification 0x806844F8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlAreBitsClear, Type: EAT modification 0x806844FC–>80517009 [ntoskrnl.exe] ntoskrnl.exe–>RtlAreBitsSet, Type: EAT modification 0x80684500–>80597044 [ntoskrnl.exe] ntoskrnl.exe–>RtlAssert, Type: EAT modification 0x80684504–>80527005 [ntoskrnl.exe] ntoskrnl.exe–>RtlCaptureContext, Type: EAT modification 0x80684508–>80557147 [ntoskrnl.exe] ntoskrnl.exe–>RtlCaptureStackBackTrace, Type: EAT modification 0x8068450C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlCharToInteger, Type: EAT modification 0x80684510–>F1F5E1E8 [unknown_code_page] ntoskrnl.exe–>RtlCheckRegistryKey, Type: EAT modification 0x80684514–>8260EE98 [unknown_code_page] ntoskrnl.exe–>RtlClearAllBits, Type: EAT modification 0x80684518–>805C5EB8 [ntoskrnl.exe] ntoskrnl.exe–>RtlClearBit, Type: EAT modification 0x8068451C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlClearBits, Type: EAT modification 0x80684520–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlCompareMemory, Type: EAT modification 0x80684524–>80527004 [ntoskrnl.exe] ntoskrnl.exe–>RtlCompareMemoryUlong, Type: EAT modification 0x80684528–>80577143 [ntoskrnl.exe] ntoskrnl.exe–>RtlCompareString, Type: EAT modification 0x8068452C–>80527003 [ntoskrnl.exe] ntoskrnl.exe–>RtlCompareUnicodeString, Type: EAT modification 0x80684530–>80557142 [ntoskrnl.exe] ntoskrnl.exe–>RtlCompressBuffer, Type: EAT modification 0x80684534–>82604568 [unknown_code_page] ntoskrnl.exe–>RtlCompressChunks, Type: EAT modification 0x80684538–>804E6FFF [ntoskrnl.exe] ntoskrnl.exe–>RtlConvertLongToLargeInteger, Type: EAT modification 0x8068453C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlConvertSidToUnicodeString, Type: EAT modification 0x80684540–>804D7004 [ntoskrnl.exe] ntoskrnl.exe–>RtlConvertUlongToLargeInteger, Type: EAT modification 0x80684544–>8050700B [ntoskrnl.exe] ntoskrnl.exe–>RtlCopyLuid, Type: EAT modification 0x80684548–>8059717F [ntoskrnl.exe] ntoskrnl.exe–>RtlCopyRangeList, Type: EAT modification 0x8068454C–>80534208 [ntoskrnl.exe] ntoskrnl.exe–>RtlCreateAtomTable, Type: EAT modification 0x80684560–>804DEFFF [ntoskrnl.exe] ntoskrnl.exe–>RtlCreateHeap, Type: EAT modification 0x80684564–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlCreateRegistryKey, Type: EAT modification 0x80684568–>8054D268 [ntoskrnl.exe] ntoskrnl.exe–>RtlCreateSecurityDescriptor, Type: EAT modification 0x8068456C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlCreateSystemVolumeInformationFolder, Type: EAT modification 0x80684570–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlCreateUnicodeString, Type: EAT modification 0x80684574–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlCustomCPToUnicodeN, Type: EAT modification 0x80684578–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlDecompressBuffer, Type: EAT modification 0x8068457C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlDecompressChunks, Type: EAT modification 0x80684580–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlDecompressFragment, Type: EAT modification 0x80684584–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlDelete, Type: EAT modification 0x80684588–>804D6FFF [unknown_code_page] ntoskrnl.exe–>RtlDeleteAce, Type: EAT modification 0x8068458C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlDeleteAtomFromAtomTable, Type: EAT modification 0x80684590–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlDeleteElementGenericTable, Type: EAT modification 0x80684594–>804D7016 [ntoskrnl.exe] ntoskrnl.exe–>RtlDeleteElementGenericTableAvl, Type: EAT modification 0x80684598–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlDeleteNoSplay, Type: EAT modification 0x8068459C–>80587004 [ntoskrnl.exe] ntoskrnl.exe–>RtlDeleteOwnersRanges, Type: EAT modification 0x806845A0–>80577170 [ntoskrnl.exe] ntoskrnl.exe–>RtlDeleteRange, Type: EAT modification 0x806845A4–>806083B0 [ntoskrnl.exe] ntoskrnl.exe–>RtlDeleteRegistryValue, Type: EAT modification 0x806845A8–>80B07065 [unknown_code_page] ntoskrnl.exe–>RtlDescribeChunk, Type: EAT modification 0x806845AC–>80917044 [unknown_code_page] ntoskrnl.exe–>RtlDestroyAtomTable, Type: EAT modification 0x806845B0–>80C0702E [unknown_code_page] ntoskrnl.exe–>RtlDestroyHeap, Type: EAT modification 0x806845B4–>80C07079 [unknown_code_page] ntoskrnl.exe–>RtlDowncaseUnicodeString, Type: EAT modification 0x806845B8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlEmptyAtomTable, Type: EAT modification 0x806845BC–>80517005 [ntoskrnl.exe] ntoskrnl.exe–>RtlEnlargedIntegerMultiply, Type: EAT modification 0x806845C0–>8055716C [ntoskrnl.exe] ntoskrnl.exe–>RtlEnlargedUnsignedDivide, Type: EAT modification 0x806845C4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlEnlargedUnsignedMultiply, Type: EAT modification 0x806845C8–>F76780D8 [unknown_code_page] ntoskrnl.exe–>RtlEnumerateGenericTable, Type: EAT modification 0x806845CC–>825E4F18 [unknown_code_page] ntoskrnl.exe–>RtlEnumerateGenericTableAvl, Type: EAT modification 0x806845D0–>825E4FD0 [unknown_code_page] ntoskrnl.exe–>RtlEnumerateGenericTableLikeADirectory, Type: EAT modification 0x806845D4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlEnumerateGenericTableWithoutSplaying, Type: EAT modification 0x806845D8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlEnumerateGenericTableWithoutSplayingAvl, Type: EAT modification 0x806845DC–>80517004 [ntoskrnl.exe] ntoskrnl.exe–>RtlEqualLuid, Type: EAT modification 0x806845E0–>80577068 [ntoskrnl.exe] ntoskrnl.exe–>RtlEqualSid, Type: EAT modification 0x806845E4–>80527003 [ntoskrnl.exe] ntoskrnl.exe–>RtlEqualString, Type: EAT modification 0x806845E8–>8055716B [ntoskrnl.exe] ntoskrnl.exe–>RtlEqualUnicodeString, Type: EAT modification 0x806845EC–>80581240 [ntoskrnl.exe] ntoskrnl.exe–>RtlExtendedIntegerMultiply, Type: EAT modification 0x806845F0–>804E6FFF [ntoskrnl.exe] ntoskrnl.exe–>RtlExtendedLargeIntegerDivide, Type: EAT modification 0x806845F4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlExtendedMagicDivide, Type: EAT modification 0x806845F8–>804D7004 [ntoskrnl.exe] ntoskrnl.exe–>RtlFillMemory, Type: EAT modification 0x806845FC–>80507004 [ntoskrnl.exe] ntoskrnl.exe–>RtlFillMemoryUlong, Type: EAT modification 0x80684600–>805B7164 [ntoskrnl.exe] ntoskrnl.exe–>RtlFindClearBits, Type: EAT modification 0x80684604–>825E1718 [unknown_code_page] ntoskrnl.exe–>RtlFindClearBitsAndSet, Type: EAT modification 0x80684608–>80A07049 [unknown_code_page] ntoskrnl.exe–>RtlFindClearRuns, Type: EAT modification 0x8068460C–>80C0702E [unknown_code_page] ntoskrnl.exe–>RtlFindFirstRunClear, Type: EAT modification 0x80684610–>80C07079 [unknown_code_page] ntoskrnl.exe–>RtlFindLastBackwardRunClear, Type: EAT modification 0x80684614–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlFindLeastSignificantBit, Type: EAT modification 0x80684618–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlFindLongestRunClear, Type: EAT modification 0x8068461C–>80517003 [ntoskrnl.exe] ntoskrnl.exe–>RtlFindMessage, Type: EAT modification 0x80684620–>80557160 [ntoskrnl.exe] ntoskrnl.exe–>RtlFindMostSignificantBit, Type: EAT modification 0x80684624–>805C3F68 [ntoskrnl.exe] ntoskrnl.exe–>RtlFindNextForwardRunClear, Type: EAT modification 0x80684628–>804E6FFF [ntoskrnl.exe] ntoskrnl.exe–>RtlFindRange, Type: EAT modification 0x8068462C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlFindSetBits, Type: EAT modification 0x80684630–>804D7004 [ntoskrnl.exe] ntoskrnl.exe–>RtlFindSetBitsAndClear, Type: EAT modification 0x80684634–>80507102 [ntoskrnl.exe] ntoskrnl.exe–>RtlFindUnicodePrefix, Type: EAT modification 0x80684638–>805D939D [ntoskrnl.exe] ntoskrnl.exe–>RtlFormatCurrentUserKeyPath, Type: EAT modification 0x8068463C–>805C4A58 [ntoskrnl.exe] ntoskrnl.exe–>RtlFreeAnsiString, Type: EAT modification 0x80684640–>805C4AB6 [ntoskrnl.exe] ntoskrnl.exe–>RtlFreeHeap, Type: EAT modification 0x80684644–>805C4B04 [ntoskrnl.exe] ntoskrnl.exe–>RtlFreeOemString, Type: EAT modification 0x80684648–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlFreeRangeList, Type: EAT modification 0x8068464C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlFreeUnicodeString, Type: EAT modification 0x80684650–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGenerate8dot3Name, Type: EAT modification 0x80684658–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGetAce, Type: EAT modification 0x8068465C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGetCallersAddress, Type: EAT modification 0x80684660–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGetCompressionWorkSpaceSize, Type: EAT modification 0x80684664–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGetDaclSecurityDescriptor, Type: EAT modification 0x80684668–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGetDefaultCodePage, Type: EAT modification 0x8068466C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGetElementGenericTable, Type: EAT modification 0x80684670–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGetElementGenericTableAvl, Type: EAT modification 0x80684674–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGetFirstRange, Type: EAT modification 0x80684678–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGetGroupSecurityDescriptor, Type: EAT modification 0x8068467C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGetNextRange, Type: EAT modification 0x80684680–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGetNtGlobalFlags, Type: EAT modification 0x80684684–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGetOwnerSecurityDescriptor, Type: EAT modification 0x80684688–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGetSaclSecurityDescriptor, Type: EAT modification 0x8068468C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGetSetBootStatusData, Type: EAT modification 0x80684690–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGetVersion, Type: EAT modification 0x80684694–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlGUIDFromString, Type: EAT modification 0x80684654–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlHashUnicodeString, Type: EAT modification 0x80684698–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlImageDirectoryEntryToData, Type: EAT modification 0x8068469C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlImageNtHeader, Type: EAT modification 0x806846A0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInitAnsiString, Type: EAT modification 0x806846A4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInitCodePageTable, Type: EAT modification 0x806846A8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInitializeBitMap, Type: EAT modification 0x806846B4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInitializeGenericTable, Type: EAT modification 0x806846B8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInitializeGenericTableAvl, Type: EAT modification 0x806846BC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInitializeRangeList, Type: EAT modification 0x806846C0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInitializeSid, Type: EAT modification 0x806846C4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInitializeUnicodePrefix, Type: EAT modification 0x806846C8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInitString, Type: EAT modification 0x806846AC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInitUnicodeString, Type: EAT modification 0x806846B0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInsertElementGenericTable, Type: EAT modification 0x806846CC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInsertElementGenericTableAvl, Type: EAT modification 0x806846D0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInsertElementGenericTableFull, Type: EAT modification 0x806846D4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInsertElementGenericTableFullAvl, Type: EAT modification 0x806846D8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInsertUnicodePrefix, Type: EAT modification 0x806846DC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInt64ToUnicodeString, Type: EAT modification 0x806846E0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIntegerToChar, Type: EAT modification 0x806846E4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIntegerToUnicode, Type: EAT modification 0x806846E8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIntegerToUnicodeString, Type: EAT modification 0x806846EC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlInvertRangeList, Type: EAT modification 0x806846F0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv4AddressToStringA, Type: EAT modification 0x806846F4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv4AddressToStringExA, Type: EAT modification 0x806846F8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv4AddressToStringExW, Type: EAT modification 0x806846FC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv4AddressToStringW, Type: EAT modification 0x80684700–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv4StringToAddressA, Type: EAT modification 0x80684704–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv4StringToAddressExA, Type: EAT modification 0x80684708–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv4StringToAddressExW, Type: EAT modification 0x8068470C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv4StringToAddressW, Type: EAT modification 0x80684710–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv6AddressToStringA, Type: EAT modification 0x80684714–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv6AddressToStringExA, Type: EAT modification 0x80684718–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv6AddressToStringExW, Type: EAT modification 0x8068471C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv6AddressToStringW, Type: EAT modification 0x80684720–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv6StringToAddressA, Type: EAT modification 0x80684724–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv6StringToAddressExA, Type: EAT modification 0x80684728–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv6StringToAddressExW, Type: EAT modification 0x8068472C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIpv6StringToAddressW, Type: EAT modification 0x80684730–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIsGenericTableEmpty, Type: EAT modification 0x80684734–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIsGenericTableEmptyAvl, Type: EAT modification 0x80684738–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIsNameLegalDOS8Dot3, Type: EAT modification 0x8068473C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIsRangeAvailable, Type: EAT modification 0x80684740–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlIsValidOemCharacter, Type: EAT modification 0x80684744–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLargeIntegerAdd, Type: EAT modification 0x80684748–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLargeIntegerArithmeticShift, Type: EAT modification 0x8068474C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLargeIntegerDivide, Type: EAT modification 0x80684750–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLargeIntegerNegate, Type: EAT modification 0x80684754–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLargeIntegerShiftLeft, Type: EAT modification 0x80684758–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLargeIntegerShiftRight, Type: EAT modification 0x8068475C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLargeIntegerSubtract, Type: EAT modification 0x80684760–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLengthRequiredSid, Type: EAT modification 0x80684764–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLengthSecurityDescriptor, Type: EAT modification 0x80684768–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLengthSid, Type: EAT modification 0x8068476C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLockBootStatusData, Type: EAT modification 0x80684770–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLookupAtomInAtomTable, Type: EAT modification 0x80684774–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLookupElementGenericTable, Type: EAT modification 0x80684778–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLookupElementGenericTableAvl, Type: EAT modification 0x8068477C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLookupElementGenericTableFull, Type: EAT modification 0x80684780–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlLookupElementGenericTableFullAvl, Type: EAT modification 0x80684784–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlMapGenericMask, Type: EAT modification 0x80684788–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlMapSecurityErrorToNtStatus, Type: EAT modification 0x8068478C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlMergeRangeLists, Type: EAT modification 0x80684790–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlMoveMemory, Type: EAT modification 0x80684794–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlMultiByteToUnicodeN, Type: EAT modification 0x80684798–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlMultiByteToUnicodeSize, Type: EAT modification 0x8068479C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlNextUnicodePrefix, Type: EAT modification 0x806847A0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlNtStatusToDosError, Type: EAT modification 0x806847A4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlNtStatusToDosErrorNoTeb, Type: EAT modification 0x806847A8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlNumberGenericTableElements, Type: EAT modification 0x806847AC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlNumberGenericTableElementsAvl, Type: EAT modification 0x806847B0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlNumberOfClearBits, Type: EAT modification 0x806847B4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlNumberOfSetBits, Type: EAT modification 0x806847B8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlOemStringToCountedUnicodeString, Type: EAT modification 0x806847BC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlOemStringToUnicodeSize, Type: EAT modification 0x806847C0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlOemStringToUnicodeString, Type: EAT modification 0x806847C4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlOemToUnicodeN, Type: EAT modification 0x806847C8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlPinAtomInAtomTable, Type: EAT modification 0x806847CC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlPrefetchMemoryNonTemporal, Type: EAT modification 0x806836F8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlPrefixString, Type: EAT modification 0x806847D0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlPrefixUnicodeString, Type: EAT modification 0x806847D4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlQueryAtomInAtomTable, Type: EAT modification 0x806847D8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlQueryRegistryValues, Type: EAT modification 0x806847DC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlQueryTimeZoneInformation, Type: EAT modification 0x806847E0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlRaiseException, Type: EAT modification 0x806847E4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlRandom, Type: EAT modification 0x806847E8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlRandomEx, Type: EAT modification 0x806847EC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlRealPredecessor, Type: EAT modification 0x806847F0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlRealSuccessor, Type: EAT modification 0x806847F4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlRemoveUnicodePrefix, Type: EAT modification 0x806847F8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlReserveChunk, Type: EAT modification 0x806847FC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSecondsSince1970ToTime, Type: EAT modification 0x80684800–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSecondsSince1980ToTime, Type: EAT modification 0x80684804–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSelfRelativeToAbsoluteSD, Type: EAT modification 0x8068480C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSelfRelativeToAbsoluteSD2, Type: EAT modification 0x80684808–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSetAllBits, Type: EAT modification 0x80684810–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSetBit, Type: EAT modification 0x80684814–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSetBits, Type: EAT modification 0x80684818–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSetDaclSecurityDescriptor, Type: EAT modification 0x8068481C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSetGroupSecurityDescriptor, Type: EAT modification 0x80684820–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSetOwnerSecurityDescriptor, Type: EAT modification 0x80684824–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSetSaclSecurityDescriptor, Type: EAT modification 0x80684828–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSetTimeZoneInformation, Type: EAT modification 0x8068482C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSizeHeap, Type: EAT modification 0x80684830–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSplay, Type: EAT modification 0x80684834–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlStringFromGUID, Type: EAT modification 0x80684838–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSubAuthorityCountSid, Type: EAT modification 0x8068483C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSubAuthoritySid, Type: EAT modification 0x80684840–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSubtreePredecessor, Type: EAT modification 0x80684844–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlSubtreeSuccessor, Type: EAT modification 0x80684848–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlTestBit, Type: EAT modification 0x8068484C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlTimeFieldsToTime, Type: EAT modification 0x80684850–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlTimeToElapsedTimeFields, Type: EAT modification 0x80684854–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlTimeToSecondsSince1970, Type: EAT modification 0x80684858–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlTimeToSecondsSince1980, Type: EAT modification 0x8068485C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlTimeToTimeFields, Type: EAT modification 0x80684860–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlTraceDatabaseAdd, Type: EAT modification 0x80684864–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlTraceDatabaseCreate, Type: EAT modification 0x80684868–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlTraceDatabaseDestroy, Type: EAT modification 0x8068486C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlTraceDatabaseEnumerate, Type: EAT modification 0x80684870–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlTraceDatabaseFind, Type: EAT modification 0x80684874–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlTraceDatabaseLock, Type: EAT modification 0x80684878–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlTraceDatabaseUnlock, Type: EAT modification 0x8068487C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlTraceDatabaseValidate, Type: EAT modification 0x80684880–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUlongByteSwap, Type: EAT modification 0x806836FC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUlonglongByteSwap, Type: EAT modification 0x80683700–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUnicodeStringToAnsiSize, Type: EAT modification 0x80684884–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUnicodeStringToAnsiString, Type: EAT modification 0x80684888–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUnicodeStringToCountedOemString, Type: EAT modification 0x8068488C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUnicodeStringToInteger, Type: EAT modification 0x80684890–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUnicodeStringToOemSize, Type: EAT modification 0x80684894–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUnicodeStringToOemString, Type: EAT modification 0x80684898–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUnicodeToCustomCPN, Type: EAT modification 0x8068489C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUnicodeToMultiByteN, Type: EAT modification 0x806848A0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUnicodeToMultiByteSize, Type: EAT modification 0x806848A4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUnicodeToOemN, Type: EAT modification 0x806848A8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUnlockBootStatusData, Type: EAT modification 0x806848AC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUnwind, Type: EAT modification 0x806848B0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUpcaseUnicodeChar, Type: EAT modification 0x806848B4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUpcaseUnicodeString, Type: EAT modification 0x806848B8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUpcaseUnicodeStringToAnsiString, Type: EAT modification 0x806848BC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUpcaseUnicodeStringToCountedOemString, Type: EAT modification 0x806848C0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUpcaseUnicodeStringToOemString, Type: EAT modification 0x806848C4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUpcaseUnicodeToCustomCPN, Type: EAT modification 0x806848C8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUpcaseUnicodeToMultiByteN, Type: EAT modification 0x806848CC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUpcaseUnicodeToOemN, Type: EAT modification 0x806848D0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUpperChar, Type: EAT modification 0x806848D4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUpperString, Type: EAT modification 0x806848D8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlUshortByteSwap, Type: EAT modification 0x80683704–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlValidRelativeSecurityDescriptor, Type: EAT modification 0x806848DC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlValidSecurityDescriptor, Type: EAT modification 0x806848E0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlValidSid, Type: EAT modification 0x806848E4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlVerifyVersionInfo, Type: EAT modification 0x806848E8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlVolumeDeviceToDosName, Type: EAT modification 0x806848EC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlWalkFrameChain, Type: EAT modification 0x806848F0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlWriteRegistryValue, Type: EAT modification 0x806848F4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlxAnsiStringToUnicodeSize, Type: EAT modification 0x80684900–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlxOemStringToUnicodeSize, Type: EAT modification 0x80684904–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlxUnicodeStringToAnsiSize, Type: EAT modification 0x80684908–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlxUnicodeStringToOemSize, Type: EAT modification 0x8068490C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlZeroHeap, Type: EAT modification 0x806848F8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>RtlZeroMemory, Type: EAT modification 0x806848FC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeAccessCheck, Type: EAT modification 0x80684910–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeAppendPrivileges, Type: EAT modification 