Avira AntiRootkit Tool (1.1.0.1) ======================================================================================================== - Scan started Wednesday, September 09, 2009 - 1:05:12 AM ======================================================================================================== -------------------------------------------------------------------------------------------------------- Configuration: -------------------------------------------------------------------------------------------------------- - [X] Scan files - [X] Scan registry - [X] Scan processes - [ ] Fast scan - Working disk total size : 46.58 GB - Working disk free size : 12.66 GB (27 %) -------------------------------------------------------------------------------------------------------- Results: Embedded nulls : HKEY_USERS\S-1-5-21-343818398-73586283-682003330-1004\Software\SecuROM\License information Hidden value : HKEY_USERS\S-1-5-21-343818398-73586283-682003330-1004\Software\SecuROM\License information -> datasecu Hidden value : HKEY_USERS\S-1-5-21-343818398-73586283-682003330-1004\Software\SecuROM\License information -> rkeysecu -------------------------------------------------------------------------------------------------------- Files: 0/104692 Registry items: 3/488450 Processes: 0/49 Scan time: 00:06:21 -------------------------------------------------------------------------------------------------------- Active processes: - kgfybrvt.exe (PID 1304) (Avira AntiRootkit Tool) - iexplore.exe (PID 3104) - System (PID 4) - smss.exe (PID 420) - csrss.exe (PID 496) - winlogon.exe (PID 684) - services.exe (PID 728) - lsass.exe (PID 740) - ati2evxx.exe (PID 908) - svchost.exe (PID 928) - svchost.exe (PID 1020) - svchost.exe (PID 1060) - svchost.exe (PID 1096) - svchost.exe (PID 1208) - aswUpdSv.exe (PID 1280) - ati2evxx.exe (PID 1376) - spoolsv.exe (PID 1612) - sched.exe (PID 1660) - avguard.exe (PID 1696) - svchost.exe (PID 1816) - explorer.exe (PID 2004) - hpztsb04.exe (PID 364) - hphmon03.exe (PID 444) - SynTPEnh.exe (PID 468) - QLBCTRL.exe (PID 488) - MOM.exe (PID 544) - iTunesHelper.exe (PID 620) - GrooveMonitor.exe (PID 636) - ashDisp.exe (PID 840) - avgnt.exe (PID 956) - GoogleToolbarNotifier.exe (PID 1240) - TeaTimer.exe (PID 1588) - EasyShare.exe (PID 780) - AppleMobileDeviceService.exe (PID 2160) - jqs.exe (PID 2352) - svchost.exe (PID 2496) - YahooAUService.exe (PID 2588) - hpqwmiex.exe (PID 2636) - ashMaiSv.exe (PID 2952) - ashWebSv.exe (PID 3000) - CCC.exe (PID 3256) - iexplore.exe (PID 3292) - hphipm09.exe (PID 3512) - iPodService.exe (PID 3652) - svchost.exe (PID 3688) - wmiprvse.exe (PID 3924) - alg.exe (PID 3932) - iexplore.exe (PID 3396) - avirarkd.exe (PID 276) ======================================================================================================== - Scan finished Wednesday, September 09, 2009 - 1:11:34 AM ======================================================================================================== Mbam LOG (Partial before it died) Malwarebytes' Anti-Malware 1.40 Database version: 2759 Executable location: C:\Program Files\Malwareb Database location: C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref Username: MASTER Windows folder: C:\WINDOWS System folder: C:\WINDOWS\system32 Root drive: C: Program Files: C:\Program Files Common Files: C:\Program Files\Common Files Desktop: C:\Documents and Settings\Administrator\Desktop Desktop: C:\Documents and Settings\All Users\Desktop Desktop: C:\Documents and Settings\Default User\Desktop Desktop: C:\Documents and Settings\MASTER\Desktop Start Menu: C:\Documents and Settings\All Users\Start Menu Start Menu: C:\Documents and Settings\Administrator\Start Menu Start Menu: C:\Documents and Settings\Default User\Start Menu Start Menu: C:\Documents and Settings\LocalService\Start Menu Start Menu: C:\Documents and Settings\MASTER\Start Menu User Root: C:\Documents and Settings\Administrator User Root: C:\Documents and Settings\All Users User Root: C:\Documents and Settings\Default User User Root: C:\Documents and Settings\LocalService User Root: C:\Documents and Settings\MASTER User Root: C:\Documents and Settings\NetworkService Favorite: C:\Documents and Settings\Administrator\Favorites Favorite: C:\Documents and Settings\All Users\Favorites Favorite: C:\Documents and Settings\Default User\Favorites Favorite: C:\Documents and Settings\MASTER\Favorites Application Data: C:\Documents and Settings\All Users\Application Data Application Data: C:\Documents and Settings\Administrator\Application Data Application Data: C:\Documents and Settings\Default User\Application Data Application Data: C:\Documents and Settings\LocalService\Application Data Application Data: C:\Documents and Settings\MASTER\Application Data Application Data: C:\Documents and Settings\NetworkService\Application Data Quick Launch: C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch Quick Launch: C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\Quick Launch Quick Launch: C:\Documents and Settings\LocalService\Application Data\Microsoft\Internet Explorer\Quick Launch Quick Launch: C:\Documents and Settings\MASTER\Application Data\Microsoft\Internet Explorer\Quick Launch Quick Launch: C:\Documents and Settings\NetworkService\Application Data\Microsoft\Internet Explorer\Quick Launch Temporary Folder: C:\WINDOWS\Temp Temporary Folder: C:\Documents and Settings\Administrator\Local Settings\Temp Temporary Folder: C:\Documents and Settings\Default User\Local Settings\Temp Temporary Folder: C:\Documents and Settings\LocalService\Local Settings\Temp Temporary Folder: C:\Documents and Settings\MASTER\Local Settings\Temp Temporary Folder: C:\Documents and Settings\NetworkService\Local Settings\Temp Programs: C:\Documents and Settings\Administrator\Start Menu\Programs Programs: C:\Documents and Settings\All Users\Start Menu\Programs Programs: C:\Documents and Settings\Default User\Start Menu\Programs Programs: C:\Documents and Settings\LocalService\Start Menu\Programs Programs: C:\Documents and Settings\MASTER\Start Menu\Programs Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup Startup: C:\Documents and Settings\Default User\Start Menu\Programs\Startup Startup: C:\Documents and Settings\MASTER\Start Menu\Programs\Startup Documents: C:\Documents and Settings\All Users\Documents Documents: C:\Documents and Settings\Administrator\My Documents Documents: C:\Documents and Settings\Default User\My Documents Documents: C:\Documents and Settings\MASTER\My Documents ===================================================================================== ===================================================================================== RootRepeal logs (Partial, "Files" dies, missing "Hidden" "Stealth" were blank.) ROOTREPEAL (c) AD, 2007-2009 ================================================== Scan Start Time: 2009/09/09 00:59 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ------------------- Name: 1394BUS.SYS Image Path: C:\WINDOWS\system32\DRIVERS\1394BUS.SYS Address: 0xF74F0000 Size: 57344 File Visible: - Signed: - Status: - Name: Aavmker4.SYS Image Path: C:\WINDOWS\System32\Drivers\Aavmker4.SYS Address: 0xF77B0000 Size: 19072 File Visible: - Signed: - Status: - Name: ACPI.sys Image Path: ACPI.sys Address: 0xF73A1000 Size: 187776 File Visible: - Signed: - Status: - Name: ACPI_HAL Image Path: \Driver\ACPI_HAL Address: 0x804D7000 Size: 2066048 File Visible: - Signed: - Status: - Name: ACPIEC.sys Image Path: ACPIEC.sys Address: 0xF78EC000 Size: 11648 File Visible: - Signed: - Status: - Name: afd.sys Image Path: C:\WINDOWS\System32\drivers\afd.sys Address: 0xAA700000 Size: 138496 File Visible: - Signed: - Status: - Name: AmdPPM.sys Image Path: C:\WINDOWS\system32\DRIVERS\AmdPPM.sys Address: 0xF7590000 Size: 53248 File Visible: - Signed: - Status: - Name: aswFsBlk.sys Image Path: C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys Address: 0xF7810000 Size: 32768 File Visible: - Signed: - Status: - Name: aswMon2.SYS Image Path: C:\WINDOWS\System32\Drivers\aswMon2.SYS Address: 0xA7F03000 Size: 87424 File Visible: - Signed: - Status: - Name: aswRdr.SYS Image Path: C:\WINDOWS\System32\Drivers\aswRdr.SYS Address: 0xA700B000 Size: 15136 File Visible: - Signed: - Status: - Name: aswSP.SYS Image Path: C:\WINDOWS\System32\Drivers\aswSP.SYS Address: 0xAA53D000 Size: 135168 File Visible: - Signed: - Status: - Name: aswTdi.SYS Image Path: C:\WINDOWS\System32\Drivers\aswTdi.SYS Address: 0xF7550000 Size: 41664 File Visible: - Signed: - Status: - Name: atapi.sys Image Path: atapi.sys Address: 0xF733B000 Size: 96512 File Visible: - Signed: - Status: - Name: ati2cqag.dll Image Path: C:\WINDOWS\System32\ati2cqag.dll Address: 0xBF062000 Size: 573440 File Visible: - Signed: - Status: - Name: ati2dvag.dll Image Path: C:\WINDOWS\System32\ati2dvag.dll Address: 0xBF012000 Size: 327680 File Visible: - Signed: - Status: - Name: ati2mtag.sys Image Path: C:\WINDOWS\system32\DRIVERS\ati2mtag.sys Address: 0xF6CAD000 Size: 5337088 File Visible: - Signed: - Status: - Name: ati3duag.dll Image Path: C:\WINDOWS\System32\ati3duag.dll Address: 0xBF19E000 Size: 4009984 File Visible: - Signed: - Status: - Name: atikvmag.dll Image Path: C:\WINDOWS\System32\atikvmag.dll Address: 0xBF0EE000 Size: 446464 File Visible: - Signed: - Status: - Name: atiok3x2.dll Image Path: C:\WINDOWS\System32\atiok3x2.dll Address: 0xBF15B000 Size: 274432 File Visible: - Signed: - Status: - Name: ativvaxx.dll Image Path: C:\WINDOWS\System32\ativvaxx.dll Address: 0xBF571000 Size: 2400256 File Visible: - Signed: - Status: - Name: ATMFD.DLL Image Path: C:\WINDOWS\System32\ATMFD.DLL Address: 0xBFFA0000 Size: 286720 File Visible: - Signed: - Status: - Name: audstub.sys Image Path: C:\WINDOWS\system32\DRIVERS\audstub.sys Address: 0xF7BCF000 Size: 3072 File Visible: - Signed: - Status: - Name: avgio.sys Image Path: C:\Program Files\Avira\AntiVir Desktop\avgio.sys Address: 0xF7A8C000 Size: 6144 File Visible: - Signed: - Status: - Name: avgntflt.sys Image Path: C:\WINDOWS\system32\DRIVERS\avgntflt.sys Address: 0xA80A9000 Size: 81920 File Visible: - Signed: - Status: - Name: avipbb.sys Image Path: C:\WINDOWS\system32\DRIVERS\avipbb.sys Address: 0xAA55E000 Size: 114688 File Visible: - Signed: - Status: - Name: BATTC.SYS Image Path: C:\WINDOWS\system32\DRIVERS\BATTC.SYS Address: 0xF78E8000 Size: 16384 File Visible: - Signed: - Status: - Name: Beep.SYS Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS Address: 0xF7A82000 Size: 4224 File Visible: - Signed: - Status: - Name: BOOTVID.dll Image Path: C:\WINDOWS\system32\BOOTVID.dll Address: 0xF78E0000 Size: 12288 File Visible: - Signed: - Status: - Name: camc6aud.sys Image Path: C:\WINDOWS\system32\drivers\camc6aud.sys Address: 0xF7670000 Size: 37760 File Visible: - Signed: - Status: - Name: camc6hal.sys Image Path: C:\WINDOWS\system32\drivers\camc6hal.sys Address: 0xF6AF1000 Size: 346496 File Visible: - Signed: - Status: - Name: Cdfs.SYS Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS Address: 0xF75E0000 Size: 63744 File Visible: - Signed: - Status: - Name: cdrom.sys Image Path: C:\WINDOWS\system32\DRIVERS\cdrom.sys Address: 0xF7620000 Size: 62976 File Visible: - Signed: - Status: - Name: CLASSPNP.SYS Image Path: C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS Address: 0xF7530000 Size: 53248 File Visible: - Signed: - Status: - Name: CmBatt.sys Image Path: C:\WINDOWS\system32\DRIVERS\CmBatt.sys Address: 0xF796C000 Size: 13952 File Visible: - Signed: - Status: - Name: compbatt.sys Image Path: compbatt.sys Address: 0xF78E4000 Size: 10240 File Visible: - Signed: - Status: - Name: disk.sys Image Path: disk.sys Address: 0xF7520000 Size: 36352 File Visible: - Signed: - Status: - Name: drmk.sys Image Path: C:\WINDOWS\system32\drivers\drmk.sys Address: 0xF7680000 Size: 61440 File Visible: - Signed: - Status: - Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xAA4FD000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF79DC000 Size: 8192 File Visible: No Signed: - Status: - Name: Dxapi.sys Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys Address: 0xAA7EE000 Size: 12288 File Visible: - Signed: - Status: - Name: dxg.sys Image Path: C:\WINDOWS\System32\drivers\dxg.sys Address: 0xBF000000 Size: 73728 File Visible: - Signed: - Status: - Name: dxgthk.sys Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys Address: 0xF7BF6000 Size: 4096 File Visible: - Signed: - Status: - Name: Fips.SYS Image Path: C:\WINDOWS\System32\Drivers\Fips.SYS Address: 0xF75A0000 Size: 44544 File Visible: - Signed: - Status: - Name: fltmgr.sys Image Path: fltmgr.sys Address: 0xF731B000 Size: 129792 File Visible: - Signed: - Status: - Name: Fs_Rec.SYS Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS Address: 0xF7A80000 Size: 7936 File Visible: - Signed: - Status: - Name: ftdisk.sys Image Path: ftdisk.sys Address: 0xF7353000 Size: 125056 File Visible: - Signed: - Status: - Name: GEARAspiWDM.sys Image Path: C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys Address: 0xF7640000 Size: 40960 File Visible: - Signed: - Status: - Name: hal.dll Image Path: C:\WINDOWS\system32\hal.dll Address: 0x806D0000 Size: 131840 File Visible: - Signed: - Status: - Name: HIDCLASS.SYS Image Path: C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS Address: 0xF7580000 Size: 36864 File Visible: - Signed: - Status: - Name: HIDPARSE.SYS Image Path: C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS Address: 0xF77A0000 Size: 28672 File Visible: - Signed: - Status: - Name: hidusb.sys Image Path: C:\WINDOWS\system32\DRIVERS\hidusb.sys Address: 0xF71C4000 Size: 10368 File Visible: - Signed: - Status: - Name: hphid409.sys Image Path: C:\WINDOWS\system32\DRIVERS\hphid409.sys Address: 0xF75C0000 Size: 50528 File Visible: - Signed: - Status: - Name: hphipr09.sys Image Path: C:\WINDOWS\system32\DRIVERS\hphipr09.sys Address: 0xF799C000 Size: 15840 File Visible: - Signed: - Status: - Name: hphius09.sys Image Path: C:\WINDOWS\System32\drivers\hphius09.sys Address: 0xF77C0000 Size: 18592 File Visible: - Signed: - Status: - Name: hphs2k09.sys Image Path: C:\WINDOWS\System32\Drivers\hphs2k09.sys Address: 0xF75D0000 Size: 50144 File Visible: - Signed: - Status: - Name: HpqKbFiltr.sys Image Path: C:\WINDOWS\system32\DRIVERS\HpqKbFiltr.sys Address: 0xF7860000 Size: 16768 File Visible: - Signed: - Status: - Name: HSF_CNXT.sys Image Path: C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys Address: 0xF68F2000 Size: 703232 File Visible: - Signed: - Status: - Name: HSF_DP.sys Image Path: C:\WINDOWS\system32\DRIVERS\HSF_DP.sys Address: 0xF699E000 Size: 1038208 File Visible: - Signed: - Status: - Name: HSFHWATI.sys Image Path: C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys Address: 0xF6A9C000 Size: 200192 File Visible: - Signed: - Status: - Name: HTTP.sys Image Path: C:\WINDOWS\System32\Drivers\HTTP.sys Address: 0xA6EF2000 Size: 264832 File Visible: - Signed: - Status: - Name: i8042prt.sys Image Path: C:\WINDOWS\system32\DRIVERS\i8042prt.sys Address: 0xF7650000 Size: 52480 File Visible: - Signed: - Status: - Name: imapi.sys Image Path: C:\WINDOWS\system32\DRIVERS\imapi.sys Address: 0xF7610000 Size: 42112 File Visible: - Signed: - Status: - Name: ipnat.sys Image Path: C:\WINDOWS\system32\DRIVERS\ipnat.sys Address: 0xAA6B5000 Size: 152832 File Visible: - Signed: - Status: - Name: ipsec.sys Image Path: C:\WINDOWS\system32\DRIVERS\ipsec.sys Address: 0xAA7A3000 Size: 75264 File Visible: - Signed: - Status: - Name: isapnp.sys Image Path: isapnp.sys Address: 0xF74D0000 Size: 37248 File Visible: - Signed: - Status: - Name: kbdclass.sys Image Path: C:\WINDOWS\system32\DRIVERS\kbdclass.sys Address: 0xF7868000 Size: 24576 File Visible: - Signed: - Status: - Name: KDCOM.DLL Image Path: C:\WINDOWS\system32\KDCOM.DLL Address: 0xF79D0000 Size: 8192 File Visible: - Signed: - Status: - Name: kmixer.sys Image Path: C:\WINDOWS\system32\drivers\kmixer.sys Address: 0xA6AB4000 Size: 172416 File Visible: - Signed: - Status: - Name: kqemu.sys Image Path: C:\WINDOWS\system32\DRIVERS\kqemu.sys Address: 0xA735B000 Size: 118784 File Visible: - Signed: - Status: - Name: ks.sys Image Path: C:\WINDOWS\system32\DRIVERS\ks.sys Address: 0xF6C52000 Size: 143360 File Visible: - Signed: - Status: - Name: KSecDD.sys Image Path: KSecDD.sys Address: 0xF7304000 Size: 92928 File Visible: - Signed: - Status: - Name: mdmxsdk.sys Image Path: C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys Address: 0xA7583000 Size: 11840 File Visible: - Signed: - Status: - Name: mnmdd.SYS Image Path: C:\WINDOWS\System32\Drivers\mnmdd.SYS Address: 0xF7A84000 Size: 4224 File Visible: - Signed: - Status: - Name: Modem.SYS Image Path: C:\WINDOWS\System32\Drivers\Modem.SYS Address: 0xF7878000 Size: 30080 File Visible: - Signed: - Status: - Name: mouclass.sys Image Path: C:\WINDOWS\system32\DRIVERS\mouclass.sys Address: 0xF7870000 Size: 23040 File Visible: - Signed: - Status: - Name: mouhid.sys Image Path: C:\WINDOWS\system32\DRIVERS\mouhid.sys Address: 0xF7988000 Size: 12160 File Visible: - Signed: - Status: - Name: MountMgr.sys Image Path: MountMgr.sys Address: 0xF7500000 Size: 42368 File Visible: - Signed: - Status: - Name: mrxdav.sys Image Path: C:\WINDOWS\system32\DRIVERS\mrxdav.sys Address: 0xA7C06000 Size: 180608 File Visible: - Signed: - Status: - Name: mrxsmb.sys Image Path: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys Address: 0xAA61A000 Size: 455296 File Visible: - Signed: - Status: - Name: Msfs.SYS Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS Address: 0xF7788000 Size: 19072 File Visible: - Signed: - Status: - Name: msgpc.sys Image Path: C:\WINDOWS\system32\DRIVERS\msgpc.sys Address: 0xF76C0000 Size: 35072 File Visible: - Signed: - Status: - Name: mssmbios.sys Image Path: C:\WINDOWS\system32\DRIVERS\mssmbios.sys Address: 0xF7978000 Size: 15488 File Visible: - Signed: - Status: - Name: Mup.sys Image Path: Mup.sys Address: 0xF721D000 Size: 105344 File Visible: - Signed: - Status: - Name: NDIS.sys Image Path: NDIS.sys Address: 0xF7237000 Size: 182656 File Visible: - Signed: - Status: - Name: ndistapi.sys Image Path: C:\WINDOWS\system32\DRIVERS\ndistapi.sys Address: 0xF7970000 Size: 10112 File Visible: - Signed: - Status: - Name: ndisuio.sys Image Path: C:\WINDOWS\system32\DRIVERS\ndisuio.sys Address: 0xA8085000 Size: 14592 File Visible: - Signed: - Status: - Name: ndiswan.sys Image Path: C:\WINDOWS\system32\DRIVERS\ndiswan.sys Address: 0xF68DB000 Size: 91520 File Visible: - Signed: - Status: - Name: NDProxy.SYS Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS Address: 0xF76E0000 Size: 40576 File Visible: - Signed: - Status: - Name: netbios.sys Image Path: C:\WINDOWS\system32\DRIVERS\netbios.sys Address: 0xF7560000 Size: 34688 File Visible: - Signed: - Status: - Name: netbt.sys Image Path: C:\WINDOWS\system32\DRIVERS\netbt.sys Address: 0xAA722000 Size: 162816 File Visible: - Signed: - Status: - Name: Npfs.SYS Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS Address: 0xF7790000 Size: 30848 File Visible: - Signed: - Status: - Name: Ntfs.sys Image Path: Ntfs.sys Address: 0xF7264000 Size: 574976 File Visible: - Signed: - Status: - Name: ntkrnlpa.exe Image Path: C:\WINDOWS\system32\ntkrnlpa.exe Address: 0x804D7000 Size: 2066048 File Visible: - Signed: - Status: - Name: Null.SYS Image Path: C:\WINDOWS\System32\Drivers\Null.SYS Address: 0xF7AA1000 Size: 2944 File Visible: - Signed: - Status: - Name: ohci1394.sys Image Path: ohci1394.sys Address: 0xF74E0000 Size: 61696 File Visible: - Signed: - Status: - Name: OPRGHDLR.SYS Image Path: C:\WINDOWS\system32\DRIVERS\OPRGHDLR.SYS Address: 0xF7A99000 Size: 4096 File Visible: - Signed: - Status: - Name: PartMgr.sys Image Path: PartMgr.sys Address: 0xF7758000 Size: 19712 File Visible: - Signed: - Status: - Name: pci.sys Image Path: pci.sys Address: 0xF7390000 Size: 68224 File Visible: - Signed: - Status: - Name: pciide.sys Image Path: pciide.sys Address: 0xF7A98000 Size: 3328 File Visible: - Signed: - Status: - Name: PCIIDEX.SYS Image Path: C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS Address: 0xF7750000 Size: 28672 File Visible: - Signed: - Status: - Name: pcmcia.sys Image Path: pcmcia.sys Address: 0xF7372000 Size: 120192 File Visible: - Signed: - Status: - Name: PnpManager Image Path: \Driver\PnpManager Address: 0x804D7000 Size: 2066048 File Visible: - Signed: - Status: - Name: portcls.sys Image Path: C:\WINDOWS\system32\drivers\portcls.sys Address: 0xF6ACD000 Size: 147456 File Visible: - Signed: - Status: - Name: psched.sys Image Path: C:\WINDOWS\system32\DRIVERS\psched.sys Address: 0xF68CA000 Size: 69120 File Visible: - Signed: - Status: - Name: ptilink.sys Image Path: C:\WINDOWS\system32\DRIVERS\ptilink.sys Address: 0xF7888000 Size: 17792 File Visible: - Signed: - Status: - Name: PxHelp20.sys Image Path: PxHelp20.sys Address: 0xF7760000 Size: 19936 File Visible: - Signed: - Status: - Name: rasacd.sys Image Path: C:\WINDOWS\system32\DRIVERS\rasacd.sys Address: 0xF71D4000 Size: 8832 File Visible: - Signed: - Status: - Name: rasl2tp.sys Image Path: C:\WINDOWS\system32\DRIVERS\rasl2tp.sys Address: 0xF7690000 Size: 51328 File Visible: - Signed: - Status: - Name: raspppoe.sys Image Path: C:\WINDOWS\system32\DRIVERS\raspppoe.sys Address: 0xF76A0000 Size: 41472 File Visible: - Signed: - Status: - Name: raspptp.sys Image Path: C:\WINDOWS\system32\DRIVERS\raspptp.sys Address: 0xF76B0000 Size: 48384 File Visible: - Signed: - Status: - Name: raspti.sys Image Path: C:\WINDOWS\system32\DRIVERS\raspti.sys Address: 0xF7890000 Size: 16512 File Visible: - Signed: - Status: - Name: RAW Image Path: \FileSystem\RAW Address: 0x804D7000 Size: 2066048 File Visible: - Signed: - Status: - Name: rdbss.sys Image Path: C:\WINDOWS\system32\DRIVERS\rdbss.sys Address: 0xAA68A000 Size: 175744 File Visible: - Signed: - Status: - Name: RDPCDD.sys Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys Address: 0xF7A86000 Size: 4224 File Visible: - Signed: - Status: - Name: redbook.sys Image Path: C:\WINDOWS\system32\DRIVERS\redbook.sys Address: 0xF7630000 Size: 57600 File Visible: - Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xA6B1F000 Size: 49152 File Visible: No Signed: - Status: - Name: Rtnicxp.sys Image Path: C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys Address: 0xF6B46000 Size: 130432 File Visible: - Signed: - Status: - Name: SASDIFSV.SYS Image Path: C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS Address: 0xF77A8000 Size: 24576 File Visible: - Signed: - Status: - Name: SASKUTIL.sys Image Path: C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys Address: 0xAA6DB000 Size: 151552 File Visible: - Signed: - Status: - Name: sdbus.sys Image Path: C:\WINDOWS\system32\DRIVERS\sdbus.sys Address: 0xF6B66000 Size: 79232 File Visible: - Signed: - Status: - Name: ssmdrv.sys Image Path: C:\WINDOWS\system32\DRIVERS\ssmdrv.sys Address: 0xF7798000 Size: 23040 File Visible: - Signed: - Status: - Name: swenum.sys Image Path: C:\WINDOWS\system32\DRIVERS\swenum.sys Address: 0xF7A3C000 Size: 4352 File Visible: - Signed: - Status: - Name: SynTP.sys Image Path: C:\WINDOWS\system32\DRIVERS\SynTP.sys Address: 0xF6BA2000 Size: 213696 File Visible: - Signed: - Status: - Name: sysaudio.sys Image Path: C:\WINDOWS\system32\drivers\sysaudio.sys Address: 0xA7E63000 Size: 60800 File Visible: - Signed: - Status: - Name: tcpip.sys Image Path: C:\WINDOWS\system32\DRIVERS\tcpip.sys Address: 0xAA74A000 Size: 361600 File Visible: - Signed: - Status: - Name: TDI.SYS Image Path: C:\WINDOWS\system32\DRIVERS\TDI.SYS Address: 0xF7880000 Size: 20480 File Visible: - Signed: - Status: - Name: termdd.sys Image Path: C:\WINDOWS\system32\DRIVERS\termdd.sys Address: 0xF76D0000 Size: 40704 File Visible: - Signed: - Status: - Name: tifm21.sys Image Path: C:\WINDOWS\system32\drivers\tifm21.sys Address: 0xF6B7A000 Size: 160768 File Visible: - Signed: - Status: - Name: tmcomm.sys Image Path: C:\WINDOWS\system32\drivers\tmcomm.sys Address: 0xA731B000 Size: 97280 File Visible: - Signed: - Status: - Name: update.sys Image Path: C:\WINDOWS\system32\DRIVERS\update.sys Address: 0xF67CC000 Size: 384768 File Visible: - Signed: - Status: - Name: USBD.SYS Image Path: C:\WINDOWS\system32\DRIVERS\USBD.SYS Address: 0xF7A3A000 Size: 8192 File Visible: - Signed: - Status: - Name: usbehci.sys Image Path: C:\WINDOWS\system32\DRIVERS\usbehci.sys Address: 0xF7858000 Size: 30208 File Visible: - Signed: - Status: - Name: usbhub.sys Image Path: C:\WINDOWS\system32\DRIVERS\usbhub.sys Address: 0xF7730000 Size: 59520 File Visible: - Signed: - Status: - Name: usbohci.sys Image Path: C:\WINDOWS\system32\DRIVERS\usbohci.sys Address: 