Созданные ответы форума
-
Сообщения
-
—- Disk sectors — GMER 1.0.15 —-
Disk DeviceHarddisk0DR0 sector 01: copy of MBR
Disk DeviceHarddisk0DR0 sector 02: copy of MBR
Disk DeviceHarddisk0DR0 sector 03: copy of MBR
Disk DeviceHarddisk0DR0 sector 04: copy of MBR
Disk DeviceHarddisk0DR0 sector 05: copy of MBR
Disk DeviceHarddisk0DR0 sector 06: copy of MBR
Disk DeviceHarddisk0DR0 sector 07: copy of MBR
Disk DeviceHarddisk0DR0 sector 08: copy of MBR
Disk DeviceHarddisk0DR0 sector 09: copy of MBR
Disk DeviceHarddisk0DR0 sector 10: copy of MBR
Disk DeviceHarddisk0DR0 sector 11: copy of MBR
Disk DeviceHarddisk0DR0 sector 12: copy of MBR
Disk DeviceHarddisk0DR0 sector 13: copy of MBR
Disk DeviceHarddisk0DR0 sector 14: copy of MBR
Disk DeviceHarddisk0DR0 sector 15: copy of MBR
Disk DeviceHarddisk0DR0 sector 16: copy of MBR
Disk DeviceHarddisk0DR0 sector 17: copy of MBR
Disk DeviceHarddisk0DR0 sector 18: copy of MBR
Disk DeviceHarddisk0DR0 sector 19: copy of MBR
Disk DeviceHarddisk0DR0 sector 20: copy of MBR
Disk DeviceHarddisk0DR0 sector 21: copy of MBR
Disk DeviceHarddisk0DR0 sector 22: copy of MBR
Disk DeviceHarddisk0DR0 sector 23: copy of MBR
Disk DeviceHarddisk0DR0 sector 24: copy of MBR
Disk DeviceHarddisk0DR0 sector 25: copy of MBR
Disk DeviceHarddisk0DR0 sector 26: copy of MBR
Disk DeviceHarddisk0DR0 sector 27: copy of MBR
Disk DeviceHarddisk0DR0 sector 28: copy of MBR
Disk DeviceHarddisk0DR0 sector 29: copy of MBR
Disk DeviceHarddisk0DR0 sector 30: copy of MBR
Disk DeviceHarddisk0DR0 sector 31: copy of MBR
Disk DeviceHarddisk0DR0 sector 32: copy of MBR
Disk DeviceHarddisk0DR0 sector 33: copy of MBR
Disk DeviceHarddisk0DR0 sector 34: copy of MBR
Disk DeviceHarddisk0DR0 sector 35: copy of MBR
Disk DeviceHarddisk0DR0 sector 36: copy of MBR
Disk DeviceHarddisk0DR0 sector 37: copy of MBR
Disk DeviceHarddisk0DR0 sector 38: copy of MBR
Disk DeviceHarddisk0DR0 sector 39: copy of MBR
Disk DeviceHarddisk0DR0 sector 40: copy of MBR
Disk DeviceHarddisk0DR0 sector 41: copy of MBR
Disk DeviceHarddisk0DR0 sector 42: copy of MBR
Disk DeviceHarddisk0DR0 sector 43: copy of MBR
Disk DeviceHarddisk0DR0 sector 44: copy of MBR
Disk DeviceHarddisk0DR0 sector 45: copy of MBR
Disk DeviceHarddisk0DR0 sector 46: copy of MBR
Disk DeviceHarddisk0DR0 sector 47: copy of MBR
Disk DeviceHarddisk0DR0 sector 48: copy of MBR
Disk DeviceHarddisk0DR0 sector 49: copy of MBR
Disk DeviceHarddisk0DR0 sector 50: copy of MBR
Disk DeviceHarddisk0DR0 sector 51: copy of MBR
Disk DeviceHarddisk0DR0 sector 52: copy of MBR
Disk DeviceHarddisk0DR0 sector 53: copy of MBR
Disk DeviceHarddisk0DR0 sector 54: copy of MBR
Disk DeviceHarddisk0DR0 sector 55: copy of MBR
Disk DeviceHarddisk0DR0 sector 56: copy of MBR
Disk DeviceHarddisk0DR0 sector 57: copy of MBR
Disk DeviceHarddisk0DR0 sector 58: copy of MBR
Disk DeviceHarddisk0DR0 sector 59: copy of MBR
Disk DeviceHarddisk0DR0 sector 60: copy of MBR
Disk DeviceHarddisk0DR0 sector 61: copy of MBR
Disk DeviceHarddisk0DR0 sector 62: rootkit-like behavior; copy of MBR
Disk DeviceHarddisk0DR0 sector 63: copy of MBR—- EOF — GMER 1.0.15 —-
Sorry 3a TPaHCJIiT …. slomalsya shift …. komp pa6otaet tak je … ra6otaet opera and icq and 6ol’we ni4ego… komp ctoit na proverke Dr.Web poka 4to 14% i 15 ploxix virusov ( trojan.PWS.Dumaru,infekcionnble konteinerbl, BackDoor.PowerSpider, Trojan.Shutdown.172,
SSDT BAA1C2F7 drweb32w.exe [4516.4864] ZwReplyWaitReceivePort
SSDT BAA1C1A6 drweb32w.exe [4516.4864] ZwReplyWaitReceivePortEx
SSDT BAA824C3 drweb32w.exe [4516.4864] ZwReplyWaitReplyPort
SSDT BAA6B794 drweb32w.exe [4516.4864] ZwRequestDeviceWakeup
SSDT BAA02209 drweb32w.exe [4516.4864] ZwRequestPort
SSDT BAA2D065 drweb32w.exe [4516.4864] ZwRequestWaitReplyPort
SSDT BAA9102F drweb32w.exe [4516.4864] ZwRequestWakeupLatency
SSDT BA9BA897 drweb32w.exe [4516.4864] ZwResetEvent
SSDT BA8D19D5 drweb32w.exe [4516.4864] ZwResetWriteWatch
SSDT BAA55452 drweb32w.exe [4516.4864] ZwRestoreKey
SSDT BAA95909 drweb32w.exe [4516.4864] ZwResumeProcess
SSDT BAA0157E drweb32w.exe [4516.4864] ZwResumeThread
SSDT BAA55573 drweb32w.exe [4516.4864] ZwSaveKey
SSDT BAA5567A drweb32w.exe [4516.4864] ZwSaveKeyEx
SSDT BAA557C7 drweb32w.exe [4516.4864] ZwSaveMergedKeys
SSDT BA9CC20E drweb32w.exe [4516.4864] ZwSecureConnectPort
SSDT BAAB73AC drweb32w.exe [4516.4864] ZwSetBootEntryOrder
SSDT BAAB78AE drweb32w.exe [4516.4864] ZwSetBootOptions
SSDT BAA94CB7 drweb32w.exe [4516.4864] ZwSetContextThread
SSDT BA93E489 drweb32w.exe [4516.4864] ZwSetDebugFilterState
SSDT BA95AF05 drweb32w.exe [4516.4864] ZwSetDefaultHardErrorPort
SSDT BA994C6F drweb32w.exe [4516.4864] ZwSetDefaultLocale
SSDT BA995020 drweb32w.exe [4516.4864] ZwSetDefaultUILanguage
SSDT BAAB835F drweb32w.exe [4516.4864] ZwSetDriverEntryOrder
SSDT BAA7103E drweb32w.exe [4516.4864] ZwSetEaFile
SSDT BAA4A551 drweb32w.exe [4516.4864] ZwSetEvent
SSDT BAAB570B drweb32w.exe [4516.4864] ZwSetEventBoostPriority
SSDT BAABC547 drweb32w.exe [4516.4864] ZwSetHighEventPair
SSDT BAABC479 drweb32w.exe [4516.4864] ZwSetHighWaitLowEventPair
SSDT BAA67DF2 drweb32w.exe [4516.4864] ZwSetInformationDebugObject
SSDT BA9F4821 drweb32w.exe [4516.4864] ZwSetInformationFile
SSDT BA9AA995 drweb32w.exe [4516.4864] ZwSetInformationJobObject
SSDT BAA5603D drweb32w.exe [4516.4864] ZwSetInformationKey
SSDT BA9EFA15 drweb32w.exe [4516.4864] ZwSetInformationObject
SSDT BAA34674 drweb32w.exe [4516.4864] ZwSetInformationProcess
SSDT BAA02B0E drweb32w.exe [4516.4864] ZwSetInformationThread
SSDT BA9DB8FA drweb32w.exe [4516.4864] ZwSetInformationToken
SSDT BAABCC96 drweb32w.exe [4516.4864] ZwSetIntervalProfile
SSDT BAA0E78F drweb32w.exe [4516.4864] ZwSetIoCompletion
SSDT BAA97089 drweb32w.exe [4516.4864] ZwSetLdtEntries
SSDT BAABC4E4 drweb32w.exe [4516.4864] ZwSetLowEventPair
SSDT BAABC40E drweb32w.exe [4516.4864] ZwSetLowWaitHighEventPair
SSDT BAA71C44 drweb32w.exe [4516.4864] ZwSetQuotaInformationFile
SSDT BA9D940D drweb32w.exe [4516.4864] ZwSetSecurityObject
SSDT BAAB5FAF drweb32w.exe [4516.4864] ZwSetSystemEnvironmentValue
SSDT BAAB65D7 drweb32w.exe [4516.4864] ZwSetSystemEnvironmentValueEx
SSDT BA9F737C drweb32w.exe [4516.4864] ZwSetSystemInformation
SSDT BAAD95E3 drweb32w.exe [4516.4864] ZwSetSystemPowerState
SSDT BAAB23B5 drweb32w.exe [4516.4864] ZwSetSystemTime
SSDT BA9ACBEA drweb32w.exe [4516.4864] ZwSetThreadExecutionState
SSDT BA839D2B drweb32w.exe [4516.4864] ZwSetTimer
SSDT BA9B3396 drweb32w.exe [4516.4864] ZwSetTimerResolution
SSDT BA95E3B6 drweb32w.exe [4516.4864] ZwSetUuidSeed
SSDT BA9E8A66 drweb32w.exe [4516.4864] ZwSetValueKey
SSDT BAA71C5E drweb32w.exe [4516.4864] ZwSetVolumeInformationFile
SSDT BAAB4039 drweb32w.exe [4516.4864] ZwShutdownSystem
SSDT BA8BE870 drweb32w.exe [4516.4864] ZwSignalAndWaitForSingleObject
SSDT BAABC9F4 drweb32w.exe [4516.4864] ZwStartProfile
SSDT BAABCBCF drweb32w.exe [4516.4864] ZwStopProfile
SSDT BAA958AB drweb32w.exe [4516.4864] ZwSuspendProcess
SSDT BAA527B8 drweb32w.exe [4516.4864] ZwSuspendThread
SSDT BA9FDABA drweb32w.exe [4516.4864] ZwSystemDebugControl
SSDT BA9D52A6 drweb32w.exe [4516.4864] ZwTerminateJobObject
SSDT BA9E2F8A drweb32w.exe [4516.4864] ZwTerminateProcess
SSDT BAA0F711 drweb32w.exe [4516.4864] ZwTerminateThread
SSDT BAA01A8B drweb32w.exe [4516.4864] ZwTestAlert
SSDT BA8C2C6D drweb32w.exe [4516.4864] ZwThawRegistry
SSDT BAAA5113 drweb32w.exe [4516.4864] ZwThawTransactions
SSDT BA82C835 drweb32w.exe [4516.4864] ZwTraceEvent
SSDT BA9EEBF8 drweb32w.exe [4516.4864] ZwTraceControl
SSDT BAAB856B drweb32w.exe [4516.4864] ZwTranslateFilePath
SSDT BAA724B2 drweb32w.exe [4516.4864] ZwUnloadDriver
SSDT BAA4FDDC drweb32w.exe [4516.4864] ZwUnloadKey
SSDT BAA4FDF6 drweb32w.exe [4516.4864] ZwUnloadKey2
SSDT BAA5595B drweb32w.exe [4516.4864] ZwUnloadKeyEx
SSDT BA9DB4C7 drweb32w.exe [4516.4864] ZwUnlockFile
SSDT BA819E7D drweb32w.exe [4516.4864] ZwUnlockVirtualMemory
SSDT BAA24DA5 drweb32w.exe [4516.4864] ZwUnmapViewOfSection
SSDT BAAA8843 drweb32w.exe [4516.4864] ZwVdmControl
SSDT BAA678FF drweb32w.exe [4516.4864] ZwWaitForDebugEvent
SSDT BAA18C76 drweb32w.exe [4516.4864] ZwWaitForMultipleObjects
SSDT BAA49389 drweb32w.exe [4516.4864] ZwWaitForSingleObject
SSDT BAABC3A5 drweb32w.exe [4516.4864] ZwWaitHighEventPair
SSDT BAABC33C drweb32w.exe [4516.4864] ZwWaitLowEventPair
SSDT BAA271F3 drweb32w.exe [4516.4864] ZwWriteFile
SSDT BA9D637A drweb32w.exe [4516.4864] ZwWriteFileGather
SSDT BAA8235A drweb32w.exe [4516.4864] ZwWriteRequestData
SSDT BAA0DC51 drweb32w.exe [4516.4864] ZwWriteVirtualMemory
SSDT BA827190 drweb32w.exe [4516.4864] ZwYieldExecution
SSDT BA9BC39C drweb32w.exe [4516.4864] ZwCreateKeyedEvent
SSDT BAABCD8F drweb32w.exe [4516.4864] ZwOpenKeyedEvent
SSDT BA9F9FD2 drweb32w.exe [4516.4864] ZwReleaseKeyedEvent
SSDT BA9F915E drweb32w.exe [4516.4864] ZwWaitForKeyedEvent
SSDT BAA946A2 drweb32w.exe [4516.4864] ZwQueryPortInformationProcess
SSDT BAA52A3B drweb32w.exe [4516.4864] ZwGetCurrentProcessorNumber
SSDT BAA8B527 drweb32w.exe [4516.4864] ZwWaitForMultipleObjects32
SSDT BAA95AC4 drweb32w.exe [4516.4864] ZwGetNextProcess
SSDT BAA95D31 drweb32w.exe [4516.4864] ZwGetNextThread
SSDT BAA70497 drweb32w.exe [4516.4864] ZwCancelIoFileEx
SSDT BAA705D7 drweb32w.exe [4516.4864] ZwCancelSynchronousIoFile
SSDT BA9BE38D drweb32w.exe [4516.4864] ZwRemoveIoCompletionEx
SSDT BA9761F3 drweb32w.exe [4516.4864] ZwRegisterProtocolAddressInformation
SSDT BAAA78B3 drweb32w.exe [4516.4864] ZwPropagationComplete
SSDT BAAA7982 drweb32w.exe [4516.4864] ZwPropagationFailed
SSDT BA9BC95C drweb32w.exe [4516.4864] ZwCreateWorkerFactory
SSDT BA83CE73 drweb32w.exe [4516.4864] ZwReleaseWorkerFactoryWorker
SSDT BA83C9AB drweb32w.exe [4516.4864] ZwWaitForWorkViaWorkerFactory
SSDT BA81B4EE drweb32w.exe [4516.4864] ZwSetInformationWorkerFactory
SSDT BA8E627D drweb32w.exe [4516.4864] ZwQueryInformationWorkerFactory
SSDT BA82F0FA drweb32w.exe [4516.4864] ZwWorkerFactoryWorkerReady
SSDT BA9B7F21 drweb32w.exe [4516.4864] ZwShutdownWorkerFactory
SSDT BAA01BDC drweb32w.exe [4516.4864] ZwCreateThreadEx
SSDT BA9C8DD5 drweb32w.exe [4516.4864] ZwCreateUserProcess
SSDT BA9C64A9 drweb32w.exe [4516.4864] ZwQueryLicenseValue
SSDT BA9CF873 drweb32w.exe [4516.4864] ZwMapCMFModule
SSDT BA985BCF drweb32w.exe [4516.4864] ZwIsUILanguageComitted
SSDT BA985CE0 drweb32w.exe [4516.4864] ZwFlushInstallUILanguage
SSDT BA9CBD9D drweb32w.exe [4516.4864] ZwGetMUIRegistryInfo
SSDT BAABCE8B drweb32w.exe [4516.4864] ZwAcquireCMFViewOwnership
SSDT BAABD053 drweb32w.exe [4516.4864] ZwReleaseCMFViewOwnership—- Registry — GMER 1.0.15 —-
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@#4A4B4@4>494A4B0424>4 Bluetooth (?4@4>4B4>4:4>4;4 RFCOMM TDI) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@#4A4B4@4>494A4B0420404 Bluetooth (;484G4=4>494 A0454B484) 1?
Reg HKLMSYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@200440404?4B0454@4 Microsoft ISATAP 1?2?3?4?5?6?7?8?9?10?11?12?13?14?15?16?17?18?19?20?21?22?23?24?25?26?27?28?29?30?31?32?
Reg HKLMSYSTEMCurrentControlSetServicesBTHPORTParametersKeys00272c881c3
Reg HKLMSYSTEMCurrentControlSetServicesBTHPORTParametersKeys00272c881c3@001ca49fbcd1 0x3F 0xCE 0x2A 0x09 …
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@#4A4B4@4>494A4B0424>4 Bluetooth (?4@4>4B4>4:4>4;4 RFCOMM TDI) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@#4A4B4@4>494A4B0420404 Bluetooth (;484G4=4>494 A0454B484) 1?
Reg HKLMSYSTEMControlSet002ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions@200440404?4B0454@4 Microsoft ISATAP 1?2?3?4?5?6?7?8?9?10?11?12?13?14?15?16?17?18?19?20?21?22?23?24?25?26?27?28?29?30?31?32?