0x80684914–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeAssignSecurity, Type: EAT modification 0x80684918–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeAssignSecurityEx, Type: EAT modification 0x8068491C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeAuditHardLinkCreation, Type: EAT modification 0x80684920–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeAuditingFileEvents, Type: EAT modification 0x80684924–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeAuditingFileEventsWithContext, Type: EAT modification 0x80684928–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeAuditingFileOrGlobalEvents, Type: EAT modification 0x8068492C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeAuditingHardLinkEvents, Type: EAT modification 0x80684930–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeAuditingHardLinkEventsWithContext, Type: EAT modification 0x80684934–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeCaptureSecurityDescriptor, Type: EAT modification 0x80684938–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeCaptureSubjectContext, Type: EAT modification 0x8068493C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeCloseObjectAuditAlarm, Type: EAT modification 0x80684940–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeCreateAccessState, Type: EAT modification 0x80684944–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeCreateClientSecurity, Type: EAT modification 0x80684948–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeCreateClientSecurityFromSubjectContext, Type: EAT modification 0x8068494C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeDeassignSecurity, Type: EAT modification 0x80684950–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeDeleteAccessState, Type: EAT modification 0x80684954–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeDeleteObjectAuditAlarm, Type: EAT modification 0x80684958–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeExports, Type: EAT modification 0x8068495C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeFilterToken, Type: EAT modification 0x80684960–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeFreePrivileges, Type: EAT modification 0x80684964–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeImpersonateClient, Type: EAT modification 0x80684968–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeImpersonateClientEx, Type: EAT modification 0x8068496C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeLockSubjectContext, Type: EAT modification 0x80684970–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeMarkLogonSessionForTerminationNotification, Type: EAT modification 0x80684974–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeOpenObjectAuditAlarm, Type: EAT modification 0x80684978–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeOpenObjectForDeleteAuditAlarm, Type: EAT modification 0x8068497C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SePrivilegeCheck, Type: EAT modification 0x80684980–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SePrivilegeObjectAuditAlarm, Type: EAT modification 0x80684984–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SePublicDefaultDacl, Type: EAT modification 0x80684988–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeQueryAuthenticationIdToken, Type: EAT modification 0x8068498C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeQueryInformationToken, Type: EAT modification 0x80684990–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeQuerySecurityDescriptorInfo, Type: EAT modification 0x80684994–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeQuerySessionIdToken, Type: EAT modification 0x80684998–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeRegisterLogonSessionTerminatedRoutine, Type: EAT modification 0x8068499C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeReleaseSecurityDescriptor, Type: EAT modification 0x806849A0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeReleaseSubjectContext, Type: EAT modification 0x806849A4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeSetAccessStateGenericMapping, Type: EAT modification 0x806849A8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeSetSecurityDescriptorInfo, Type: EAT modification 0x806849AC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeSetSecurityDescriptorInfoEx, Type: EAT modification 0x806849B0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeSinglePrivilegeCheck, Type: EAT modification 0x806849B4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeSystemDefaultDacl, Type: EAT modification 0x806849B8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeTokenImpersonationLevel, Type: EAT modification 0x806849BC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeTokenIsAdmin, Type: EAT modification 0x806849C0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeTokenIsRestricted, Type: EAT modification 0x806849C4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeTokenIsWriteRestricted, Type: EAT modification 0x806849C8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeTokenObjectType, Type: EAT modification 0x806849CC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeTokenType, Type: EAT modification 0x806849D0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeUnlockSubjectContext, Type: EAT modification 0x806849D4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeUnregisterLogonSessionTerminatedRoutine, Type: EAT modification 0x806849D8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>SeValidSecurityDescriptor, Type: EAT modification 0x806849DC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>sprintf, Type: EAT modification 0x80684CD8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>srand, Type: EAT modification 0x80684CDC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>strcat, Type: EAT modification 0x80684CE0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>strchr, Type: EAT modification 0x80684CE4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>strcmp, Type: EAT modification 0x80684CE8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>strcpy, Type: EAT modification 0x80684CEC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>strlen, Type: EAT modification 0x80684CF0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>strncat, Type: EAT modification 0x80684CF4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>strncmp, Type: EAT modification 0x80684CF8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>strncpy, Type: EAT modification 0x80684CFC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>strrchr, Type: EAT modification 0x80684D00–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>strspn, Type: EAT modification 0x80684D04–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>strstr, Type: EAT modification 0x80684D08–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>swprintf, Type: EAT modification 0x80684D0C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>tolower, Type: EAT modification 0x80684D10–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>toupper, Type: EAT modification 0x80684D14–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>towlower, Type: EAT modification 0x80684D18–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>towupper, Type: EAT modification 0x80684D1C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>vDbgPrintEx, Type: EAT modification 0x80684D20–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>vDbgPrintExWithPrefix, Type: EAT modification 0x80684D24–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>VerSetConditionMask, Type: EAT modification 0x806849E0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>VfFailDeviceNode, Type: EAT modification 0x806849E4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>VfFailDriver, Type: EAT modification 0x806849E8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>VfFailSystemBIOS, Type: EAT modification 0x806849EC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>VfIsVerificationEnabled, Type: EAT modification 0x806849F0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>vsprintf, Type: EAT modification 0x80684D28–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>wcscat, Type: EAT modification 0x80684D2C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>wcschr, Type: EAT modification 0x80684D30–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>wcscmp, Type: EAT modification 0x80684D34–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>wcscpy, Type: EAT modification 0x80684D38–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>wcscspn, Type: EAT modification 0x80684D3C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>wcslen, Type: EAT modification 0x80684D40–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>wcsncat, Type: EAT modification 0x80684D44–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>wcsncmp, Type: EAT modification 0x80684D48–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>wcsncpy, Type: EAT modification 0x80684D4C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>wcsrchr, Type: EAT modification 0x80684D50–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>wcsspn, Type: EAT modification 0x80684D54–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>wcsstr, Type: EAT modification 0x80684D58–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>wcstombs, Type: EAT modification 0x80684D5C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>wctomb, Type: EAT modification 0x80684D60–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>WmiFlushTrace, Type: EAT modification 0x80684A0C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>WmiGetClock, Type: EAT modification 0x80683708–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>WmiQueryTrace, Type: EAT modification 0x80684A10–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>WmiQueryTraceInformation, Type: EAT modification 0x80684A14–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>WmiStartTrace, Type: EAT modification 0x80684A18–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>WmiStopTrace, Type: EAT modification 0x80684A1C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>WmiTraceMessage, Type: EAT modification 0x80684A20–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>WmiTraceMessageVa, Type: EAT modification 0x80684A24–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>WmiUpdateTrace, Type: EAT modification 0x80684A28–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>WRITE_REGISTER_BUFFER_UCHAR, Type: EAT modification 0x806849F4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>WRITE_REGISTER_BUFFER_ULONG, Type: EAT modification 0x806849F8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>WRITE_REGISTER_BUFFER_USHORT, Type: EAT modification 0x806849FC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>WRITE_REGISTER_UCHAR, Type: EAT modification 0x80684A00–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>WRITE_REGISTER_ULONG, Type: EAT modification 0x80684A04–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>WRITE_REGISTER_USHORT, Type: EAT modification 0x80684A08–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>XIPDispatch, Type: EAT modification 0x80684A2C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwAccessCheckAndAuditAlarm, Type: EAT modification 0x80684A30–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwAddBootEntry, Type: EAT modification 0x80684A34–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwAdjustPrivilegesToken, Type: EAT modification 0x80684A38–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwAlertThread, Type: EAT modification 0x80684A3C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwAllocateVirtualMemory, Type: EAT modification 0x80684A40–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwAssignProcessToJobObject, Type: EAT modification 0x80684A44–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwCancelIoFile, Type: EAT modification 0x80684A48–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwCancelTimer, Type: EAT modification 0x80684A4C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwClearEvent, Type: EAT modification 0x80684A50–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwClose, Type: EAT modification 0x80684A54–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwCloseObjectAuditAlarm, Type: EAT modification 0x80684A58–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwConnectPort, Type: EAT modification 0x80684A5C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwCreateDirectoryObject, Type: EAT modification 0x80684A60–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwCreateEvent, Type: EAT modification 0x80684A64–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwCreateFile, Type: EAT modification 0x80684A68–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwCreateJobObject, Type: EAT modification 0x80684A6C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwCreateKey, Type: EAT modification 0x80684A70–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwCreateSection, Type: EAT modification 0x80684A74–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwCreateSymbolicLinkObject, Type: EAT modification 0x80684A78–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwCreateTimer, Type: EAT modification 0x80684A7C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwDeleteBootEntry, Type: EAT modification 0x80684A80–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwDeleteFile, Type: EAT modification 0x80684A84–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwDeleteKey, Type: EAT modification 0x80684A88–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwDeleteValueKey, Type: EAT modification 0x80684A8C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwDeviceIoControlFile, Type: EAT modification 0x80684A90–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwDisplayString, Type: EAT modification 0x80684A94–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwDuplicateObject, Type: EAT modification 0x80684A98–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwDuplicateToken, Type: EAT modification 0x80684A9C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwEnumerateBootEntries, Type: EAT modification 0x80684AA0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwEnumerateKey, Type: EAT modification 0x80684AA4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwEnumerateValueKey, Type: EAT modification 0x80684AA8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwFlushInstructionCache, Type: EAT modification 0x80684AAC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwFlushKey, Type: EAT modification 0x80684AB0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwFlushVirtualMemory, Type: EAT modification 0x80684AB4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwFreeVirtualMemory, Type: EAT modification 0x80684AB8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwFsControlFile, Type: EAT modification 0x80684ABC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwInitiatePowerAction, Type: EAT modification 0x80684AC0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwIsProcessInJob, Type: EAT modification 0x80684AC4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwLoadDriver, Type: EAT modification 0x80684AC8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwLoadKey, Type: EAT modification 0x80684ACC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwMakeTemporaryObject, Type: EAT modification 0x80684AD0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwMapViewOfSection, Type: EAT modification 0x80684AD4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwNotifyChangeKey, Type: EAT modification 0x80684AD8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwOpenDirectoryObject, Type: EAT modification 0x80684ADC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwOpenEvent, Type: EAT modification 0x80684AE0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwOpenFile, Type: EAT modification 0x80684AE4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwOpenJobObject, Type: EAT modification 0x80684AE8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwOpenKey, Type: EAT modification 0x80684AEC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwOpenProcess, Type: EAT modification 0x80684AF0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwOpenProcessToken, Type: EAT modification 0x80684AF4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwOpenProcessTokenEx, Type: EAT modification 0x80684AF8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwOpenSection, Type: EAT modification 0x80684AFC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwOpenSymbolicLinkObject, Type: EAT modification 0x80684B00–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwOpenThread, Type: EAT modification 0x80684B04–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwOpenThreadToken, Type: EAT modification 0x80684B08–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwOpenThreadTokenEx, Type: EAT modification 0x80684B0C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwOpenTimer, Type: EAT modification 0x80684B10–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwPowerInformation, Type: EAT modification 0x80684B14–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwPulseEvent, Type: EAT modification 0x80684B18–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryBootEntryOrder, Type: EAT modification 0x80684B1C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryBootOptions, Type: EAT modification 0x80684B20–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryDefaultLocale, Type: EAT modification 0x80684B24–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryDefaultUILanguage, Type: EAT modification 0x80684B28–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryDirectoryFile, Type: EAT modification 0x80684B2C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryDirectoryObject, Type: EAT modification 0x80684B30–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryEaFile, Type: EAT modification 0x80684B34–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryFullAttributesFile, Type: EAT modification 0x80684B38–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryInformationFile, Type: EAT modification 0x80684B3C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryInformationJobObject, Type: EAT modification 0x80684B40–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryInformationProcess, Type: EAT modification 0x80684B44–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryInformationThread, Type: EAT modification 0x80684B48–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryInformationToken, Type: EAT modification 0x80684B4C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryInstallUILanguage, Type: EAT modification 0x80684B50–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryKey, Type: EAT modification 0x80684B54–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryObject, Type: EAT modification 0x80684B58–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQuerySection, Type: EAT modification 0x80684B5C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQuerySecurityObject, Type: EAT modification 0x80684B60–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQuerySymbolicLinkObject, Type: EAT modification 0x80684B64–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQuerySystemInformation, Type: EAT modification 0x80684B68–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryValueKey, Type: EAT modification 0x80684B6C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwQueryVolumeInformationFile, Type: EAT modification 0x80684B70–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwReadFile, Type: EAT modification 0x80684B74–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwReplaceKey, Type: EAT modification 0x80684B78–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwRequestWaitReplyPort, Type: EAT modification 0x80684B7C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwResetEvent, Type: EAT modification 0x80684B80–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwRestoreKey, Type: EAT modification 0x80684B84–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSaveKey, Type: EAT modification 0x80684B88–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSaveKeyEx, Type: EAT modification 0x80684B8C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetBootEntryOrder, Type: EAT modification 0x80684B90–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetBootOptions, Type: EAT modification 0x80684B94–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetDefaultLocale, Type: EAT modification 0x80684B98–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetDefaultUILanguage, Type: EAT modification 0x80684B9C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetEaFile, Type: EAT modification 0x80684BA0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetEvent, Type: EAT modification 0x80684BA4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetInformationFile, Type: EAT modification 0x80684BA8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetInformationJobObject, Type: EAT modification 0x80684BAC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetInformationObject, Type: EAT modification 0x80684BB0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetInformationProcess, Type: EAT modification 0x80684BB4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetInformationThread, Type: EAT modification 0x80684BB8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetSecurityObject, Type: EAT modification 0x80684BBC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetSystemInformation, Type: EAT modification 0x80684BC0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetSystemTime, Type: EAT modification 0x80684BC4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetTimer, Type: EAT modification 0x80684BC8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetValueKey, Type: EAT modification 0x80684BCC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwSetVolumeInformationFile, Type: EAT modification 0x80684BD0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwTerminateJobObject, Type: EAT modification 0x80684BD4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwTerminateProcess, Type: EAT modification 0x80684BD8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwTranslateFilePath, Type: EAT modification 0x80684BDC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwUnloadDriver, Type: EAT modification 0x80684BE0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwUnloadKey, Type: EAT modification 0x80684BE4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwUnmapViewOfSection, Type: EAT modification 0x80684BE8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwWaitForMultipleObjects, Type: EAT modification 0x80684BEC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwWaitForSingleObject, Type: EAT modification 0x80684BF0–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwWriteFile, Type: EAT modification 0x80684BF4–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>ZwYieldExecution, Type: EAT modification 0x80684BF8–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_abnormal_termination, Type: EAT modification 0x80684C08–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_alldiv, Type: EAT modification 0x80684C0C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_alldvrm, Type: EAT modification 0x80684C10–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_allmul, Type: EAT modification 0x80684C14–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_alloca_probe, Type: EAT modification 0x80684C18–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_allrem, Type: EAT modification 0x80684C1C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_allshl, Type: EAT modification 0x80684C20–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_allshr, Type: EAT modification 0x80684C24–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_aulldiv, Type: EAT modification 0x80684C28–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_aulldvrm, Type: EAT modification 0x80684C2C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_aullrem, Type: EAT modification 0x80684C30–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_aullshr, Type: EAT modification 0x80684C34–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_CIcos, Type: EAT modification 0x80684BFC–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_CIsin, Type: EAT modification 0x80684C00–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_CIsqrt, Type: EAT modification 0x80684C04–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_except_handler2, Type: EAT modification 0x80684C38–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_except_handler3, Type: EAT modification 0x80684C3C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_global_unwind2, Type: EAT modification 0x80684C40–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_itoa, Type: EAT modification 0x80684C44–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_itow, Type: EAT modification 0x80684C48–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_local_unwind2, Type: EAT modification 0x80684C4C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_purecall, Type: EAT modification 0x80684C50–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_snprintf, Type: EAT modification 0x80684C54–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_snwprintf, Type: EAT modification 0x80684C58–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_stricmp, Type: EAT modification 0x80684C5C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_strlwr, Type: EAT modification 0x80684C60–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_strnicmp, Type: EAT modification 0x80684C64–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_strnset, Type: EAT modification 0x80684C68–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_strrev, Type: EAT modification 0x80684C6C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_strset, Type: EAT modification 0x80684C70–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_strupr, Type: EAT modification 0x80684C74–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_vsnprintf, Type: EAT modification 0x80684C78–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_vsnwprintf, Type: EAT modification 0x80684C7C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_wcsicmp, Type: EAT modification 0x80684C80–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_wcslwr, Type: EAT modification 0x80684C84–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_wcsnicmp, Type: EAT modification 0x80684C88–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_wcsnset, Type: EAT modification 0x80684C8C–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_wcsrev, Type: EAT modification 0x80684C90–>804D7000 [ntoskrnl.exe] ntoskrnl.exe–>_wcsupr, Type: EAT modification 0x80684C94–>804D7000 [ntoskrnl.exe] [1772]explorer.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77DD1218–>00000000 [shimeng.dll] [1772]explorer.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77F110B4–>00000000 [shimeng.dll] [1772]explorer.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x01001268–>00000000 [shimeng.dll] [1772]explorer.exe–>shell32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7C9C15A4–>00000000 [shimeng.dll] [1772]explorer.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7E41133C–>00000000 [shimeng.dll] [1772]explorer.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x3D9314B0–>00000000 [shimeng.dll] [1772]explorer.exe–>ws2_32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x71AB109C–>00000000 [shimeng.dll] 📎Attach.txt
Post #4
curlee1982:

🖼Click to load external image (Posted Image) Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please include the following in your next post:
  • ComboFix log
Post #5
I've discovered a Panda Active Scan program and tried to disable it according to the directions on the link you provided but I cannot identify which of the running processes on the task manager belongs to this particular program. I'm not sure where or when we downloaded it. If suitable I'd be willing to go ahead and remove it as I'd like to install some more current antivirus software after this fix anyway. I'll follow whatever suggestions you make! Thanks!
Post #7
Here is the Combofix log. While running step 4 a dialogue box popped up which stated "while running the procedure * could not be located in the DLL Wintrust.dll". Don't know if significant or not.

ComboFix 10-10-30.01 - jimmy 10/30/2010 23:54:06.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.127.4 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\jimmy\Application Data\AntiSpywareDAT
c:\documents and settings\jimmy\Application Data\AntiSpywareDAT\Scan_Log.txt
c:\documents and settings\jimmy\unstall.exe
c:\program files\filesubmit
c:\program files\gamevance\gamevancelib32.dll
c:\windows\Debug\dcpromo.log
c:\windows\desktop
c:\windows\desktop\EA Hot Titles!.exe
c:\windows\didduid.ini
c:\windows\Readme.txt
c:\windows\system32\mcrh.tmp
c:\windows\system32\skinboxer43.dll
c:\windows\system32\Temp