0xF7850000 Size: 17152 File Visible: - Signed: - Status: - Name: USBPORT.SYS Image Path: C:\WINDOWS\system32\DRIVERS\USBPORT.SYS Address: 0xF6C75000 Size: 147456 File Visible: - Signed: - Status: - Name: vga.sys Image Path: C:\WINDOWS\System32\drivers\vga.sys Address: 0xF7780000 Size: 20992 File Visible: - Signed: - Status: - Name: VIDEOPRT.SYS Image Path: C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS Address: 0xF6C99000 Size: 81920 File Visible: - Signed: - Status: - Name: VolSnap.sys Image Path: VolSnap.sys Address: 0xF7510000 Size: 52352 File Visible: - Signed: - Status: - Name: wanarp.sys Image Path: C:\WINDOWS\system32\DRIVERS\wanarp.sys Address: 0xF689A000 Size: 34560 File Visible: - Signed: - Status: - Name: watchdog.sys Image Path: C:\WINDOWS\System32\watchdog.sys Address: 0xF77C8000 Size: 20480 File Visible: - Signed: - Status: - Name: Wdf01000.sys Image Path: C:\WINDOWS\system32\DRIVERS\Wdf01000.sys Address: 0xF6BD7000 Size: 503808 File Visible: - Signed: - Status: - Name: WDFLDR.SYS Image Path: C:\WINDOWS\system32\DRIVERS\WDFLDR.SYS Address: 0xF7660000 Size: 53248 File Visible: - Signed: - Status: - Name: wdmaud.sys Image Path: C:\WINDOWS\system32\drivers\wdmaud.sys Address: 0xA7B79000 Size: 83072 File Visible: - Signed: - Status: - Name: Win32k Image Path: \Driver\Win32k Address: 0xBF800000 Size: 1847296 File Visible: - Signed: - Status: - Name: win32k.sys Image Path: C:\WINDOWS\System32\win32k.sys Address: 0xBF800000 Size: 1847296 File Visible: - Signed: - Status: - Name: win32k.sys:1 Image Path: C:\WINDOWS\win32k.sys:1 Address: 0xF7818000 Size: 20480 File Visible: No Signed: - Status: - Name: win32k.sys:2 Image Path: C:\WINDOWS\win32k.sys:2 Address: 0xF68BA000 Size: 61440 File Visible: No Signed: - Status: - Name: wmiacpi.sys Image Path: C:\WINDOWS\system32\DRIVERS\wmiacpi.sys Address: 0xF79C4000 Size: 8832 File Visible: - Signed: - Status: - Name: WMILIB.SYS Image Path: C:\WINDOWS\system32\DRIVERS\WMILIB.SYS Address: 0xF79D2000 Size: 8192 File Visible: - Signed: - Status: - Name: WMIxWDM Image Path: \Driver\WMIxWDM Address: 0x804D7000 Size: 2066048 File Visible: - Signed: - Status: - Name: WudfPf.sys Image Path: WudfPf.sys Address: 0xF72F1000 Size: 77568 File Visible: - Signed: - Status: - ROOTREPEAL (c) AD, 2007-2009 ================================================== Scan Start Time: 2009/09/09 00:59 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Shadow SSDT ------------------- #: 000 Function Name: NtGdiAbortDoc Status: Not hooked #: 001 Function Name: NtGdiAbortPath Status: Not hooked #: 002 Function Name: NtGdiAddFontResourceW Status: Not hooked #: 003 Function Name: NtGdiAddRemoteFontToDC Status: Not hooked #: 004 Function Name: NtGdiAddFontMemResourceEx Status: Not hooked #: 005 Function Name: NtGdiRemoveMergeFont Status: Not hooked #: 006 Function Name: NtGdiAddRemoteMMInstanceToDC Status: Not hooked #: 007 Function Name: NtGdiAlphaBlend Status: Not hooked #: 008 Function Name: NtGdiAngleArc Status: Not hooked #: 009 Function Name: NtGdiAnyLinkedFonts Status: Not hooked #: 010 Function Name: NtGdiFontIsLinked Status: Not hooked #: 011 Function Name: NtGdiArcInternal Status: Not hooked #: 012 Function Name: NtGdiBeginPath Status: Not hooked #: 013 Function Name: NtGdiBitBlt Status: Not hooked #: 014 Function Name: NtGdiCancelDC Status: Not hooked #: 015 Function Name: NtGdiCheckBitmapBits Status: Not hooked #: 016 Function Name: NtGdiCloseFigure Status: Not hooked #: 017 Function Name: NtGdiClearBitmapAttributes Status: Not hooked #: 018 Function Name: NtGdiClearBrushAttributes Status: Not hooked #: 019 Function Name: NtGdiColorCorrectPalette Status: Not hooked #: 020 Function Name: NtGdiCombineRgn Status: Not hooked #: 021 Function Name: NtGdiCombineTransform Status: Not hooked #: 022 Function Name: NtGdiComputeXformCoefficients Status: Not hooked #: 023 Function Name: NtGdiConsoleTextOut Status: Not hooked #: 024 Function Name: NtGdiConvertMetafileRect Status: Not hooked #: 025 Function Name: NtGdiCreateBitmap Status: Not hooked #: 026 Function Name: NtGdiCreateClientObj Status: Not hooked #: 027 Function Name: NtGdiCreateColorSpace Status: Not hooked #: 028 Function Name: NtGdiCreateColorTransform Status: Not hooked #: 029 Function Name: NtGdiCreateCompatibleBitmap Status: Not hooked #: 030 Function Name: NtGdiCreateCompatibleDC Status: Not hooked #: 031 Function Name: NtGdiCreateDIBBrush Status: Not hooked #: 032 Function Name: NtGdiCreateDIBitmapInternal Status: Not hooked #: 033 Function Name: NtGdiCreateDIBSection Status: Not hooked #: 034 Function Name: NtGdiCreateEllipticRgn Status: Not hooked #: 035 Function Name: NtGdiCreateHalftonePalette Status: Not hooked #: 036 Function Name: NtGdiCreateHatchBrushInternal Status: Not hooked #: 037 Function Name: NtGdiCreateMetafileDC Status: Not hooked #: 038 Function Name: NtGdiCreatePaletteInternal Status: Not hooked #: 039 Function Name: NtGdiCreatePatternBrushInternal Status: Not hooked #: 040 Function Name: NtGdiCreatePen Status: Not hooked #: 041 Function Name: NtGdiCreateRectRgn Status: Not hooked #: 042 Function Name: NtGdiCreateRoundRectRgn Status: Not hooked #: 043 Function Name: NtGdiCreateServerMetaFile Status: Not hooked #: 044 Function Name: NtGdiCreateSolidBrush Status: Not hooked #: 045 Function Name: NtGdiD3dContextCreate Status: Not hooked #: 046 Function Name: NtGdiD3dContextDestroy Status: Not hooked #: 047 Function Name: NtGdiD3dContextDestroyAll Status: Not hooked #: 048 Function Name: NtGdiD3dValidateTextureStageState Status: Not hooked #: 049 Function Name: NtGdiD3dDrawPrimitives2 Status: Not hooked #: 050 Function Name: NtGdiDdGetDriverState Status: Not hooked #: 051 Function Name: NtGdiDdAddAttachedSurface Status: Not hooked #: 052 Function Name: NtGdiDdAlphaBlt Status: Not hooked #: 053 Function Name: NtGdiDdAttachSurface Status: Not hooked #: 054 Function Name: NtGdiDdBeginMoCompFrame Status: Not hooked #: 055 Function Name: NtGdiDdBlt Status: Not hooked #: 056 Function Name: NtGdiDdCanCreateSurface Status: Not hooked #: 057 Function Name: NtGdiDdCanCreateD3DBuffer Status: Not hooked #: 058 Function Name: NtGdiDdColorControl Status: Not hooked #: 059 Function Name: NtGdiDdCreateDirectDrawObject Status: Not hooked #: 060 Function Name: NtGdiDdCreateSurface Status: Not hooked #: 061 Function Name: NtGdiDdCreateD3DBuffer Status: Not hooked #: 062 Function Name: NtGdiDdCreateMoComp Status: Not hooked #: 063 Function Name: NtGdiDdCreateSurfaceObject Status: Not hooked #: 064 Function Name: NtGdiDdDeleteDirectDrawObject Status: Not hooked #: 065 Function Name: NtGdiDdDeleteSurfaceObject Status: Not hooked #: 066 Function Name: NtGdiDdDestroyMoComp Status: Not hooked #: 067 Function Name: NtGdiDdDestroySurface Status: Not hooked #: 068 Function Name: NtGdiDdDestroyD3DBuffer Status: Not hooked #: 069 Function Name: NtGdiDdEndMoCompFrame Status: Not hooked #: 070 Function Name: NtGdiDdFlip Status: Not hooked #: 071 Function Name: NtGdiDdFlipToGDISurface Status: Not hooked #: 072 Function Name: NtGdiDdGetAvailDriverMemory Status: Not hooked #: 073 Function Name: NtGdiDdGetBltStatus Status: Not hooked #: 074 Function Name: NtGdiDdGetDC Status: Not hooked #: 075 Function Name: NtGdiDdGetDriverInfo Status: Not hooked #: 076 Function Name: NtGdiDdGetDxHandle Status: Not hooked #: 077 Function Name: NtGdiDdGetFlipStatus Status: Not hooked #: 078 Function Name: NtGdiDdGetInternalMoCompInfo Status: Not hooked #: 079 Function Name: NtGdiDdGetMoCompBuffInfo Status: Not hooked #: 080 Function Name: NtGdiDdGetMoCompGuids Status: Not hooked #: 081 Function Name: NtGdiDdGetMoCompFormats Status: Not hooked #: 082 Function Name: NtGdiDdGetScanLine Status: Not hooked #: 083 Function Name: NtGdiDdLock Status: Not hooked #: 084 Function Name: NtGdiDdLockD3D Status: Not hooked #: 085 Function Name: NtGdiDdQueryDirectDrawObject Status: Not hooked #: 086 Function Name: NtGdiDdQueryMoCompStatus Status: Not hooked #: 087 Function Name: NtGdiDdReenableDirectDrawObject Status: Not hooked #: 088 Function Name: NtGdiDdReleaseDC Status: Not hooked #: 089 Function Name: NtGdiDdRenderMoComp Status: Not hooked #: 090 Function Name: NtGdiDdResetVisrgn Status: Not hooked #: 091 Function Name: NtGdiDdSetColorKey Status: Not hooked #: 092 Function Name: NtGdiDdSetExclusiveMode Status: Not hooked #: 093 Function Name: NtGdiDdSetGammaRamp Status: Not hooked #: 094 Function Name: NtGdiDdCreateSurfaceEx Status: Not hooked #: 095 Function Name: NtGdiDdSetOverlayPosition Status: Not hooked #: 096 Function Name: NtGdiDdUnattachSurface Status: Not hooked #: 097 Function Name: NtGdiDdUnlock Status: Not hooked #: 098 Function Name: NtGdiDdUnlockD3D Status: Not hooked #: 099 Function Name: NtGdiDdUpdateOverlay Status: Not hooked #: 100 Function Name: NtGdiDdWaitForVerticalBlank Status: Not hooked #: 101 Function Name: NtGdiDvpCanCreateVideoPort Status: Not hooked #: 102 Function Name: NtGdiDvpColorControl Status: Not hooked #: 103 Function Name: NtGdiDvpCreateVideoPort Status: Not hooked #: 104 Function Name: NtGdiDvpDestroyVideoPort Status: Not hooked #: 105 Function Name: NtGdiDvpFlipVideoPort Status: Not hooked #: 106 Function Name: NtGdiDvpGetVideoPortBandwidth Status: Not hooked #: 107 Function Name: NtGdiDvpGetVideoPortField Status: Not hooked #: 108 Function Name: NtGdiDvpGetVideoPortFlipStatus Status: Not hooked #: 109 Function Name: NtGdiDvpGetVideoPortInputFormats Status: Not hooked #: 110 Function Name: NtGdiDvpGetVideoPortLine Status: Not hooked #: 111 Function Name: NtGdiDvpGetVideoPortOutputFormats Status: Not hooked #: 112 Function Name: NtGdiDvpGetVideoPortConnectInfo Status: Not hooked #: 113 Function Name: NtGdiDvpGetVideoSignalStatus Status: Not hooked #: 114 Function Name: NtGdiDvpUpdateVideoPort Status: Not hooked #: 115 Function Name: NtGdiDvpWaitForVideoPortSync Status: Not hooked #: 116 Function Name: NtGdiDvpAcquireNotification Status: Not hooked #: 117 Function Name: NtGdiDvpReleaseNotification Status: Not hooked #: 118 Function Name: NtGdiDxgGenericThunk Status: Not hooked #: 119 Function Name: NtGdiDeleteClientObj Status: Not hooked #: 120 Function Name: NtGdiDeleteColorSpace Status: Not hooked #: 121 Function Name: NtGdiDeleteColorTransform Status: Not hooked #: 122 Function Name: NtGdiDeleteObjectApp Status: Not hooked #: 123 Function Name: NtGdiDescribePixelFormat Status: Not hooked #: 124 Function Name: NtGdiGetPerBandInfo Status: Not hooked #: 125 Function Name: NtGdiDoBanding Status: Not hooked #: 126 Function Name: NtGdiDoPalette Status: Not hooked #: 127 Function Name: NtGdiDrawEscape Status: Not hooked #: 128 Function Name: NtGdiEllipse Status: Not hooked #: 129 Function Name: NtGdiEnableEudc Status: Not hooked #: 130 Function Name: NtGdiEndDoc Status: Not hooked #: 131 Function Name: NtGdiEndPage Status: Not hooked #: 132 Function Name: NtGdiEndPath Status: Not hooked #: 133 Function Name: NtGdiEnumFontChunk Status: Not hooked #: 134 Function Name: NtGdiEnumFontClose Status: Not hooked #: 135 Function Name: NtGdiEnumFontOpen Status: Not hooked #: 136 Function Name: NtGdiEnumObjects Status: Not hooked #: 137 Function Name: NtGdiEqualRgn Status: Not hooked #: 138 Function Name: NtGdiEudcLoadUnloadLink Status: Not hooked #: 139 Function Name: NtGdiExcludeClipRect Status: Not hooked #: 140 Function Name: NtGdiExtCreatePen Status: Not hooked #: 141 Function Name: NtGdiExtCreateRegion Status: Not hooked #: 142 Function Name: NtGdiExtEscape Status: Not hooked #: 143 Function Name: NtGdiExtFloodFill Status: Not hooked #: 144 Function Name: NtGdiExtGetObjectW Status: Not hooked #: 145 Function Name: NtGdiExtSelectClipRgn Status: Not hooked #: 146 Function Name: NtGdiExtTextOutW Status: Not hooked #: 147 Function Name: NtGdiFillPath Status: Not hooked #: 148 Function Name: NtGdiFillRgn Status: Not hooked #: 149 Function Name: NtGdiFlattenPath Status: Not hooked #: 150 Function Name: NtGdiFlushUserBatch Status: Not hooked #: 151 Function Name: NtGdiFlush Status: Not hooked #: 152 Function Name: NtGdiForceUFIMapping Status: Not hooked #: 153 Function Name: NtGdiFrameRgn Status: Not hooked #: 154 Function Name: NtGdiFullscreenControl Status: Not hooked #: 155 Function Name: NtGdiGetAndSetDCDword Status: Not hooked #: 156 Function Name: NtGdiGetAppClipBox Status: Not hooked #: 157 Function Name: NtGdiGetBitmapBits