Reg HKLMSYSTEMControlSet002ServicesBTHPORTParametersKeys00272c881c3 (not active ControlSet)
Reg HKLMSYSTEMControlSet002ServicesBTHPORTParametersKeys00272c881c3@001ca49fbcd1 0x3F 0xCE 0x2A 0x09 …drweb32w.exe [4516.4864] ZwExtendSection
SSDT BA9AA3E8 drweb32w.exe [4516.4864] ZwFilterToken
SSDT BA9B41E1 drweb32w.exe [4516.4864] ZwFindAtom
SSDT BA9F27D1 drweb32w.exe [4516.4864] ZwFlushBuffersFile
SSDT BA9B230B drweb32w.exe [4516.4864] ZwFlushInstructionCache
SSDT BA98553A drweb32w.exe [4516.4864] ZwFlushKey
SSDT BA817A42 drweb32w.exe [4516.4864] ZwFlushProcessWriteBuffers
SSDT BA9AEA08 drweb32w.exe [4516.4864] ZwFlushVirtualMemory
SSDT BAA887CE drweb32w.exe [4516.4864] ZwFlushWriteBuffer
SSDT BAA87E97 drweb32w.exe [4516.4864] ZwFreeUserPhysicalPages
SSDT BA891CB7 drweb32w.exe [4516.4864] ZwFreeVirtualMemory
SSDT BA8C2C09 drweb32w.exe [4516.4864] ZwFreezeRegistry
SSDT BAAA502C drweb32w.exe [4516.4864] ZwFreezeTransactions
SSDT BAA2996D drweb32w.exe [4516.4864] ZwFsControlFile
SSDT BAA5274C drweb32w.exe [4516.4864] ZwGetContextThread
SSDT BAA9129F drweb32w.exe [4516.4864] ZwGetDevicePowerState
SSDT BA9AC6BB drweb32w.exe [4516.4864] ZwGetNlsSectionPtr
SSDT BA991842 drweb32w.exe [4516.4864] ZwGetPlugPlayEvent
SSDT BA8D126C drweb32w.exe [4516.4864] ZwGetWriteWatch
SSDT BA9BB237 drweb32w.exe [4516.4864] ZwImpersonateAnonymousToken
SSDT BA9E01B5 drweb32w.exe [4516.4864] ZwImpersonateClientOfPort
SSDT BA9CD92F drweb32w.exe [4516.4864] ZwImpersonateThread
SSDT BA9CBB36 drweb32w.exe [4516.4864] ZwInitializeNlsFiles
SSDT BA97145C drweb32w.exe [4516.4864] ZwInitializeRegistry
SSDT BAA9108C drweb32w.exe [4516.4864] ZwInitiatePowerAction
SSDT BAA549B7 drweb32w.exe [4516.4864] ZwIsProcessInJob
SSDT BAA91283 drweb32w.exe [4516.4864] ZwIsSystemResumeAutomatic
SSDT BA95FE77 drweb32w.exe [4516.4864] ZwListenPort
SSDT BA96FAD2 drweb32w.exe [4516.4864] ZwLoadDriver
SSDT BA98540A drweb32w.exe [4516.4864] ZwLoadKey
SSDT BA953D1E drweb32w.exe [4516.4864] ZwLoadKey2
SSDT BA9874C8 drweb32w.exe [4516.4864] ZwLoadKeyEx
SSDT BA9DB057 drweb32w.exe [4516.4864] ZwLockFile
SSDT BA9B0522 drweb32w.exe [4516.4864] ZwLockProductActivationKeys
SSDT BA94125A drweb32w.exe [4516.4864] ZwLockRegistryKey
SSDT BA81BFB1 drweb32w.exe [4516.4864] ZwLockVirtualMemory
SSDT BA9AD57A drweb32w.exe [4516.4864] ZwMakePermanentObject
SSDT BA9DFACF drweb32w.exe [4516.4864] ZwMakeTemporaryObject
SSDT BAA86AF8 drweb32w.exe [4516.4864] ZwMapUserPhysicalPages
SSDT BAA8706F drweb32w.exe [4516.4864] ZwMapUserPhysicalPagesScatter
SSDT BAA2474E drweb32w.exe [4516.4864] ZwMapViewOfSection
SSDT BAAB6C7B drweb32w.exe [4516.4864] ZwModifyBootEntry
SSDT BAAB7F1F drweb32w.exe [4516.4864] ZwModifyDriverEntry
SSDT BA9B12A2 drweb32w.exe [4516.4864] ZwNotifyChangeDirectoryFile
SSDT BA9C117C drweb32w.exe [4516.4864] ZwNotifyChangeKey
SSDT BA9C044A drweb32w.exe [4516.4864] ZwNotifyChangeMultipleKeys
SSDT BAA345BA drweb32w.exe [4516.4864] ZwOpenDirectoryObject
SSDT BA9E60E9 drweb32w.exe [4516.4864] ZwOpenEvent
SSDT BAABC267 drweb32w.exe [4516.4864] ZwOpenEventPair
SSDT BAA10607 drweb32w.exe [4516.4864] ZwOpenFile
SSDT BAA7023B drweb32w.exe [4516.4864] ZwOpenIoCompletion
SSDT BAA973D3 drweb32w.exe [4516.4864] ZwOpenJobObject
SSDT BAA15145 drweb32w.exe [4516.4864] ZwOpenKey
SSDT BA97C7A4 drweb32w.exe [4516.4864] ZwOpenKeyTransacted
SSDT BAA2D294 drweb32w.exe [4516.4864] ZwOpenMutant
SSDT BA9A7203 drweb32w.exe [4516.4864] ZwOpenPrivateNamespace
SSDT BA99A723 drweb32w.exe [4516.4864] ZwOpenObjectAuditAlarm
SSDT BAA11B10 drweb32w.exe [4516.4864] ZwOpenProcess
SSDT BAA0D299 drweb32w.exe [4516.4864] ZwOpenProcessToken
SSDT BAA08A2B drweb32w.exe [4516.4864] ZwOpenProcessTokenEx
SSDT BAA287F2 drweb32w.exe [4516.4864] ZwOpenSection
SSDT BA9AB82B drweb32w.exe [4516.4864] ZwOpenSemaphore
SSDT BA99D17B drweb32w.exe [4516.4864] ZwOpenSession
SSDT BA9DF93E drweb32w.exe [4516.4864] ZwOpenSymbolicLinkObject
SSDT BAA021D4 drweb32w.exe [4516.4864] ZwOpenThread
SSDT BAA0DA6F drweb32w.exe [4516.4864] ZwOpenThreadToken
SSDT BAA0B42F drweb32w.exe [4516.4864] ZwOpenThreadTokenEx
SSDT BAABBEC3 drweb32w.exe [4516.4864] ZwOpenTimer
SSDT BA9B2A7E drweb32w.exe [4516.4864] ZwPlugPlayControl
SSDT BAA301B7 drweb32w.exe [4516.4864] ZwPowerInformation
SSDT BA9ED8E9 drweb32w.exe [4516.4864] ZwPrivilegeCheck
SSDT BA99571D drweb32w.exe [4516.4864] ZwPrivilegeObjectAuditAlarm
SSDT BA9B0AAC drweb32w.exe [4516.4864] ZwPrivilegedServiceAuditAlarm
SSDT BAA368CE drweb32w.exe [4516.4864] ZwProtectVirtualMemory
SSDT BAA54B85 drweb32w.exe [4516.4864] ZwPulseEvent
SSDT BAA0C5F8 drweb32w.exe [4516.4864] ZwQueryAttributesFile
SSDT BAAB715D drweb32w.exe [4516.4864] ZwQueryBootEntryOrder
SSDT BAAB75B9 drweb32w.exe [4516.4864] ZwQueryBootOptions
SSDT BA8BDDD9 drweb32w.exe [4516.4864] ZwQueryDebugFilterState
SSDT BA9C8CDF drweb32w.exe [4516.4864] ZwQueryDefaultLocale
SSDT BA985A04 drweb32w.exe [4516.4864] ZwQueryDefaultUILanguage
SSDT BAA10D9A drweb32w.exe [4516.4864] ZwQueryDirectoryFile
SSDT BAA2A4C8 drweb32w.exe [4516.4864] ZwQueryDirectoryObject
SSDT BAAB7ACF drweb32w.exe [4516.4864] ZwQueryDriverEntryOrder
SSDT BA95DB4E drweb32w.exe [4516.4864] ZwQueryEaFile
SSDT BA9B3A6A drweb32w.exe [4516.4864] ZwQueryEvent
SSDT BA9D1C3F drweb32w.exe [4516.4864] ZwQueryFullAttributesFile
SSDT BA9B45CA drweb32w.exe [4516.4864] ZwQueryInformationAtom
SSDT BAA0B6FE drweb32w.exe [4516.4864] ZwQueryInformationFile
SSDT BA971D97 drweb32w.exe [4516.4864] ZwQueryInformationJobObject
SSDT BAA8222D drweb32w.exe [4516.4864] ZwQueryInformationPort
SSDT BAA4A9B2 drweb32w.exe [4516.4864] ZwQueryInformationProcess
SSDT BAA1C356 drweb32w.exe [4516.4864] ZwQueryInformationThread
SSDT BAA08B56 drweb32w.exe [4516.4864] ZwQueryInformationToken
SSDT BA98D701 drweb32w.exe [4516.4864] ZwQueryInstallUILanguage
SSDT BAABCCBB drweb32w.exe [4516.4864] ZwQueryIntervalProfile
SSDT BAA70312 drweb32w.exe [4516.4864] ZwQueryIoCompletion
SSDT BAA07FBE drweb32w.exe [4516.4864] ZwQueryKey
SSDT BAA565C9 drweb32w.exe [4516.4864] ZwQueryMultipleValueKey
SSDT BAABC5B8 drweb32w.exe [4516.4864] ZwQueryMutant
SSDT BA9D5D76 drweb32w.exe [4516.4864] ZwQueryObject
SSDT BAA56825 drweb32w.exe [4516.4864] ZwQueryOpenSubKeys
SSDT BAA4E34A drweb32w.exe [4516.4864] ZwQueryOpenSubKeysEx
SSDT BAA4C1FB drweb32w.exe [4516.4864] ZwQueryPerformanceCounter
SSDT BAA715F2 drweb32w.exe [4516.4864] ZwQueryQuotaInformationFile
SSDT BAA36A96 drweb32w.exe [4516.4864] ZwQuerySection
SSDT BA9D3B4D drweb32w.exe [4516.4864] ZwQuerySecurityObject
SSDT BAAB5AAE drweb32w.exe [4516.4864] ZwQuerySemaphore
SSDT BA9C8723 drweb32w.exe [4516.4864] ZwQuerySymbolicLinkObject
SSDT BAAB5CA3 drweb32w.exe [4516.4864] ZwQuerySystemEnvironmentValue
SSDT BAAB62B1 drweb32w.exe [4516.4864] ZwQuerySystemEnvironmentValueEx
SSDT BAA36CBF drweb32w.exe [4516.4864] ZwQuerySystemInformation
SSDT BAA129B3 drweb32w.exe [4516.4864] ZwQuerySystemTime
SSDT BAABBF96 drweb32w.exe [4516.4864] ZwQueryTimer
SSDT BA9B0EFB drweb32w.exe [4516.4864] ZwQueryTimerResolution
SSDT BAA05B4F drweb32w.exe [4516.4864] ZwQueryValueKey
SSDT BAA0C795 drweb32w.exe [4516.4864] ZwQueryVirtualMemory
SSDT BAA299A0 drweb32w.exe [4516.4864] ZwQueryVolumeInformationFile
SSDT BA9B3F7C drweb32w.exe [4516.4864] ZwQueueApcThread
SSDT BA85B4E0 drweb32w.exe [4516.4864] ZwRaiseException
SSDT BA97F554 drweb32w.exe [4516.4864] ZwRaiseHardError
SSDT BAA0BF28 drweb32w.exe [4516.4864] ZwReadFile
SSDT BA98DD2E drweb32w.exe [4516.4864] ZwReadFileScatter
SSDT BAA822ED drweb32w.exe [4516.4864] ZwReadRequestData
SSDT BA9DAE63 drweb32w.exe [4516.4864] ZwReadVirtualMemory
SSDT BAA950A2 drweb32w.exe [4516.4864] ZwRegisterThreadTerminatePort
SSDT BAA4A62E drweb32w.exe [4516.4864] ZwReleaseMutant
SSDT BA9F6FD2 drweb32w.exe [4516.4864] ZwReleaseSemaphore
SSDT BAA4CDFE drweb32w.exe [4516.4864] ZwRemoveIoCompletion
SSDT BAA676AF drweb32w.exe [4516.4864] ZwRemoveProcessDebug
SSDT BAA56ACE drweb32w.exe [4516.4864] ZwRenameKey
SSDT BAA5649E drweb32w.exe [4516.4864] ZwReplaceKey
SSDT BA8CB8BF drweb32w.exe [4516.4864] ZwReplacePartitionUnit
SSDT BA9F6ED2 drweb32w.exe [4516.4864] ZwReplyPort
SSDT BAA1C2F7 drweb32w.exe [4516.4864] ZwReplyWaitReceivePortSSDT BA9B7F21 drweb32w.exe [4516.252] ZwShutdownWorkerFactory
SSDT BAA01BDC drweb32w.exe [4516.252] ZwCreateThreadEx
SSDT BA9C8DD5 drweb32w.exe [4516.252] ZwCreateUserProcess
SSDT BA9C64A9 drweb32w.exe [4516.252] ZwQueryLicenseValue
SSDT BA9CF873 drweb32w.exe [4516.252] ZwMapCMFModule
SSDT BA985BCF drweb32w.exe [4516.252] ZwIsUILanguageComitted
SSDT BA985CE0 drweb32w.exe [4516.252] ZwFlushInstallUILanguage
SSDT BA9CBD9D drweb32w.exe [4516.252] ZwGetMUIRegistryInfo
SSDT BAABCE8B drweb32w.exe [4516.252] ZwAcquireCMFViewOwnership
SSDT BAABD053 drweb32w.exe [4516.252] ZwReleaseCMFViewOwnership—- Threads — GMER 1.0.15 —-
Thread drweb32w.exe [4516:4864] SSDT 0x84E6F008 != 0x81CD68E0
SSDT BA9BA971 drweb32w.exe [4516.4864] ZwAcceptConnectPort
SSDT BA827013 drweb32w.exe [4516.4864] ZwAccessCheck
SSDT BA9EEAC3 drweb32w.exe [4516.4864] ZwAccessCheckAndAuditAlarm
SSDT BA82C175 drweb32w.exe [4516.4864] ZwAccessCheckByType
SSDT BA9EE9E3 drweb32w.exe [4516.4864] ZwAccessCheckByTypeAndAuditAlarm
SSDT BA8E0B20 drweb32w.exe [4516.4864] ZwAccessCheckByTypeResultList
SSDT BAAA1A87 drweb32w.exe [4516.4864] ZwAccessCheckByTypeResultListAndAuditAlarm
SSDT BAAA1AD0 drweb32w.exe [4516.4864] ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
SSDT BA9BCBD1 drweb32w.exe [4516.4864] ZwAddAtom
SSDT BAAB6A7A drweb32w.exe [4516.4864] ZwAddBootEntry
SSDT BAAB7D1E drweb32w.exe [4516.4864] ZwAddDriverEntry
SSDT BA9E49F0 drweb32w.exe [4516.4864] ZwAdjustGroupsToken
SSDT BA9E598B drweb32w.exe [4516.4864] ZwAdjustPrivilegesToken
SSDT BAA9596F drweb32w.exe [4516.4864] ZwAlertResumeThread
SSDT BA9FAF5F drweb32w.exe [4516.4864] ZwAlertThread
SSDT BA9DADD7 drweb32w.exe [4516.4864] ZwAllocateLocallyUniqueId
SSDT BAA87765 drweb32w.exe [4516.4864] ZwAllocateUserPhysicalPages
SSDT BA9A6FA9 drweb32w.exe [4516.4864] ZwAllocateUuids
SSDT BAA32AB8 drweb32w.exe [4516.4864] ZwAllocateVirtualMemory
SSDT BA9ED360 drweb32w.exe [4516.4864] ZwAlpcAcceptConnectPort
SSDT BA9B4335 drweb32w.exe [4516.4864] ZwAlpcCancelMessage
SSDT BA9EC185 drweb32w.exe [4516.4864] ZwAlpcConnectPort
SSDT BA9BC7B2 drweb32w.exe [4516.4864] ZwAlpcCreatePort
SSDT BA9FD4E6 drweb32w.exe [4516.4864] ZwAlpcCreatePortSection
SSDT BA9B2824 drweb32w.exe [4516.4864] ZwAlpcCreateResourceReserve
SSDT BA9FD2B6 drweb32w.exe [4516.4864] ZwAlpcCreateSectionView
SSDT BA9F6CA4 drweb32w.exe [4516.4864] ZwAlpcCreateSecurityContext
SSDT BA9E02C7 drweb32w.exe [4516.4864] ZwAlpcDeletePortSection
SSDT BAA83119 drweb32w.exe [4516.4864] ZwAlpcDeleteResourceReserve
SSDT BA9E539F drweb32w.exe [4516.4864] ZwAlpcDeleteSectionView
SSDT BA9F7276 drweb32w.exe [4516.4864] ZwAlpcDeleteSecurityContext
SSDT BA9E61B7 drweb32w.exe [4516.4864] ZwAlpcDisconnectPort
SSDT BA9F255F drweb32w.exe [4516.4864] ZwAlpcImpersonateClientOfPort
SSDT BA9BDA8E drweb32w.exe [4516.4864] ZwAlpcOpenSenderProcess
SSDT BA9BFB42 drweb32w.exe [4516.4864] ZwAlpcOpenSenderThread
SSDT BA9E6259 drweb32w.exe [4516.4864] ZwAlpcQueryInformation
SSDT BA9FB0DA drweb32w.exe [4516.4864] ZwAlpcQueryInformationMessage
SSDT BAA8323C drweb32w.exe [4516.4864] ZwAlpcRevokeSecurityContext
SSDT BAA2BAF8 drweb32w.exe [4516.4864] ZwAlpcSendWaitReceivePort
SSDT BA9D8A5D drweb32w.exe [4516.4864] ZwAlpcSetInformation
SSDT BA9CDB35 drweb32w.exe [4516.4864] ZwApphelpCacheControl
SSDT BAA4F46C drweb32w.exe [4516.4864] ZwAreMappedFilesTheSame
SSDT BA9C01C0 drweb32w.exe [4516.4864] ZwAssignProcessToJobObject
SSDT BA8B938C drweb32w.exe [4516.4864] ZwCallbackReturn
SSDT BAA6B794 drweb32w.exe [4516.4864] ZwCancelDeviceWakeupRequest
SSDT BA9B3532 drweb32w.exe [4516.4864] ZwCancelIoFile
SSDT BA82C37E drweb32w.exe [4516.4864] ZwCancelTimer
SSDT BAA4A964 drweb32w.exe [4516.4864] ZwClearEvent
SSDT BAA1D8F5 drweb32w.exe [4516.4864] ZwClose
SSDT BA9EE908 drweb32w.exe [4516.4864] ZwCloseObjectAuditAlarm
SSDT BAA56D54 drweb32w.exe [4516.4864] ZwCompactKeys
SSDT BA9B7083 drweb32w.exe [4516.4864] ZwCompareTokens
SSDT BA9BA9EE drweb32w.exe [4516.4864] ZwCompleteConnectPort
SSDT BAA56FDF drweb32w.exe [4516.4864] ZwCompressKey
SSDT BA9CC7FC drweb32w.exe [4516.4864] ZwConnectPort
SSDT BA85B498 drweb32w.exe [4516.4864] ZwContinue
SSDT BAA6665C drweb32w.exe [4516.4864] ZwCreateDebugObject
SSDT BA9D95D4 drweb32w.exe [4516.4864] ZwCreateDirectoryObject
SSDT BAA286D4 drweb32w.exe [4516.4864] ZwCreateEvent
SSDT BAABC138 drweb32w.exe [4516.4864] ZwCreateEventPair
SSDT BAA26FB6 drweb32w.exe [4516.4864] ZwCreateFile
SSDT BA9CC10D drweb32w.exe [4516.4864] ZwCreateIoCompletion
SSDT BA9AB67A drweb32w.exe [4516.4864] ZwCreateJobObject
SSDT BAA976E1 drweb32w.exe [4516.4864] ZwCreateJobSet
SSDT BA9E7C3A drweb32w.exe [4516.4864] ZwCreateKey
SSDT BA97C7FF drweb32w.exe [4516.4864] ZwCreateKeyTransacted
SSDT BA99F9EA drweb32w.exe [4516.4864] ZwCreateMailslotFile
SSDT BAA36BC7 drweb32w.exe [4516.4864] ZwCreateMutant
SSDT BA9CE0B3 drweb32w.exe [4516.4864] ZwCreateNamedPipeFile
SSDT BA99A0C0 drweb32w.exe [4516.4864] ZwCreatePrivateNamespace
SSDT BA95160B drweb32w.exe [4516.4864] ZwCreatePagingFile
SSDT BA997581 drweb32w.exe [4516.4864] ZwCreatePort
SSDT BAA941AF drweb32w.exe [4516.4864] ZwCreateProcess
SSDT BAA941FA drweb32w.exe [4516.4864] ZwCreateProcessEx
SSDT BAABC7BB drweb32w.exe [4516.4864] ZwCreateProfile
SSDT BAA49157 drweb32w.exe [4516.4864] ZwCreateSection
SSDT BA9E0098 drweb32w.exe [4516.4864] ZwCreateSemaphore
SSDT BA9D9095 drweb32w.exe [4516.4864] ZwCreateSymbolicLinkObject
SSDT BAA93FE4 drweb32w.exe [4516.4864] ZwCreateThread
SSDT BA9BC815 drweb32w.exe [4516.4864] ZwCreateTimer
SSDT BA9DCDBB drweb32w.exe [4516.4864] ZwCreateToken
SSDT BA9ABF9D drweb32w.exe [4516.4864] ZwCreateTransaction
SSDT BAAA42CD drweb32w.exe [4516.4864] ZwOpenTransaction
SSDT BAAA44DC drweb32w.exe [4516.4864] ZwQueryInformationTransaction
SSDT BA9752FC drweb32w.exe [4516.4864] ZwQueryInformationTransactionManager
SSDT BAAA3C04 drweb32w.exe [4516.4864] ZwPrePrepareEnlistment
SSDT BAAA3B43 drweb32w.exe [4516.4864] ZwPrepareEnlistment
SSDT BAAA3CC5 drweb32w.exe [4516.4864] ZwCommitEnlistment
SSDT BAAA4149 drweb32w.exe [4516.4864] ZwReadOnlyEnlistment
SSDT BAAA4208 drweb32w.exe [4516.4864] ZwRollbackComplete
SSDT BAAA3D86 drweb32w.exe [4516.4864] ZwRollbackEnlistment
SSDT BA97AB09 drweb32w.exe [4516.4864] ZwCommitTransaction
SSDT BA9783DC drweb32w.exe [4516.4864] ZwRollbackTransaction
SSDT BAAA3F08 drweb32w.exe [4516.4864] ZwPrePrepareComplete
SSDT BAAA3E47 drweb32w.exe [4516.4864] ZwPrepareComplete
SSDT BAAA3FC9 drweb32w.exe [4516.4864] ZwCommitComplete
SSDT BAAA408A drweb32w.exe [4516.4864] ZwSinglePhaseReject
SSDT BAAA4DB1 drweb32w.exe [4516.4864] ZwSetInformationTransaction
SSDT BAAA561B drweb32w.exe [4516.4864] ZwSetInformationTransactionManager
SSDT BA975CEE drweb32w.exe [4516.4864] ZwSetInformationResourceManager
SSDT BA983B39 drweb32w.exe [4516.4864] ZwCreateTransactionManager
SSDT BA975F72 drweb32w.exe [4516.4864] ZwOpenTransactionManager
SSDT BAAA53E3 drweb32w.exe [4516.4864] ZwRenameTransactionManager
SSDT BAAA5550 drweb32w.exe [4516.4864] ZwRollforwardTransactionManager
SSDT BAAA368C drweb32w.exe [4516.4864] ZwRecoverEnlistment
SSDT BA9853B6 drweb32w.exe [4516.4864] ZwRecoverResourceManager
SSDT BA981D58 drweb32w.exe [4516.4864] ZwRecoverTransactionManager
SSDT BA98368D drweb32w.exe [4516.4864] ZwCreateResourceManager
SSDT BA97583C drweb32w.exe [4516.4864] ZwOpenResourceManager
SSDT BA98542B drweb32w.exe [4516.4864] ZwGetNotificationResourceManager
SSDT BAAA5197 drweb32w.exe [4516.4864] ZwQueryInformationResourceManager
SSDT BA979B9C drweb32w.exe [4516.4864] ZwCreateEnlistment
SSDT BAAA34C3 drweb32w.exe [4516.4864] ZwOpenEnlistment
SSDT BAAA3954 drweb32w.exe [4516.4864] ZwSetInformationEnlistment
SSDT BAAA36E7 drweb32w.exe [4516.4864] ZwQueryInformationEnlistment
SSDT BA98DC77 drweb32w.exe [4516.4864] ZwCreateWaitablePort
SSDT BAA67564 drweb32w.exe [4516.4864] ZwDebugActiveProcess
SSDT BAA67C29 drweb32w.exe [4516.4864] ZwDebugContinue
SSDT BAA4A748 drweb32w.exe [4516.4864] ZwDelayExecution
SSDT BA9B471D drweb32w.exe [4516.4864] ZwDeleteAtom
SSDT BAAB6AAB drweb32w.exe [4516.4864] ZwDeleteBootEntry
SSDT BAAB7D4F drweb32w.exe [4516.4864] ZwDeleteDriverEntry
SSDT BA971A67 drweb32w.exe [4516.4864] ZwDeleteFile
SSDT BA9B581C drweb32w.exe [4516.4864] ZwDeleteKey
SSDT BAA8C843 drweb32w.exe [4516.4864] ZwDeletePrivateNamespace