.
((((((((((((((((((((((((( Files Created from 2010-09-28 to 2010-10-31 )))))))))))))))))))))))))))))))
.

2010-10-30 19:23 . 2010-10-30 19:23 6656 —-a-w- c:\windows\system32\D1028DA9.exe
2010-10-30 19:13 . 2010-10-30 19:13 6656 —-a-w- c:\windows\system32\89FA5AA9.exe
2010-10-27 18:16 . 2010-10-27 18:16 388096 —-a-r- c:\documents and settings\jimmy\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-10-27 18:16 . 2010-10-27 18:16 ——– d—–w- c:\program files\Trend Micro
2010-10-24 07:13 . 2010-10-24 07:13 ——– d—–w- c:\windows\system32\XPSViewer
2010-10-24 07:13 . 2010-10-24 07:13 ——– d—–w- c:\program files\MSBuild
2010-10-24 07:13 . 2010-10-24 07:13 ——– d—–w- c:\program files\Reference Assemblies
2010-10-24 07:12 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-10-24 07:11 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-10-24 07:11 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2010-10-24 07:11 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-10-24 07:11 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2010-10-24 07:11 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-10-24 07:11 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-10-24 07:11 . 2010-10-24 07:12 ——– d—–w- C:\916a60ceab285d5f6344
2010-10-24 07:11 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2010-10-24 07:11 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2010-10-15 17:51 . 2010-09-18 06:53 954368 ——w- c:\windows\system32\dllcache\mfc40.dll
2010-10-15 17:51 . 2010-09-18 06:53 953856 ——w- c:\windows\system32\dllcache\mfc40u.dll
2010-10-15 17:51 . 2010-09-18 06:53 974848 ——w- c:\windows\system32\dllcache\mfc42.dll
2010-10-15 02:12 . 2010-08-23 16:12 617472 ——w- c:\windows\system32\dllcache\comctl32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-30 19:01 . 2006-09-30 00:53 1409 —-a-w- c:\windows\QTFont.for
2010-09-18 16:23 . 2002-08-29 11:00 974848 —-a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2002-08-29 11:00 974848 —-a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2002-08-29 11:00 954368 —-a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2002-08-29 11:00 953856 —-a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:58 . 2005-02-18 21:19 916480 —-a-w- c:\windows\system32\wininet.dll
2010-09-10 05:58 . 2002-08-29 11:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:58 . 2002-08-29 11:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:51 . 2002-08-29 11:00 285824 —-a-w- c:\windows\system32\atmfd.dll
2010-08-31 13:42 . 2002-08-29 11:00 1852800 —-a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02 . 2002-08-29 11:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2002-08-29 11:00 99840 —-a-w- c:\windows\system32\srvsvc.dll
2010-08-26 13:39 . 2002-08-29 11:00 357248 —-a-w- c:\windows\system32\drivers\srv.sys
2010-08-26 12:52 . 2009-04-17 12:25 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2010-08-23 16:12 . 2002-08-29 11:00 617472 —-a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2002-08-29 11:00 58880 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-06-08 04:48 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2005-05-30 01:00 . 2005-05-30 01:00 774144 —-a-w- c:\program files\RngInterstitial.dll
2007-12-09 19:03 . 2004-06-14 15:32 67696 —-a-w- c:\program files\mozilla firefox\components\jar50.dll
2007-12-09 19:04 . 2004-06-14 15:32 54376 —-a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2007-12-09 19:04 . 2007-04-21 18:54 34952 —-a-w- c:\program files\mozilla firefox\components\myspell.dll
2007-12-09 19:04 . 2007-04-21 18:54 46720 —-a-w- c:\program files\mozilla firefox\components\spellchk.dll
2007-12-09 19:04 . 2004-06-14 15:32 172144 —-a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-01-29 77824]
"Conime"="c:\windows\system32\conime.exe" [2008-04-14 27648]
"EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2009-04-07 1511424]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]