Status: Not hooked #: 158 Function Name: NtGdiGetBitmapDimension Status: Not hooked #: 159 Function Name: NtGdiGetBoundsRect Status: Not hooked #: 160 Function Name: NtGdiGetCharABCWidthsW Status: Not hooked #: 161 Function Name: NtGdiGetCharacterPlacementW Status: Not hooked #: 162 Function Name: NtGdiGetCharSet Status: Not hooked #: 163 Function Name: NtGdiGetCharWidthW Status: Not hooked #: 164 Function Name: NtGdiGetCharWidthInfo Status: Not hooked #: 165 Function Name: NtGdiGetColorAdjustment Status: Not hooked #: 166 Function Name: NtGdiGetColorSpaceforBitmap Status: Not hooked #: 167 Function Name: NtGdiGetDCDword Status: Not hooked #: 168 Function Name: NtGdiGetDCforBitmap Status: Not hooked #: 169 Function Name: NtGdiGetDCObject Status: Not hooked #: 170 Function Name: NtGdiGetDCPoint Status: Not hooked #: 171 Function Name: NtGdiGetDeviceCaps Status: Not hooked #: 172 Function Name: NtGdiGetDeviceGammaRamp Status: Not hooked #: 173 Function Name: NtGdiGetDeviceCapsAll Status: Not hooked #: 174 Function Name: NtGdiGetDIBitsInternal Status: Not hooked #: 175 Function Name: NtGdiGetETM Status: Not hooked #: 176 Function Name: NtGdiGetEudcTimeStampEx Status: Not hooked #: 177 Function Name: NtGdiGetFontData Status: Not hooked #: 178 Function Name: NtGdiGetFontResourceInfoInternalW Status: Not hooked #: 179 Function Name: NtGdiGetGlyphIndicesW Status: Not hooked #: 180 Function Name: NtGdiGetGlyphIndicesWInternal Status: Not hooked #: 181 Function Name: NtGdiGetGlyphOutline Status: Not hooked #: 182 Function Name: NtGdiGetKerningPairs Status: Not hooked #: 183 Function Name: NtGdiGetLinkedUFIs Status: Not hooked #: 184 Function Name: NtGdiGetMiterLimit Status: Not hooked #: 185 Function Name: NtGdiGetMonitorID Status: Not hooked #: 186 Function Name: NtGdiGetNearestColor Status: Not hooked #: 187 Function Name: NtGdiGetNearestPaletteIndex Status: Not hooked #: 188 Function Name: NtGdiGetObjectBitmapHandle Status: Not hooked #: 189 Function Name: NtGdiGetOutlineTextMetricsInternalW Status: Not hooked #: 190 Function Name: NtGdiGetPath Status: Not hooked #: 191 Function Name: NtGdiGetPixel Status: Not hooked #: 192 Function Name: NtGdiGetRandomRgn Status: Not hooked #: 193 Function Name: NtGdiGetRasterizerCaps Status: Not hooked #: 194 Function Name: NtGdiGetRealizationInfo Status: Not hooked #: 195 Function Name: NtGdiGetRegionData Status: Not hooked #: 196 Function Name: NtGdiGetRgnBox Status: Not hooked #: 197 Function Name: NtGdiGetServerMetaFileBits Status: Not hooked #: 198 Function Name: NtGdiGetSpoolMessage Status: Not hooked #: 199 Function Name: NtGdiGetStats Status: Not hooked #: 200 Function Name: NtGdiGetStockObject Status: Not hooked #: 201 Function Name: NtGdiGetStringBitmapW Status: Not hooked #: 202 Function Name: NtGdiGetSystemPaletteUse Status: Not hooked #: 203 Function Name: NtGdiGetTextCharsetInfo Status: Not hooked #: 204 Function Name: NtGdiGetTextExtent Status: Not hooked #: 205 Function Name: NtGdiGetTextExtentExW Status: Not hooked #: 206 Function Name: NtGdiGetTextFaceW Status: Not hooked #: 207 Function Name: NtGdiGetTextMetricsW Status: Not hooked #: 208 Function Name: NtGdiGetTransform Status: Not hooked #: 209 Function Name: NtGdiGetUFI Status: Not hooked #: 210 Function Name: NtGdiGetEmbUFI Status: Not hooked #: 211 Function Name: NtGdiGetUFIPathname Status: Not hooked #: 212 Function Name: NtGdiGetEmbedFonts Status: Not hooked #: 213 Function Name: NtGdiChangeGhostFont Status: Not hooked #: 214 Function Name: NtGdiAddEmbFontToDC Status: Not hooked #: 215 Function Name: NtGdiGetFontUnicodeRanges Status: Not hooked #: 216 Function Name: NtGdiGetWidthTable Status: Not hooked #: 217 Function Name: NtGdiGradientFill Status: Not hooked #: 218 Function Name: NtGdiHfontCreate Status: Not hooked #: 219 Function Name: NtGdiIcmBrushInfo Status: Not hooked #: 220 Function Name: NtGdiInit Status: Not hooked #: 221 Function Name: NtGdiInitSpool Status: Not hooked #: 222 Function Name: NtGdiIntersectClipRect Status: Not hooked #: 223 Function Name: NtGdiInvertRgn Status: Not hooked #: 224 Function Name: NtGdiLineTo Status: Not hooked #: 225 Function Name: NtGdiMakeFontDir Status: Not hooked #: 226 Function Name: NtGdiMakeInfoDC Status: Not hooked #: 227 Function Name: NtGdiMaskBlt Status: Not hooked #: 228 Function Name: NtGdiModifyWorldTransform Status: Not hooked #: 229 Function Name: NtGdiMonoBitmap Status: Not hooked #: 230 Function Name: NtGdiMoveTo Status: Not hooked #: 231 Function Name: NtGdiOffsetClipRgn Status: Not hooked #: 232 Function Name: NtGdiOffsetRgn Status: Not hooked #: 233 Function Name: NtGdiOpenDCW Status: Not hooked #: 234 Function Name: NtGdiPatBlt Status: Not hooked #: 235 Function Name: NtGdiPolyPatBlt Status: Not hooked #: 236 Function Name: NtGdiPathToRegion Status: Not hooked #: 237 Function Name: NtGdiPlgBlt Status: Not hooked #: 238 Function Name: NtGdiPolyDraw Status: Not hooked #: 239 Function Name: NtGdiPolyPolyDraw Status: Not hooked #: 240 Function Name: NtGdiPolyTextOutW Status: Not hooked #: 241 Function Name: NtGdiPtInRegion Status: Not hooked #: 242 Function Name: NtGdiPtVisible Status: Not hooked #: 243 Function Name: NtGdiQueryFonts Status: Not hooked #: 244 Function Name: NtGdiQueryFontAssocInfo Status: Not hooked #: 245 Function Name: NtGdiRectangle Status: Not hooked #: 246 Function Name: NtGdiRectInRegion Status: Not hooked #: 247 Function Name: NtGdiRectVisible Status: Not hooked #: 248 Function Name: NtGdiRemoveFontResourceW Status: Not hooked #: 249 Function Name: NtGdiRemoveFontMemResourceEx Status: Not hooked #: 250 Function Name: NtGdiResetDC Status: Not hooked #: 251 Function Name: NtGdiResizePalette Status: Not hooked #: 252 Function Name: NtGdiRestoreDC Status: Not hooked #: 253 Function Name: NtGdiRoundRect Status: Not hooked #: 254 Function Name: NtGdiSaveDC Status: Not hooked #: 255 Function Name: NtGdiScaleViewportExtEx Status: Not hooked #: 256 Function Name: NtGdiScaleWindowExtEx Status: Not hooked #: 257 Function Name: NtGdiSelectBitmap Status: Not hooked #: 258 Function Name: NtGdiSelectBrush Status: Not hooked #: 259 Function Name: NtGdiSelectClipPath Status: Not hooked #: 260 Function Name: NtGdiSelectFont Status: Not hooked #: 261 Function Name: NtGdiSelectPen Status: Not hooked #: 262 Function Name: NtGdiSetBitmapAttributes Status: Not hooked #: 263 Function Name: NtGdiSetBitmapBits Status: Not hooked #: 264 Function Name: NtGdiSetBitmapDimension Status: Not hooked #: 265 Function Name: NtGdiSetBoundsRect Status: Not hooked #: 266 Function Name: NtGdiSetBrushAttributes Status: Not hooked #: 267 Function Name: NtGdiSetBrushOrg Status: Not hooked #: 268 Function Name: NtGdiSetColorAdjustment Status: Not hooked #: 269 Function Name: NtGdiSetColorSpace Status: Not hooked #: 270 Function Name: NtGdiSetDeviceGammaRamp Status: Not hooked #: 271 Function Name: NtGdiSetDIBitsToDeviceInternal Status: Not hooked #: 272 Function Name: NtGdiSetFontEnumeration Status: Not hooked #: 273 Function Name: NtGdiSetFontXform Status: Not hooked #: 274 Function Name: NtGdiSetIcmMode Status: Not hooked #: 275 Function Name: NtGdiSetLinkedUFIs Status: Not hooked #: 276 Function Name: NtGdiSetMagicColors Status: Not hooked #: 277 Function Name: NtGdiSetMetaRgn Status: Not hooked #: 278 Function Name: NtGdiSetMiterLimit Status: Not hooked #: 279 Function Name: NtGdiGetDeviceWidth Status: Not hooked #: 280 Function Name: NtGdiMirrorWindowOrg Status: Not hooked #: 281 Function Name: NtGdiSetLayout Status: Not hooked #: 282 Function Name: NtGdiSetPixel Status: Not hooked #: 283 Function Name: NtGdiSetPixelFormat Status: Not hooked #: 284 Function Name: NtGdiSetRectRgn Status: Not hooked #: 285 Function Name: NtGdiSetSystemPaletteUse Status: Not hooked #: 286 Function Name: NtGdiSetTextJustification Status: Not hooked #: 287 Function Name: NtGdiSetupPublicCFONT Status: Not hooked #: 288 Function Name: NtGdiSetVirtualResolution Status: Not hooked #: 289 Function Name: NtGdiSetSizeDevice Status: Not hooked #: 290 Function Name: NtGdiStartDoc Status: Not hooked #: 291 Function Name: NtGdiStartPage Status: Not hooked #: 292 Function Name: NtGdiStretchBlt Status: Not hooked #: 293 Function Name: NtGdiStretchDIBitsInternal Status: Not hooked #: 294 Function Name: NtGdiStrokeAndFillPath Status: Not hooked #: 295 Function Name: NtGdiStrokePath Status: Not hooked #: 296 Function Name: NtGdiSwapBuffers Status: Not hooked #: 297 Function Name: NtGdiTransformPoints Status: Not hooked #: 298 Function Name: NtGdiTransparentBlt Status: Not hooked #: 299 Function Name: NtGdiUnloadPrinterDriver Status: Not hooked #: 300 Function Name: NtGdiUnmapMemFont Status: Not hooked #: 301 Function Name: NtGdiUnrealizeObject Status: Not hooked #: 302 Function Name: NtGdiUpdateColors Status: Not hooked #: 303 Function Name: NtGdiWidenPath Status: Not hooked #: 304 Function Name: NtUserActivateKeyboardLayout Status: Not hooked #: 305 Function Name: NtUserAlterWindowStyle Status: Not hooked #: 306 Function Name: NtUserAssociateInputContext Status: Not hooked #: 307 Function Name: NtUserAttachThreadInput Status: Not hooked #: 308 Function Name: NtUserBeginPaint Status: Not hooked #: 309 Function Name: NtUserBitBltSysBmp Status: Not hooked #: 310 Function Name: NtUserBlockInput Status: Not hooked #: 311 Function Name: NtUserBuildHimcList Status: Not hooked #: 312 Function Name: NtUserBuildHwndList Status: Not hooked #: 313 Function Name: NtUserBuildNameList Status: Not hooked #: 314 Function Name: NtUserBuildPropList Status: Not hooked #: 315 Function Name: NtUserCallHwnd Status: Not hooked #: 316 Function Name: NtUserCallHwndLock Status: Not hooked #: 317 Function Name: NtUserCallHwndOpt Status: Not hooked #: 318 Function Name: NtUserCallHwndParam Status: Not hooked #: 319 Function Name: NtUserCallHwndParamLock Status: Not hooked #: 320 Function Name: NtUserCallMsgFilter Status: Not hooked #: 321 Function Name: NtUserCallNextHookEx Status: Not hooked #: 322 Function Name: NtUserCallNoParam Status: Not hooked #: 323 Function Name: NtUserCallOneParam Status: Not hooked #: 324 Function Name: NtUserCallTwoParam Status: Not hooked #: 325 Function Name: NtUserChangeClipboardChain Status: Not hooked #: 326 Function Name: NtUserChangeDisplaySettings Status: Not hooked #: 327 Function Name: NtUserCheckImeHotKey Status: Not hooked #: 328 Function Name: NtUserCheckMenuItem Status: Not hooked #: 329 Function Name: NtUserChildWindowFromPointEx Status: Not hooked #: 330 Function Name: NtUserClipCursor Status: Not hooked #: 331 Function Name: NtUserCloseClipboard Status: Not hooked #: 332 Function Name: NtUserCloseDesktop Status: Not hooked #: 333 Function Name: NtUserCloseWindowStation Status: Not hooked #: 334 Function Name: NtUserConsoleControl Status: Not hooked #: 335 Function Name: NtUserConvertMemHandle Status: Not hooked #: 336 Function Name: NtUserCopyAcceleratorTable Status: Not hooked #: 337 Function Name: NtUserCountClipboardFormats Status: Not hooked #: 338 Function Name: NtUserCreateAcceleratorTable Status: Not hooked #: 339 Function Name: NtUserCreateCaret Status: Not hooked #: 340 Function Name: NtUserCreateDesktop Status: Not hooked #: 341 Function Name: NtUserCreateInputContext Status: Not hooked #: 342 Function Name: NtUserCreateLocalMemHandle Status: Not hooked #: 343 Function Name: NtUserCreateWindowEx Status: Not hooked #: 344 Function Name: NtUserCreateWindowStation Status: Not hooked #: 345 Function Name: NtUserDdeGetQualityOfService Status: Not hooked #: 346 Function Name: NtUserDdeInitialize Status: Not hooked #: 347 Function Name: NtUserDdeSetQualityOfService Status: Not hooked #: 348 Function Name: NtUserDeferWindowPos Status: Not hooked #: 349 Function Name: NtUserDefSetText Status: Not hooked #: 350 Function Name: NtUserDeleteMenu Status: Not hooked #: 351 Function Name: NtUserDestroyAcceleratorTable Status: Not hooked #: 352 Function Name: NtUserDestroyCursor Status: Not hooked #: 353 Function Name: NtUserDestroyInputContext Status: Not hooked #: 354 Function Name: NtUserDestroyMenu Status: Not hooked #: 355 Function Name: NtUserDestroyWindow Status: Not hooked #: 356 Function Name: NtUserDisableThreadIme Status: Not hooked #: 357 Function Name: NtUserDispatchMessage Status: Not hooked #: 358 Function Name: NtUserDragDetect Status: Not