SSDT BAA4F953 drweb32w.exe [4516.4864] ZwDeleteObjectAuditAlarm
SSDT BA9B01FF drweb32w.exe [4516.4864] ZwDeleteValueKey
SSDT BAA36A63 drweb32w.exe [4516.4864] ZwDeviceIoControlFile
SSDT BA94F0B9 drweb32w.exe [4516.4864] ZwDisplayString
SSDT BA9F9E8B drweb32w.exe [4516.4864] ZwDuplicateObject
SSDT BA9EB10F drweb32w.exe [4516.4864] ZwDuplicateToken
SSDT BAAB6CAC drweb32w.exe [4516.4864] ZwEnumerateBootEntries
SSDT BAAB7F4E drweb32w.exe [4516.4864] ZwEnumerateDriverEntries
SSDT BAA07BAC drweb32w.exe [4516.4864] ZwEnumerateKey
SSDT BAAB687B drweb32w.exe [4516.4864] ZwEnumerateSystemEnvironmentValuesEx
SSDT BAAA4B9F drweb32w.exe [4516.4864] ZwEnumerateTransactionObject
SSDT BA9D19C5 drweb32w.exe [4516.4864] ZwEnumerateValueKey
SSDT BAA85BB3SSDT BA8BDDD9 drweb32w.exe [4516.252] ZwQueryDebugFilterState
SSDT BA9C8CDF drweb32w.exe [4516.252] ZwQueryDefaultLocale
SSDT BA985A04 drweb32w.exe [4516.252] ZwQueryDefaultUILanguage
SSDT BAA10D9A drweb32w.exe [4516.252] ZwQueryDirectoryFile
SSDT BAA2A4C8 drweb32w.exe [4516.252] ZwQueryDirectoryObject
SSDT BAAB7ACF drweb32w.exe [4516.252] ZwQueryDriverEntryOrder
SSDT BA95DB4E drweb32w.exe [4516.252] ZwQueryEaFile
SSDT BA9B3A6A drweb32w.exe [4516.252] ZwQueryEvent
SSDT BA9D1C3F drweb32w.exe [4516.252] ZwQueryFullAttributesFile
SSDT BA9B45CA drweb32w.exe [4516.252] ZwQueryInformationAtom
SSDT BAA0B6FE drweb32w.exe [4516.252] ZwQueryInformationFile
SSDT BA971D97 drweb32w.exe [4516.252] ZwQueryInformationJobObject
SSDT BAA8222D drweb32w.exe [4516.252] ZwQueryInformationPort
SSDT BAA4A9B2 drweb32w.exe [4516.252] ZwQueryInformationProcess
SSDT BAA1C356 drweb32w.exe [4516.252] ZwQueryInformationThread
SSDT BAA08B56 drweb32w.exe [4516.252] ZwQueryInformationToken
SSDT BA98D701 drweb32w.exe [4516.252] ZwQueryInstallUILanguage
SSDT BAABCCBB drweb32w.exe [4516.252] ZwQueryIntervalProfile
SSDT BAA70312 drweb32w.exe [4516.252] ZwQueryIoCompletion
SSDT BAA07FBE drweb32w.exe [4516.252] ZwQueryKey
SSDT BAA565C9 drweb32w.exe [4516.252] ZwQueryMultipleValueKey
SSDT BAABC5B8 drweb32w.exe [4516.252] ZwQueryMutant
SSDT BA9D5D76 drweb32w.exe [4516.252] ZwQueryObject
SSDT BAA56825 drweb32w.exe [4516.252] ZwQueryOpenSubKeys
SSDT BAA4E34A drweb32w.exe [4516.252] ZwQueryOpenSubKeysEx
SSDT BAA4C1FB drweb32w.exe [4516.252] ZwQueryPerformanceCounter
SSDT BAA715F2 drweb32w.exe [4516.252] ZwQueryQuotaInformationFile
SSDT BAA36A96 drweb32w.exe [4516.252] ZwQuerySection
SSDT BA9D3B4D drweb32w.exe [4516.252] ZwQuerySecurityObject
SSDT BAAB5AAE drweb32w.exe [4516.252] ZwQuerySemaphore
SSDT BA9C8723 drweb32w.exe [4516.252] ZwQuerySymbolicLinkObject
SSDT BAAB5CA3 drweb32w.exe [4516.252] ZwQuerySystemEnvironmentValue
SSDT BAAB62B1 drweb32w.exe [4516.252] ZwQuerySystemEnvironmentValueEx
SSDT BAA36CBF drweb32w.exe [4516.252] ZwQuerySystemInformation
SSDT BAA129B3 drweb32w.exe [4516.252] ZwQuerySystemTime
SSDT BAABBF96 drweb32w.exe [4516.252] ZwQueryTimer
SSDT BA9B0EFB drweb32w.exe [4516.252] ZwQueryTimerResolution
SSDT BAA05B4F drweb32w.exe [4516.252] ZwQueryValueKey
SSDT BAA0C795 drweb32w.exe [4516.252] ZwQueryVirtualMemory
SSDT BAA299A0 drweb32w.exe [4516.252] ZwQueryVolumeInformationFile
SSDT BA9B3F7C drweb32w.exe [4516.252] ZwQueueApcThread
SSDT BA85B4E0 drweb32w.exe [4516.252] ZwRaiseException
SSDT BA97F554 drweb32w.exe [4516.252] ZwRaiseHardError
SSDT BAA0BF28 drweb32w.exe [4516.252] ZwReadFile
SSDT BA98DD2E drweb32w.exe [4516.252] ZwReadFileScatter
SSDT BAA822ED drweb32w.exe [4516.252] ZwReadRequestData
SSDT BA9DAE63 drweb32w.exe [4516.252] ZwReadVirtualMemory
SSDT BAA950A2 drweb32w.exe [4516.252] ZwRegisterThreadTerminatePort
SSDT BAA4A62E drweb32w.exe [4516.252] ZwReleaseMutant
SSDT BA9F6FD2 drweb32w.exe [4516.252] ZwReleaseSemaphore
SSDT BAA4CDFE drweb32w.exe [4516.252] ZwRemoveIoCompletion
SSDT BAA676AF drweb32w.exe [4516.252] ZwRemoveProcessDebug
SSDT BAA56ACE drweb32w.exe [4516.252] ZwRenameKey
SSDT BAA5649E drweb32w.exe [4516.252] ZwReplaceKey
SSDT BA8CB8BF drweb32w.exe [4516.252] ZwReplacePartitionUnit
SSDT BA9F6ED2 drweb32w.exe [4516.252] ZwReplyPort
SSDT BAA1C2F7 drweb32w.exe [4516.252] ZwReplyWaitReceivePort
SSDT BAA1C1A6 drweb32w.exe [4516.252] ZwReplyWaitReceivePortEx
SSDT BAA824C3 drweb32w.exe [4516.252] ZwReplyWaitReplyPort
SSDT BAA6B794 drweb32w.exe [4516.252] ZwRequestDeviceWakeup
SSDT BAA02209 drweb32w.exe [4516.252] ZwRequestPort
SSDT BAA2D065 drweb32w.exe [4516.252] ZwRequestWaitReplyPort
SSDT BAA9102F drweb32w.exe [4516.252] ZwRequestWakeupLatency
SSDT BA9BA897 drweb32w.exe [4516.252] ZwResetEvent
SSDT BA8D19D5 drweb32w.exe [4516.252] ZwResetWriteWatch
SSDT BAA55452 drweb32w.exe [4516.252] ZwRestoreKey
SSDT BAA95909 drweb32w.exe [4516.252] ZwResumeProcess
SSDT BAA0157E drweb32w.exe [4516.252] ZwResumeThread
SSDT BAA55573 drweb32w.exe [4516.252] ZwSaveKey
SSDT BAA5567A drweb32w.exe [4516.252] ZwSaveKeyEx
SSDT BAA557C7 drweb32w.exe [4516.252] ZwSaveMergedKeys
SSDT BA9CC20E drweb32w.exe [4516.252] ZwSecureConnectPort
SSDT BAAB73AC drweb32w.exe [4516.252] ZwSetBootEntryOrder
SSDT BAAB78AE drweb32w.exe [4516.252] ZwSetBootOptions
SSDT BAA94CB7 drweb32w.exe [4516.252] ZwSetContextThread
SSDT BA93E489 drweb32w.exe [4516.252] ZwSetDebugFilterState
SSDT BA95AF05 drweb32w.exe [4516.252] ZwSetDefaultHardErrorPort
SSDT BA994C6F drweb32w.exe [4516.252] ZwSetDefaultLocale
SSDT BA995020 drweb32w.exe [4516.252] ZwSetDefaultUILanguage
SSDT BAAB835F drweb32w.exe [4516.252] ZwSetDriverEntryOrder
SSDT BAA7103E drweb32w.exe [4516.252] ZwSetEaFile
SSDT BAA4A551 drweb32w.exe [4516.252] ZwSetEvent
SSDT BAAB570B drweb32w.exe [4516.252] ZwSetEventBoostPriority
SSDT BAABC547 drweb32w.exe [4516.252] ZwSetHighEventPair
SSDT BAABC479 drweb32w.exe [4516.252] ZwSetHighWaitLowEventPair
SSDT BAA67DF2 drweb32w.exe [4516.252] ZwSetInformationDebugObject
SSDT BA9F4821 drweb32w.exe [4516.252] ZwSetInformationFile
SSDT BA9AA995 drweb32w.exe [4516.252] ZwSetInformationJobObject
SSDT BAA5603D drweb32w.exe [4516.252] ZwSetInformationKey
SSDT BA9EFA15 drweb32w.exe [4516.252] ZwSetInformationObject
SSDT BAA34674 drweb32w.exe [4516.252] ZwSetInformationProcess
SSDT BAA02B0E drweb32w.exe [4516.252] ZwSetInformationThread
SSDT BA9DB8FA drweb32w.exe [4516.252] ZwSetInformationToken
SSDT BAABCC96 drweb32w.exe [4516.252] ZwSetIntervalProfile
SSDT BAA0E78F drweb32w.exe [4516.252] ZwSetIoCompletion
SSDT BAA97089 drweb32w.exe [4516.252] ZwSetLdtEntries
SSDT BAABC4E4 drweb32w.exe [4516.252] ZwSetLowEventPair
SSDT BAABC40E drweb32w.exe [4516.252] ZwSetLowWaitHighEventPair
SSDT BAA71C44 drweb32w.exe [4516.252] ZwSetQuotaInformationFile
SSDT BA9D940D drweb32w.exe [4516.252] ZwSetSecurityObject
SSDT BAAB5FAF drweb32w.exe [4516.252] ZwSetSystemEnvironmentValue
SSDT BAAB65D7 drweb32w.exe [4516.252] ZwSetSystemEnvironmentValueEx
SSDT BA9F737C drweb32w.exe [4516.252] ZwSetSystemInformation
SSDT BAAD95E3 drweb32w.exe [4516.252] ZwSetSystemPowerState
SSDT BAAB23B5 drweb32w.exe [4516.252] ZwSetSystemTime
SSDT BA9ACBEA drweb32w.exe [4516.252] ZwSetThreadExecutionState
SSDT BA839D2B drweb32w.exe [4516.252] ZwSetTimer
SSDT BA9B3396 drweb32w.exe [4516.252] ZwSetTimerResolution
SSDT BA95E3B6 drweb32w.exe [4516.252] ZwSetUuidSeed
SSDT BA9E8A66 drweb32w.exe [4516.252] ZwSetValueKey
SSDT BAA71C5E drweb32w.exe [4516.252] ZwSetVolumeInformationFile
SSDT BAAB4039 drweb32w.exe [4516.252] ZwShutdownSystem
SSDT BA8BE870 drweb32w.exe [4516.252] ZwSignalAndWaitForSingleObject
SSDT BAABC9F4 drweb32w.exe [4516.252] ZwStartProfile
SSDT BAABCBCF drweb32w.exe [4516.252] ZwStopProfile
SSDT BAA958AB drweb32w.exe [4516.252] ZwSuspendProcess
SSDT BAA527B8 drweb32w.exe [4516.252] ZwSuspendThread
SSDT BA9FDABA drweb32w.exe [4516.252] ZwSystemDebugControl
SSDT BA9D52A6 drweb32w.exe [4516.252] ZwTerminateJobObject
SSDT BA9E2F8A drweb32w.exe [4516.252] ZwTerminateProcess
SSDT BAA0F711 drweb32w.exe [4516.252] ZwTerminateThread
SSDT BAA01A8B drweb32w.exe [4516.252] ZwTestAlert
SSDT BA8C2C6D drweb32w.exe [4516.252] ZwThawRegistry
SSDT BAAA5113 drweb32w.exe [4516.252] ZwThawTransactions
SSDT BA82C835 drweb32w.exe [4516.252] ZwTraceEvent
SSDT BA9EEBF8 drweb32w.exe [4516.252] ZwTraceControl
SSDT BAAB856B drweb32w.exe [4516.252] ZwTranslateFilePath
SSDT BAA724B2 drweb32w.exe [4516.252] ZwUnloadDriver
SSDT BAA4FDDC drweb32w.exe [4516.252] ZwUnloadKey
SSDT BAA4FDF6 drweb32w.exe [4516.252] ZwUnloadKey2
SSDT BAA5595B drweb32w.exe [4516.252] ZwUnloadKeyEx
SSDT BA9DB4C7 drweb32w.exe [4516.252] ZwUnlockFile
SSDT BA819E7D drweb32w.exe [4516.252] ZwUnlockVirtualMemory
SSDT BAA24DA5 drweb32w.exe [4516.252] ZwUnmapViewOfSection
SSDT BAAA8843 drweb32w.exe [4516.252] ZwVdmControl
SSDT BAA678FF drweb32w.exe [4516.252] ZwWaitForDebugEvent
SSDT BAA18C76 drweb32w.exe [4516.252] ZwWaitForMultipleObjects
SSDT BAA49389 drweb32w.exe [4516.252] ZwWaitForSingleObject
SSDT BAABC3A5 drweb32w.exe [4516.252] ZwWaitHighEventPair
SSDT BAABC33C drweb32w.exe [4516.252] ZwWaitLowEventPair
SSDT BAA271F3 drweb32w.exe [4516.252] ZwWriteFile
SSDT BA9D637A drweb32w.exe [4516.252] ZwWriteFileGather
SSDT BAA8235A drweb32w.exe [4516.252] ZwWriteRequestData
SSDT BAA0DC51 drweb32w.exe [4516.252] ZwWriteVirtualMemory
SSDT BA827190 drweb32w.exe [4516.252] ZwYieldExecution
SSDT BA9BC39C drweb32w.exe [4516.252] ZwCreateKeyedEvent
SSDT BAABCD8F drweb32w.exe [4516.252] ZwOpenKeyedEvent
SSDT BA9F9FD2 drweb32w.exe [4516.252] ZwReleaseKeyedEvent
SSDT BA9F915E drweb32w.exe [4516.252] ZwWaitForKeyedEvent
SSDT BAA946A2 drweb32w.exe [4516.252] ZwQueryPortInformationProcess
SSDT BAA52A3B drweb32w.exe [4516.252] ZwGetCurrentProcessorNumber
SSDT BAA8B527 drweb32w.exe [4516.252] ZwWaitForMultipleObjects32
SSDT BAA95AC4 drweb32w.exe [4516.252] ZwGetNextProcess
SSDT BAA95D31 drweb32w.exe [4516.252] ZwGetNextThread
SSDT BAA70497 drweb32w.exe [4516.252] ZwCancelIoFileEx
SSDT BAA705D7 drweb32w.exe [4516.252] ZwCancelSynchronousIoFile
SSDT BA9BE38D drweb32w.exe [4516.252] ZwRemoveIoCompletionEx
SSDT BA9761F3 drweb32w.exe [4516.252] ZwRegisterProtocolAddressInformation
SSDT BAAA78B3 drweb32w.exe [4516.252] ZwPropagationComplete
SSDT BAAA7982 drweb32w.exe [4516.252] ZwPropagationFailed
SSDT BA9BC95C drweb32w.exe [4516.252] ZwCreateWorkerFactory
SSDT BA83CE73 drweb32w.exe [4516.252] ZwReleaseWorkerFactoryWorker
SSDT BA83C9AB drweb32w.exe [4516.252] ZwWaitForWorkViaWorkerFactory
SSDT BA81B4EE drweb32w.exe [4516.252] ZwSetInformationWorkerFactory
SSDT BA8E627D drweb32w.exe [4516.252] ZwQueryInformationWorkerFactory
SSDT BA82F0FASSDT BA9B581C drweb32w.exe [4516.252] ZwDeleteKey
SSDT BAA8C843 drweb32w.exe [4516.252] ZwDeletePrivateNamespace
SSDT BAA4F953 drweb32w.exe [4516.252] ZwDeleteObjectAuditAlarm
SSDT BA9B01FF drweb32w.exe [4516.252] ZwDeleteValueKey
SSDT BAA36A63 drweb32w.exe [4516.252] ZwDeviceIoControlFile
SSDT BA94F0B9 drweb32w.exe [4516.252] ZwDisplayString
SSDT BA9F9E8B drweb32w.exe [4516.252] ZwDuplicateObject
SSDT BA9EB10F drweb32w.exe [4516.252] ZwDuplicateToken
SSDT BAAB6CAC drweb32w.exe [4516.252] ZwEnumerateBootEntries
SSDT BAAB7F4E drweb32w.exe [4516.252] ZwEnumerateDriverEntries
SSDT BAA07BAC drweb32w.exe [4516.252] ZwEnumerateKey
SSDT BAAB687B drweb32w.exe [4516.252] ZwEnumerateSystemEnvironmentValuesEx
SSDT BAAA4B9F drweb32w.exe [4516.252] ZwEnumerateTransactionObject
SSDT BA9D19C5 drweb32w.exe [4516.252] ZwEnumerateValueKey
SSDT BAA85BB3 drweb32w.exe [4516.252] ZwExtendSection
SSDT BA9AA3E8 drweb32w.exe [4516.252] ZwFilterToken
SSDT BA9B41E1 drweb32w.exe [4516.252] ZwFindAtom
SSDT BA9F27D1 drweb32w.exe [4516.252] ZwFlushBuffersFile
SSDT BA9B230B drweb32w.exe [4516.252] ZwFlushInstructionCache
SSDT BA98553A drweb32w.exe [4516.252] ZwFlushKey
SSDT BA817A42 drweb32w.exe [4516.252] ZwFlushProcessWriteBuffers
SSDT BA9AEA08 drweb32w.exe [4516.252] ZwFlushVirtualMemory
SSDT BAA887CE drweb32w.exe [4516.252] ZwFlushWriteBuffer
SSDT BAA87E97 drweb32w.exe [4516.252] ZwFreeUserPhysicalPages
SSDT BA891CB7 drweb32w.exe [4516.252] ZwFreeVirtualMemory
SSDT BA8C2C09 drweb32w.exe [4516.252] ZwFreezeRegistry
SSDT BAAA502C drweb32w.exe [4516.252] ZwFreezeTransactions
SSDT BAA2996D drweb32w.exe [4516.252] ZwFsControlFile
SSDT BAA5274C drweb32w.exe [4516.252] ZwGetContextThread
SSDT BAA9129F drweb32w.exe [4516.252] ZwGetDevicePowerState
SSDT BA9AC6BB drweb32w.exe [4516.252] ZwGetNlsSectionPtr
SSDT BA991842 drweb32w.exe [4516.252] ZwGetPlugPlayEvent
SSDT BA8D126C drweb32w.exe [4516.252] ZwGetWriteWatch
SSDT BA9BB237 drweb32w.exe [4516.252] ZwImpersonateAnonymousToken
SSDT BA9E01B5 drweb32w.exe [4516.252] ZwImpersonateClientOfPort
SSDT BA9CD92F drweb32w.exe [4516.252] ZwImpersonateThread
SSDT BA9CBB36 drweb32w.exe [4516.252] ZwInitializeNlsFiles
SSDT BA97145C drweb32w.exe [4516.252] ZwInitializeRegistry
SSDT BAA9108C drweb32w.exe [4516.252] ZwInitiatePowerAction
SSDT BAA549B7 drweb32w.exe [4516.252] ZwIsProcessInJob
SSDT BAA91283 drweb32w.exe [4516.252] ZwIsSystemResumeAutomatic
SSDT BA95FE77 drweb32w.exe [4516.252] ZwListenPort
SSDT BA96FAD2 drweb32w.exe [4516.252] ZwLoadDriver
SSDT BA98540A drweb32w.exe [4516.252] ZwLoadKey
SSDT BA953D1E drweb32w.exe [4516.252] ZwLoadKey2
SSDT BA9874C8 drweb32w.exe [4516.252] ZwLoadKeyEx
SSDT BA9DB057 drweb32w.exe [4516.252] ZwLockFile
SSDT BA9B0522 drweb32w.exe [4516.252] ZwLockProductActivationKeys
SSDT BA94125A drweb32w.exe [4516.252] ZwLockRegistryKey
SSDT BA81BFB1 drweb32w.exe [4516.252] ZwLockVirtualMemory
SSDT BA9AD57A drweb32w.exe [4516.252] ZwMakePermanentObject
SSDT BA9DFACF drweb32w.exe [4516.252] ZwMakeTemporaryObject
SSDT BAA86AF8 drweb32w.exe [4516.252] ZwMapUserPhysicalPages
SSDT BAA8706F drweb32w.exe [4516.252] ZwMapUserPhysicalPagesScatter
SSDT BAA2474E drweb32w.exe [4516.252] ZwMapViewOfSection
SSDT BAAB6C7B drweb32w.exe [4516.252] ZwModifyBootEntry
SSDT BAAB7F1F drweb32w.exe [4516.252] ZwModifyDriverEntry
SSDT BA9B12A2 drweb32w.exe [4516.252] ZwNotifyChangeDirectoryFile
SSDT BA9C117C drweb32w.exe [4516.252] ZwNotifyChangeKey
SSDT BA9C044A drweb32w.exe [4516.252] ZwNotifyChangeMultipleKeys
SSDT BAA345BA drweb32w.exe [4516.252] ZwOpenDirectoryObject
SSDT BA9E60E9 drweb32w.exe [4516.252] ZwOpenEvent
SSDT BAABC267 drweb32w.exe [4516.252] ZwOpenEventPair
SSDT BAA10607 drweb32w.exe [4516.252] ZwOpenFile
SSDT BAA7023B drweb32w.exe [4516.252] ZwOpenIoCompletion
SSDT BAA973D3 drweb32w.exe [4516.252] ZwOpenJobObject
SSDT BAA15145 drweb32w.exe [4516.252] ZwOpenKey
SSDT BA97C7A4 drweb32w.exe [4516.252] ZwOpenKeyTransacted
SSDT BAA2D294 drweb32w.exe [4516.252] ZwOpenMutant
SSDT BA9A7203 drweb32w.exe [4516.252] ZwOpenPrivateNamespace
SSDT BA99A723 drweb32w.exe [4516.252] ZwOpenObjectAuditAlarm
SSDT BAA11B10 drweb32w.exe [4516.252] ZwOpenProcess
SSDT BAA0D299 drweb32w.exe [4516.252] ZwOpenProcessToken
SSDT BAA08A2B drweb32w.exe [4516.252] ZwOpenProcessTokenEx
SSDT BAA287F2 drweb32w.exe [4516.252] ZwOpenSection
SSDT BA9AB82B drweb32w.exe [4516.252] ZwOpenSemaphore
SSDT BA99D17B drweb32w.exe [4516.252] ZwOpenSession
SSDT BA9DF93E drweb32w.exe [4516.252] ZwOpenSymbolicLinkObject
SSDT BAA021D4 drweb32w.exe [4516.252] ZwOpenThread
SSDT BAA0DA6F drweb32w.exe [4516.252] ZwOpenThreadToken
SSDT BAA0B42F drweb32w.exe [4516.252] ZwOpenThreadTokenEx
SSDT BAABBEC3 drweb32w.exe [4516.252] ZwOpenTimer
SSDT BA9B2A7E drweb32w.exe [4516.252] ZwPlugPlayControl
SSDT BAA301B7 drweb32w.exe [4516.252] ZwPowerInformation
SSDT BA9ED8E9 drweb32w.exe [4516.252] ZwPrivilegeCheck
SSDT BA99571D drweb32w.exe [4516.252] ZwPrivilegeObjectAuditAlarm
SSDT BA9B0AAC drweb32w.exe [4516.252] ZwPrivilegedServiceAuditAlarm
SSDT BAA368CE drweb32w.exe [4516.252] ZwProtectVirtualMemory
SSDT BAA54B85 drweb32w.exe [4516.252] ZwPulseEvent
SSDT BAA0C5F8 drweb32w.exe [4516.252] ZwQueryAttributesFile
SSDT BAAB715D drweb32w.exe [4516.252] ZwQueryBootEntryOrder
SSDT BAAB75B9SSDT BAA70497 drweb32w.exe [4516.4112] ZwCancelIoFileEx
SSDT BAA705D7 drweb32w.exe [4516.4112] ZwCancelSynchronousIoFile
SSDT BA9BE38D drweb32w.exe [4516.4112] ZwRemoveIoCompletionEx
SSDT BA9761F3 drweb32w.exe [4516.4112] ZwRegisterProtocolAddressInformation
SSDT BAAA78B3 drweb32w.exe [4516.4112] ZwPropagationComplete
SSDT BAAA7982 drweb32w.exe [4516.4112] ZwPropagationFailed
SSDT BA9BC95C drweb32w.exe [4516.4112] ZwCreateWorkerFactory
SSDT BA83CE73 drweb32w.exe [4516.4112] ZwReleaseWorkerFactoryWorker
SSDT BA83C9AB drweb32w.exe [4516.4112] ZwWaitForWorkViaWorkerFactory
SSDT BA81B4EE drweb32w.exe [4516.4112] ZwSetInformationWorkerFactory
SSDT BA8E627D drweb32w.exe [4516.4112] ZwQueryInformationWorkerFactory