c:\documents and settings\jimmy\Start Menu\Programs\Startup\
Event Reminder.lnk - c:\pmw\PMREMIND.EXE [1998-2-24 255408]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2002-12-11 45056]
Script execution time was exceeded on script "c:\combofix\lnkread.vbs".
Script execution was terminated.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9322:TCP"= 9322:TCP:EKDiscovery
"9323:TCP"= 9323:TCP:EKDiscovery

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-04 135664]
R3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\AT&T\Communication Manager\RcAppSvc.exe [2008-11-21 113152]
S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\EKDiscovery.exe [2009-05-04 279960]
S2 KodakSvc;Kodak AiO Device Service;c:\program files\Kodak\AiO\center\KodakSvc.exe [2009-04-17 32768]


— Other Services/Drivers In Memory —

*NewlyCreated* - 89FA5AA9
*NewlyCreated* - D1028DA9
.
Contents of the 'Scheduled Tasks' folder

2010-10-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cb711c96de43e4.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-04 03:26]

2010-10-31 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2002-12-11 17:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.att.net/
mSearch Bar =
uInternet Connection Wizard,ShellNext = iexplore
LSP: bmnet.dll
TCP: {78D5FBE4-BADD-4888-9CEE-BAE7A1FE7A90} = 68.94.156.1 68.94.157.1
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} - hxxp://games.bellsouth.net/Gh/Tumblebugs/axhost.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://games.bellsouth.net/Gh/DeliciousWeb/zylomplayer.cab
FF - ProfilePath - c:\documents and settings\jimmy\Application Data\Mozilla\Firefox\Profiles\oxgkpr22.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-OM_Monitor - c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe
HKCU-Run-Microsoft Works Update Detection - c:\program files\Microsoft Works\WkDetect.exe
AddRemove-HijackThis - c:\documents and settings\jimmy\Local Settings\Temporary Internet Files\Content.IE5\HN3J91OE\HijackThis.exe
AddRemove-love file kind - c:\progra~1\GPLFLA~1\cdrom third.exe
AddRemove-MediaLoads - c:\program files\MediaLoads\v1\ml.exe
AddRemove-VX2 Cleaner plug-in for Ad-aware 6 - c:\progra~1\Lavasoft\AD-AWA~1\UNWISE.EXE
AddRemove-Works2002Setup - c:\program files\Microsoft Works Suite 2002\Setup\Launcher.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-31 01:39
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(724)
c:\windows\system32\bmnet.dll

- - - - - - - > 'Explorer.EXE'(1772)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\jscript.dll
c:\windows\system32\webcheck.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
c:\program files\Fellowes\MediaFACE 4.0\MFShlExt.dll
c:\program files\Fellowes\MediaFACE 4.0\MFExtRes.dll
.
Completion time: 2010-10-31 02:07:21
ComboFix-quarantined-files.txt 2010-10-31 06:06

Pre-Run: 95,515,238,400 bytes free
Post-Run: 95,802,011,648 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - 4237F34C4A28E159CB794E4B2E28944F
Post #8
curlee1982:

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
c:\windows\system32\D1028DA9.exe
c:\windows\system32\89FA5AA9.exe
Driver::
89FA5AA9
D1028DA9

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

🖼Click to load external image (Posted Image) Please download Malwarebytes' Anti-Malware to your desktop.
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please post the results.
Please include the following in your next post:
  • ComboFix log
  • MBAM log
Post #9
Unable to open Notepad. Get this error message. "Problem with shortcut. The drive or netwrok connection that the shortcut 'Notepad.Ink' refers to is unavailable. Make sure that the disk is properly inserted or the netwrok resource is available and then try again". Suggestions?
Post #11
Yes, it worked great. Here are the two logs you requested.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5017

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

11/1/2010 7:36:16 PM
mbam-log-2010-11-01 (19-36-16).txt

Scan type: Full scan (C:\|)
Objects scanned: 234486
Time elapsed: 49 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 8
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0ed403e8-470a-4a8a-85a4-d7688cfe39a3} (Adware.Gamevance) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{df058c45-cd18-453e-8745-5a77f60722ab} (Adware.Gdown) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{b5a33c35-7298-4d15-8753-a2e851e2eab3} (Adware.Gdown) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f0d2b812-752d-4af1-a2fb-968c4d8446db} (Adware.Gdown) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e856b973-45fd-4559-8f82-eab539144667} (Adware.Gdown) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gamevance (Adware.Gamevance) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Gamevance (Adware.Gamevance) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\SYSTEM32\GTDownDE_87.ocx (Adware.Gdown) -> Quarantined and deleted successfully.
C:\Program Files\Gamevance\ars.cfg (Adware.Gamevance) -> Quarantined and deleted successfully.
C:\Program Files\Gamevance\gamevance32.exe (Adware.Gamevance) -> Quarantined and deleted successfully.
C:\Program Files\Gamevance\gvun.exe (Adware.Gamevance) -> Quarantined and deleted successfully.
C:\Program Files\Gamevance\icon.ico (Adware.Gamevance) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\mljji.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

ComboFix 10-10-31.04 - jimmy 11/01/2010 16:08:51.2.1 - x86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\jimmy\Desktop\CFScript.txt

FILE ::
"c:\windows\system32\89FA5AA9.exe"
"c:\windows\system32\D1028DA9.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\89FA5AA9.exe
c:\windows\system32\D1028DA9.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_89FA5AA9
——-\Legacy_D1028DA9
——-\Service_89FA5AA9
——-\Service_D1028DA9


((((((((((((((((((((((((( Files Created from 2010-10-01 to 2010-11-01 )))))))))))))))))))))))))))))))
.