hooked #: 359 Function Name: NtUserDragObject Status: Not hooked #: 360 Function Name: NtUserDrawAnimatedRects Status: Not hooked #: 361 Function Name: NtUserDrawCaption Status: Not hooked #: 362 Function Name: NtUserDrawCaptionTemp Status: Not hooked #: 363 Function Name: NtUserDrawIconEx Status: Not hooked #: 364 Function Name: NtUserDrawMenuBarTemp Status: Not hooked #: 365 Function Name: NtUserEmptyClipboard Status: Not hooked #: 366 Function Name: NtUserEnableMenuItem Status: Not hooked #: 367 Function Name: NtUserEnableScrollBar Status: Not hooked #: 368 Function Name: NtUserEndDeferWindowPosEx Status: Not hooked #: 369 Function Name: NtUserEndMenu Status: Not hooked #: 370 Function Name: NtUserEndPaint Status: Not hooked #: 371 Function Name: NtUserEnumDisplayDevices Status: Not hooked #: 372 Function Name: NtUserEnumDisplayMonitors Status: Not hooked #: 373 Function Name: NtUserEnumDisplaySettings Status: Not hooked #: 374 Function Name: NtUserEvent Status: Not hooked #: 375 Function Name: NtUserExcludeUpdateRgn Status: Not hooked #: 376 Function Name: NtUserFillWindow Status: Not hooked #: 377 Function Name: NtUserFindExistingCursorIcon Status: Not hooked #: 378 Function Name: NtUserFindWindowEx Status: Not hooked #: 379 Function Name: NtUserFlashWindowEx Status: Not hooked #: 380 Function Name: NtUserGetAltTabInfo Status: Not hooked #: 381 Function Name: NtUserGetAncestor Status: Not hooked #: 382 Function Name: NtUserGetAppImeLevel Status: Not hooked #: 383 Function Name: NtUserGetAsyncKeyState Status: Not hooked #: 384 Function Name: NtUserGetAtomName Status: Not hooked #: 385 Function Name: NtUserGetCaretBlinkTime Status: Not hooked #: 386 Function Name: NtUserGetCaretPos Status: Not hooked #: 387 Function Name: NtUserGetClassInfo Status: Not hooked #: 388 Function Name: NtUserGetClassName Status: Not hooked #: 389 Function Name: NtUserGetClipboardData Status: Not hooked #: 390 Function Name: NtUserGetClipboardFormatName Status: Not hooked #: 391 Function Name: NtUserGetClipboardOwner Status: Not hooked #: 392 Function Name: NtUserGetClipboardSequenceNumber Status: Not hooked #: 393 Function Name: NtUserGetClipboardViewer Status: Not hooked #: 394 Function Name: NtUserGetClipCursor Status: Not hooked #: 395 Function Name: NtUserGetComboBoxInfo Status: Not hooked #: 396 Function Name: NtUserGetControlBrush Status: Not hooked #: 397 Function Name: NtUserGetControlColor Status: Not hooked #: 398 Function Name: NtUserGetCPD Status: Not hooked #: 399 Function Name: NtUserGetCursorFrameInfo Status: Not hooked #: 400 Function Name: NtUserGetCursorInfo Status: Not hooked #: 401 Function Name: NtUserGetDC Status: Not hooked #: 402 Function Name: NtUserGetDCEx Status: Not hooked #: 403 Function Name: NtUserGetDoubleClickTime Status: Not hooked #: 404 Function Name: NtUserGetForegroundWindow Status: Not hooked #: 405 Function Name: NtUserGetGuiResources Status: Not hooked #: 406 Function Name: NtUserGetGUIThreadInfo Status: Not hooked #: 407 Function Name: NtUserGetIconInfo Status: Not hooked #: 408 Function Name: NtUserGetIconSize Status: Not hooked #: 409 Function Name: NtUserGetImeHotKey Status: Not hooked #: 410 Function Name: NtUserGetImeInfoEx Status: Not hooked #: 411 Function Name: NtUserGetInternalWindowPos Status: Not hooked #: 412 Function Name: NtUserGetKeyboardLayoutList Status: Not hooked #: 413 Function Name: NtUserGetKeyboardLayoutName Status: Not hooked #: 414 Function Name: NtUserGetKeyboardState Status: Not hooked #: 415 Function Name: NtUserGetKeyNameText Status: Not hooked #: 416 Function Name: NtUserGetKeyState Status: Not hooked #: 417 Function Name: NtUserGetListBoxInfo Status: Not hooked #: 418 Function Name: NtUserGetMenuBarInfo Status: Not hooked #: 419 Function Name: NtUserGetMenuIndex Status: Not hooked #: 420 Function Name: NtUserGetMenuItemRect Status: Not hooked #: 421 Function Name: NtUserGetMessage Status: Not hooked #: 422 Function Name: NtUserGetMouseMovePointsEx Status: Not hooked #: 423 Function Name: NtUserGetObjectInformation Status: Not hooked #: 424 Function Name: NtUserGetOpenClipboardWindow Status: Not hooked #: 425 Function Name: NtUserGetPriorityClipboardFormat Status: Not hooked #: 426 Function Name: NtUserGetProcessWindowStation Status: Not hooked #: 427 Function Name: NtUserGetRawInputBuffer Status: Not hooked #: 428 Function Name: NtUserGetRawInputData Status: Not hooked #: 429 Function Name: NtUserGetRawInputDeviceInfo Status: Not hooked #: 430 Function Name: NtUserGetRawInputDeviceList Status: Not hooked #: 431 Function Name: NtUserGetRegisteredRawInputDevices Status: Not hooked #: 432 Function Name: NtUserGetScrollBarInfo Status: Not hooked #: 433 Function Name: NtUserGetSystemMenu Status: Not hooked #: 434 Function Name: NtUserGetThreadDesktop Status: Not hooked #: 435 Function Name: NtUserGetThreadState Status: Not hooked #: 436 Function Name: NtUserGetTitleBarInfo Status: Not hooked #: 437 Function Name: NtUserGetUpdateRect Status: Not hooked #: 438 Function Name: NtUserGetUpdateRgn Status: Not hooked #: 439 Function Name: NtUserGetWindowDC Status: Not hooked #: 440 Function Name: NtUserGetWindowPlacement Status: Not hooked #: 441 Function Name: NtUserGetWOWClass Status: Not hooked #: 442 Function Name: NtUserHardErrorControl Status: Not hooked #: 443 Function Name: NtUserHideCaret Status: Not hooked #: 444 Function Name: NtUserHiliteMenuItem Status: Not hooked #: 445 Function Name: NtUserImpersonateDdeClientWindow Status: Not hooked #: 446 Function Name: NtUserInitialize Status: Not hooked #: 447 Function Name: NtUserInitializeClientPfnArrays Status: Not hooked #: 448 Function Name: NtUserInitTask Status: Not hooked #: 449 Function Name: NtUserInternalGetWindowText Status: Not hooked #: 450 Function Name: NtUserInvalidateRect Status: Not hooked #: 451 Function Name: NtUserInvalidateRgn Status: Not hooked #: 452 Function Name: NtUserIsClipboardFormatAvailable Status: Not hooked #: 453 Function Name: NtUserKillTimer Status: Not hooked #: 454 Function Name: NtUserLoadKeyboardLayoutEx Status: Not hooked #: 455 Function Name: NtUserLockWindowStation Status: Not hooked #: 456 Function Name: NtUserLockWindowUpdate Status: Not hooked #: 457 Function Name: NtUserLockWorkStation Status: Not hooked #: 458 Function Name: NtUserMapVirtualKeyEx Status: Not hooked #: 459 Function Name: NtUserMenuItemFromPoint Status: Not hooked #: 460 Function Name: NtUserMessageCall Status: Not hooked #: 461 Function Name: NtUserMinMaximize Status: Not hooked #: 462 Function Name: NtUserMNDragLeave Status: Not hooked #: 463 Function Name: NtUserMNDragOver Status: Not hooked #: 464 Function Name: NtUserModifyUserStartupInfoFlags Status: Not hooked #: 465 Function Name: NtUserMoveWindow Status: Not hooked #: 466 Function Name: NtUserNotifyIMEStatus Status: Not hooked #: 467 Function Name: NtUserNotifyProcessCreate Status: Not hooked #: 468 Function Name: NtUserNotifyWinEvent Status: Not hooked #: 469 Function Name: NtUserOpenClipboard Status: Not hooked #: 470 Function Name: NtUserOpenDesktop Status: Not hooked #: 471 Function Name: NtUserOpenInputDesktop Status: Not hooked #: 472 Function Name: NtUserOpenWindowStation Status: Not hooked #: 473 Function Name: NtUserPaintDesktop Status: Not hooked #: 474 Function Name: NtUserPeekMessage Status: Not hooked #: 475 Function Name: NtUserPostMessage Status: Not hooked #: 476 Function Name: NtUserPostThreadMessage Status: Not hooked #: 477 Function Name: NtUserPrintWindow Status: Not hooked #: 478 Function Name: NtUserProcessConnect Status: Not hooked #: 479 Function Name: NtUserQueryInformationThread Status: Not hooked #: 480 Function Name: NtUserQueryInputContext Status: Not hooked #: 481 Function Name: NtUserQuerySendMessage Status: Not hooked #: 482 Function Name: NtUserQueryUserCounters Status: Not hooked #: 483 Function Name: NtUserQueryWindow Status: Not hooked #: 484 Function Name: NtUserRealChildWindowFromPoint Status: Not hooked #: 485 Function Name: NtUserRealInternalGetMessage Status: Not hooked #: 486 Function Name: NtUserRealWaitMessageEx Status: Not hooked #: 487 Function Name: NtUserRedrawWindow Status: Not hooked #: 488 Function Name: NtUserRegisterClassExWOW Status: Not hooked #: 489 Function Name: NtUserRegisterUserApiHook Status: Not hooked #: 490 Function Name: NtUserRegisterHotKey Status: Not hooked #: 491 Function Name: NtUserRegisterRawInputDevices Status: Not hooked #: 492 Function Name: NtUserRegisterTasklist Status: Not hooked #: 493 Function Name: NtUserRegisterWindowMessage Status: Not hooked #: 494 Function Name: NtUserRemoveMenu Status: Not hooked #: 495 Function Name: NtUserRemoveProp Status: Not hooked #: 496 Function Name: NtUserResolveDesktop Status: Not hooked #: 497 Function Name: NtUserResolveDesktopForWOW Status: Not hooked #: 498 Function Name: NtUserSBGetParms Status: Not hooked #: 499 Function Name: NtUserScrollDC Status: Not hooked #: 500 Function Name: NtUserScrollWindowEx Status: Not hooked #: 501 Function Name: NtUserSelectPalette Status: Not hooked #: 502 Function Name: NtUserSendInput Status: Not hooked #: 503 Function Name: NtUserSetActiveWindow Status: Not hooked #: 504 Function Name: NtUserSetAppImeLevel Status: Not hooked #: 505 Function Name: NtUserSetCapture Status: Not hooked #: 506 Function Name: NtUserSetClassLong Status: Not hooked #: 507 Function Name: NtUserSetClassWord Status: Not hooked #: 508 Function Name: NtUserSetClipboardData Status: Not hooked #: 509 Function Name: NtUserSetClipboardViewer Status: Not hooked #: 510 Function Name: NtUserSetConsoleReserveKeys Status: Not hooked #: 511 Function Name: NtUserSetCursor Status: Not hooked #: 512 Function Name: NtUserSetCursorContents Status: Not hooked #: 513 Function Name: NtUserSetCursorIconData Status: Not hooked #: 514 Function Name: NtUserSetDbgTag Status: Not hooked #: 515 Function Name: NtUserSetFocus Status: Not hooked #: 516 Function Name: NtUserSetImeHotKey Status: Not hooked #: 517 Function Name: NtUserSetImeInfoEx Status: Not hooked #: 518 Function Name: NtUserSetImeOwnerWindow Status: Not hooked #: 519 Function Name: NtUserSetInformationProcess Status: Not hooked #: 520 Function Name: NtUserSetInformationThread Status: Not hooked #: 521 Function Name: NtUserSetInternalWindowPos Status: Not hooked #: 522 Function Name: NtUserSetKeyboardState Status: Not hooked #: 523 Function Name: NtUserSetLogonNotifyWindow Status: Not hooked #: 524 Function Name: NtUserSetMenu Status: Not hooked #: 525 Function Name: NtUserSetMenuContextHelpId Status: Not hooked #: 526 Function Name: NtUserSetMenuDefaultItem Status: Not hooked #: 527 Function Name: NtUserSetMenuFlagRtoL Status: Not hooked #: 528 Function Name: NtUserSetObjectInformation Status: Not hooked #: 529 Function Name: NtUserSetParent Status: Not hooked #: 530 Function Name: NtUserSetProcessWindowStation Status: Not hooked #: 531 Function Name: NtUserSetProp Status: Not hooked #: 532 Function Name: NtUserSetRipFlags Status: Not hooked #: 533 Function Name: NtUserSetScrollInfo Status: Not hooked #: 534 Function Name: NtUserSetShellWindowEx Status: Not hooked #: 535 Function Name: NtUserSetSysColors Status: Not hooked #: 536 Function Name: NtUserSetSystemCursor Status: Not hooked #: 537 Function Name: NtUserSetSystemMenu Status: Not hooked #: 538 Function Name: NtUserSetSystemTimer Status: Not hooked #: 539 Function Name: NtUserSetThreadDesktop Status: Not hooked #: 540 Function Name: NtUserSetThreadLayoutHandles Status: Not hooked #: 541 Function Name: NtUserSetThreadState Status: Not hooked #: 542 Function Name: NtUserSetTimer Status: Not hooked #: 543 Function Name: NtUserSetWindowFNID Status: Not hooked #: 544 Function Name: NtUserSetWindowLong Status: Not hooked #: 545 Function Name: NtUserSetWindowPlacement Status: Not hooked #: 546 Function Name: NtUserSetWindowPos Status: Not hooked #: 547 Function Name: NtUserSetWindowRgn Status: Not hooked #: 548 Function Name: NtUserSetWindowsHookAW Status: Not hooked #: 549 Function Name: NtUserSetWindowsHookEx Status: Not hooked #: 550 Function Name: NtUserSetWindowStationUser Status: Not hooked #: 551 Function Name: NtUserSetWindowWord Status: Not hooked #: 552 Function Name: NtUserSetWinEventHook Status: Not hooked #: 553 Function Name: NtUserShowCaret Status: Not hooked #: 554 Function Name: NtUserShowScrollBar Status: Not hooked #: 555 Function Name: NtUserShowWindow Status: Not hooked #: 556 Function Name: NtUserShowWindowAsync Status: Not hooked #: 557 Function Name: NtUserSoundSentry Status: Not hooked #: 558 Function Name: NtUserSwitchDesktop Status: Not hooked #: 559 Function Name: NtUserSystemParametersInfo Status: Not hooked #: 560 Function Name: NtUserTestForInteractiveUser Status: Not hooked #: 561 Function Name: NtUserThunkedMenuInfo Status: Not hooked #: 562 Function Name: NtUserThunkedMenuItemInfo Status: Not hooked #: 563 Function Name: NtUserToUnicodeEx Status: Not hooked #: 564 Function Name: NtUserTrackMouseEvent Status: Not hooked #: 565 Function Name: NtUserTrackPopupMenuEx Status: Not hooked #: 566 Function Name: NtUserCalcMenuBar Status: Not hooked #: 567 Function Name: NtUserPaintMenuBar Status: Not hooked #: 568 Function Name: NtUserTranslateAccelerator Status: Not hooked #: 569 Function Name: NtUserTranslateMessage Status: Not hooked #: 570 Function Name: NtUserUnhookWindowsHookEx Status: Not hooked #: 571 Function Name: NtUserUnhookWinEvent Status: Not hooked #: 572 Function Name: NtUserUnloadKeyboardLayout Status: Not hooked #: 573 Function Name: NtUserUnlockWindowStation Status: Not hooked #: 574 Function Name: NtUserUnregisterClass Status: Not hooked #: 575 Function Name: NtUserUnregisterUserApiHook Status: Not hooked #: 576 Function Name: NtUserUnregisterHotKey Status: Not hooked #: 577 Function Name: NtUserUpdateInputContext Status: Not hooked #: 578 Function Name: NtUserUpdateInstance Status: Not hooked #: 579 Function Name: NtUserUpdateLayeredWindow Status: Not hooked #: 580 Function Name: NtUserGetLayeredWindowAttributes Status: Not hooked #: 581 Function Name: NtUserSetLayeredWindowAttributes Status: Not hooked #: 582 Function Name: NtUserUpdatePerUserSystemParameters Status: Not hooked #: 583 Function Name: NtUserUserHandleGrantAccess Status: Not hooked #: 584 Function Name: NtUserValidateHandleSecure Status: Not hooked #: 585 Function Name: NtUserValidateRect Status: Not hooked #: 586 Function Name: NtUserValidateTimerCallback Status: Not hooked #: 587 Function Name: NtUserVkKeyScanEx Status: Not hooked #: 588 Function Name: NtUserWaitForInputIdle Status: Not hooked #: 589 Function Name: NtUserWaitForMsgAndEvent Status: Not hooked #: 590 Function Name: NtUserWaitMessage Status: Not hooked #: 591 Function Name: NtUserWin32PoolAllocationStats Status: Not hooked #: 592 Function Name: NtUserWindowFromPoint Status: Not hooked #: 593 Function Name: NtUserYieldTask Status: Not hooked #: 594 Function Name: NtUserRemoteConnect Status: Not hooked #: 595 Function Name: NtUserRemoteRedrawRectangle Status: Not hooked #: 596 Function Name: NtUserRemoteRedrawScreen Status: Not hooked #: 597 Function Name: NtUserRemoteStopScreenUpdates Status: Not hooked #: 598 Function Name: NtUserCtxDisplayIOCtl Status: Not hooked #: 599 Function Name: NtGdiEngAssociateSurface Status: Not hooked #: 600 Function Name: NtGdiEngCreateBitmap Status: Not hooked #: 601 Function Name: NtGdiEngCreateDeviceSurface Status: Not hooked #: 602 Function Name: NtGdiEngCreateDeviceBitmap Status: Not hooked #: 603 Function Name: NtGdiEngCreatePalette Status: Not hooked #: 604 Function Name: NtGdiEngComputeGlyphSet Status: Not hooked #: 605 Function Name: NtGdiEngCopyBits Status: Not hooked #: 606 Function Name: NtGdiEngDeletePalette Status: Not hooked #: 607 Function Name: NtGdiEngDeleteSurface Status: Not hooked #: 608 Function Name: NtGdiEngEraseSurface Status: Not hooked #: 609 Function Name: NtGdiEngUnlockSurface Status: Not hooked #: 610 Function Name: NtGdiEngLockSurface Status: Not hooked #: 611 Function Name: NtGdiEngBitBlt Status: Not hooked #: 612 Function Name: NtGdiEngStretchBlt Status: Not hooked #: 613 Function Name: NtGdiEngPlgBlt Status: Not hooked #: 614 Function Name: NtGdiEngMarkBandingSurface Status: Not hooked #: 615 Function Name: NtGdiEngStrokePath Status: Not hooked #: 616 Function Name: NtGdiEngFillPath Status: Not hooked #: 617 Function Name: NtGdiEngStrokeAndFillPath Status: Not hooked #: 618 Function Name: NtGdiEngPaint Status: Not hooked #: 619 Function Name: NtGdiEngLineTo Status: Not hooked #: 620 Function Name: NtGdiEngAlphaBlend Status: Not hooked #: 621 Function Name: NtGdiEngGradientFill Status: Not hooked #: 622 Function Name: NtGdiEngTransparentBlt Status: Not hooked #: 623 Function Name: NtGdiEngTextOut Status: Not hooked #: 624 Function Name: NtGdiEngStretchBltROP Status: Not hooked #: 625 Function Name: NtGdiXLATEOBJ_cGetPalette Status: Not hooked #: 626 Function Name: NtGdiXLATEOBJ_iXlate Status: Not hooked #: 627 Function Name: NtGdiXLATEOBJ_hGetColorTransform Status: Not hooked #: 628 Function Name: NtGdiCLIPOBJ_bEnum Status: Not hooked #: 629 Function Name: NtGdiCLIPOBJ_cEnumStart Status: Not hooked #: 630 Function Name: NtGdiCLIPOBJ_ppoGetPath Status: Not hooked #: 631 Function Name: NtGdiEngDeletePath Status: Not hooked #: 632 Function Name: NtGdiEngCreateClip Status: Not hooked #: 633 Function Name: NtGdiEngDeleteClip Status: Not hooked #: 634 Function Name: NtGdiBRUSHOBJ_ulGetBrushColor Status: Not hooked #: 635 Function Name: NtGdiBRUSHOBJ_pvAllocRbrush Status: Not hooked #: 636 Function Name: NtGdiBRUSHOBJ_pvGetRbrush Status: Not hooked #: 637 Function Name: NtGdiBRUSHOBJ_hGetColorTransform Status: Not hooked #: 638 Function Name: NtGdiXFORMOBJ_bApplyXform Status: Not hooked #: 639 Function Name: NtGdiXFORMOBJ_iGetXform Status: Not hooked #: 640 Function Name: NtGdiFONTOBJ_vGetInfo Status: Not hooked #: 641 Function Name: NtGdiFONTOBJ_pxoGetXform Status: Not hooked #: 642 Function Name: NtGdiFONTOBJ_cGetGlyphs Status: Not hooked #: 643 Function Name: NtGdiFONTOBJ_pifi Status: Not hooked #: 644 Function Name: NtGdiFONTOBJ_pfdg Status: Not hooked #: 645 Function Name: NtGdiFONTOBJ_pQueryGlyphAttrs Status: Not hooked #: 646 Function Name: NtGdiFONTOBJ_pvTrueTypeFontFile Status: Not hooked #: 647 Function Name: NtGdiFONTOBJ_cGetAllGlyphHandles Status: Not hooked #: 648 Function Name: NtGdiSTROBJ_bEnum Status: Not hooked #: 649 Function Name: NtGdiSTROBJ_bEnumPositionsOnly Status: Not hooked #: 650 Function Name: NtGdiSTROBJ_bGetAdvanceWidths Status: Not hooked #: 651 Function Name: NtGdiSTROBJ_vEnumStart Status: Not hooked #: 652 Function Name: NtGdiSTROBJ_dwGetCodePage Status: Not hooked #: 653 Function Name: NtGdiPATHOBJ_vGetBounds Status: Not hooked #: 654 Function Name: NtGdiPATHOBJ_bEnum Status: Not hooked #: 655 Function Name: NtGdiPATHOBJ_vEnumStart Status: Not hooked #: 656 Function Name: NtGdiPATHOBJ_vEnumStartClipLines Status: Not hooked #: 657 Function Name: NtGdiPATHOBJ_bEnumClipLines Status: Not hooked #: 658 Function Name: NtGdiGetDhpdev Status: Not hooked #: 659 Function Name: NtGdiEngCheckAbort Status: Not hooked #: 660 Function Name: NtGdiHT_Get8BPPFormatPalette Status: Not hooked #: 661 Function Name: NtGdiHT_Get8BPPMaskPalette Status: Not hooked #: 662 Function Name: NtGdiUpdateTransform Status: Not hooked #: 663 Function Name: NtGdiSetPUMPDOBJ Status: Not hooked #: 664 Function Name: NtGdiBRUSHOBJ_DeleteRbrush Status: Not hooked #: 665 Function Name: NtGdiUnmapMemFont Status: Not hooked #: 666 Function Name: NtGdiDrawStream Status: Not hooked ROOTREPEAL (c) AD, 2007-2009 ================================================== Scan Start Time: 2009/09/09 00:58 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== SSDT ------------------- #: 000 Function Name: NtAcceptConnectPort Status: Not hooked #: 001 Function Name: NtAccessCheck Status: Not hooked #: 002 Function Name: NtAccessCheckAndAuditAlarm Status: Not hooked #: 003 Function Name: NtAccessCheckByType Status: Not hooked #: 004 Function Name: NtAccessCheckByTypeAndAuditAlarm Status: Not hooked #: 005 Function Name: NtAccessCheckByTypeResultList Status: Not hooked #: 006 Function Name: NtAccessCheckByTypeResultListAndAuditAlarm Status: Not hooked #: 007 Function Name: NtAccessCheckByTypeResultListAndAuditAlarmByHandle Status: Not hooked #: 008 Function Name: NtAddAtom Status: Not hooked #: 009 Function Name: NtAddBootEntry Status: Not hooked #: 010 Function Name: NtAdjustGroupsToken Status: Not hooked #: 011 Function Name: NtAdjustPrivilegesToken Status: Not hooked #: 012 Function Name: NtAlertResumeThread Status: Not hooked #: 013 Function Name: NtAlertThread Status: Not hooked #: 014 Function Name: NtAllocateLocallyUniqueId Status: Not hooked #: 015 Function Name: NtAllocateUserPhysicalPages Status: Not hooked #: 016 Function Name: NtAllocateUuids Status: Not hooked #: 017 Function Name: NtAllocateVirtualMemory Status: Not hooked #: 018 Function Name: NtAreMappedFilesTheSame Status: Not hooked #: 019 Function Name: NtAssignProcessToJobObject Status: Not hooked #: 020 Function Name: NtCallbackReturn Status: Not hooked #: 021 Function Name: NtCancelDeviceWakeupRequest Status: Not hooked #: 022 Function Name: NtCancelIoFile Status: Not hooked #: 023 Function Name: NtCancelTimer Status: Not hooked #: 024 Function Name: NtClearEvent Status: Not hooked #: 025 Function Name: NtClose Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaa5456b8 #: 026 Function Name: NtCloseObjectAuditAlarm Status: Not hooked #: 027 Function Name: NtCompactKeys Status: Not hooked #: 028 Function Name: NtCompareTokens Status: Not hooked #: 029 Function Name: NtCompleteConnectPort Status: Not hooked #: 030 Function Name: NtCompressKey Status: Not hooked #: 031 Function Name: NtConnectPort Status: Not hooked #: 032 Function Name: NtContinue Status: Not hooked #: 033 Function Name: NtCreateDebugObject Status: Not hooked #: 034 Function Name: NtCreateDirectoryObject Status: Not hooked #: 035 Function Name: NtCreateEvent Status: Not hooked #: 036 Function Name: NtCreateEventPair Status: Not hooked #: 037 Function Name: NtCreateFile Status: Not hooked #: 038 Function Name: NtCreateIoCompletion Status: Not hooked #: 039 Function Name: NtCreateJobObject Status: Not hooked #: 040 Function Name: NtCreateJobSet Status: Not hooked #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaa545574 #: 042 Function Name: NtCreateMailslotFile Status: Not hooked #: 043 Function Name: NtCreateMutant Status: Not hooked #: 044 Function Name: NtCreateNamedPipeFile Status: Not hooked #: 045 Function Name: NtCreatePagingFile Status: Not hooked #: 046 Function Name: NtCreatePort Status: Not hooked #: 047 Function Name: NtCreateProcess Status: Not hooked #: 048 Function Name: NtCreateProcessEx Status: Not hooked #: 049 Function Name: NtCreateProfile Status: Not hooked #: 050 Function Name: NtCreateSection Status: Not hooked #: 051 Function Name: NtCreateSemaphore Status: Not hooked #: 052 Function Name: NtCreateSymbolicLinkObject Status: Not hooked #: 053 Function Name: NtCreateThread Status: Hooked by "" at address 0xf7acc2b4 #: 054 Function Name: NtCreateTimer Status: Not hooked #: 055 Function Name: NtCreateToken Status: Not hooked #: 056 Function Name: NtCreateWaitablePort Status: Not hooked #: 057 Function Name: NtDebugActiveProcess Status: Not hooked #: 058 Function Name: NtDebugContinue Status: Not hooked #: 059 Function Name: NtDelayExecution Status: Not hooked #: 060 Function Name: NtDeleteAtom Status: Not hooked #: 061 Function Name: NtDeleteBootEntry Status: Not hooked #: 062 Function Name: NtDeleteFile Status: Not hooked #: 063 Function Name: NtDeleteKey Status: Hooked by "" at address 0xf7acc2c3 #: 064 Function Name: NtDeleteObjectAuditAlarm Status: Not hooked #: 065 Function Name: NtDeleteValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaa545a52 #: 066 Function Name: NtDeviceIoControlFile Status: Not hooked #: 067 Function Name: NtDisplayString Status: Not hooked #: 068 Function Name: NtDuplicateObject Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaa54514c #: 069 Function Name: NtDuplicateToken Status: Not hooked #: 070 Function Name: NtEnumerateBootEntries Status: Not hooked #: 071 Function Name: NtEnumerateKey Status: Not hooked #: 072 Function Name: NtEnumerateSystemEnvironmentValuesEx Status: Not hooked #: 073 Function Name: NtEnumerateValueKey Status: Not hooked #: 074 Function Name: NtExtendSection Status: Not hooked #: 075 Function Name: NtFilterToken Status: Not hooked #: 076 Function Name: NtFindAtom Status: Not hooked #: 077 Function Name: NtFlushBuffersFile Status: Not hooked #: 078 Function Name: NtFlushInstructionCache Status: Not hooked #: 079 Function Name: NtFlushKey Status: Not hooked #: 080 Function Name: NtFlushVirtualMemory Status: Not hooked #: 081 Function Name: NtFlushWriteBuffer Status: Not hooked #: 082 Function Name: NtFreeUserPhysicalPages Status: Not hooked #: 083 Function Name: NtFreeVirtualMemory Status: Not hooked #: 084 Function Name: NtFsControlFile Status: Not hooked #: 085 Function Name: NtGetContextThread Status: Not hooked #: 086 Function Name: NtGetDevicePowerState Status: Not hooked #: 087 Function Name: NtGetPlugPlayEvent Status: Not hooked #: 088 Function Name: NtGetWriteWatch Status: Not hooked #: 089 Function Name: NtImpersonateAnonymousToken Status: Not hooked #: 090 Function Name: NtImpersonateClientOfPort Status: Not hooked #: 091 Function Name: NtImpersonateThread Status: Not hooked #: 092 Function Name: NtInitializeRegistry Status: Not hooked #: 093 Function Name: NtInitiatePowerAction Status: Not hooked #: 094 Function Name: NtIsProcessInJob Status: Not hooked #: 095 Function Name: NtIsSystemResumeAutomatic Status: Not hooked #: 096 Function Name: NtListenPort Status: Not hooked #: 097 Function Name: NtLoadDriver Status: Not hooked #: 098 Function Name: NtLoadKey Status: Hooked by "" at address 0xf7acc2d2 #: 099 Function Name: NtLoadKey2 Status: Not hooked #: 100 Function Name: NtLockFile Status: Not hooked #: 101 Function Name: NtLockProductActivationKeys Status: Not hooked #: 102 Function Name: NtLockRegistryKey Status: Not hooked #: 103 Function Name: NtLockVirtualMemory Status: Not hooked #: 104 Function Name: NtMakePermanentObject Status: Not hooked #: 105 Function Name: NtMakeTemporaryObject Status: Not hooked #: 106 Function Name: NtMapUserPhysicalPages Status: Not hooked #: 107 Function Name: NtMapUserPhysicalPagesScatter Status: Not hooked #: 108 Function Name: NtMapViewOfSection Status: Not hooked #: 109 Function Name: NtModifyBootEntry Status: Not hooked #: 110 Function Name: NtNotifyChangeDirectoryFile Status: Not hooked #: 111 Function Name: NtNotifyChangeKey Status: Not hooked #: 112 Function Name: NtNotifyChangeMultipleKeys Status: Not hooked #: 113 Function Name: NtOpenDirectoryObject Status: Not hooked #: 114 Function Name: NtOpenEvent Status: Not hooked #: 115 Function Name: NtOpenEventPair Status: Not hooked #: 116 Function Name: NtOpenFile Status: Not hooked #: 117 Function Name: NtOpenIoCompletion Status: Not hooked #: 118 Function Name: NtOpenJobObject Status: Not hooked #: 119 Function Name: NtOpenKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaa54564e #: 120 Function Name: NtOpenMutant Status: Not hooked #: 121 Function Name: NtOpenObjectAuditAlarm Status: Not hooked #: 122 Function Name: NtOpenProcess Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaa54508c #: 123 Function Name: NtOpenProcessToken Status: Not hooked #: 124 Function Name: NtOpenProcessTokenEx Status: Not hooked #: 125 Function Name: NtOpenSection Status: Not hooked #: 126 Function Name: NtOpenSemaphore Status: Not hooked #: 127 Function Name: NtOpenSymbolicLinkObject Status: Not hooked #: 128 Function Name: NtOpenThread Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaa5450f0 #: 129 Function Name: NtOpenThreadToken Status: Not hooked #: 130 Function Name: NtOpenThreadTokenEx Status: Not hooked #: 131 Function Name: NtOpenTimer Status: Not hooked #: 132 Function Name: NtPlugPlayControl Status: Not hooked #: 133 Function Name: NtPowerInformation Status: Not hooked #: 134 Function Name: NtPrivilegeCheck Status: Not hooked #: 135 Function Name: NtPrivilegeObjectAuditAlarm Status: Not hooked #: 136 Function Name: NtPrivilegedServiceAuditAlarm Status: Not hooked #: 137 Function Name: NtProtectVirtualMemory Status: Not hooked #: 138 Function Name: NtPulseEvent Status: Not hooked #: 139 Function Name: NtQueryAttributesFile Status: Not hooked #: 140 Function Name: NtQueryBootEntryOrder Status: Not hooked #: 141 Function Name: NtQueryBootOptions Status: Not hooked #: 142 Function Name: NtQueryDebugFilterState Status: Not hooked #: 143 Function Name: NtQueryDefaultLocale Status: Not hooked #: 144 Function Name: NtQueryDefaultUILanguage Status: Not hooked #: 145 Function Name: NtQueryDirectoryFile Status: Not hooked #: 146 Function Name: NtQueryDirectoryObject Status: Not hooked #: 147 Function Name: NtQueryEaFile Status: Not hooked #: 148 Function Name: NtQueryEvent Status: Not hooked #: 149 Function Name: NtQueryFullAttributesFile Status: Not hooked #: 150 Function Name: NtQueryInformationAtom Status: Not hooked #: 151 Function Name: NtQueryInformationFile Status: Not hooked #: 152 Function Name: NtQueryInformationJobObject Status: Not hooked #: 153 Function Name: NtQueryInformationPort Status: Not hooked #: 154 Function Name: NtQueryInformationProcess Status: Not hooked #: 155 Function Name: NtQueryInformationThread Status: Not hooked #: 156 Function Name: NtQueryInformationToken Status: Not hooked #: 157 Function Name: NtQueryInstallUILanguage Status: Not hooked #: 158 Function Name: NtQueryIntervalProfile Status: Not hooked #: 159 Function Name: NtQueryIoCompletion Status: Not hooked #: 160 Function Name: NtQueryKey Status: Not hooked #: 161 Function Name: NtQueryMultipleValueKey Status: Not hooked #: 162 Function Name: NtQueryMutant Status: Not hooked #: 163 Function Name: NtQueryObject Status: Not hooked #: 164 Function Name: NtQueryOpenSubKeys Status: Not hooked #: 165 Function Name: NtQueryPerformanceCounter Status: Not hooked #: 166 Function Name: NtQueryQuotaInformationFile Status: Not hooked #: 167 Function Name: NtQuerySection Status: Not hooked #: 168 Function Name: NtQuerySecurityObject Status: Not hooked #: 169 Function Name: NtQuerySemaphore Status: Not hooked #: 170 Function Name: NtQuerySymbolicLinkObject Status: Not hooked #: 171 Function Name: NtQuerySystemEnvironmentValue Status: Not hooked #: 172 Function Name: NtQuerySystemEnvironmentValueEx Status: Not hooked #: 173 Function Name: NtQuerySystemInformation Status: Not hooked #: 174 Function Name: NtQuerySystemTime Status: Not hooked #: 175 Function Name: NtQueryTimer Status: Not hooked #: 176 Function Name: NtQueryTimerResolution Status: Not hooked #: 177 Function Name: NtQueryValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaa54576e #: 178 Function Name: NtQueryVirtualMemory Status: Not hooked #: 179 Function Name: NtQueryVolumeInformationFile Status: Not hooked #: 180 Function Name: NtQueueApcThread Status: Not hooked #: 181 Function Name: NtRaiseException Status: Not hooked #: 182 Function Name: NtRaiseHardError Status: Not hooked #: 183 Function Name: NtReadFile Status: Not hooked #: 184 Function Name: NtReadFileScatter Status: Not hooked #: 185 Function Name: NtReadRequestData Status: Not hooked #: 186 Function Name: NtReadVirtualMemory Status: Not hooked #: 187 Function Name: NtRegisterThreadTerminatePort Status: Not hooked #: 188 Function Name: NtReleaseMutant Status: Not hooked #: 189 Function Name: NtReleaseSemaphore Status: Not hooked #: 190 Function Name: NtRemoveIoCompletion Status: Not hooked #: 191 Function Name: NtRemoveProcessDebug Status: Not hooked #: 192 Function Name: NtRenameKey Status: Not hooked #: 193 Function Name: NtReplaceKey Status: Hooked by "" at address 0xf7acc2dc #: 194 Function Name: NtReplyPort Status: Not hooked #: 195 Function Name: NtReplyWaitReceivePort Status: Not hooked #: 196 Function Name: NtReplyWaitReceivePortEx Status: Not hooked #: 197 Function Name: NtReplyWaitReplyPort Status: Not hooked #: 198 Function Name: NtRequestDeviceWakeup Status: Not hooked #: 199 Function Name: NtRequestPort Status: Not hooked #: 200 Function Name: NtRequestWaitReplyPort Status: Not hooked #: 201 Function Name: NtRequestWakeupLatency Status: Not hooked #: 202 Function Name: NtResetEvent Status: Not hooked #: 203 Function Name: NtResetWriteWatch Status: Not hooked #: 204 Function Name: NtRestoreKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaa54572e #: 205 Function Name: NtResumeProcess Status: Not hooked #: 206 Function Name: NtResumeThread Status: Not hooked #: 207 Function Name: NtSaveKey Status: Not hooked #: 208 Function Name: NtSaveKeyEx Status: Not hooked #: 209 Function Name: NtSaveMergedKeys Status: Not hooked #: 210 Function Name: NtSecureConnectPort Status: Not hooked #: 211 Function Name: NtSetBootEntryOrder Status: Not hooked #: 212 Function Name: NtSetBootOptions Status: Not hooked #: 213 Function Name: NtSetContextThread Status: Not hooked #: 214 Function Name: NtSetDebugFilterState Status: Not hooked #: 215 Function Name: NtSetDefaultHardErrorPort Status: Not hooked #: 216 Function Name: NtSetDefaultLocale Status: Not hooked #: 217 Function Name: NtSetDefaultUILanguage Status: Not hooked #: 218 Function Name: NtSetEaFile Status: Not hooked #: 219 Function Name: NtSetEvent Status: Not hooked #: 220 Function Name: NtSetEventBoostPriority Status: Not hooked #: 221 Function Name: NtSetHighEventPair Status: Not hooked #: 222 Function Name: NtSetHighWaitLowEventPair Status: Not hooked #: 223 Function Name: NtSetInformationDebugObject Status: Not hooked #: 224 Function Name: NtSetInformationFile Status: Not hooked #: 225 Function Name: NtSetInformationJobObject Status: Not hooked #: 226 Function Name: NtSetInformationKey Status: Not hooked #: 227 Function Name: NtSetInformationObject Status: Not hooked #: 228 Function Name: NtSetInformationProcess Status: Not hooked #: 229 Function Name: NtSetInformationThread Status: Not hooked #: 230 Function Name: NtSetInformationToken Status: Not hooked #: 231 Function Name: NtSetIntervalProfile Status: Not hooked #: 232 Function Name: NtSetIoCompletion Status: Not hooked #: 233 Function Name: NtSetLdtEntries Status: Not hooked #: 234 Function Name: NtSetLowEventPair Status: Not hooked #: 235 Function Name: NtSetLowWaitHighEventPair Status: Not hooked #: 236 Function Name: NtSetQuotaInformationFile Status: Not hooked #: 237 Function Name: NtSetSecurityObject Status: Not hooked #: 238 Function Name: NtSetSystemEnvironmentValue Status: Not hooked #: 239 Function Name: NtSetSystemEnvironmentValueEx Status: Not hooked #: 240 Function Name: NtSetSystemInformation Status: Not hooked #: 241 Function Name: NtSetSystemPowerState Status: Not hooked #: 242 Function Name: NtSetSystemTime Status: Not hooked #: 243 Function Name: NtSetThreadExecutionState Status: Not hooked #: 244 Function Name: NtSetTimer Status: Not hooked #: 245 Function Name: NtSetTimerResolution Status: Not hooked #: 246 Function Name: NtSetUuidSeed Status: Not hooked #: 247 Function Name: NtSetValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xaa5458ae #: 248 Function Name: NtSetVolumeInformationFile Status: Not hooked #: 249 Function Name: NtShutdownSystem Status: Not hooked #: 250 Function Name: NtSignalAndWaitForSingleObject Status: Not hooked #: 251 Function Name: NtStartProfile Status: Not hooked #: 252 Function Name: NtStopProfile Status: Not hooked #: 253 Function Name: NtSuspendProcess Status: Not hooked #: 254 Function Name: NtSuspendThread Status: Not hooked #: 255 Function Name: NtSystemDebugControl Status: Not hooked #: 256 Function Name: NtTerminateJobObject Status: Not hooked #: 257 Function Name: NtTerminateProcess Status: Hooked by "" at address 0xf7acc2af #: 258 Function Name: NtTerminateThread Status: Not hooked #: 259 Function Name: NtTestAlert Status: Not hooked #: 260 Function Name: NtTraceEvent Status: Not hooked #: 261 Function Name: NtTranslateFilePath Status: Not hooked #: 262 Function Name: NtUnloadDriver Status: Not hooked #: 263 Function Name: NtUnloadKey Status: Not hooked #: 264 Function Name: NtUnloadKeyEx Status: Not hooked #: 265 Function Name: NtUnlockFile Status: Not hooked #: 266 Function Name: NtUnlockVirtualMemory Status: Not hooked #: 267 Function Name: NtUnmapViewOfSection Status: Not hooked #: 268 Function Name: NtVdmControl Status: Not hooked #: 269 Function Name: NtWaitForDebugEvent Status: Not hooked #: 270 Function Name: NtWaitForMultipleObjects Status: Not hooked #: 271 Function Name: NtWaitForSingleObject Status: Not hooked #: 272 Function Name: NtWaitHighEventPair Status: Not hooked #: 273 Function Name: NtWaitLowEventPair Status: Not hooked #: 274 Function Name: NtWriteFile Status: Not hooked #: 275 Function Name: NtWriteFileGather Status: Not hooked #: 276 Function Name: NtWriteRequestData Status: Not hooked #: 277 Function Name: NtWriteVirtualMemory Status: Not hooked #: 278 Function Name: NtYieldExecution Status: Not hooked #: 279 Function Name: NtCreateKeyedEvent Status: Not hooked #: 280 Function Name: NtOpenKeyedEvent Status: Not hooked #: 281 Function Name: NtReleaseKeyedEvent Status: Not hooked #: 282 Function Name: NtWaitForKeyedEvent Status: Not hooked #: 283 Function Name: NtQueryPortInformationProcess Status: Not hooked ROOTREPEAL (c) AD, 2007-2009 ================================================== Scan Start Time: 2009/09/09 00:58 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Processes ------------------- Path: System PID: 4 Status: - Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe PID: 364 Status: - Path: C:\WINDOWS\system32\smss.exe PID: 420 Status: - Path: C:\WINDOWS\system32\hphmon03.exe PID: 444 Status: - Path: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe PID: 468 Status: - Path: C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe PID: 488 Status: - Path: C:\WINDOWS\system32\csrss.exe PID: 496 Status: - Path: C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe PID: 544 Status: - Path: C:\Program Files\iTunes\iTunesHelper.exe PID: 620 Status: - Path: C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe PID: 636 Status: - Path: C:\WINDOWS\system32\winlogon.exe PID: 684 Status: - Path: C:\WINDOWS\system32\services.exe PID: 728 Status: - Path: C:\WINDOWS\system32\lsass.exe PID: 740 Status: - Path: C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe PID: 780 Status: - Path: C:\PROGRA~1\AVIR\ashDisp.exe PID: 840 Status: - Path: C:\WINDOWS\system32\ati2evxx.exe PID: 908 Status: - Path: C:\WINDOWS\system32\svchost.exe PID: 928 Status: - Path: C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PID: 956 Status: - Path: C:\WINDOWS\system32\svchost.exe PID: 1020 Status: - Path: C:\WINDOWS\system32\svchost.exe PID: 1060 Status: - Path: C:\WINDOWS\system32\svchost.exe PID: 1096 Status: - Path: C:\WINDOWS\system32\svchost.exe PID: 1208 Status: - Path: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe PID: 1240 Status: - Path: C:\Program Files\AVIR\aswUpdSv.exe PID: 1280 Status: - Path: C:\WINDOWS\system32\ati2evxx.exe PID: 1376 Status: - Path: C:\Program Files\SBSD\TeaTimer.exe PID: 1588 Status: - Path: C:\WINDOWS\system32\spoolsv.exe PID: 1612 Status: - Path: C:\Program Files\Avira\AntiVir Desktop\sched.exe PID: 1660 Status: - Path: C:\Program Files\Avira\AntiVir Desktop\avguard.exe PID: 1696 Status: - Path: C:\WINDOWS\system32\svchost.exe PID: 1816 Status: - Path: C:\WINDOWS\explorer.exe PID: 2004 Status: - Path: C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe PID: 2160 Status: - Path: C:\Program Files\Java\jre6\bin\jqs.exe PID: 2352 Status: - Path: C:\WINDOWS\system32\svchost.exe PID: 2496 Status: - Path: C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe PID: 2588 Status: - Path: C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe PID: 2636 Status: - Path: C:\Program Files\AVIR\ashMaiSv.exe PID: 2952 Status: - Path: C:\Program Files\AVIR\ashWebSv.exe PID: 3000 Status: - Path: C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe PID: 3256 Status: - Path: C:\Program Files\Internet Explorer\iexplore.exe PID: 3292 Status: - Path: C:\Program Files\Internet Explorer\iexplore.exe PID: 3396 Status: - Path: C:\WINDOWS\system32\hphipm09.exe PID: 3512 Status: - Path: C:\Documents and Settings\Administrator\Desktop\RootRepeal.exe PID: 3580 Status: - Path: C:\Program Files\iPod\bin\iPodService.exe PID: 3652 Status: - Path: C:\WINDOWS\system32\svchost.exe PID: 3688 Status: - Path: C:\WINDOWS\system32\wbem\wmiprvse.exe PID: 3924 Status: - Path: C:\WINDOWS\system32\alg.exe PID: 3932 Status: - Log file is located at: C:\Documents and Settings\MASTER\Desktop\Win32kDiag.txt WARNING: Could not get backup privileges! Searching 'C:\WINDOWS'... Found mount point : C:\WINDOWS\$hf_mig$\KB915865\KB915865 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\$hf_mig$\KB953838\KB953838 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\addins\addins Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP331.tmp\ZAP331.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP413.tmp\ZAP413.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Temp\ZAP42C.tmp\ZAP42C.tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\temp\temp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\assembly\tmp\tmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Cache\Cache Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Config\Config Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Connection Wizard\Connection Wizard Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Debug\UserMode\UserMode Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\ime\imejp\applets\applets Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\ime\imejp98\imejp98 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\000021091A0090400000000000F01FEC\12.0.6425\12.0.6425 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109411090400000000000F01FEC\12.0.4518\12.0.4518 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109440090400000000000F01FEC\12.0.6425\12.0.6425 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109510090400000000000F01FEC\12.0.6425\12.0.6425 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109511090400000000000F01FEC\12.0.4518\12.0.4518 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109610090400000000000F01FEC\12.0.6425\12.0.6425 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109711090400000000000F01FEC\12.0.4518\12.0.4518 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109810090400000000000F01FEC\12.0.6425\12.0.6425 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109910090400000000000F01FEC\12.0.6425\12.0.6425 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109A10090400000000000F01FEC\12.0.6425\12.0.6425 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109B10090400000000000F01FEC\12.0.6425\12.0.6425 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\00002109E60090400000000000F01FEC\12.0.6425\12.0.6425 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\0DC1503A46F231838AD88BCDDC8E8F7C\3.2.30729\3.2.30729 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\D7314F9862C648A4DB8BE2A5B47BE100\1.0.0\1.0.0 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Installer\$PatchCache$\Managed\DC3BF90CC0D3D2F398A9A6D1762F70F3\2.2.30729\2.2.30729 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\java\classes\classes Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\java\trustlib\trustlib Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Temporary ASP.NET Files\Bind Logs\Bind Logs Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\Temporary ASP.NET Files Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\msapps\msinfo\msinfo Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\mui\mui Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\pchealth\ERRORREP\QHEADLES\QHEADLES Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\pchealth\ERRORREP\QSIGNOFF\QSIGNOFF Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\pchealth\helpctr\BATCH\BATCH Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\pchealth\helpctr\Config\CheckPoint\CheckPoint Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\pchealth\helpctr\HelpFiles\HelpFiles Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\pchealth\helpctr\InstalledSKUs\InstalledSKUs Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\pchealth\helpctr\System\DFS\DFS Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\pchealth\helpctr\System_OEM\System_OEM Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\pchealth\helpctr\Temp\Temp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\PIF\PIF Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Registration\CRMLog\CRMLog Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SoftwareDistribution\AuthCabs\Downloaded\Downloaded Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SoftwareDistribution\Download\1c0a4d9681e4b56278490848f7545aa5\backup\backup Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SoftwareDistribution\EventCache\EventCache Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Sun\Java\Deployment\Deployment Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\SxsCaPendDel\SxsCaPendDel Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\1025\1025 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\1028\1028 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\1031\1031 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\1037\1037 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\1041\1041 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\1042\1042 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\1054\1054 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\2052\2052 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\3076\3076 Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\3com_dmi\3com_dmi Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Media Player\Media Player Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\Certificates\Certificates Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CRLs\CRLs Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\SystemCertificates\My\CTLs\CTLs Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\config\systemprofile\Desktop\Desktop Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\config\systemprofile\Favorites\Favorites Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\Temp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\config\systemprofile\My Documents\My Documents Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\config\systemprofile\NetHood\NetHood Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\config\systemprofile\PrintHood\PrintHood Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\config\systemprofile\Recent\Recent Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\dhcp\dhcp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\drivers\disdn\disdn Mount point destination : \Device\__max++>\^ Cannot access: C:\WINDOWS\system32\dumprep.exe [1] 2004-08-04 08:00:00 10752 C:\WINDOWS\$NtServicePackUninstall$\dumprep.exe (Microsoft Corporation) [1] 2008-04-13 20:12:18 10752 C:\WINDOWS\ServicePackFiles\i386\dumprep.exe (Microsoft Corporation) [1] 2008-04-13 20:12:18 10752 C:\WINDOWS\system32\dumprep.exe () Cannot access: C:\WINDOWS\system32\eventlog.dll [1] 2004-08-04 08:00:00 55808 C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll (Microsoft Corporation) [1] 2008-04-13 20:11:53 56320 C:\WINDOWS\ServicePackFiles\i386\eventlog.dll (Microsoft Corporation) [1] 2008-04-13 20:11:53 61952 C:\WINDOWS\system32\eventlog.dll () [2] 2008-04-13 20:11:53 56320 C:\WINDOWS\system32\logevent.dll (Microsoft Corporation) Found mount point : C:\WINDOWS\system32\export\export Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\inetsrv\inetsrv Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\mui\dispspec\dispspec Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\oobe\html\ispsgnup\ispsgnup Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\oobe\html\oemcust\oemcust Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\oobe\html\oemhw\oemhw Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\oobe\html\oemreg\oemreg Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\oobe\sample\sample Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\ShellExt\ShellExt Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\spool\PRINTERS\PRINTERS Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\wbem\mof\bad\bad Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\wbem\mof\good\good Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\wbem\snmp\snmp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\wins\wins Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\system32\xircom\xircom Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Temp\Google Toolbar\Google Toolbar Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\Temp\_avast4_\_avast4_ Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\WinSxS\InstallTemp\InstallTemp Mount point destination : \Device\__max++>\^ Found mount point : C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2 Mount point destination : \Device\__max++>\^ Finished!