SSDT BA82F0FA drweb32w.exe [4516.4112] ZwWorkerFactoryWorkerReady
SSDT BA9B7F21 drweb32w.exe [4516.4112] ZwShutdownWorkerFactory
SSDT BAA01BDC drweb32w.exe [4516.4112] ZwCreateThreadEx
SSDT BA9C8DD5 drweb32w.exe [4516.4112] ZwCreateUserProcess
SSDT BA9C64A9 drweb32w.exe [4516.4112] ZwQueryLicenseValue
SSDT BA9CF873 drweb32w.exe [4516.4112] ZwMapCMFModule
SSDT BA985BCF drweb32w.exe [4516.4112] ZwIsUILanguageComitted
SSDT BA985CE0 drweb32w.exe [4516.4112] ZwFlushInstallUILanguage
SSDT BA9CBD9D drweb32w.exe [4516.4112] ZwGetMUIRegistryInfo
SSDT BAABCE8B drweb32w.exe [4516.4112] ZwAcquireCMFViewOwnership
SSDT BAABD053 drweb32w.exe [4516.4112] ZwReleaseCMFViewOwnership—- Threads — GMER 1.0.15 —-
Thread drweb32w.exe [4516:252] SSDT 0x84E6F008 != 0x81CD68E0
SSDT BA9BA971 drweb32w.exe [4516.252] ZwAcceptConnectPort
SSDT BA827013 drweb32w.exe [4516.252] ZwAccessCheck
SSDT BA9EEAC3 drweb32w.exe [4516.252] ZwAccessCheckAndAuditAlarm
SSDT BA82C175 drweb32w.exe [4516.252] ZwAccessCheckByType
SSDT BA9EE9E3 drweb32w.exe [4516.252] ZwAccessCheckByTypeAndAuditAlarm
SSDT BA8E0B20 drweb32w.exe [4516.252] ZwAccessCheckByTypeResultList
SSDT BAAA1A87 drweb32w.exe [4516.252] ZwAccessCheckByTypeResultListAndAuditAlarm
SSDT BAAA1AD0 drweb32w.exe [4516.252] ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
SSDT BA9BCBD1 drweb32w.exe [4516.252] ZwAddAtom
SSDT BAAB6A7A drweb32w.exe [4516.252] ZwAddBootEntry
SSDT BAAB7D1E drweb32w.exe [4516.252] ZwAddDriverEntry
SSDT BA9E49F0 drweb32w.exe [4516.252] ZwAdjustGroupsToken
SSDT BA9E598B drweb32w.exe [4516.252] ZwAdjustPrivilegesToken
SSDT BAA9596F drweb32w.exe [4516.252] ZwAlertResumeThread
SSDT BA9FAF5F drweb32w.exe [4516.252] ZwAlertThread
SSDT BA9DADD7 drweb32w.exe [4516.252] ZwAllocateLocallyUniqueId
SSDT BAA87765 drweb32w.exe [4516.252] ZwAllocateUserPhysicalPages
SSDT BA9A6FA9 drweb32w.exe [4516.252] ZwAllocateUuids
SSDT BAA32AB8 drweb32w.exe [4516.252] ZwAllocateVirtualMemory
SSDT BA9ED360 drweb32w.exe [4516.252] ZwAlpcAcceptConnectPort
SSDT BA9B4335 drweb32w.exe [4516.252] ZwAlpcCancelMessage
SSDT BA9EC185 drweb32w.exe [4516.252] ZwAlpcConnectPort
SSDT BA9BC7B2 drweb32w.exe [4516.252] ZwAlpcCreatePort
SSDT BA9FD4E6 drweb32w.exe [4516.252] ZwAlpcCreatePortSection
SSDT BA9B2824 drweb32w.exe [4516.252] ZwAlpcCreateResourceReserve
SSDT BA9FD2B6 drweb32w.exe [4516.252] ZwAlpcCreateSectionView
SSDT BA9F6CA4 drweb32w.exe [4516.252] ZwAlpcCreateSecurityContext
SSDT BA9E02C7 drweb32w.exe [4516.252] ZwAlpcDeletePortSection
SSDT BAA83119 drweb32w.exe [4516.252] ZwAlpcDeleteResourceReserve
SSDT BA9E539F drweb32w.exe [4516.252] ZwAlpcDeleteSectionView
SSDT BA9F7276 drweb32w.exe [4516.252] ZwAlpcDeleteSecurityContext
SSDT BA9E61B7 drweb32w.exe [4516.252] ZwAlpcDisconnectPort
SSDT BA9F255F drweb32w.exe [4516.252] ZwAlpcImpersonateClientOfPort
SSDT BA9BDA8E drweb32w.exe [4516.252] ZwAlpcOpenSenderProcess
SSDT BA9BFB42 drweb32w.exe [4516.252] ZwAlpcOpenSenderThread
SSDT BA9E6259 drweb32w.exe [4516.252] ZwAlpcQueryInformation
SSDT BA9FB0DA drweb32w.exe [4516.252] ZwAlpcQueryInformationMessage
SSDT BAA8323C drweb32w.exe [4516.252] ZwAlpcRevokeSecurityContext
SSDT BAA2BAF8 drweb32w.exe [4516.252] ZwAlpcSendWaitReceivePort
SSDT BA9D8A5D drweb32w.exe [4516.252] ZwAlpcSetInformation
SSDT BA9CDB35 drweb32w.exe [4516.252] ZwApphelpCacheControl
SSDT BAA4F46C drweb32w.exe [4516.252] ZwAreMappedFilesTheSame
SSDT BA9C01C0 drweb32w.exe [4516.252] ZwAssignProcessToJobObject
SSDT BA8B938C drweb32w.exe [4516.252] ZwCallbackReturn
SSDT BAA6B794 drweb32w.exe [4516.252] ZwCancelDeviceWakeupRequest
SSDT BA9B3532 drweb32w.exe [4516.252] ZwCancelIoFile
SSDT BA82C37E drweb32w.exe [4516.252] ZwCancelTimer
SSDT BAA4A964 drweb32w.exe [4516.252] ZwClearEvent
SSDT BAA1D8F5 drweb32w.exe [4516.252] ZwClose
SSDT BA9EE908 drweb32w.exe [4516.252] ZwCloseObjectAuditAlarm
SSDT BAA56D54 drweb32w.exe [4516.252] ZwCompactKeys
SSDT BA9B7083 drweb32w.exe [4516.252] ZwCompareTokens
SSDT BA9BA9EE drweb32w.exe [4516.252] ZwCompleteConnectPort
SSDT BAA56FDF drweb32w.exe [4516.252] ZwCompressKey
SSDT BA9CC7FC drweb32w.exe [4516.252] ZwConnectPort
SSDT BA85B498 drweb32w.exe [4516.252] ZwContinue
SSDT BAA6665C drweb32w.exe [4516.252] ZwCreateDebugObject
SSDT BA9D95D4 drweb32w.exe [4516.252] ZwCreateDirectoryObject
SSDT BAA286D4 drweb32w.exe [4516.252] ZwCreateEvent
SSDT BAABC138 drweb32w.exe [4516.252] ZwCreateEventPair
SSDT BAA26FB6 drweb32w.exe [4516.252] ZwCreateFile
SSDT BA9CC10D drweb32w.exe [4516.252] ZwCreateIoCompletion
SSDT BA9AB67A drweb32w.exe [4516.252] ZwCreateJobObject
SSDT BAA976E1 drweb32w.exe [4516.252] ZwCreateJobSet
SSDT BA9E7C3A drweb32w.exe [4516.252] ZwCreateKey
SSDT BA97C7FF drweb32w.exe [4516.252] ZwCreateKeyTransacted
SSDT BA99F9EA drweb32w.exe [4516.252] ZwCreateMailslotFile
SSDT BAA36BC7 drweb32w.exe [4516.252] ZwCreateMutant
SSDT BA9CE0B3 drweb32w.exe [4516.252] ZwCreateNamedPipeFile
SSDT BA99A0C0 drweb32w.exe [4516.252] ZwCreatePrivateNamespace
SSDT BA95160B drweb32w.exe [4516.252] ZwCreatePagingFile
SSDT BA997581 drweb32w.exe [4516.252] ZwCreatePort
SSDT BAA941AF drweb32w.exe [4516.252] ZwCreateProcess
SSDT BAA941FA drweb32w.exe [4516.252] ZwCreateProcessEx
SSDT BAABC7BB drweb32w.exe [4516.252] ZwCreateProfile
SSDT BAA49157 drweb32w.exe [4516.252] ZwCreateSection
SSDT BA9E0098 drweb32w.exe [4516.252] ZwCreateSemaphore
SSDT BA9D9095 drweb32w.exe [4516.252] ZwCreateSymbolicLinkObject
SSDT BAA93FE4 drweb32w.exe [4516.252] ZwCreateThread
SSDT BA9BC815 drweb32w.exe [4516.252] ZwCreateTimer
SSDT BA9DCDBB drweb32w.exe [4516.252] ZwCreateToken
SSDT BA9ABF9D drweb32w.exe [4516.252] ZwCreateTransaction
SSDT BAAA42CD drweb32w.exe [4516.252] ZwOpenTransaction
SSDT BAAA44DC drweb32w.exe [4516.252] ZwQueryInformationTransaction
SSDT BA9752FC drweb32w.exe [4516.252] ZwQueryInformationTransactionManager
SSDT BAAA3C04 drweb32w.exe [4516.252] ZwPrePrepareEnlistment
SSDT BAAA3B43 drweb32w.exe [4516.252] ZwPrepareEnlistment
SSDT BAAA3CC5 drweb32w.exe [4516.252] ZwCommitEnlistment
SSDT BAAA4149 drweb32w.exe [4516.252] ZwReadOnlyEnlistment
SSDT BAAA4208 drweb32w.exe [4516.252] ZwRollbackComplete
SSDT BAAA3D86 drweb32w.exe [4516.252] ZwRollbackEnlistment
SSDT BA97AB09 drweb32w.exe [4516.252] ZwCommitTransaction
SSDT BA9783DC drweb32w.exe [4516.252] ZwRollbackTransaction
SSDT BAAA3F08 drweb32w.exe [4516.252] ZwPrePrepareComplete
SSDT BAAA3E47 drweb32w.exe [4516.252] ZwPrepareComplete
SSDT BAAA3FC9 drweb32w.exe [4516.252] ZwCommitComplete
SSDT BAAA408A drweb32w.exe [4516.252] ZwSinglePhaseReject
SSDT BAAA4DB1 drweb32w.exe [4516.252] ZwSetInformationTransaction
SSDT BAAA561B drweb32w.exe [4516.252] ZwSetInformationTransactionManager
SSDT BA975CEE drweb32w.exe [4516.252] ZwSetInformationResourceManager
SSDT BA983B39 drweb32w.exe [4516.252] ZwCreateTransactionManager
SSDT BA975F72 drweb32w.exe [4516.252] ZwOpenTransactionManager
SSDT BAAA53E3 drweb32w.exe [4516.252] ZwRenameTransactionManager
SSDT BAAA5550 drweb32w.exe [4516.252] ZwRollforwardTransactionManager
SSDT BAAA368C drweb32w.exe [4516.252] ZwRecoverEnlistment
SSDT BA9853B6 drweb32w.exe [4516.252] ZwRecoverResourceManager
SSDT BA981D58 drweb32w.exe [4516.252] ZwRecoverTransactionManager
SSDT BA98368D drweb32w.exe [4516.252] ZwCreateResourceManager
SSDT BA97583C drweb32w.exe [4516.252] ZwOpenResourceManager
SSDT BA98542B drweb32w.exe [4516.252] ZwGetNotificationResourceManager
SSDT BAAA5197 drweb32w.exe [4516.252] ZwQueryInformationResourceManager
SSDT BA979B9C drweb32w.exe [4516.252] ZwCreateEnlistment
SSDT BAAA34C3 drweb32w.exe [4516.252] ZwOpenEnlistment
SSDT BAAA3954 drweb32w.exe [4516.252] ZwSetInformationEnlistment
SSDT BAAA36E7 drweb32w.exe [4516.252] ZwQueryInformationEnlistment
SSDT BA98DC77 drweb32w.exe [4516.252] ZwCreateWaitablePort
SSDT BAA67564 drweb32w.exe [4516.252] ZwDebugActiveProcess
SSDT BAA67C29 drweb32w.exe [4516.252] ZwDebugContinue
SSDT BAA4A748 drweb32w.exe [4516.252] ZwDelayExecution
SSDT BA9B471D drweb32w.exe [4516.252] ZwDeleteAtom
SSDT BAAB6AAB drweb32w.exe [4516.252] ZwDeleteBootEntry
SSDT BAAB7D4F drweb32w.exe [4516.252] ZwDeleteDriverEntry
SSDT BA971A67SSDT BA991842 drweb32w.exe [4516.4112] ZwGetPlugPlayEvent
SSDT BA8D126C drweb32w.exe [4516.4112] ZwGetWriteWatch
SSDT BA9BB237 drweb32w.exe [4516.4112] ZwImpersonateAnonymousToken
SSDT BA9E01B5 drweb32w.exe [4516.4112] ZwImpersonateClientOfPort
SSDT BA9CD92F drweb32w.exe [4516.4112] ZwImpersonateThread
SSDT BA9CBB36 drweb32w.exe [4516.4112] ZwInitializeNlsFiles
SSDT BA97145C drweb32w.exe [4516.4112] ZwInitializeRegistry
SSDT BAA9108C drweb32w.exe [4516.4112] ZwInitiatePowerAction
SSDT BAA549B7 drweb32w.exe [4516.4112] ZwIsProcessInJob
SSDT BAA91283 drweb32w.exe [4516.4112] ZwIsSystemResumeAutomatic
SSDT BA95FE77 drweb32w.exe [4516.4112] ZwListenPort
SSDT BA96FAD2 drweb32w.exe [4516.4112] ZwLoadDriver
SSDT BA98540A drweb32w.exe [4516.4112] ZwLoadKey
SSDT BA953D1E drweb32w.exe [4516.4112] ZwLoadKey2
SSDT BA9874C8 drweb32w.exe [4516.4112] ZwLoadKeyEx
SSDT BA9DB057 drweb32w.exe [4516.4112] ZwLockFile
SSDT BA9B0522 drweb32w.exe [4516.4112] ZwLockProductActivationKeys
SSDT BA94125A drweb32w.exe [4516.4112] ZwLockRegistryKey
SSDT BA81BFB1 drweb32w.exe [4516.4112] ZwLockVirtualMemory
SSDT BA9AD57A drweb32w.exe [4516.4112] ZwMakePermanentObject
SSDT BA9DFACF drweb32w.exe [4516.4112] ZwMakeTemporaryObject
SSDT BAA86AF8 drweb32w.exe [4516.4112] ZwMapUserPhysicalPages
SSDT BAA8706F drweb32w.exe [4516.4112] ZwMapUserPhysicalPagesScatter
SSDT BAA2474E drweb32w.exe [4516.4112] ZwMapViewOfSection
SSDT BAAB6C7B drweb32w.exe [4516.4112] ZwModifyBootEntry
SSDT BAAB7F1F drweb32w.exe [4516.4112] ZwModifyDriverEntry
SSDT BA9B12A2 drweb32w.exe [4516.4112] ZwNotifyChangeDirectoryFile
SSDT BA9C117C drweb32w.exe [4516.4112] ZwNotifyChangeKey
SSDT BA9C044A drweb32w.exe [4516.4112] ZwNotifyChangeMultipleKeys
SSDT BAA345BA drweb32w.exe [4516.4112] ZwOpenDirectoryObject
SSDT BA9E60E9 drweb32w.exe [4516.4112] ZwOpenEvent
SSDT BAABC267 drweb32w.exe [4516.4112] ZwOpenEventPair
SSDT BAA10607 drweb32w.exe [4516.4112] ZwOpenFile
SSDT BAA7023B drweb32w.exe [4516.4112] ZwOpenIoCompletion
SSDT BAA973D3 drweb32w.exe [4516.4112] ZwOpenJobObject
SSDT BAA15145 drweb32w.exe [4516.4112] ZwOpenKey
SSDT BA97C7A4 drweb32w.exe [4516.4112] ZwOpenKeyTransacted
SSDT BAA2D294 drweb32w.exe [4516.4112] ZwOpenMutant
SSDT BA9A7203 drweb32w.exe [4516.4112] ZwOpenPrivateNamespace
SSDT BA99A723 drweb32w.exe [4516.4112] ZwOpenObjectAuditAlarm
SSDT BAA11B10 drweb32w.exe [4516.4112] ZwOpenProcess
SSDT BAA0D299 drweb32w.exe [4516.4112] ZwOpenProcessToken
SSDT BAA08A2B drweb32w.exe [4516.4112] ZwOpenProcessTokenEx
SSDT BAA287F2 drweb32w.exe [4516.4112] ZwOpenSection
SSDT BA9AB82B drweb32w.exe [4516.4112] ZwOpenSemaphore
SSDT BA99D17B drweb32w.exe [4516.4112] ZwOpenSession
SSDT BA9DF93E drweb32w.exe [4516.4112] ZwOpenSymbolicLinkObject
SSDT BAA021D4 drweb32w.exe [4516.4112] ZwOpenThread
SSDT BAA0DA6F drweb32w.exe [4516.4112] ZwOpenThreadToken
SSDT BAA0B42F drweb32w.exe [4516.4112] ZwOpenThreadTokenEx
SSDT BAABBEC3 drweb32w.exe [4516.4112] ZwOpenTimer
SSDT BA9B2A7E drweb32w.exe [4516.4112] ZwPlugPlayControl
SSDT BAA301B7 drweb32w.exe [4516.4112] ZwPowerInformation
SSDT BA9ED8E9 drweb32w.exe [4516.4112] ZwPrivilegeCheck
SSDT BA99571D drweb32w.exe [4516.4112] ZwPrivilegeObjectAuditAlarm
SSDT BA9B0AAC drweb32w.exe [4516.4112] ZwPrivilegedServiceAuditAlarm
SSDT BAA368CE drweb32w.exe [4516.4112] ZwProtectVirtualMemory
SSDT BAA54B85 drweb32w.exe [4516.4112] ZwPulseEvent
SSDT BAA0C5F8 drweb32w.exe [4516.4112] ZwQueryAttributesFile
SSDT BAAB715D drweb32w.exe [4516.4112] ZwQueryBootEntryOrder
SSDT BAAB75B9 drweb32w.exe [4516.4112] ZwQueryBootOptions
SSDT BA8BDDD9 drweb32w.exe [4516.4112] ZwQueryDebugFilterState
SSDT BA9C8CDF drweb32w.exe [4516.4112] ZwQueryDefaultLocale
SSDT BA985A04 drweb32w.exe [4516.4112] ZwQueryDefaultUILanguage
SSDT BAA10D9A drweb32w.exe [4516.4112] ZwQueryDirectoryFile
SSDT BAA2A4C8 drweb32w.exe [4516.4112] ZwQueryDirectoryObject
SSDT BAAB7ACF drweb32w.exe [4516.4112] ZwQueryDriverEntryOrder
SSDT BA95DB4E drweb32w.exe [4516.4112] ZwQueryEaFile
SSDT BA9B3A6A drweb32w.exe [4516.4112] ZwQueryEvent
SSDT BA9D1C3F drweb32w.exe [4516.4112] ZwQueryFullAttributesFile
SSDT BA9B45CA drweb32w.exe [4516.4112] ZwQueryInformationAtom
SSDT BAA0B6FE drweb32w.exe [4516.4112] ZwQueryInformationFile
SSDT BA971D97 drweb32w.exe [4516.4112] ZwQueryInformationJobObject
SSDT BAA8222D drweb32w.exe [4516.4112] ZwQueryInformationPort
SSDT BAA4A9B2 drweb32w.exe [4516.4112] ZwQueryInformationProcess
SSDT BAA1C356 drweb32w.exe [4516.4112] ZwQueryInformationThread
SSDT BAA08B56 drweb32w.exe [4516.4112] ZwQueryInformationToken
SSDT BA98D701 drweb32w.exe [4516.4112] ZwQueryInstallUILanguage
SSDT BAABCCBB drweb32w.exe [4516.4112] ZwQueryIntervalProfile
SSDT BAA70312 drweb32w.exe [4516.4112] ZwQueryIoCompletion
SSDT BAA07FBE drweb32w.exe [4516.4112] ZwQueryKey
SSDT BAA565C9 drweb32w.exe [4516.4112] ZwQueryMultipleValueKey
SSDT BAABC5B8 drweb32w.exe [4516.4112] ZwQueryMutant
SSDT BA9D5D76 drweb32w.exe [4516.4112] ZwQueryObject
SSDT BAA56825 drweb32w.exe [4516.4112] ZwQueryOpenSubKeys
SSDT BAA4E34A drweb32w.exe [4516.4112] ZwQueryOpenSubKeysEx
SSDT BAA4C1FB drweb32w.exe [4516.4112] ZwQueryPerformanceCounter
SSDT BAA715F2 drweb32w.exe [4516.4112] ZwQueryQuotaInformationFile
SSDT BAA36A96 drweb32w.exe [4516.4112] ZwQuerySection
SSDT BA9D3B4D drweb32w.exe [4516.4112] ZwQuerySecurityObject
SSDT BAAB5AAE drweb32w.exe [4516.4112] ZwQuerySemaphore
SSDT BA9C8723 drweb32w.exe [4516.4112] ZwQuerySymbolicLinkObject
SSDT BAAB5CA3 drweb32w.exe [4516.4112] ZwQuerySystemEnvironmentValue
SSDT BAAB62B1 drweb32w.exe [4516.4112] ZwQuerySystemEnvironmentValueEx
SSDT BAA36CBF drweb32w.exe [4516.4112] ZwQuerySystemInformation
SSDT BAA129B3 drweb32w.exe [4516.4112] ZwQuerySystemTime
SSDT BAABBF96 drweb32w.exe [4516.4112] ZwQueryTimer
SSDT BA9B0EFB drweb32w.exe [4516.4112] ZwQueryTimerResolution
SSDT BAA05B4F drweb32w.exe [4516.4112] ZwQueryValueKey
SSDT BAA0C795 drweb32w.exe [4516.4112] ZwQueryVirtualMemory
SSDT BAA299A0 drweb32w.exe [4516.4112] ZwQueryVolumeInformationFile
SSDT BA9B3F7C drweb32w.exe [4516.4112] ZwQueueApcThread
SSDT BA85B4E0 drweb32w.exe [4516.4112] ZwRaiseException
SSDT BA97F554 drweb32w.exe [4516.4112] ZwRaiseHardError
SSDT BAA0BF28 drweb32w.exe [4516.4112] ZwReadFile
SSDT BA98DD2E drweb32w.exe [4516.4112] ZwReadFileScatter
SSDT BAA822ED drweb32w.exe [4516.4112] ZwReadRequestData
SSDT BA9DAE63 drweb32w.exe [4516.4112] ZwReadVirtualMemory
SSDT BAA950A2 drweb32w.exe [4516.4112] ZwRegisterThreadTerminatePort
SSDT BAA4A62E drweb32w.exe [4516.4112] ZwReleaseMutant
SSDT BA9F6FD2 drweb32w.exe [4516.4112] ZwReleaseSemaphore
SSDT BAA4CDFE drweb32w.exe [4516.4112] ZwRemoveIoCompletion
SSDT BAA676AF drweb32w.exe [4516.4112] ZwRemoveProcessDebug
SSDT BAA56ACE drweb32w.exe [4516.4112] ZwRenameKey
SSDT BAA5649E drweb32w.exe [4516.4112] ZwReplaceKey
SSDT BA8CB8BF drweb32w.exe [4516.4112] ZwReplacePartitionUnit
SSDT BA9F6ED2 drweb32w.exe [4516.4112] ZwReplyPort
SSDT BAA1C2F7 drweb32w.exe [4516.4112] ZwReplyWaitReceivePort
SSDT BAA1C1A6 drweb32w.exe [4516.4112] ZwReplyWaitReceivePortEx
SSDT BAA824C3 drweb32w.exe [4516.4112] ZwReplyWaitReplyPort
SSDT BAA6B794 drweb32w.exe [4516.4112] ZwRequestDeviceWakeup
SSDT BAA02209 drweb32w.exe [4516.4112] ZwRequestPort
SSDT BAA2D065 drweb32w.exe [4516.4112] ZwRequestWaitReplyPort
SSDT BAA9102F drweb32w.exe [4516.4112] ZwRequestWakeupLatency
SSDT BA9BA897 drweb32w.exe [4516.4112] ZwResetEvent
SSDT BA8D19D5 drweb32w.exe [4516.4112] ZwResetWriteWatch
SSDT BAA55452 drweb32w.exe [4516.4112] ZwRestoreKey
SSDT BAA95909 drweb32w.exe [4516.4112] ZwResumeProcess
SSDT BAA0157E drweb32w.exe [4516.4112] ZwResumeThread
SSDT BAA55573 drweb32w.exe [4516.4112] ZwSaveKey
SSDT BAA5567A drweb32w.exe [4516.4112] ZwSaveKeyEx
SSDT BAA557C7 drweb32w.exe [4516.4112] ZwSaveMergedKeys
SSDT BA9CC20E drweb32w.exe [4516.4112] ZwSecureConnectPort
SSDT BAAB73AC drweb32w.exe [4516.4112] ZwSetBootEntryOrder
SSDT BAAB78AE drweb32w.exe [4516.4112] ZwSetBootOptions
SSDT BAA94CB7 drweb32w.exe [4516.4112] ZwSetContextThread
SSDT BA93E489 drweb32w.exe [4516.4112] ZwSetDebugFilterState
SSDT BA95AF05 drweb32w.exe [4516.4112] ZwSetDefaultHardErrorPort
SSDT BA994C6F drweb32w.exe [4516.4112] ZwSetDefaultLocale
SSDT BA995020 drweb32w.exe [4516.4112] ZwSetDefaultUILanguage
SSDT BAAB835F drweb32w.exe [4516.4112] ZwSetDriverEntryOrder
SSDT BAA7103E drweb32w.exe [4516.4112] ZwSetEaFile
SSDT BAA4A551 drweb32w.exe [4516.4112] ZwSetEvent
SSDT BAAB570B drweb32w.exe [4516.4112] ZwSetEventBoostPriority
SSDT BAABC547 drweb32w.exe [4516.4112] ZwSetHighEventPair
SSDT BAABC479 drweb32w.exe [4516.4112] ZwSetHighWaitLowEventPair
SSDT BAA67DF2 drweb32w.exe [4516.4112] ZwSetInformationDebugObject
SSDT BA9F4821 drweb32w.exe [4516.4112] ZwSetInformationFile
SSDT BA9AA995 drweb32w.exe [4516.4112] ZwSetInformationJobObject
SSDT BAA5603D drweb32w.exe [4516.4112] ZwSetInformationKey
SSDT BA9EFA15 drweb32w.exe [4516.4112] ZwSetInformationObject
SSDT BAA34674 drweb32w.exe [4516.4112] ZwSetInformationProcess
SSDT BAA02B0E drweb32w.exe [4516.4112] ZwSetInformationThread
SSDT BA9DB8FA drweb32w.exe [4516.4112] ZwSetInformationToken
SSDT BAABCC96 drweb32w.exe [4516.4112] ZwSetIntervalProfile
SSDT BAA0E78F drweb32w.exe [4516.4112] ZwSetIoCompletion
SSDT BAA97089 drweb32w.exe [4516.4112] ZwSetLdtEntries
SSDT BAABC4E4 drweb32w.exe [4516.4112] ZwSetLowEventPair
SSDT BAABC40E drweb32w.exe [4516.4112] ZwSetLowWaitHighEventPair
SSDT BAA71C44 drweb32w.exe [4516.4112] ZwSetQuotaInformationFile
SSDT BA9D940D drweb32w.exe [4516.4112] ZwSetSecurityObject
SSDT BAAB5FAF drweb32w.exe [4516.4112] ZwSetSystemEnvironmentValue
SSDT BAAB65D7 drweb32w.exe [4516.4112] ZwSetSystemEnvironmentValueEx
SSDT BA9F737C drweb32w.exe [4516.4112] ZwSetSystemInformation
SSDT BAAD95E3 drweb32w.exe [4516.4112] ZwSetSystemPowerState
SSDT BAAB23B5 drweb32w.exe [4516.4112] ZwSetSystemTime
SSDT BA9ACBEA drweb32w.exe [4516.4112] ZwSetThreadExecutionState
SSDT BA839D2B drweb32w.exe [4516.4112] ZwSetTimer
SSDT BA9B3396 drweb32w.exe [4516.4112] ZwSetTimerResolution
SSDT BA95E3B6 drweb32w.exe [4516.4112] ZwSetUuidSeed
SSDT BA9E8A66 drweb32w.exe [4516.4112] ZwSetValueKey
SSDT BAA71C5E drweb32w.exe [4516.4112] ZwSetVolumeInformationFile
SSDT BAAB4039 drweb32w.exe [4516.4112] ZwShutdownSystem
SSDT BA8BE870 drweb32w.exe [4516.4112] ZwSignalAndWaitForSingleObject
SSDT BAABC9F4 drweb32w.exe [4516.4112] ZwStartProfile
SSDT BAABCBCF drweb32w.exe [4516.4112] ZwStopProfile
SSDT BAA958AB drweb32w.exe [4516.4112] ZwSuspendProcess
SSDT BAA527B8 drweb32w.exe [4516.4112] ZwSuspendThread
SSDT BA9FDABA drweb32w.exe [4516.4112] ZwSystemDebugControl
SSDT BA9D52A6 drweb32w.exe [4516.4112] ZwTerminateJobObject
SSDT BA9E2F8A drweb32w.exe [4516.4112] ZwTerminateProcess
SSDT BAA0F711 drweb32w.exe [4516.4112] ZwTerminateThread
SSDT BAA01A8B drweb32w.exe [4516.4112] ZwTestAlert
SSDT BA8C2C6D drweb32w.exe [4516.4112] ZwThawRegistry
SSDT BAAA5113 drweb32w.exe [4516.4112] ZwThawTransactions
SSDT BA82C835 drweb32w.exe [4516.4112] ZwTraceEvent
SSDT BA9EEBF8 drweb32w.exe [4516.4112] ZwTraceControl
SSDT BAAB856B drweb32w.exe [4516.4112] ZwTranslateFilePath
SSDT BAA724B2 drweb32w.exe [4516.4112] ZwUnloadDriver
SSDT BAA4FDDC drweb32w.exe [4516.4112] ZwUnloadKey
SSDT BAA4FDF6 drweb32w.exe [4516.4112] ZwUnloadKey2
SSDT BAA5595B drweb32w.exe [4516.4112] ZwUnloadKeyEx
SSDT BA9DB4C7 drweb32w.exe [4516.4112] ZwUnlockFile
SSDT BA819E7D drweb32w.exe [4516.4112] ZwUnlockVirtualMemory
SSDT BAA24DA5 drweb32w.exe [4516.4112] ZwUnmapViewOfSection
SSDT BAAA8843 drweb32w.exe [4516.4112] ZwVdmControl
SSDT BAA678FF drweb32w.exe [4516.4112] ZwWaitForDebugEvent
SSDT BAA18C76 drweb32w.exe [4516.4112] ZwWaitForMultipleObjects
SSDT BAA49389 drweb32w.exe [4516.4112] ZwWaitForSingleObject
SSDT BAABC3A5 drweb32w.exe [4516.4112] ZwWaitHighEventPair
SSDT BAABC33C drweb32w.exe [4516.4112] ZwWaitLowEventPair
SSDT BAA271F3 drweb32w.exe [4516.4112] ZwWriteFile
SSDT BA9D637A drweb32w.exe [4516.4112] ZwWriteFileGather
SSDT BAA8235A drweb32w.exe [4516.4112] ZwWriteRequestData
SSDT BAA0DC51 drweb32w.exe [4516.4112] ZwWriteVirtualMemory
SSDT BA827190 drweb32w.exe [4516.4112] ZwYieldExecution
SSDT BA9BC39C drweb32w.exe [4516.4112] ZwCreateKeyedEvent
SSDT BAABCD8F drweb32w.exe [4516.4112] ZwOpenKeyedEvent
SSDT BA9F9FD2 drweb32w.exe [4516.4112] ZwReleaseKeyedEvent
SSDT BA9F915E drweb32w.exe [4516.4112] ZwWaitForKeyedEvent
SSDT BAA946A2 drweb32w.exe [4516.4112] ZwQueryPortInformationProcess
SSDT BAA52A3B drweb32w.exe [4516.4112] ZwGetCurrentProcessorNumber
SSDT BAA8B527 drweb32w.exe [4516.4112] ZwWaitForMultipleObjects32
SSDT BAA95AC4 drweb32w.exe [4516.4112] ZwGetNextProcess
SSDT BAA95D31GMER 1.0.15.15281 — http://www.gmer.net
Rootkit scan 2010-01-04 00:39:50
Windows 6.0.6001 Service Pack 1
Running: gmer.exe; Driver: C:Users3ED1~1AppDataLocalTempugldipod.sys—- System — GMER 1.0.15 —-
SSDT ??C:Windowssystem32driversSandBox.sys ZwAlpcConnectPort [0x90E99B50]
SSDT ??C:Windowssystem32driversSandBox.sys ZwAlpcSendWaitReceivePort [0x90E9B3C0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwAssignProcessToJobObject [0x90E94C50]
SSDT ??C:Windowssystem32driversSandBox.sys ZwClose [0x90E79C70]
SSDT ??C:Windowssystem32driversSandBox.sys ZwConnectPort [0x90E98370]
SSDT ??C:Windowssystem32driversSandBox.sys ZwCreateFile [0x90E75FE0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwCreateKey [0x90E81280]
SSDT ??C:Windowssystem32driversSandBox.sys ZwCreateProcess [0x90E8D4A0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwCreateProcessEx [0x90E8DDA0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwCreateSection [0x90E74D90]
SSDT ??C:Windowssystem32driversSandBox.sys ZwCreateSymbolicLinkObject [0x90E81030]
SSDT ??C:Windowssystem32driversSandBox.sys ZwCreateThread [0x90E8BF60]
SSDT ??C:Windowssystem32driversSandBox.sys ZwDebugActiveProcess [0x90E9BE00]
SSDT ??C:Windowssystem32driversSandBox.sys ZwDeleteFile [0x90E7FD10]
SSDT ??C:Windowssystem32driversSandBox.sys ZwDeleteKey [0x90E82AF0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwDeleteValueKey [0x90E89590]
SSDT ??C:Windowssystem32driversSandBox.sys ZwLoadDriver [0x90E8ADA0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwMakeTemporaryObject [0x90E808A0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwOpenFile [0x90E78C90]
SSDT ??C:Windowssystem32driversSandBox.sys ZwOpenKey [0x90E821B0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwOpenProcess [0x90E8FE90]
SSDT ??C:Windowssystem32driversSandBox.sys ZwOpenSection [0x90E75600]
SSDT ??C:Windowssystem32driversSandBox.sys ZwOpenThread [0x90E8F250]
SSDT ??C:Windowssystem32driversSandBox.sys ZwProtectVirtualMemory [0x90E95F90]
SSDT ??C:Windowssystem32driversSandBox.sys ZwQueryDirectoryFile [0x90E7AA90]
SSDT ??C:Windowssystem32driversSandBox.sys ZwQueryKey [0x90E84940]
SSDT ??C:Windowssystem32driversSandBox.sys ZwQueryValueKey [0x90E85190]
SSDT ??C:Windowssystem32driversSandBox.sys ZwQueueApcThread [0x90E940C0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwRenameKey [0x90E88780]
SSDT ??C:Windowssystem32driversSandBox.sys ZwReplaceKey [0x90E866F0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwRequestPort [0x90E9A610]
SSDT ??C:Windowssystem32driversSandBox.sys ZwRequestWaitReplyPort [0x90E9A930]
SSDT ??C:Windowssystem32driversSandBox.sys ZwRestoreKey [0x90E87F10]
SSDT ??C:Windowssystem32driversSandBox.sys ZwSaveKey [0x90E86E70]
SSDT ??C:Windowssystem32driversSandBox.sys ZwSaveKeyEx [0x90E876C0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwSecureConnectPort [0x90E98F50]
SSDT ??C:Windowssystem32driversSandBox.sys ZwSetContextThread [0x90E93630]
SSDT ??C:Windowssystem32driversSandBox.sys ZwSetInformationDebugObject [0x90E9C3F0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwSetInformationFile [0x90E7BDE0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwSetSystemInformation [0x90E8A3B0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwSetValueKey [0x90E85A10]
SSDT ??C:Windowssystem32driversSandBox.sys ZwSuspendProcess [0x90E92380]
SSDT ??C:Windowssystem32driversSandBox.sys ZwSuspendThread [0x90E92CB0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwSystemDebugControl [0x90E9B640]
SSDT ??C:Windowssystem32driversSandBox.sys ZwTerminateProcess [0x90E90980]
SSDT ??C:Windowssystem32driversSandBox.sys ZwTerminateThread [0x90E91810]
SSDT ??C:Windowssystem32driversSandBox.sys ZwUnloadDriver [0x90E8B720]
SSDT ??C:Windowssystem32driversSandBox.sys ZwWriteVirtualMemory [0x90E954A0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwCreateThreadEx [0x90E8C9E0]
SSDT ??C:Windowssystem32driversSandBox.sys ZwCreateUserProcess [0x90E8E6B0]—- Kernel code sections — GMER 1.0.15 —-
.text ntkrnlpa.exe!KeSetTimerEx + 370 81CD6934 4 Bytes [50, 9B, E9, 90]
.text ntkrnlpa.exe!KeSetTimerEx + 3B4 81CD6978 4 Bytes JMP E9B3C081
.text ntkrnlpa.exe!KeSetTimerEx + 3C4 81CD6988 4 Bytes [50, 4C, E9, 90]
.text ntkrnlpa.exe!KeSetTimerEx + 3DC 81CD69A0 4 Bytes [70, 9C, E7, 90] {JO 0xffffffffffffff9e; OUT 0x90, EAX}
.text ntkrnlpa.exe!KeSetTimerEx + 3F4 81CD69B8 4 Bytes [70, 83, E9, 90]
.text …
.text C:Windowssystem32DRIVERSatikmdag.sys section is writeable [0x90403000, 0x213AB7, 0xE8000020]
? C:Users3ED1~1AppDataLocalTemp5syPeHZj.sys Íå óäàåòñÿ íàéòè óêàçàííûé ôàéë. !—- Threads — GMER 1.0.15 —-
Thread drweb32w.exe [4516:4112] SSDT 0x84E6F008 != 0x81CD68E0
SSDT BA9BA971 drweb32w.exe [4516.4112] ZwAcceptConnectPort
SSDT BA827013 drweb32w.exe [4516.4112] ZwAccessCheck
SSDT BA9EEAC3 drweb32w.exe [4516.4112] ZwAccessCheckAndAuditAlarm
SSDT BA82C175 drweb32w.exe [4516.4112] ZwAccessCheckByType
SSDT BA9EE9E3 drweb32w.exe [4516.4112] ZwAccessCheckByTypeAndAuditAlarm
SSDT BA8E0B20 drweb32w.exe [4516.4112] ZwAccessCheckByTypeResultList
SSDT BAAA1A87 drweb32w.exe [4516.4112] ZwAccessCheckByTypeResultListAndAuditAlarm
SSDT BAAA1AD0 drweb32w.exe [4516.4112] ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
SSDT BA9BCBD1 drweb32w.exe [4516.4112] ZwAddAtom
SSDT BAAB6A7A drweb32w.exe [4516.4112] ZwAddBootEntry
SSDT BAAB7D1E drweb32w.exe [4516.4112] ZwAddDriverEntry
SSDT BA9E49F0 drweb32w.exe [4516.4112] ZwAdjustGroupsToken
SSDT BA9E598B drweb32w.exe [4516.4112] ZwAdjustPrivilegesToken
SSDT BAA9596F drweb32w.exe [4516.4112] ZwAlertResumeThread
SSDT BA9FAF5F drweb32w.exe [4516.4112] ZwAlertThread
SSDT BA9DADD7 drweb32w.exe [4516.4112] ZwAllocateLocallyUniqueId
SSDT BAA87765 drweb32w.exe [4516.4112] ZwAllocateUserPhysicalPages
SSDT BA9A6FA9 drweb32w.exe [4516.4112] ZwAllocateUuids
SSDT BAA32AB8 drweb32w.exe [4516.4112] ZwAllocateVirtualMemory
SSDT BA9ED360 drweb32w.exe [4516.4112] ZwAlpcAcceptConnectPort
SSDT BA9B4335 drweb32w.exe [4516.4112] ZwAlpcCancelMessage
SSDT BA9EC185 drweb32w.exe [4516.4112] ZwAlpcConnectPort
SSDT BA9BC7B2 drweb32w.exe [4516.4112] ZwAlpcCreatePort
SSDT BA9FD4E6 drweb32w.exe [4516.4112] ZwAlpcCreatePortSection
SSDT BA9B2824 drweb32w.exe [4516.4112] ZwAlpcCreateResourceReserve
SSDT BA9FD2B6 drweb32w.exe [4516.4112] ZwAlpcCreateSectionView
SSDT BA9F6CA4 drweb32w.exe [4516.4112] ZwAlpcCreateSecurityContext
SSDT BA9E02C7 drweb32w.exe [4516.4112] ZwAlpcDeletePortSection
SSDT BAA83119 drweb32w.exe [4516.4112] ZwAlpcDeleteResourceReserve
SSDT BA9E539F drweb32w.exe [4516.4112] ZwAlpcDeleteSectionView
SSDT BA9F7276 drweb32w.exe [4516.4112] ZwAlpcDeleteSecurityContext
SSDT BA9E61B7 drweb32w.exe [4516.4112] ZwAlpcDisconnectPort
SSDT BA9F255F drweb32w.exe [4516.4112] ZwAlpcImpersonateClientOfPort
SSDT BA9BDA8E drweb32w.exe [4516.4112] ZwAlpcOpenSenderProcess
SSDT BA9BFB42 drweb32w.exe [4516.4112] ZwAlpcOpenSenderThread
SSDT BA9E6259 drweb32w.exe [4516.4112] ZwAlpcQueryInformation
SSDT BA9FB0DA drweb32w.exe [4516.4112] ZwAlpcQueryInformationMessage
SSDT BAA8323C drweb32w.exe [4516.4112] ZwAlpcRevokeSecurityContext
SSDT BAA2BAF8 drweb32w.exe [4516.4112] ZwAlpcSendWaitReceivePort
SSDT BA9D8A5D drweb32w.exe [4516.4112] ZwAlpcSetInformation
SSDT BA9CDB35 drweb32w.exe [4516.4112] ZwApphelpCacheControl
SSDT BAA4F46C drweb32w.exe [4516.4112] ZwAreMappedFilesTheSame
SSDT BA9C01C0 drweb32w.exe [4516.4112] ZwAssignProcessToJobObject
SSDT BA8B938C drweb32w.exe [4516.4112] ZwCallbackReturn
SSDT BAA6B794 drweb32w.exe [4516.4112] ZwCancelDeviceWakeupRequest
SSDT BA9B3532 drweb32w.exe [4516.4112] ZwCancelIoFile
SSDT BA82C37E drweb32w.exe [4516.4112] ZwCancelTimer
SSDT BAA4A964 drweb32w.exe [4516.4112] ZwClearEvent
SSDT BAA1D8F5 drweb32w.exe [4516.4112] ZwClose
SSDT BA9EE908 drweb32w.exe [4516.4112] ZwCloseObjectAuditAlarm
SSDT BAA56D54 drweb32w.exe [4516.4112] ZwCompactKeys
SSDT BA9B7083 drweb32w.exe [4516.4112] ZwCompareTokens
SSDT BA9BA9EE drweb32w.exe [4516.4112] ZwCompleteConnectPort
SSDT BAA56FDF drweb32w.exe [4516.4112] ZwCompressKey
SSDT BA9CC7FC drweb32w.exe [4516.4112] ZwConnectPort
SSDT BA85B498 drweb32w.exe [4516.4112] ZwContinue
SSDT BAA6665C drweb32w.exe [4516.4112] ZwCreateDebugObject
SSDT BA9D95D4 drweb32w.exe [4516.4112] ZwCreateDirectoryObject
SSDT BAA286D4 drweb32w.exe [4516.4112] ZwCreateEvent
SSDT BAABC138 drweb32w.exe [4516.4112] ZwCreateEventPair
SSDT BAA26FB6 drweb32w.exe [4516.4112] ZwCreateFile
SSDT BA9CC10D drweb32w.exe [4516.4112] ZwCreateIoCompletion
SSDT BA9AB67A drweb32w.exe [4516.4112] ZwCreateJobObject
SSDT BAA976E1 drweb32w.exe [4516.4112] ZwCreateJobSet
SSDT BA9E7C3A drweb32w.exe [4516.4112] ZwCreateKey
SSDT BA97C7FF drweb32w.exe [4516.4112] ZwCreateKeyTransacted
SSDT BA99F9EA drweb32w.exe [4516.4112] ZwCreateMailslotFile
SSDT BAA36BC7 drweb32w.exe [4516.4112] ZwCreateMutant
SSDT BA9CE0B3 drweb32w.exe [4516.4112] ZwCreateNamedPipeFile
SSDT BA99A0C0 drweb32w.exe [4516.4112] ZwCreatePrivateNamespace
SSDT BA95160B drweb32w.exe [4516.4112] ZwCreatePagingFile
SSDT BA997581 drweb32w.exe [4516.4112] ZwCreatePort
SSDT BAA941AF drweb32w.exe [4516.4112] ZwCreateProcess
SSDT BAA941FA drweb32w.exe [4516.4112] ZwCreateProcessEx
SSDT BAABC7BB drweb32w.exe [4516.4112] ZwCreateProfile
SSDT BAA49157 drweb32w.exe [4516.4112] ZwCreateSection
SSDT BA9E0098 drweb32w.exe [4516.4112] ZwCreateSemaphore
SSDT BA9D9095 drweb32w.exe [4516.4112] ZwCreateSymbolicLinkObject
SSDT BAA93FE4 drweb32w.exe [4516.4112] ZwCreateThread
SSDT BA9BC815 drweb32w.exe [4516.4112] ZwCreateTimer
SSDT BA9DCDBB drweb32w.exe [4516.4112] ZwCreateToken
SSDT BA9ABF9D drweb32w.exe [4516.4112] ZwCreateTransaction
SSDT BAAA42CD drweb32w.exe [4516.4112] ZwOpenTransaction
SSDT BAAA44DC drweb32w.exe [4516.4112] ZwQueryInformationTransaction
SSDT BA9752FC drweb32w.exe [4516.4112] ZwQueryInformationTransactionManager
SSDT BAAA3C04 drweb32w.exe [4516.4112] ZwPrePrepareEnlistment
SSDT BAAA3B43 drweb32w.exe [4516.4112] ZwPrepareEnlistment
SSDT BAAA3CC5 drweb32w.exe [4516.4112] ZwCommitEnlistment
SSDT BAAA4149 drweb32w.exe [4516.4112] ZwReadOnlyEnlistment
SSDT BAAA4208 drweb32w.exe [4516.4112] ZwRollbackComplete
SSDT BAAA3D86 drweb32w.exe [4516.4112] ZwRollbackEnlistment
SSDT BA97AB09 drweb32w.exe [4516.4112] ZwCommitTransaction
SSDT BA9783DC drweb32w.exe [4516.4112] ZwRollbackTransaction
SSDT BAAA3F08 drweb32w.exe [4516.4112] ZwPrePrepareComplete
SSDT BAAA3E47 drweb32w.exe [4516.4112] ZwPrepareComplete
SSDT BAAA3FC9 drweb32w.exe [4516.4112] ZwCommitComplete
SSDT BAAA408A drweb32w.exe [4516.4112] ZwSinglePhaseReject
SSDT BAAA4DB1 drweb32w.exe [4516.4112] ZwSetInformationTransaction
SSDT BAAA561B drweb32w.exe [4516.4112] ZwSetInformationTransactionManager
SSDT BA975CEE drweb32w.exe [4516.4112] ZwSetInformationResourceManager
SSDT BA983B39 drweb32w.exe [4516.4112] ZwCreateTransactionManager
SSDT BA975F72 drweb32w.exe [4516.4112] ZwOpenTransactionManager
SSDT BAAA53E3 drweb32w.exe [4516.4112] ZwRenameTransactionManager
SSDT BAAA5550 drweb32w.exe [4516.4112] ZwRollforwardTransactionManager
SSDT BAAA368C drweb32w.exe [4516.4112] ZwRecoverEnlistment
SSDT BA9853B6 drweb32w.exe [4516.4112] ZwRecoverResourceManager
SSDT BA981D58 drweb32w.exe [4516.4112] ZwRecoverTransactionManager
SSDT BA98368D drweb32w.exe [4516.4112] ZwCreateResourceManager
SSDT BA97583C drweb32w.exe [4516.4112] ZwOpenResourceManager
SSDT BA98542B drweb32w.exe [4516.4112] ZwGetNotificationResourceManager
SSDT BAAA5197 drweb32w.exe [4516.4112] ZwQueryInformationResourceManager
SSDT BA979B9C drweb32w.exe [4516.4112] ZwCreateEnlistment
SSDT BAAA34C3 drweb32w.exe [4516.4112] ZwOpenEnlistment
SSDT BAAA3954 drweb32w.exe [4516.4112] ZwSetInformationEnlistment
SSDT BAAA36E7 drweb32w.exe [4516.4112] ZwQueryInformationEnlistment
SSDT BA98DC77 drweb32w.exe [4516.4112] ZwCreateWaitablePort
SSDT BAA67564 drweb32w.exe [4516.4112] ZwDebugActiveProcess
SSDT BAA67C29 drweb32w.exe [4516.4112] ZwDebugContinue
SSDT BAA4A748 drweb32w.exe [4516.4112] ZwDelayExecution
SSDT BA9B471D drweb32w.exe [4516.4112] ZwDeleteAtom
SSDT BAAB6AAB drweb32w.exe [4516.4112] ZwDeleteBootEntry
SSDT BAAB7D4F drweb32w.exe [4516.4112] ZwDeleteDriverEntry
SSDT BA971A67 drweb32w.exe [4516.4112] ZwDeleteFile
SSDT BA9B581C drweb32w.exe [4516.4112] ZwDeleteKey
SSDT BAA8C843 drweb32w.exe [4516.4112] ZwDeletePrivateNamespace
SSDT BAA4F953 drweb32w.exe [4516.4112] ZwDeleteObjectAuditAlarm
SSDT BA9B01FF drweb32w.exe [4516.4112] ZwDeleteValueKey
SSDT BAA36A63 drweb32w.exe [4516.4112] ZwDeviceIoControlFile
SSDT BA94F0B9 drweb32w.exe [4516.4112] ZwDisplayString
SSDT BA9F9E8B drweb32w.exe [4516.4112] ZwDuplicateObject
SSDT BA9EB10F drweb32w.exe [4516.4112] ZwDuplicateToken
SSDT BAAB6CAC drweb32w.exe [4516.4112] ZwEnumerateBootEntries
SSDT BAAB7F4E drweb32w.exe [4516.4112] ZwEnumerateDriverEntries
SSDT BAA07BAC drweb32w.exe [4516.4112] ZwEnumerateKey
SSDT BAAB687B drweb32w.exe [4516.4112] ZwEnumerateSystemEnvironmentValuesEx
SSDT BAAA4B9F drweb32w.exe [4516.4112] ZwEnumerateTransactionObject
SSDT BA9D19C5 drweb32w.exe [4516.4112] ZwEnumerateValueKey
SSDT BAA85BB3 drweb32w.exe [4516.4112] ZwExtendSection
SSDT BA9AA3E8 drweb32w.exe [4516.4112] ZwFilterToken
SSDT BA9B41E1 drweb32w.exe [4516.4112] ZwFindAtom
SSDT BA9F27D1 drweb32w.exe [4516.4112] ZwFlushBuffersFile
SSDT BA9B230B drweb32w.exe [4516.4112] ZwFlushInstructionCache
SSDT BA98553A drweb32w.exe [4516.4112] ZwFlushKey
SSDT BA817A42 drweb32w.exe [4516.4112] ZwFlushProcessWriteBuffers
SSDT BA9AEA08 drweb32w.exe [4516.4112] ZwFlushVirtualMemory
SSDT BAA887CE drweb32w.exe [4516.4112] ZwFlushWriteBuffer
SSDT BAA87E97 drweb32w.exe [4516.4112] ZwFreeUserPhysicalPages
SSDT BA891CB7 drweb32w.exe [4516.4112] ZwFreeVirtualMemory
SSDT BA8C2C09 drweb32w.exe [4516.4112] ZwFreezeRegistry
SSDT BAAA502C drweb32w.exe [4516.4112] ZwFreezeTransactions
SSDT BAA2996D drweb32w.exe [4516.4112] ZwFsControlFile
SSDT BAA5274C drweb32w.exe [4516.4112] ZwGetContextThread
SSDT BAA9129F drweb32w.exe [4516.4112] ZwGetDevicePowerState
SSDT BA9AC6BBSorry BepXHee coo6wenie LOG
A BoT Info
info.txt logfile of random’s system information tool 1.06 2010-01-04 00:53:00
======Uninstall list======
—>MsiExec /X{5DB65884-C963-4454-AABA-4CA3089281FA}
µTorrent—>»C:Program FilesuTorrentuTorrent.exe» /UNINSTALL
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
Adobe Flash Player 10 ActiveX—>C:Windowssystem32MacromedFlashuninstall_activeX.exe
Adobe Flash Player 10 Plugin—>C:Windowssystem32MacromedFlashuninstall_plugin.exe
Aion—>»C:Program Files4GameAionUninstall.exe» «C:Program Files4GameAioninstall.log» -u
Auto Updater 1.00—>C:UsersPublicLineAge II Gracia 2 FINAL EUROLineAge II Gracia 2 FINAL EUROLineage2Uninstall.exe
Counter-Strike 1.6 [ v08.02.06-2 ]—>»C:Program FilesCounter-Strike 1.6unins000.exe»
Counter-Strike Source [ v22.12.08 ]—>»C:Program FilesCounter-Strike Sourceunins000.exe»
Dr.Web anti-virus for Windows 5.0 (x86)—>MsiExec.exe /I{2BD3661D-1384-4EF4-9E5C-DFDB8EE6E3EA}
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)—>C:Windowssystem32msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=»»
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)—>C:Windowssystem32msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=»»
IceDC++ 1.01a MN Rus v4—>»C:Program FilesIceDC++unins000.exe»
ICQ6.5—>»C:Program FilesInstallShield Installation Information{60DE4033-9503-48D1-A483-7846BD217CA9}setup.exe» -runfromtemp -l0x0009 -removeonly
jetAudio Basic—>C:Program FilesInstallShield Installation Information{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}setup.exe -runfromtemp -l0x0019 -removeonly
Lineage II—>C:Program FilesInstallShield Installation Information{076A6FD8-EE45-4A83-B3C9-C7C34E7CAFDD}setup.exe -runfromtemp -l0x0009 -removeonly
Lineage II—>C:Program FilesInstallShield Installation Information{430B1017-1B12-420C-8F27-05D0EC2995E0}setup.exe -runfromtemp -l0x0009 -removeonly
Malwarebytes’ Anti-Malware—>»C:Program FilesMalwarebytes’ Anti-Malwareunins000.exe»
Microsoft .NET Framework 3.5 Language Pack SP1 — rus—>MsiExec.exe /I{2744791F-4E7C-32F5-AB40-AEC6A6C86DBF}
Microsoft .NET Framework 3.5 SP1—>c:WindowsMicrosoft.NETFrameworkv3.5Microsoft .NET Framework 3.5 SP1setup.exe
Microsoft .NET Framework 3.5 SP1—>MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office 2007 Service Pack 2 (SP2)—>msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office 2007 Service Pack 2 (SP2)—>msiexec /package {90120000-001B-0419-0000-0000000FF1CE} /uninstall {DCB382C1-7F1B-42B2-9D47-EDC4262E832F}
Microsoft Office 2007 Service Pack 2 (SP2)—>msiexec /package {90120000-006E-0419-0000-0000000FF1CE} /uninstall {37317C49-30C4-412C-B0B9-D95090F330D8}
Microsoft Office Access MUI (English) 2007—>MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007—>MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall ENTERPRISER /dll OSETUP.DLL
Microsoft Office Enterprise 2007—>MsiExec.exe /X{91120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007—>MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007—>MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007—>MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007—>MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007—>MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007—>MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007—>MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007—>MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007—>MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007—>MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Russian) 2007—>MsiExec.exe /X{90120000-001F-0419-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007—>MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proof (Ukrainian) 2007—>MsiExec.exe /X{90120000-001F-0422-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007—>MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Proofing (Russian) 2007—>MsiExec.exe /X{90120000-002C-0419-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)—>msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)—>msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)—>msiexec /package {90120000-001F-0419-0000-0000000FF1CE} /uninstall {57A92C5E-E76A-49CC-9EC2-A7B6CE1255EA}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)—>msiexec /package {90120000-001F-0422-0000-0000000FF1CE} /uninstall {6F177D09-F21D-4F50-9436-353972D1D232}
Microsoft Office Publisher MUI (English) 2007—>MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007—>MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (Russian) 2007—>MsiExec.exe /X{90120000-006E-0419-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007—>MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word 2007 Help Обновление (KB963665)—>msiexec /package {90120000-001B-0419-0000-0000000FF1CE} /uninstall {D3A002FB-0F62-4840-80AD-2D2C63F83449}
Microsoft Office Word 2007—>»C:Program FilesCommon FilesMicrosoft SharedOFFICE12Office Setup Controllersetup.exe» /uninstall WORD /dll OSETUP.DLL
Microsoft Office Word 2007—>MsiExec.exe /X{90120000-001B-0000-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007—>MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (Russian) 2007—>MsiExec.exe /X{90120000-001B-0419-0000-0000000FF1CE}
Microsoft Silverlight—>MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 ATL Update kb973923 — x86 8.0.50727.4053—>MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable—>MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.5.6)—>C:Program FilesMozilla Firefoxuninstallhelper.exe
Need for Speed™ SHIFT—>MsiExec.exe /X{BBF0A67B-5DBA-452F-9D2E-6F168BC226E4}
NVIDIA PhysX—>MsiExec.exe /X{5DB65884-C963-4454-AABA-4CA3089281FA}
Opera 10.10—>MsiExec.exe /X{FB8148DD-C575-4B0A-9F6C-0CFC46937930}
Outpost Firewall Pro 2009—>»C:Program FilesAgnitumOutpost Firewall Prounins000.exe»
Rambler-Ассистент—>»C:Program FilesRambler Assistantuninstall.exe»
Realtek High Definition Audio Driver—>RtkUpd.exe -r -m
Security Update for 2007 Microsoft Office System (KB951550)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB969559)—>msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB969559)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB973704)—>msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {E626DC89-A787-4553-9BB3-DC2EC7E1593F}
Security Update for 2007 Microsoft Office System (KB973704)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {E626DC89-A787-4553-9BB3-DC2EC7E1593F}
Security Update for Microsoft Office Excel 2007 (KB973593)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {7D6255E3-3423-4D8B-A328-F6F8D28DD5FE}
Security Update for Microsoft Office OneNote 2007 (KB950130)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {F1B2401C-B610-4BF2-AA1C-52C55827A8F4}
Security Update for Microsoft Office Outlook 2007 (KB972363)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {120BE9A0-9B09-4855-9E0C-7DEE45CB03C0}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office Publisher 2007 (KB969693)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}
Security Update for Microsoft Office system 2007 (972581)—>msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (972581)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB969613)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB974234)—>msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office system 2007 (KB974234)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Skype™ 4.1—>MsiExec.exe /I{5C474A83-A45F-470C-9AC8-2BD1C251BF9A}
Stronghold Crusader—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1engine6INTEL3~1Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{8C3727F2-8E37-49E4-820C-03B1677F53B6}Setup.exe» -l0x19
Update for 2007 Microsoft Office System (KB967642)—>msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for 2007 Microsoft Office System (KB967642)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)—>C:Windowssystem32msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=»»
Update for Microsoft Office 2007 Help for Common Features (KB963673)—>msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}
Update for Microsoft Office Access 2007 Help (KB963663)—>msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}
Update for Microsoft Office Excel 2007 Help (KB963678)—>msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}
Update for Microsoft Office InfoPath 2007 (KB976416)—>msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {432C5EE4-8096-4FF1-95E1-65219365DFF7}
Update for Microsoft Office InfoPath 2007 (KB976416)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {432C5EE4-8096-4FF1-95E1-65219365DFF7}
Update for Microsoft Office Infopath 2007 Help (KB963662)—>msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {716B81B8-B13C-41DF-8EAC-7A2F656CAB63}
Update for Microsoft Office OneNote 2007 Help (KB963670)—>msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2744EF05-38E1-4D5D-B333-E021EDAEA245}
Update for Microsoft Office Outlook 2007 Help (KB963677)—>msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {0451F231-E3E3-4943-AB9F-58EB96171784}
Update for Microsoft Office Powerpoint 2007 Help (KB963669)—>msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}
Update for Microsoft Office Publisher 2007 Help (KB963667)—>msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2E40DE55-B289-4C8B-8901-5D369B16814F}
Update for Microsoft Office Script Editor Help (KB963671)—>msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
Update for Microsoft Office Word 2007 (KB974561)—>msiexec /package {90120000-001B-0000-0000-0000000FF1CE} /uninstall {0CDDBAA2-2111-4A0E-A1B0-76C40C635331}
Update for Microsoft Office Word 2007 (KB974561)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {0CDDBAA2-2111-4A0E-A1B0-76C40C635331}
Update for Microsoft Office Word 2007 Help (KB963665)—>msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}
Update for Outlook 2007 Junk Email Filter (kb976884)—>msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {FB60F280-C70F-4174-BADB-471412AA42F0}
Ventrilo Client—>MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Winamp Toolbar—>»C:Program FilesWinamp Toolbaruninstall.exe»
Windows Live installer—>MsiExec.exe /X{61C981F9-FF8A-46EC-B6FE-FF8B293F36D3}
Windows Live Messenger—>MsiExec.exe /X{087B2CCA-0F1C-4434-B7C6-6B5E0EFD31BC}
Windows Media Player Firefox Plugin—>MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Архиватор WinRAR—>C:Program FilesWinRARuninstall.exe
Звуковое устройство IDT Audio—>RunDll32 C:PROGRA~1COMMON~1INSTAL~1PROFES~1RunTime101Intel32Ctor.dll,LaunchSetup «C:Program FilesInstallShield Installation Information{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}setup.exe» -l0x19 -remove -removeonly
Персональный поиск Яндекса 2.6.0—>»C:Program FilesYandexDesktopunins000.exe»
Помощник по входу в Windows Live—>MsiExec.exe /I{26048B61-7083-494A-B441-69E461CE8686}
Языковой пакет Microsoft .NET Framework 3.5 SP1 — RUS—>c:WindowsMicrosoft.NETFrameworkv3.5Microsoft .NET Framework 3.5 Language Pack SP1 — russetup.exe
Яндекс.Бар для Internet Explorer 3.5.3—>»C:Program FilesYandexYandexBarIEunins000.exe»======Security center information======
AS: Windows Defender
======System event log======
Computer Name: TRUGAN
Event Code: 1
Message: Doctor Web self protection enabled
Record Number: 48745
Source Name: DwProt
Time Written: 20100103214052.540771-000
Event Type: Сведения
User:Computer Name: TRUGAN
Event Code: 20003
Message: По запросу средства управления драйверами процесс добавил службу tunnel для кода экземпляра устройства ROOT*ISATAP044. Состояние: 0.
Record Number: 48746
Source Name: Microsoft-Windows-User-PnP
Time Written: 20100103214053.080771-000
Event Type: Сведения
User: NT AUTHORITYSYSTEMComputer Name: TRUGAN
Event Code: 3004
Message: Защитник Windows: агент защиты в режиме реального времени обнаружил изменения. Рекомендуется проверить программы, которые внесли эти изменения, чтобы исключить потенциальные риски. Используя сведения о работе этих программ, следует принять решение о разрешении их запуска либо удалении этих программ с компьютера. Разрешать изменения следует только для надежных программ или надежных издателей ПО. Защитник Windows не может отменить изменения, если они были разрешены.
Дополнительные сведения см. в следующих источниках:
Неприменимо
Идентификатор проверки: {AD7D8B1B-E895-4D79-BA86-4A713F2018DF}
Пользователь: TRUGANмой компьютер
Имя: Unknown
Идентификатор:
Идентификатор серьезности:
Идентификатор категории:
Найденный путь: lsp:C:Usersмой компьютерAppDataRoamingMicrosoftWindowsCookiesuserlib.dll;file:C:Usersмой компьютерAppDataRoamingMicrosoftWindowsCookiesuserlib.dll
Тип оповещения: Неклассифицированное программное обеспечение
Тип обнаружения:
Record Number: 48747
Source Name: Microsoft-Windows-Windows Defender
Time Written: 20100103214059.000000-000
Event Type: Предупреждение
User:Computer Name: TRUGAN
Event Code: 7036
Message: Служба «Служба автоматического обнаружения веб-прокси WinHTTP» перешла в состояние Работает.
Record Number: 48748
Source Name: Service Control Manager
Time Written: 20100103214059.000000-000
Event Type: Сведения
User:Computer Name: TRUGAN
Event Code: 3005
Message: Защитник Windows: агент защиты в режиме реального времени выполнил действие по защите данного компьютера от шпионского или иного потенциально нежелательного ПО.
Дополнительные сведения см. в следующих источниках:
Неприменимо
Идентификатор проверки: {AD7D8B1B-E895-4D79-BA86-4A713F2018DF}
Пользователь: TRUGANмой компьютер
Имя: Unknown
Идентификатор:
Идентификатор серьезности:
Идентификатор категории:
Тип оповещения: Неклассифицированное программное обеспечение
Действие: Пропустить
Record Number: 48749
Source Name: Microsoft-Windows-Windows Defender
Time Written: 20100103214059.000000-000
Event Type: Сведения
User:=====Application event log=====
Computer Name: TRUGAN
Event Code: 20222
Message: CoID={ED97DD80-ABE5-4114-956C-38B202CB588E}: Пользователь TRUGANмой компьютер пытается установить связь с сервером удаленного доступа для подключения Высокоскоростное подключение при помощи следующего устройства:
Server address/Phone Number =
Device = Минипорт WAN (PPPoE)
Port = PPPoE2-0
MediaType = PPPoE.
Record Number: 10195
Source Name: RasClient
Time Written: 20100103214041.000000-000
Event Type: Сведения
User:Computer Name: TRUGAN
Event Code: 20223
Message: CoID={ED97DD80-ABE5-4114-956C-38B202CB588E}: Пользователь TRUGANмой компьютер успешно установил связь с сервером удаленного доступа с помощью следующего устройства:
Server address/Phone Number =
Device = Минипорт WAN (PPPoE)
Port = PPPoE2-0
MediaType = PPPoE.
Record Number: 10196
Source Name: RasClient
Time Written: 20100103214042.000000-000
Event Type: Сведения
User:Computer Name: TRUGAN
Event Code: 20224
Message: CoID={ED97DD80-ABE5-4114-956C-38B202CB588E}: Связь с сервером удаленного доступа установлена пользователем TRUGANмой компьютер.
Record Number: 10197
Source Name: RasClient
Time Written: 20100103214042.000000-000
Event Type: Сведения
User:Computer Name: TRUGAN
Event Code: 20225
Message: CoID={ED97DD80-ABE5-4114-956C-38B202CB588E}: Пользователь TRUGANмой компьютер успешно подключился к серверу удаленного доступа. Имя подключения: Высокоскоростное подключение. Параметры подключения:
TunnelIpAddress = 10.199.78.124
TunnelIpv6Address = fe80::
Dial-in User = ls4278.
Record Number: 10198
Source Name: RasClient
Time Written: 20100103214047.000000-000
Event Type: Сведения
User:Computer Name: TRUGAN
Event Code: 1903
Message:
Record Number: 10199
Source Name: HHCTRL
Time Written: 20100103215101.000000-000
Event Type: Сведения
User:=====Security event log=====
Computer Name: TRUGAN
Event Code: 4907
Message: Изменились параметры аудита для объекта.Предмет:
Идентификатор безопасности: S-1-5-18
Имя учетной записи: TRUGAN$
Домен учетной записи: WORKGROUP
Идентификатор входа: 0x3e7Объект:
Сервер объекта: Security
Тип объекта: File
Имя объекта: C:System Volume InformationSystemRestoreFRStaging$Recycle.BinS-1-5-21-3307135893-1800648409-69095361-1001$R57WUH5systemIpDrv.dll
Идентификатор дескриптора: 0x148Сведения о процессе:
Идентификатор процесса: 0x244
Имя процесса: C:WindowsSystem32wininit.exeПараметры аудита:
Исходный дескриптор безопасности: S:AI
Новый дескриптор безопасности: S:ARAI(ML;ID;NW;;;LW)
Record Number: 12195
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100102232424.118000-000
Event Type: Аудит выполнен успешно
User:Computer Name: TRUGAN
Event Code: 4907
Message: Изменились параметры аудита для объекта.Предмет:
Идентификатор безопасности: S-1-5-18
Имя учетной записи: TRUGAN$
Домен учетной записи: WORKGROUP
Идентификатор входа: 0x3e7Объект:
Сервер объекта: Security
Тип объекта: File
Имя объекта: C:System Volume InformationSystemRestoreFRStaging$Recycle.BinS-1-5-21-3307135893-1800648409-69095361-1001$R57WUH5systemIpDrv.dll
Идентификатор дескриптора: 0x148Сведения о процессе:
Идентификатор процесса: 0x244
Имя процесса: C:WindowsSystem32wininit.exeПараметры аудита:
Исходный дескриптор безопасности: S:AI
Новый дескриптор безопасности: S:ARAI(ML;ID;NW;;;LW)
Record Number: 12196
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100102232424.167000-000
Event Type: Аудит выполнен успешно
User:Computer Name: TRUGAN
Event Code: 4907
Message: Изменились параметры аудита для объекта.Предмет:
Идентификатор безопасности: S-1-5-18
Имя учетной записи: TRUGAN$
Домен учетной записи: WORKGROUP
Идентификатор входа: 0x3e7Объект:
Сервер объекта: Security
Тип объекта: File
Имя объекта: C:System Volume InformationSystemRestoreFRStaging$Recycle.BinS-1-5-21-3307135893-1800648409-69095361-1001$R57WUH5systemL2.exe
Идентификатор дескриптора: 0x148Сведения о процессе:
Идентификатор процесса: 0x244
Имя процесса: C:WindowsSystem32wininit.exeПараметры аудита:
Исходный дескриптор безопасности: S:AI
Новый дескриптор безопасности: S:ARAI(ML;ID;NW;;;LW)
Record Number: 12197
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100102232424.419000-000
Event Type: Аудит выполнен успешно
User:Computer Name: TRUGAN
Event Code: 4907
Message: Изменились параметры аудита для объекта.Предмет:
Идентификатор безопасности: S-1-5-18
Имя учетной записи: TRUGAN$
Домен учетной записи: WORKGROUP
Идентификатор входа: 0x3e7Объект:
Сервер объекта: Security
Тип объекта: File
Имя объекта: C:System Volume InformationSystemRestoreFRStaging$Recycle.BinS-1-5-21-3307135893-1800648409-69095361-1001$R57WUH5systemL2.exe
Идентификатор дескриптора: 0x148Сведения о процессе:
Идентификатор процесса: 0x244
Имя процесса: C:WindowsSystem32wininit.exeПараметры аудита:
Исходный дескриптор безопасности: S:AI
Новый дескриптор безопасности: S:ARAI(ML;ID;NW;;;LW)
Record Number: 12198
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100102232424.472000-000
Event Type: Аудит выполнен успешно
User:Computer Name: TRUGAN
Event Code: 4907
Message: Изменились параметры аудита для объекта.Предмет:
Идентификатор безопасности: S-1-5-18
Имя учетной записи: TRUGAN$
Домен учетной записи: WORKGROUP
Идентификатор входа: 0x3e7Объект:
Сервер объекта: Security
Тип объекта: File
Имя объекта: C:System Volume InformationSystemRestoreFRStaging$Recycle.BinS-1-5-21-3307135893-1800648409-69095361-1001$R57WUH5systeml2.ini
Идентификатор дескриптора: 0x148Сведения о процессе:
Идентификатор процесса: 0x244
Имя процесса: C:WindowsSystem32wininit.exeПараметры аудита:
Исходный дескриптор безопасности: S:AI
Новый дескриптор безопасности: S:ARAI(ML;ID;NW;;;LW)
Record Number: 12199
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100102232424.756000-000
Event Type: Аудит выполнен успешно
User:======Environment variables======
«ComSpec»=%SystemRoot%system32cmd.exe
«FP_NO_HOST_CHECK»=NO
«OS»=Windows_NT
«Path»=%SystemRoot%system32;%SystemRoot%;%SystemRoot%System32Wbem
«PATHEXT»=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
«PROCESSOR_ARCHITECTURE»=x86
«TEMP»=%SystemRoot%TEMP
«TMP»=%SystemRoot%TEMP
«USERNAME»=SYSTEM
«windir»=%SystemRoot%
«PROCESSOR_LEVEL»=16
«PROCESSOR_IDENTIFIER»=x86 Family 16 Model 2 Stepping 2, AuthenticAMD
«PROCESSOR_REVISION»=0202
«NUMBER_OF_PROCESSORS»=3
«TRACE_FORMAT_SEARCH_PATH»=\NTREL202.ntdev.corp.microsoft.com4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0TraceFormat
«DFSTRACINGON»=FALSE
EOF
Info
jLogfile of random’s system information tool 1.06 (written by random/random)
Run by мой компьютер at 2010-01-04 00:52:57
Microsoft® Windows Vista™ Home Basic Service Pack 1
System drive C: has 192 GB (63%) free of 305 GB
Total RAM: 3071 MB (46% free)HijackThis download failed
======Scheduled tasks folder======
C:WindowstasksDr.Web Daily scan.job
C:WindowstasksDr.Web Update.job======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
Winamp Toolbar Loader — C:Program FilesWinamp Toolbarwinamptb.dll [2009-05-06 1262888][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper — C:Program FilesMicrosoft OfficeOffice12GrooveShellExtensions.dll [2007-08-24 2212224][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Помощник по входу в Windows Live — C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll [2009-02-17 408440][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{91397D20-1446-11D4-8AF4-0040CA1127B6} — Яндекс.Бар — C:Program FilesYandexYandexBarIEyndbar.dll [2008-09-01 1572864]
{468CD8A9-7C25-45FA-969E-3D925C689DC4} — Rambler-Ассистент — C:Program FilesRambler AssistantramblertoolbarU0.dll [2009-10-08 849392]
{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} — Winamp Toolbar — C:Program FilesWinamp Toolbarwinamptb.dll [2009-05-06 1262888][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«Windows Defender»=C:Program FilesWindows DefenderMSASCui.exe [2008-01-21 1008184]
«IntelliPoint»=C:Program FilesMicrosoft IntelliPointipoint.exe [2007-02-05 849280]
«SysTrayApp»=C:Program FilesIDTWDMsttray.exe [2007-12-14 413696]
«Depo»=C:WINDOWSsystem32DepoComputersQuestioning.exe [2007-09-17 212992]
«GrooveMonitor»=C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe [2007-08-24 33648]
«SpIDerAgent»=C:Program FilesDrWebSpIDerAgent.exe [2009-11-18 447728]
«SpIDerMail»=C:Program FilesDrWebspiderml.exe [2009-06-30 644336]
«SpIDerNT»=C:PROGRA~1DrWebspiderui.exe [2009-08-17 231840]
«OutpostFeedBack»=C:Program FilesAgnitumOutpost Firewall Profeedback.exe [2009-09-23 436552]
«OutpostMonitor»=C:PROGRA~1AgnitumOUTPOS~1op_mon.exe [2009-12-17 1269632][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«Sidebar»=C:Program FilesWindows Sidebarsidebar.exe [2008-01-21 1233920]
«WindowsWelcomeCenter»=oobefldr.dll,ShowWelcomeCenter []
«YandexDesktopSearch»=C:Program FilesYandexDesktopyandesk.exe [2008-09-18 7508776]
«Yupdate!»=C:Program FilesCommon FilesYandexYupdateyupdate.exe [2008-09-01 479496]
«Skype»=C:Program FilesSkypePhoneSkype.exe [2009-10-09 25626408]
«uTorrent»=C:Program FilesuTorrentuTorrent.exe [2009-12-16 289584]
«ICQ»=C:Program FilesICQ6.5ICQ.exe [2009-11-16 172792]
«WMPNSCFG»=C:Program FilesWindows Media PlayerWMPNSCFG.exe [2008-01-21 202240][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]
«AppInit_DLLS»=»c:PROGRA~1AgnitumOUTPOS~1wl_hook.dll»[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks]
«{B5A7F190-DDA6-4420-B3BA-52453494E6CD}»=C:Program FilesMicrosoft OfficeOffice12GrooveShellExtensions.dll [2007-08-24 2212224]
«{AEB6717E-7E19-11d0-97EE-00C04FD91972}»= [][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«ConsentPromptBehaviorUser»=0
«EnableInstallerDetection»=0
«EnableLUA»=0
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«EnableUIADesktopToggle»=0[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145
«NoDrives»=0[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDrives»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
======List of files/folders created in the last 1 months======
2010-01-04 00:52:57 —-DC—- C:rsit
2010-01-03 02:09:20 —-A—- C:Windowsntbtlog.txt
2010-01-03 00:01:14 —-D—- C:Usersмой компьютерAppDataRoamingMalwarebytes
2010-01-03 00:01:06 —-D—- C:ProgramDataMalwarebytes
2010-01-03 00:01:05 —-DC—- C:Program FilesMalwarebytes’ Anti-Malware
2010-01-02 18:35:28 —-DC—- C:Program FilesFirefly Studios
2010-01-02 17:54:40 —-DC—- C:Program Filestrend micro
2010-01-02 17:22:49 —-SHDC—- C:$RECYCLE.BIN
2010-01-02 17:22:46 —-D—- C:Windowstemp
2010-01-02 17:22:44 —-AC—- C:ComboFix.txt
2010-01-02 17:10:38 —-D—- C:WindowsERDNT
2009-12-28 16:15:20 —-DC—- C:Program FilesAgnitum
2009-12-28 16:15:20 —-D—- C:Windowssystem32Filt
2009-12-28 16:14:47 —-D—- C:ProgramDataAgnitum
2009-12-28 15:48:26 —-DC—- C:Program FilesCommon FilesDoctor Web
2009-12-28 15:48:23 —-DC—- C:Program FilesDrWeb
2009-12-28 15:48:23 —-D—- C:ProgramDataDoctor Web
2009-12-27 23:53:16 —-D—- C:Usersмой компьютерAppDataRoamingHP
2009-12-25 03:00:59 —-DC—- C:Program FilesMSXML 4.0
2009-12-24 01:00:10 —-DC—- C:Program FilesVistaVisualMaster
2009-12-23 23:39:03 —-D—- C:ProgramDataWEBREG
2009-12-23 23:37:14 —-D—- C:ProgramDataHPSSUPPLY
2009-12-23 23:34:59 —-DC—- C:Program FilesHewlett-Packard
2009-12-23 23:34:49 —-DC—- C:Program FilesCommon FilesHewlett-Packard
2009-12-23 23:29:03 —-DC—- C:Program FilesHP
2009-12-23 23:28:14 —-D—- C:ProgramDataHP
2009-12-23 14:02:12 —-D—- C:Usersмой компьютерAppDataRoamingOpera
2009-12-23 14:01:59 —-DC—- C:Program FilesOpera
2009-12-16 16:09:45 —-DC—- C:Program Files4Game
2009-12-15 22:28:18 —-A—- C:Windowssystem32msonpmon.dll
2009-12-15 22:26:02 —-DC—- C:Program FilesMicrosoft Visual Studio
2009-12-15 22:22:57 —-DC—- C:Program FilesMicrosoft Visual Studio 8
2009-12-15 22:22:21 —-D—- C:WindowsSHELLNEW
2009-12-15 17:19:03 —-DC—- C:Program FilesICQ6.5
2009-12-12 14:23:17 —-D—- C:Usersмой компьютерAppDataRoamingteamspeak2
2009-12-09 15:15:24 —-A—- C:Windowssystem32winhttp.dll
2009-12-09 15:15:19 —-A—- C:Windowssystem32mshtml.dll
2009-12-09 15:15:18 —-A—- C:Windowssystem32wininet.dll
2009-12-09 15:15:18 —-A—- C:Windowssystem32urlmon.dll
2009-12-09 15:15:18 —-A—- C:Windowssystem32occache.dll
2009-12-09 15:15:17 —-A—- C:Windowssystem32iertutil.dll
2009-12-09 15:15:17 —-A—- C:Windowssystem32ieframe.dll
2009-12-09 15:15:17 —-A—- C:Windowssystem32ieapfltr.dll
2009-12-09 15:15:16 —-A—- C:Windowssystem32mstime.dll
2009-12-09 15:15:16 —-A—- C:Windowssystem32msfeeds.dll
2009-12-09 15:15:16 —-A—- C:Windowssystem32jsproxy.dll
2009-12-09 15:15:16 —-A—- C:Windowssystem32ieUnatt.exe
2009-12-09 15:15:16 —-A—- C:Windowssystem32ieencode.dll
2009-12-09 15:15:16 —-A—- C:Windowssystem32iedkcs32.dll
2009-12-09 15:15:16 —-A—- C:Windowssystem32ieaksie.dll
2009-12-09 15:15:08 —-A—- C:Windowssystem32nshhttp.dll
2009-12-09 15:15:08 —-A—- C:Windowssystem32httpapi.dll
2009-12-09 15:15:00 —-A—- C:Windowssystem32rastls.dll
2009-12-09 15:15:00 —-A—- C:Windowssystem32raschap.dll======List of files/folders modified in the last 1 months======
2010-01-04 00:46:33 —-D—- C:Usersмой компьютерAppDataRoamingSkype
2010-01-03 23:46:45 —-D—- C:Program FilesCounter-Strike Source
2010-01-03 20:52:11 —-D—- C:WindowsSystem32
2010-01-03 20:17:29 —-D—- C:Windowstracing
2010-01-03 20:01:20 —-D—- C:Program FilesMozilla Firefox
2010-01-03 19:22:09 —-D—- C:Usersмой компьютерAppDataRoaminguTorrent
2010-01-03 19:20:49 —-D—- C:WindowsMinidump
2010-01-03 19:20:49 —-D—- C:Windows
2010-01-03 02:45:07 —-D—- C:Windowssystem32wbem
2010-01-03 02:41:39 —-D—- C:WindowsTasks
2010-01-03 02:41:39 —-D—- C:Windowssystem32spool
2010-01-03 02:41:39 —-D—- C:Windowssystem32ru-RU
2010-01-03 02:41:38 —-RSD—- C:WindowsFonts
2010-01-03 02:41:38 —-D—- C:Windowssystem32drivers
2010-01-03 02:41:38 —-D—- C:Windowssystem32CodeIntegrity
2010-01-03 02:41:38 —-D—- C:Windowssystem32catroot2
2010-01-03 02:41:38 —-D—- C:Windowsinf
2010-01-03 02:41:37 —-D—- C:Windowsregistration
2010-01-03 02:19:21 —-SHD—- C:System Volume Information
2010-01-03 00:01:06 —-D—- C:ProgramData
2010-01-03 00:01:05 —-RDC—- C:Program Files
2010-01-02 18:35:24 —-HD—- C:Program FilesInstallShield Installation Information
2010-01-02 18:32:52 —-DC—- C:Program FilesCommon FilesInstallShield
2010-01-02 17:20:25 —-AC—- C:Windowssystem.ini
2010-01-02 17:16:22 —-D—- C:WindowsAppPatch
2010-01-02 17:16:21 —-DC—- C:Program FilesCommon Files
2010-01-01 19:22:05 —-D—- C:Usersмой компьютерAppDataRoamingICQ
2009-12-31 21:05:07 —-D—- C:WindowsPrefetch
2009-12-30 21:50:24 —-D—- C:Program FilesIceDC++
2009-12-30 03:54:30 —-D—- C:Windowssystem32config
2009-12-30 02:20:51 —-SHD—- C:WindowsInstaller
2009-12-30 02:05:41 —-SD—- C:Usersмой компьютерAppDataRoamingMicrosoft
2009-12-29 02:14:53 —-D—- C:Windowssystem32catroot
2009-12-28 15:49:05 —-D—- C:Windowssystem32Tasks
2009-12-28 12:55:16 —-D—- C:ProgramDataMicrosoft Help
2009-12-28 12:53:56 —-RSD—- C:Windowsassembly
2009-12-28 12:33:12 —-D—- C:Windowssystem32Msdtc
2009-12-28 12:31:54 —-DC—- C:Program FilesuTorrent
2009-12-28 12:31:54 —-DC—- C:Program FilesQIP
2009-12-26 03:04:26 —-D—- C:Windowswinsxs
2009-12-23 23:35:08 —-D—- C:Windowstwain_32
2009-12-20 22:12:23 —-D—- C:Windowssystem32WDI
2009-12-17 12:29:37 —-A—- C:Windowswin.ini
2009-12-17 12:23:04 —-A—- C:Windowssystem32PerfStringBackup.INI
2009-12-15 22:26:35 —-DC—- C:Program FilesCommon Filesmicrosoft shared
2009-12-15 22:26:31 —-D—- C:Program FilesMSBuild
2009-12-15 22:25:34 —-DC—- C:Program FilesMicrosoft Office
2009-12-15 22:25:18 —-SD—- C:ProgramDataMicrosoft
2009-12-15 22:22:32 —-DC—- C:Program FilesCommon FilesSystem
2009-12-10 19:36:06 —-D—- C:Windowsrescache
2009-12-10 11:13:45 —-D—- C:Windowssystem32en-US
2009-12-10 11:13:45 —-D—- C:Program FilesWindows Mail
2009-12-10 11:13:45 —-D—- C:Program FilesInternet Explorer======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 afw;Agnitum Firewall Driver; C:Windowssystem32DRIVERSafw.sys [2009-02-18 29208]
R1 SandBox;SandBox; ??C:Windowssystem32driversSandBox.sys [2009-08-28 714112]
R2 RMCAST;Драйвер протокола RMCAST (Pgm); C:Windowssystem32DRIVERSRMCAST.sys [2008-05-10 113664]
R2 SPIDER;SpIDer Guard File System Monitor; ??C:PROGRA~1DrWebspider.sys [2009-08-17 306464]
R3 afwcore;afwcore; C:Windowssystem32driversafwcore.sys [2009-09-14 318488]
R3 Atc002;NDIS Miniport Driver for Attansic L2 Fast Ethernet Controller; C:Windowssystem32DRIVERSL260x86.sys [2006-12-13 25600]
R3 atikmdag;atikmdag; C:Windowssystem32DRIVERSatikmdag.sys [2008-08-20 3928576]
R3 Point32;Microsoft IntelliPoint Filter Driver; C:Windowssystem32DRIVERSpoint32k.sys [2006-11-07 24064]
R3 RTHDMIAzAudService;Service for HDMI; C:Windowssystem32driversRtHDMIV.sys [2007-05-14 135400]
R3 STHDA;IDT High Definition Audio CODEC; C:Windowssystem32DRIVERSstwrt.sys [2007-12-14 361984]
R3 WUDFRd;WUDFRd; C:Windowssystem32DRIVERSWUDFRd.sys [2008-01-21 83328]
S3 ASWFilt;ASWFilt; ??C:Windowssystem32FiltASWFilt.dll [2009-08-28 33920]
S3 BthEnum;Служба перечислителя Bluetooth; C:Windowssystem32DRIVERSBthEnum.sys [2008-01-21 19456]
S3 BthPan;Устройства Bluetooth (личной сети); C:Windowssystem32DRIVERSbthpan.sys [2008-01-21 92160]
S3 BTHPORT;Драйвер порта Bluetooth; C:WindowsSystem32DriversBTHport.sys [2008-04-29 220160]
S3 BTHUSB;Драйвер порта USB радиомодуля Bluetooth; C:WindowsSystem32DriversBTHUSB.sys [2008-04-29 29184]
S3 catchme;catchme; ??C:Users3ED1~1AppDataLocalTempcatchme.sys []
S3 drmkaud;Звуковой дешифратор DRM ядра системы; C:Windowssystem32driversdrmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Драйвер функции UAA для службы High Definition Audio (Microsoft), версия 1.1; C:Windowssystem32driversHdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Представитель служб потоков Microsoft; C:Windowssystem32driversMSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Посредник синхронизации потоков Microsoft; C:Windowssystem32driversMSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Представитель диспетчера качества потоков Microsoft; C:Windowssystem32driversMSPQM.sys [2008-01-21 5504]
S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:Windowssystem32driversMSTEE.sys [2008-01-21 6016]
S3 RFCOMM;Устройство Bluetooth (протокол RFCOMM TDI); C:Windowssystem32DRIVERSrfcomm.sys [2008-01-21 49664]
S3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 драйвер; C:Windowssystem32DRIVERSRtnicxp.sys [2006-11-02 47104]
S3 ugldipod;ugldipod; ??C:Users3ED1~1AppDataLocalTempugldipod.sys []
S4 ErrDev;Microsoft Hardware Error Device Driver; C:Windowssystem32driverserrdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:Windowssystem32driversmegasr.sys [2008-01-21 386616]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:Windowssystem32driverswmiacpi.sys [2008-01-21 11264]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 acssrv;Agnitum Client Security Service; C:PROGRA~1AgnitumOUTPOS~1acs.exe [2009-12-17 1338624]
R2 Ati External Event Utility;Ati External Event Utility; C:Windowssystem32Ati2evxx.exe [2008-08-20 700416]
R2 BthServ;@%SystemRoot%System32bthserv.dll,-101; C:Windowssystem32svchost.exe [2008-01-21 21504]
R2 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine); C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe [2009-09-22 869688]
R2 SPIDERNT;SpIDer Guard for Windows; C:PROGRA~1DrWebspidernt.exe [2009-08-17 231328]
R2 STacSV;Audio Service; C:WindowsSystem32DriverStoreFileRepositorystwrt.inf_c6f2043dSTacSV.exe [2007-12-14 212992]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:Program FilesMicrosoft OfficeOffice12GrooveAuditService.exe [2007-08-24 68464]
S3 npggsvc;nProtect GameGuard Service; C:Windowssystem32GameMon.des [2009-10-12 3369044]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 usnjsvc;Служба Messenger Sharing Folders USN Journal Reader; C:Program FilesWindows LiveMessengerusnsvc.exe [2007-10-18 98328]
S3 WLSetupSvc;Windows Live Setup Service; C:Program FilesWindows LiveinstallerWLSetupSvc.exe [2007-10-25 266240]
EOF
с момента включения компа… обнаружены атаки
16:01:56 81.88.208.202 Обнаружена атака, узел не заблокирован SINGLE_SCAN_PORT (5324)
16:02:11 81.88.208.250 Обнаружена атака, узел не заблокирован SINGLE_SCAN_PORT (9714)
16:37:05 0.0.0.0 Узел заблокирован на 60 мин. ARP_SCAN
16:52:13 93.182.13.152 Обнаружена атака, узел не заблокирован SINGLE_SCAN_PORT (34699)
16:52:16 0.0.0.0 Атакующий разблокирован
16:54:05 81.88.208.250 Обнаружена атака, узел не заблокирован SINGLE_SCAN_PORT (17637)
16:54:07 67.15.231.73 Обнаружена атака, узел не заблокирован SINGLE_SCAN_PORT (47557)
16:55:25 0.0.0.0 Узел заблокирован на 60 мин. ARP_SCAN
17:55:26 0.0.0.0 Атакующий разблокирован
18:21:48 67.15.231.73 Обнаружена атака, узел не заблокирован SINGLE_SCAN_PORT (35039)
18:22:28 79.165.190.108 Узел заблокирован на 60 мин. SHORT_FRAGMENTS
19:08:01 89.123.87.244 Узел заблокирован на 60 мин. SHORT_FRAGMENTS
19:22:28 79.165.190.108 Атакующий разблокирован
19:47:37 0.0.0.0 Узел заблокирован на 60 мин. ARP_SCAN
20:07:13 10.55.22.69 Обнаружена атака, узел не заблокирован SINGLE_SCAN_PORT (36056)
20:08:01 89.123.87.244 Атакующий разблокирован
20:19:11 10.55.22.69 Обнаружена атака, узел не заблокирован SINGLE_SCAN_PORT (10715)
20:27:28 85.234.2.187 Обнаружена атака, узел не заблокирован SINGLE_SCAN_PORT (43228)
20:39:45 81.88.208.250 Обнаружена атака, узел не заблокирован SINGLE_SCAN_PORT (63698)
20:39:46 81.88.208.202 Обнаружена атака, узел не заблокирован SINGLE_SCAN_PORT (63698)
20:40:05 81.88.208.250 Узел заблокирован на 60 мин. SCAN (63698, 38379, 25574)извени за такой флуд. просто со времен что-то новое происходит.
тормоза. долго открываются папки. в них курсор двигается медленно… а в браузере все ок. подвисание. может пропасть нижняя панель де пуск
цп пригвет от 50 до 100.. и часто стоит на 100%… физическая память 75%… без вируса не больше 30% и цп без вируса 20-40%…. в конце любого трека музыки идет подвисаниеПровел еще раз проверку и вылезло 2 вируса.
1) Имя: BiFrost
Тип: Backdoor
Ключи реестра:
HKEY_USERSS-1-5-21-3307135893-1800648409-69095361-1001softwareWget2)
Имя: BZub
Тип: Trojan
Ключи реестра:
HKEY_LOCAL_MACHINEsoftwareMicrosoftwindowscurrentversionControl Panelload2-ой лог
Logfile of random’s system information tool 1.06 (written by random/random)
Run by мой компьютер at 2010-01-02 17:54:36
Microsoft® Windows Vista™ Home Basic Service Pack 1
System drive C: has 162 GB (53%) free of 305 GB
Total RAM: 3071 MB (55% free)HijackThis download failed
======Scheduled tasks folder======
C:WindowstasksDr.Web Daily scan.job
C:WindowstasksDr.Web Update.job======Registry dump======
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
Winamp Toolbar Loader — C:Program FilesWinamp Toolbarwinamptb.dll [2009-05-06 1262888][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper — C:Program FilesMicrosoft OfficeOffice12GrooveShellExtensions.dll [2007-08-24 2212224][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{7E853D72-626A-48EC-A868-BA8D5E23E045}]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Помощник по входу в Windows Live — C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll [2009-02-17 408440][HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerToolbar]
{91397D20-1446-11D4-8AF4-0040CA1127B6} — Яндекс.Бар — C:Program FilesYandexYandexBarIEyndbar.dll [2008-09-01 1572864]
{468CD8A9-7C25-45FA-969E-3D925C689DC4} — Rambler-Ассистент — C:Program FilesRambler AssistantramblertoolbarU0.dll [2009-10-08 849392]
{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} — Winamp Toolbar — C:Program FilesWinamp Toolbarwinamptb.dll [2009-05-06 1262888][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun]
«Windows Defender»=C:Program FilesWindows DefenderMSASCui.exe [2008-01-21 1008184]
«IntelliPoint»=C:Program FilesMicrosoft IntelliPointipoint.exe [2007-02-05 849280]
«SysTrayApp»=C:Program FilesIDTWDMsttray.exe [2007-12-14 413696]
«Depo»=C:WINDOWSsystem32DepoComputersQuestioning.exe [2007-09-17 212992]
«GrooveMonitor»=C:Program FilesMicrosoft OfficeOffice12GrooveMonitor.exe [2007-08-24 33648]
«SpIDerAgent»=C:Program FilesDrWebSpIDerAgent.exe [2009-11-18 447728]
«SpIDerMail»=C:Program FilesDrWebspiderml.exe [2009-06-30 644336]
«SpIDerNT»=C:PROGRA~1DrWebspiderui.exe [2009-08-17 231840]
«OutpostFeedBack»=C:Program FilesAgnitumOutpost Firewall Profeedback.exe [2009-09-23 436552]
«OutpostMonitor»=C:PROGRA~1AgnitumOUTPOS~1op_mon.exe [2009-12-17 1269632][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]
«Sidebar»=C:Program FilesWindows Sidebarsidebar.exe [2008-01-21 1233920]
«WindowsWelcomeCenter»=oobefldr.dll,ShowWelcomeCenter []
«YandexDesktopSearch»=C:Program FilesYandexDesktopyandesk.exe [2008-09-18 7508776]
«Yupdate!»=C:Program FilesCommon FilesYandexYupdateyupdate.exe [2008-09-01 479496]
«Skype»=C:Program FilesSkypePhoneSkype.exe [2009-10-09 25626408]
«uTorrent»=C:Program FilesuTorrentuTorrent.exe [2009-12-16 289584]
«ICQ»=C:Program FilesICQ6.5ICQ.exe [2009-11-16 172792]
«WMPNSCFG»=C:Program FilesWindows Media PlayerWMPNSCFG.exe [2008-01-21 202240][HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows]
«AppInit_DLLS»=»c:PROGRA~1AgnitumOUTPOS~1wl_hook.dll»[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks]
«{B5A7F190-DDA6-4420-B3BA-52453494E6CD}»=C:Program FilesMicrosoft OfficeOffice12GrooveShellExtensions.dll [2007-08-24 2212224]
«{AEB6717E-7E19-11d0-97EE-00C04FD91972}»= [][HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
«ConsentPromptBehaviorUser»=0
«EnableInstallerDetection»=0
«EnableLUA»=0
«dontdisplaylastusername»=0
«legalnoticecaption»=
«legalnoticetext»=
«shutdownwithoutlogon»=1
«undockwithoutlogon»=1
«EnableUIADesktopToggle»=0[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDriveTypeAutoRun»=145
«NoDrives»=0[HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesexplorer]
«NoDrives»=[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
======List of files/folders created in the last 1 months======
2010-01-02 17:54:40 —-DC—- C:Program Filestrend micro
2010-01-02 17:54:36 —-DC—- C:rsit
2010-01-02 17:22:49 —-SHDC—- C:$RECYCLE.BIN
2010-01-02 17:22:46 —-D—- C:Windowstemp
2010-01-02 17:22:44 —-AC—- C:ComboFix.txt
2010-01-02 17:10:48 —-A—- C:WindowsPEV.exe
2010-01-02 17:10:48 —-A—- C:WindowsNIRCMD.exe
2010-01-02 17:10:48 —-A—- C:WindowsMBR.exe
2010-01-02 17:10:47 —-A—- C:Windowszip.exe
2010-01-02 17:10:47 —-A—- C:WindowsSWSC.exe
2010-01-02 17:10:47 —-A—- C:WindowsSWREG.exe
2010-01-02 17:10:47 —-A—- C:Windowssed.exe
2010-01-02 17:10:47 —-A—- C:Windowsgrep.exe
2010-01-02 17:10:38 —-D—- C:WindowsERDNT
2010-01-02 17:10:30 —-DC—- C:ComboFix
2010-01-02 17:10:10 —-DC—- C:Qoobox
2010-01-02 17:09:00 —-A—- C:WindowsSWXCACLS.exe
2009-12-28 16:15:20 —-DC—- C:Program FilesAgnitum
2009-12-28 16:15:20 —-D—- C:Windowssystem32Filt
2009-12-28 16:14:47 —-D—- C:ProgramDataAgnitum
2009-12-28 15:48:26 —-DC—- C:Program FilesCommon FilesDoctor Web
2009-12-28 15:48:23 —-DC—- C:Program FilesDrWeb
2009-12-28 15:48:23 —-D—- C:ProgramDataDoctor Web
2009-12-27 23:53:16 —-D—- C:Usersмой компьютерAppDataRoamingHP
2009-12-25 03:00:59 —-DC—- C:Program FilesMSXML 4.0
2009-12-24 01:00:10 —-DC—- C:Program FilesVistaVisualMaster
2009-12-23 23:39:03 —-D—- C:ProgramDataWEBREG
2009-12-23 23:37:14 —-D—- C:ProgramDataHPSSUPPLY
2009-12-23 23:34:59 —-DC—- C:Program FilesHewlett-Packard
2009-12-23 23:34:49 —-DC—- C:Program FilesCommon FilesHewlett-Packard
2009-12-23 23:29:03 —-DC—- C:Program FilesHP
2009-12-23 23:28:14 —-D—- C:ProgramDataHP
2009-12-23 14:02:12 —-D—- C:Usersмой компьютерAppDataRoamingOpera
2009-12-23 14:01:59 —-DC—- C:Program FilesOpera
2009-12-16 16:09:45 —-DC—- C:Program Files4Game
2009-12-15 22:28:18 —-A—- C:Windowssystem32msonpmon.dll
2009-12-15 22:26:02 —-DC—- C:Program FilesMicrosoft Visual Studio
2009-12-15 22:22:57 —-DC—- C:Program FilesMicrosoft Visual Studio 8
2009-12-15 22:22:21 —-D—- C:WindowsSHELLNEW
2009-12-15 17:19:03 —-DC—- C:Program FilesICQ6.5
2009-12-12 14:23:17 —-D—- C:Usersмой компьютерAppDataRoamingteamspeak2
2009-12-09 15:15:24 —-A—- C:Windowssystem32winhttp.dll
2009-12-09 15:15:19 —-A—- C:Windowssystem32mshtml.dll
2009-12-09 15:15:18 —-A—- C:Windowssystem32wininet.dll
2009-12-09 15:15:18 —-A—- C:Windowssystem32urlmon.dll
2009-12-09 15:15:18 —-A—- C:Windowssystem32occache.dll
2009-12-09 15:15:17 —-A—- C:Windowssystem32iertutil.dll
2009-12-09 15:15:17 —-A—- C:Windowssystem32ieframe.dll
2009-12-09 15:15:17 —-A—- C:Windowssystem32ieapfltr.dll
2009-12-09 15:15:16 —-A—- C:Windowssystem32mstime.dll
2009-12-09 15:15:16 —-A—- C:Windowssystem32msfeeds.dll
2009-12-09 15:15:16 —-A—- C:Windowssystem32jsproxy.dll
2009-12-09 15:15:16 —-A—- C:Windowssystem32ieUnatt.exe
2009-12-09 15:15:16 —-A—- C:Windowssystem32ieencode.dll
2009-12-09 15:15:16 —-A—- C:Windowssystem32iedkcs32.dll
2009-12-09 15:15:16 —-A—- C:Windowssystem32ieaksie.dll
2009-12-09 15:15:08 —-A—- C:Windowssystem32nshhttp.dll
2009-12-09 15:15:08 —-A—- C:Windowssystem32httpapi.dll
2009-12-09 15:15:00 —-A—- C:Windowssystem32rastls.dll
2009-12-09 15:15:00 —-A—- C:Windowssystem32raschap.dll======List of files/folders modified in the last 1 months======
2010-01-02 17:54:41 —-D—- C:Usersмой компьютерAppDataRoaminguTorrent
2010-01-02 17:54:40 —-RDC—- C:Program Files
2010-01-02 17:25:34 —-D—- C:Program FilesMozilla Firefox
2010-01-02 17:22:46 —-D—- C:Windows
2010-01-02 17:20:25 —-AC—- C:Windowssystem.ini
2010-01-02 17:16:22 —-D—- C:Windowssystem32drivers
2010-01-02 17:16:22 —-D—- C:WindowsSystem32
2010-01-02 17:16:22 —-D—- C:WindowsAppPatch
2010-01-02 17:16:21 —-DC—- C:Program FilesCommon Files
2010-01-02 16:35:21 —-D—- C:Usersмой компьютерAppDataRoamingSkype
2010-01-02 16:33:02 —-D—- C:Windowssystem32wbem
2010-01-02 16:32:17 —-D—- C:WindowsTasks
2010-01-02 16:32:17 —-D—- C:Windowssystem32spool
2010-01-02 16:32:17 —-D—- C:Windowssystem32CodeIntegrity
2010-01-02 16:32:17 —-D—- C:Windowssystem32catroot2
2010-01-02 16:32:17 —-D—- C:Windowsinf
2010-01-02 16:32:15 —-D—- C:Windowsregistration
2010-01-02 16:15:25 —-SHD—- C:System Volume Information
2010-01-02 03:01:13 —-D—- C:Windowstracing
2010-01-01 19:22:05 —-D—- C:Usersмой компьютерAppDataRoamingICQ
2009-12-31 21:05:07 —-D—- C:WindowsPrefetch
2009-12-30 21:50:24 —-D—- C:Program FilesIceDC++
2009-12-30 21:04:09 —-D—- C:WindowsMinidump
2009-12-30 03:54:30 —-D—- C:Windowssystem32config
2009-12-30 02:20:51 —-SHD—- C:WindowsInstaller
2009-12-30 02:05:41 —-SD—- C:Usersмой компьютерAppDataRoamingMicrosoft
2009-12-29 02:14:53 —-D—- C:Windowssystem32catroot
2009-12-28 16:14:47 —-D—- C:ProgramData
2009-12-28 15:49:05 —-D—- C:Windowssystem32Tasks
2009-12-28 12:55:16 —-D—- C:ProgramDataMicrosoft Help
2009-12-28 12:53:56 —-RSD—- C:Windowsassembly
2009-12-28 12:33:12 —-D—- C:Windowssystem32Msdtc
2009-12-28 12:31:54 —-DC—- C:Program FilesuTorrent
2009-12-28 12:31:54 —-DC—- C:Program FilesQIP
2009-12-27 19:26:05 —-D—- C:Program FilesCounter-Strike Source
2009-12-26 03:04:26 —-D—- C:Windowswinsxs
2009-12-23 23:35:08 —-D—- C:Windowstwain_32
2009-12-20 22:12:23 —-D—- C:Windowssystem32WDI
2009-12-17 12:29:37 —-A—- C:Windowswin.ini
2009-12-17 12:23:04 —-A—- C:Windowssystem32PerfStringBackup.INI
2009-12-15 22:26:35 —-DC—- C:Program FilesCommon Filesmicrosoft shared
2009-12-15 22:26:31 —-D—- C:Program FilesMSBuild
2009-12-15 22:25:34 —-DC—- C:Program FilesMicrosoft Office
2009-12-15 22:25:27 —-RSD—- C:WindowsFonts
2009-12-15 22:25:18 —-SD—- C:ProgramDataMicrosoft
2009-12-15 22:22:32 —-DC—- C:Program FilesCommon FilesSystem
2009-12-10 19:36:06 —-D—- C:Windowsrescache
2009-12-10 11:13:45 —-D—- C:Windowssystem32ru-RU
2009-12-10 11:13:45 —-D—- C:Windowssystem32en-US
2009-12-10 11:13:45 —-D—- C:Program FilesWindows Mail
2009-12-10 11:13:45 —-D—- C:Program FilesInternet Explorer
2009-12-05 16:51:32 —-HD—- C:Program FilesInstallShield Installation Information======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 afw;Agnitum Firewall Driver; C:Windowssystem32DRIVERSafw.sys [2009-02-18 29208]
R1 SandBox;SandBox; ??C:Windowssystem32driversSandBox.sys [2009-08-28 714112]
R2 RMCAST;Драйвер протокола RMCAST (Pgm); C:Windowssystem32DRIVERSRMCAST.sys [2008-05-10 113664]
R2 SPIDER;SpIDer Guard File System Monitor; ??C:PROGRA~1DrWebspider.sys [2009-08-17 306464]
R3 afwcore;afwcore; C:Windowssystem32driversafwcore.sys [2009-09-14 318488]
R3 Atc002;NDIS Miniport Driver for Attansic L2 Fast Ethernet Controller; C:Windowssystem32DRIVERSL260x86.sys [2006-12-13 25600]
R3 atikmdag;atikmdag; C:Windowssystem32DRIVERSatikmdag.sys [2008-08-20 3928576]
R3 Point32;Microsoft IntelliPoint Filter Driver; C:Windowssystem32DRIVERSpoint32k.sys [2006-11-07 24064]
R3 RTHDMIAzAudService;Service for HDMI; C:Windowssystem32driversRtHDMIV.sys [2007-05-14 135400]
R3 STHDA;IDT High Definition Audio CODEC; C:Windowssystem32DRIVERSstwrt.sys [2007-12-14 361984]
R3 WUDFRd;WUDFRd; C:Windowssystem32DRIVERSWUDFRd.sys [2008-01-21 83328]
S3 ASWFilt;ASWFilt; ??C:Windowssystem32FiltASWFilt.dll [2009-08-28 33920]
S3 BthEnum;Служба перечислителя Bluetooth; C:Windowssystem32DRIVERSBthEnum.sys [2008-01-21 19456]
S3 BthPan;Устройства Bluetooth (личной сети); C:Windowssystem32DRIVERSbthpan.sys [2008-01-21 92160]
S3 BTHPORT;Драйвер порта Bluetooth; C:WindowsSystem32DriversBTHport.sys [2008-04-29 220160]
S3 BTHUSB;Драйвер порта USB радиомодуля Bluetooth; C:WindowsSystem32DriversBTHUSB.sys [2008-04-29 29184]
S3 catchme;catchme; ??C:Users3ED1~1AppDataLocalTempcatchme.sys []
S3 drmkaud;Звуковой дешифратор DRM ядра системы; C:Windowssystem32driversdrmkaud.sys [2008-01-21 5632]
S3 HdAudAddService;Драйвер функции UAA для службы High Definition Audio (Microsoft), версия 1.1; C:Windowssystem32driversHdAudio.sys [2006-11-02 235520]
S3 mbr;mbr; ??C:Users3ED1~1AppDataLocalTempmbr.sys []
S3 MSKSSRV;Представитель служб потоков Microsoft; C:Windowssystem32driversMSKSSRV.sys [2008-01-21 8192]
S3 MSPCLOCK;Посредник синхронизации потоков Microsoft; C:Windowssystem32driversMSPCLOCK.sys [2008-01-21 5888]
S3 MSPQM;Представитель диспетчера качества потоков Microsoft; C:Windowssystem32driversMSPQM.sys [2008-01-21 5504]
S3 MSTEE;Преобразователь потоков Tee/Sink-to-Sink Microsoft; C:Windowssystem32driversMSTEE.sys [2008-01-21 6016]
S3 RFCOMM;Устройство Bluetooth (протокол RFCOMM TDI); C:Windowssystem32DRIVERSrfcomm.sys [2008-01-21 49664]
S3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 драйвер; C:Windowssystem32DRIVERSRtnicxp.sys [2006-11-02 47104]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:Windowssystem32driverserrdev.sys [2008-01-21 6656]
S4 MegaSR;MegaSR; C:Windowssystem32driversmegasr.sys [2008-01-21 386616]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:Windowssystem32driverswmiacpi.sys [2008-01-21 11264]======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 acssrv;Agnitum Client Security Service; C:PROGRA~1AgnitumOUTPOS~1acs.exe [2009-12-17 1338624]
R2 Ati External Event Utility;Ati External Event Utility; C:Windowssystem32Ati2evxx.exe [2008-08-20 700416]
R2 BthServ;@%SystemRoot%System32bthserv.dll,-101; C:Windowssystem32svchost.exe [2008-01-21 21504]
R2 DrWebEngine;Dr.Web Scanning Engine (DrWebEngine); C:Program FilesCommon FilesDoctor WebScanning Enginedwengine.exe [2009-09-22 869688]
R2 SPIDERNT;SpIDer Guard for Windows; C:PROGRA~1DrWebspidernt.exe [2009-08-17 231328]
R2 STacSV;Audio Service; C:WindowsSystem32DriverStoreFileRepositorystwrt.inf_c6f2043dSTacSV.exe [2007-12-14 212992]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:Program FilesMicrosoft OfficeOffice12GrooveAuditService.exe [2007-08-24 68464]
S3 npggsvc;nProtect GameGuard Service; C:Windowssystem32GameMon.des [2009-10-12 3369044]
S3 odserv;Microsoft Office Diagnostics Service; C:Program FilesCommon FilesMicrosoft SharedOFFICE12ODSERV.EXE [2008-11-04 441712]
S3 ose;Office Source Engine; C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE [2006-10-26 145184]
S3 usnjsvc;Служба Messenger Sharing Folders USN Journal Reader; C:Program FilesWindows LiveMessengerusnsvc.exe [2007-10-18 98328]
S3 WLSetupSvc;Windows Live Setup Service; C:Program FilesWindows LiveinstallerWLSetupSvc.exe [2007-10-25 266240]
EOF