2010-11-01 21:11 . 2010-11-01 21:11 1409 —-a-w- c:\windows\QTFont.for
2010-11-01 19:23 . 2010-11-01 19:24 ——– d—–r- C:\32788R22FWJFW
2010-10-27 18:16 . 2010-10-27 18:16 388096 —-a-r- c:\documents and settings\jimmy\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-10-27 18:16 . 2010-10-27 18:16 ——– d—–w- c:\program files\Trend Micro
2010-10-24 07:13 . 2010-10-24 07:13 ——– d—–w- c:\windows\system32\XPSViewer
2010-10-24 07:13 . 2010-10-24 07:13 ——– d—–w- c:\program files\MSBuild
2010-10-24 07:13 . 2010-10-24 07:13 ——– d—–w- c:\program files\Reference Assemblies
2010-10-24 07:12 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-10-24 07:11 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-10-24 07:11 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2010-10-24 07:11 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-10-24 07:11 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2010-10-24 07:11 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-10-24 07:11 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-10-24 07:11 . 2010-10-24 07:12 ——– d—–w- C:\916a60ceab285d5f6344
2010-10-24 07:11 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2010-10-24 07:11 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2010-10-15 17:51 . 2010-09-18 06:53 954368 ——w- c:\windows\system32\dllcache\mfc40.dll
2010-10-15 17:51 . 2010-09-18 06:53 953856 ——w- c:\windows\system32\dllcache\mfc40u.dll
2010-10-15 17:51 . 2010-09-18 06:53 974848 ——w- c:\windows\system32\dllcache\mfc42.dll
2010-10-15 02:12 . 2010-08-23 16:12 617472 ——w- c:\windows\system32\dllcache\comctl32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-18 16:23 . 2002-08-29 11:00 974848 —-a-w- c:\windows\system32\mfc42u.dll
2010-09-18 06:53 . 2002-08-29 11:00 974848 —-a-w- c:\windows\system32\mfc42.dll
2010-09-18 06:53 . 2002-08-29 11:00 954368 —-a-w- c:\windows\system32\mfc40.dll
2010-09-18 06:53 . 2002-08-29 11:00 953856 —-a-w- c:\windows\system32\mfc40u.dll
2010-09-10 05:58 . 2005-02-18 21:19 916480 —-a-w- c:\windows\system32\wininet.dll
2010-09-10 05:58 . 2002-08-29 11:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2010-09-10 05:58 . 2002-08-29 11:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2010-09-01 11:51 . 2002-08-29 11:00 285824 —-a-w- c:\windows\system32\atmfd.dll
2010-08-31 13:42 . 2002-08-29 11:00 1852800 —-a-w- c:\windows\system32\win32k.sys
2010-08-27 08:02 . 2002-08-29 11:00 119808 —-a-w- c:\windows\system32\t2embed.dll
2010-08-27 05:57 . 2002-08-29 11:00 99840 —-a-w- c:\windows\system32\srvsvc.dll
2010-08-26 13:39 . 2002-08-29 11:00 357248 —-a-w- c:\windows\system32\drivers\srv.sys
2010-08-26 12:52 . 2009-04-17 12:25 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2010-08-23 16:12 . 2002-08-29 11:00 617472 —-a-w- c:\windows\system32\comctl32.dll
2010-08-17 13:17 . 2002-08-29 11:00 58880 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-16 08:45 . 2004-06-08 04:48 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2005-05-30 01:00 . 2005-05-30 01:00 774144 —-a-w- c:\program files\RngInterstitial.dll
2007-12-09 19:03 . 2004-06-14 15:32 67696 —-a-w- c:\program files\mozilla firefox\components\jar50.dll
2007-12-09 19:04 . 2004-06-14 15:32 54376 —-a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2007-12-09 19:04 . 2007-04-21 18:54 34952 —-a-w- c:\program files\mozilla firefox\components\myspell.dll
2007-12-09 19:04 . 2007-04-21 18:54 46720 —-a-w- c:\program files\mozilla firefox\components\spellchk.dll
2007-12-09 19:04 . 2004-06-14 15:32 172144 —-a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-01-29 77824]
"Conime"="c:\windows\system32\conime.exe" [2008-04-14 27648]
"EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2009-04-07 1511424]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-14 53760]

c:\documents and settings\jimmy\Start Menu\Programs\Startup\
Event Reminder.lnk - c:\pmw\PMREMIND.EXE [1998-2-24 255408]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2002-12-11 45056]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2004-8-11 757760]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-18 65588]
Microsoft Works Calendar Reminders.lnk - c:\program files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-8-7 24633]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9322:TCP"= 9322:TCP:EKDiscovery
"9323:TCP"= 9323:TCP:EKDiscovery

S3 SWNC8U80;Sierra Wireless MUX NDIS Driver (UMTS80);c:\windows\SYSTEM32\DRIVERS\swnc8u80.sys [8/20/2008 1:35 PM 168192]
S3 SWUMX80;Sierra Wireless USB MUX Driver (UMTS80);c:\windows\SYSTEM32\DRIVERS\swumx80.sys [8/20/2008 1:36 PM 142976]
.
Contents of the 'Scheduled Tasks' folder

2010-11-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cb711c96de43e4.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-04 03:26]

2010-11-01 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2002-12-11 17:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.att.net/
mSearch Bar =
uInternet Connection Wizard,ShellNext = iexplore
LSP: bmnet.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} - hxxp://games.bellsouth.net/Gh/Tumblebugs/axhost.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://games.bellsouth.net/Gh/DeliciousWeb/zylomplayer.cab
FF - ProfilePath - c:\documents and settings\jimmy\Application Data\Mozilla\Firefox\Profiles\oxgkpr22.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-11-01 17:22
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(716)
c:\windows\system32\bmnet.dll

- - - - - - - > 'Explorer.EXE'(388)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2010-11-01 17:32:16 - machine was rebooted
ComboFix-quarantined-files.txt 2010-11-01 21:32
ComboFix2.txt 2010-10-31 06:07

Pre-Run: 95,379,726,336 bytes free
Post-Run: 95,393,214,464 bytes free

- - End Of File - - 12A99345946D33ECC301240585A8DF82
Post #12
curlee1982:

How is your computer running now? Please do this next:

🖼Click to load external image (Posted Image) Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Java™ 6 Update 20 can be updated from the Java control panel Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now. An update should begin; follow the prompts. If it does not, let me know.

Once the install is complete…

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button
  • There are two options in the window to clear the cache - Leave BOTH Checked
    • Applications and Applets
    • Trace and Log Files
  • Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.
🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.
  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
Please include the following in your next post:
  • Kaspersky log
  • How is the computer running now?
Post #13
Computer is running much better. Thank you so very much for your help. It has cleared up several issues we were having. I have updated Java but was unable to download Kaspersky-it is being updated and is currently unavailable. Will continue to check over the next day or two to see if it becomes available. What software do you recommend to best keep the computer clean from all of this stuff? Again, thanks for your assistance.-curlee1982
Post #14
Did you use the link in my last post to attempt to access the Kaspersky Online Scanner? If that still doesn't work you may run this one instead:

🖼Click to load external image (Posted Image) Please run ESET Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI