Vba32 AntiRootKit Log

OS: Microsoft Windows Vista Home Premium Edition Service Pack 2 (build 6002), loaded in normal mode

AntiRootKit version 3.12.5.2 build 168

AntiVirus checking is OFF

Vba32 Defender is ON

AntiRootKit driver is working in ordinary mode

Don't display trusted items

Don't display user-mode images

Don't display unloaded modules

Base	Entry Point	Size	DriverObject	Path	State
0x77680000		0x127000		C:\Windows\System32\ntdll.dll Description: NT Layer DLL Company name: Microsoft Corporation Size: 1202168 Attrs: ----a Created: 12:14:34 03.11.2010 Modified: 23:27:50 10.04.2009 Accessed: 07:56:41 22.01.2011	Signed User-mode image
0x80403000	0x80403000	0x7000		C:\Windows\system32\kdcom.dll Description: Kernel Debugger HW Extension DLL Company name: Microsoft Corporation Size: 17384 Attrs: ----a Created: 12:14:12 03.11.2010 Modified: 23:32:28 10.04.2009 Accessed: 07:55:52 22.01.2011	Signed
0x8040A000	0x8040A000	0x11000		C:\Windows\system32\PSHED.dll Description: Platform Specific Hardware Error Driver Company name: Microsoft Corporation Size: 50664 Attrs: ----a Created: 12:14:31 03.11.2010 Modified: 23:32:54 10.04.2009 Accessed: 07:56:51 22.01.2011	Signed
0x8041B000	0x8041B000	0x8000		C:\Windows\system32\BOOTVID.dll Description: VGA Boot Driver Company name: Microsoft Corporation Size: 24120 Attrs: ----a Created: 11:37:10 03.11.2010 Modified: 22:41:36 18.01.2008 Accessed: 07:49:47 22.01.2011	Signed
0x80423000	0x8045E005	0x41000	\Driver\CLFS [0x846F5450]	C:\Windows\system32\CLFS.SYS Description: Common Log File System Driver Company name: Microsoft Corporation Size: 245736 Attrs: ----a Created: 12:14:19 03.11.2010 Modified: 23:32:48 10.04.2009 Accessed: 07:50:01 22.01.2011	Signed
0x80464000	0x80464000	0xE0000		C:\Windows\system32\CI.dll Description: Code Integrity Module Company name: Microsoft Corporation Size: 614376 Attrs: ----a Created: 12:14:19 03.11.2010 Modified: 23:33:04 10.04.2009 Accessed: 07:50:01 22.01.2011	Signed
0x80544000	0x805B5005	0x7C000	\Driver\Wdf01000 [0x846EEE70]	C:\Windows\system32\drivers\Wdf01000.sys Description: WDF Dynamic Company name: Microsoft Corporation Size: 503864 Attrs: ----a Created: 11:36:59 03.11.2010 Modified: 22:43:28 18.01.2008 Accessed: 07:55:26 22.01.2011	Signed
0x805C0000	0x805CA005	0xD000		C:\Windows\system32\drivers\WDFLDR.SYS Description: WDFLDR Company name: Microsoft Corporation Size: 35896 Attrs: ----a Created: 11:36:59 03.11.2010 Modified: 22:42:00 18.01.2008 Accessed: 07:55:27 22.01.2011	Signed
0x805CD000	0x805F2035	0x2A000		C:\Windows\system32\DRIVERS\ks.sys Description: Kernel CSA Library Company name: Microsoft Corporation Size: 149504 Attrs: ----a Created: 12:14:13 03.11.2010 Modified: 21:38:50 10.04.2009 Accessed: 07:55:19 22.01.2011	Signed
0x80600000	0x806017C5	0xD000	\Driver\umbus [0x854FDF38]	C:\Windows\system32\DRIVERS\umbus.sys Description: User-Mode Bus Enumerator Company name: Microsoft Corporation Size: 34816 Attrs: ----a Created: 11:36:50 03.11.2010 Modified: 20:53:42 18.01.2008 Accessed: 07:55:25 22.01.2011	Signed
0x8060D000	0x8064A490	0x46000	\Driver\ACPI [0x846EE6F8]	C:\Windows\system32\drivers\acpi.sys Description: ACPI Driver for NT Company name: Microsoft Corporation Size: 265688 Attrs: ----a Created: 12:14:21 03.11.2010 Modified: 23:32:48 10.04.2009 Accessed: 07:55:13 22.01.2011	Signed
0x80653000	0x80659010	0x9000		C:\Windows\system32\drivers\WMILIB.SYS Description: WMILIB WMI support library Dll Company name: Microsoft Corporation Size: 17976 Attrs: ----a Created: 11:36:56 03.11.2010 Modified: 22:41:22 18.01.2008 Accessed: 07:55:27 22.01.2011	Signed
0x8065C000	0x8065D070	0x8000	\Driver\msisadrv [0x847148B8]	C:\Windows\system32\drivers\msisadrv.sys Description: ISA Driver Company name: Microsoft Corporation Size: 16440 Attrs: ----a Created: 11:37:36 03.11.2010 Modified: 22:41:16 18.01.2008 Accessed: 07:55:21 22.01.2011	Signed
0x80664000	0x80685CEB	0x27000	\Driver\pci [0x83DA2CA8]	C:\Windows\system32\drivers\pci.sys Description: NT Plug and Play PCI Enumerator Company name: Microsoft Corporation Size: 149480 Attrs: ----a Created: 12:14:34 03.11.2010 Modified: 23:32:56 10.04.2009 Accessed: 07:55:22 22.01.2011	Signed
0x8068B000	0x8069722D	0xF000	\Driver\partmgr [0x846FAB08]	C:\Windows\System32\drivers\partmgr.sys Description: Partition Management Driver Company name: Microsoft Corporation Size: 54248 Attrs: ----a Created: 12:14:34 03.11.2010 Modified: 23:32:32 10.04.2009 Accessed: 07:55:22 22.01.2011	Signed
0x8069A000	0x8069BDD3	0x3000	\Driver\Compbatt [0x84773F38]	C:\Windows\system32\DRIVERS\compbatt.sys Description: Composite Battery Driver Company name: Microsoft Corporation Size: 20792 Attrs: ----a Created: 11:37:15 03.11.2010 Modified: 22:41:26 18.01.2008 Accessed: 07:55:15 22.01.2011	Signed
0x8069D000	0x806A3005	0xA000		C:\Windows\system32\DRIVERS\BATTC.SYS Description: Battery Class Driver Company name: Microsoft Corporation Size: 28216 Attrs: ----a Created: 11:37:12 03.11.2010 Modified: 22:41:40 18.01.2008 Accessed: 07:55:15 22.01.2011	Signed
0x806A7000	0x806B339B	0xF000	\Driver\volmgr [0x84714268]	C:\Windows\system32\drivers\volmgr.sys Description: Volume Manager Driver Company name: Microsoft Corporation Size: 52792 Attrs: ----a Created: 11:36:50 03.11.2010 Modified: 22:42:20 18.01.2008 Accessed: 07:55:26 22.01.2011	Signed
0x806B6000	0x806F966E	0x4A000	\Driver\volmgrx [0x84715B28]	C:\Windows\System32\drivers\volmgrx.sys Description: Volume Manager Extension Driver Company name: Microsoft Corporation Size: 292840 Attrs: ----a Created: 12:14:10 03.11.2010 Modified: 23:33:04 10.04.2009 Accessed: 07:55:26 22.01.2011	Signed
0x80700000	0x80704005	0x7000	\Driver\pciide [0x847157D8]	C:\Windows\system32\drivers\pciide.sys Description: Generic PCI IDE Bus Driver Company name: Microsoft Corporation Size: 14312 Attrs: ----a Created: 12:14:34 03.11.2010 Modified: 23:32:50 10.04.2009 Accessed: 07:55:22 22.01.2011	Signed
0x80707000	0x80712010	0xE000		C:\Windows\system32\drivers\PCIIDEX.SYS Description: PCI IDE Bus Driver Extension Company name: Microsoft Corporation Size: 43496 Attrs: ----a Created: 12:14:34 03.11.2010 Modified: 23:32:54 10.04.2009 Accessed: 07:55:22 22.01.2011	Signed
0x80715000	0x80722255	0x10000	\Driver\MountMgr [0x847156E0]	C:\Windows\System32\drivers\mountmgr.sys Description: Mount Point Manager Company name: Microsoft Corporation Size: 57400 Attrs: ----a Created: 11:37:29 03.11.2010 Modified: 22:42:30 18.01.2008 Accessed: 07:55:20 22.01.2011	Signed
0x80725000	0x8072A005	0x8000	\Driver\atapi [0x847153F0]	C:\Windows\system32\drivers\atapi.sys Description: ATAPI IDE Miniport Driver Company name: Microsoft Corporation Size: 19944 Attrs: ----a Created: 12:14:22 03.11.2010 Modified: 23:32:28 10.04.2009 Accessed: 07:55:14 22.01.2011	Signed
0x8072D000	0x80747010	0x1E000		C:\Windows\system32\drivers\ataport.SYS Description: ATAPI Driver Extension Company name: Microsoft Corporation Size: 109032 Attrs: ----a Created: 12:14:23 03.11.2010 Modified: 23:32:44 10.04.2009 Accessed: 07:55:14 22.01.2011	Signed
0x8074B000	0x807769A7	0x32000	\FileSystem\FltMgr [0x839A6DD8]	C:\Windows\system32\drivers\fltmgr.sys Description: Microsoft Filesystem Filter Manager Company name: Microsoft Corporation Size: 190424 Attrs: ----a Created: 12:14:24 03.11.2010 Modified: 23:32:48 10.04.2009 Accessed: 07:55:18 22.01.2011	Signed
0x8077D000	0x807894C8	0x10000	\FileSystem\FileInfo [0x846F4458]	C:\Windows\system32\drivers\fileinfo.sys Description: FileInfo Filter Driver Company name: Microsoft Corporation Size: 58936 Attrs: ----a Created: 11:37:14 03.11.2010 Modified: 22:42:32 18.01.2008 Accessed: 07:55:18 22.01.2011	Signed
0x8078D000	0x807F82A5	0x71000	\Driver\KSecDD [0x846F6C58]	C:\Windows\System32\Drivers\ksecdd.sys Description: Kernel Security Support Provider Interface Company name: Microsoft Corporation Size: 439784 Attrs: ----a Created: 12:14:13 03.11.2010 Modified: 23:32:50 10.04.2009 Accessed: 07:55:19 22.01.2011	Signed
0x81C1B000	0x81D074B0	0x3B9000	\FileSystem\RAW [0x846D1990]	C:\Windows\system32\ntkrnlpa.exe ( ntoskrnl.exe ) Description: NT Kernel & System Company name: Microsoft Corporation Size: 3601896 Attrs: ----a Created: 12:14:34 03.11.2010 Modified: 23:32:50 10.04.2009 Accessed: 07:56:42 22.01.2011	Signed
0x81C1B000	0x81D074B0	0x3B9000	\Driver\WMIxWDM [0x839688D0]	C:\Windows\system32\ntkrnlpa.exe ( ntoskrnl.exe ) Description: NT Kernel & System Company name: Microsoft Corporation Size: 3601896 Attrs: ----a Created: 12:14:34 03.11.2010 Modified: 23:32:50 10.04.2009 Accessed: 07:56:42 22.01.2011	Signed
0x81C1B000	0x81D074B0	0x3B9000	\Driver\PnpManager [0x839A4A50]	C:\Windows\system32\ntkrnlpa.exe ( ntoskrnl.exe ) Description: NT Kernel & System Company name: Microsoft Corporation Size: 3601896 Attrs: ----a Created: 12:14:34 03.11.2010 Modified: 23:32:50 10.04.2009 Accessed: 07:56:42 22.01.2011	Signed
0x81FD4000	0x81FD4000	0x33000	\Driver\ACPI_HAL [0x839561C8]	C:\Windows\system32\hal.dll Description: Hardware Abstraction Layer DLL Company name: Microsoft Corporation Size: 177128 Attrs: ----a Created: 05:25:51 02.11.2006 Modified: 23:32:48 10.04.2009 Accessed: 07:55:11 22.01.2011	Signed
0x82200000	0x82206CD2	0xE000	\Driver\circlass [0x85500118]	C:\Windows\system32\DRIVERS\circlass.sys Description: Consumer IR Class Driver for eHome Company name: Microsoft Corporation Size: 35328 Attrs: ----a Created: 11:37:15 03.11.2010 Modified: 20:53:26 18.01.2008 Accessed: 07:55:15 22.01.2011	Signed
0x8220F000	0x823101ED	0x10B000	\Driver\NDIS [0x846F7D50]	C:\Windows\system32\drivers\ndis.sys Description: NDIS 6.0 wrapper driver Company name: Microsoft Corporation Size: 527848 Attrs: ----a Created: 12:14:17 03.11.2010 Modified: 23:32:50 10.04.2009 Accessed: 07:55:21 22.01.2011	Signed
0x8231A000	0x82342032	0x2B000		C:\Windows\system32\drivers\msrpc.sys Description: Kernel Remote Procedure Call Provider Company name: Microsoft Corporation Size: 161752 Attrs: ----a Created: 12:14:16 03.11.2010 Modified: 23:32:48 10.04.2009 Accessed: 07:55:21 22.01.2011	Signed
0x82345000	0x8237B112	0x3B000		C:\Windows\system32\drivers\NETIO.SYS Description: Network I/O Subsystem Company name: Microsoft Corporation Size: 223208 Attrs: ----a Created: 12:14:17 03.11.2010 Modified: 23:32:48 10.04.2009 Accessed: 07:55:21 22.01.2011	Signed
0x82380000	0x823BD005	0x41000		C:\Windows\system32\DRIVERS\storport.sys Description: Microsoft Storage Port Driver Company name: Microsoft Corporation Size: 122344 Attrs: ----a Created: 12:14:08 03.11.2010 Modified: 23:32:56 10.04.2009 Accessed: 07:55:24 22.01.2011	Signed
0x823C1000	0x823D3005	0x15000	\Driver\RasSstp [0x8550E608]	C:\Windows\system32\DRIVERS\rassstp.sys Description: RAS SSTP Miniport Call Manager Company name: Microsoft Corporation Size: 69120 Attrs: ----a Created: 12:14:32 03.11.2010 Modified: 21:46:42 10.04.2009 Accessed: 07:55:23 22.01.2011	Signed
0x823D6000	0x823E3272	0x10000	\Driver\TermDD [0x855003C8]	C:\Windows\system32\DRIVERS\termdd.sys Description: Terminal Server Driver Company name: Microsoft Corporation Size: 53224 Attrs: ----a Created: 12:14:04 03.11.2010 Modified: 23:32:54 10.04.2009 Accessed: 07:55:25 22.01.2011	Signed
0x823E6000	0x823E9D90	0x1A000	\Driver\VBoxNetFlt [0x85506BB0]	C:\Windows\system32\DRIVERS\VBoxNetFlt.sys Description: VirtualBox Bridged Networking Driver Company name: Oracle Corporation Size: 111312 Attrs: ----a Created: 22:51:41 03.11.2010 Modified: 14:08:04 05.08.2010 Accessed: 07:55:26 22.01.2011	Signed
0x87201000	0x872DD1B9	0xE8000	\Driver\Tcpip [0x846F7728]	C:\Windows\System32\drivers\tcpip.sys Description: TCP/IP Driver Company name: Microsoft Corporation Size: 897000 Attrs: ----a Created: 12:14:05 03.11.2010 Modified: 23:33:04 10.04.2009 Accessed: 07:55:24 22.01.2011	Signed
0x872E9000	0x87301005	0x1B000		C:\Windows\System32\drivers\fwpkclnt.sys Description: FWP/IPsec Kernel-Mode API Company name: Microsoft Corporation Size: 99816 Attrs: ----a Created: 12:14:23 03.11.2010 Modified: 23:32:44 10.04.2009 Accessed: 07:55:18 22.01.2011	Signed
0x87304000	0x8732100F	0x21000		C:\Windows\system32\drivers\CLASSPNP.SYS Description: SCSI Class System Dll Company name: Microsoft Corporation Size: 125928 Attrs: ----a Created: 12:14:19 03.11.2010 Modified: 23:32:44 10.04.2009 Accessed: 07:55:15 22.01.2011	Signed
0x87325000	0x8732B065	0x9000	\Driver\crcdisk [0x84E9E478]	C:\Windows\system32\drivers\crcdisk.sys Description: Disk Block Verification Filter Driver Company name: Microsoft Corporation Size: 22632 Attrs: ----a Created: 03:52:27 02.11.2006 Modified: 04:49:43 02.11.2006 Accessed: 07:55:15 22.01.2011	Signed
0x8732E000		0xD000		C:\Windows\System32\Drivers\crashdmp.sys Description: Crash Dump Driver Company name: Microsoft Corporation Size: 35304 Attrs: ----a Created: 12:14:20 03.11.2010 Modified: 23:32:32 10.04.2009 Accessed: 07:55:15 22.01.2011	Signed Unloaded module ( 18:09:14 19.03.2011 )
0x8733B000		0xB000		dump_ataport.sys	File doesn't exist Unloaded module ( 18:09:14 19.03.2011 )
0x87346000		0x8000		dump_atapi.sys	File doesn't exist Unloaded module ( 18:09:14 19.03.2011 )
0x8734E000	0x87356005	0xB000	\Driver\tunnel [0x8545BB08]	C:\Windows\system32\DRIVERS\tunnel.sys Description: Microsoft Tunnel Interface Driver Company name: Microsoft Corporation Size: 23040 Attrs: ----a Created: 11:36:50 03.11.2010 Modified: 20:55:52 18.01.2008 Accessed: 07:55:25 22.01.2011	Signed
0x87359000	0x8735E05E	0x8000	\Driver\FwLnk [0x85470D30]	C:\Windows\system32\DRIVERS\FwLnk.sys Description: TOSHIBA Firmware Linkage 32-bit Driver Company name: TOSHIBA Corporation Size: 7168 Attrs: ----a Created: 15:53:00 22.08.2007 Modified: 01:11:14 20.11.2006 Accessed: 07:55:18 22.01.2011	Signed
0x87361000	0x87362978	0x10000	\Driver\AmdK8 [0x8549C570]	C:\Windows\system32\DRIVERS\amdk8.sys Description: Processor Device Driver Company name: Microsoft Corporation Size: 44032 Attrs: ----a Created: 11:37:11 03.11.2010 Modified: 20:27:22 18.01.2008 Accessed: 07:55:14 22.01.2011	Signed
0x87371000	0x873AA005	0x3E000		C:\Windows\system32\DRIVERS\USBPORT.SYS Description: USB 1.1 & 2.0 Port Driver Company name: Microsoft Corporation Size: 226304 Attrs: ----a Created: 12:14:11 03.11.2010 Modified: 21:42:58 10.04.2009 Accessed: 07:55:26 22.01.2011	Signed
0x873AF000	0x873C4005	0x18000	\Driver\cdrom [0x854798F8]	C:\Windows\system32\DRIVERS\cdrom.sys Description: SCSI CD-ROM Driver Company name: Microsoft Corporation Size: 67072 Attrs: ----a Created: 12:14:19 03.11.2010 Modified: 21:39:18 10.04.2009 Accessed: 07:55:15 22.01.2011	Signed
0x873C7000	0x873E45D8	0x23000	\Driver\NdisWan [0x85532240]	C:\Windows\system32\DRIVERS\ndiswan.sys Description: MS PPP Framing Driver (Strong Encryption) Company name: Microsoft Corporation Size: 121344 Attrs: ----a Created: 12:14:17 03.11.2010 Modified: 21:46:34 10.04.2009 Accessed: 07:55:21 22.01.2011	Signed
0x873EA000	0x873FB005	0x14000	\Driver\PptpMiniport [0x8547D030]	C:\Windows\system32\DRIVERS\raspptp.sys Description: Peer-to-Peer Tunneling Protocol Company name: Microsoft Corporation Size: 62976 Attrs: ----a Created: 11:37:17 03.11.2010 Modified: 20:56:36 18.01.2008 Accessed: 07:55:20 22.01.2011	Signed
0x87405000	0x874F8B75	0x110000	\FileSystem\Ntfs [0x84865F38]	C:\Windows\System32\Drivers\Ntfs.sys Description: NT File System Driver Company name: Microsoft Corporation Size: 1083880 Attrs: ----a Created: 12:14:34 03.11.2010 Modified: 23:32:50 10.04.2009 Accessed: 07:55:21 22.01.2011	Signed
0x87515000	0x87543640	0x39000	\Driver\volsnap [0x84805B10]	C:\Windows\system32\drivers\volsnap.sys Description: Volume Shadow Copy Driver Company name: Microsoft Corporation Size: 226280 Attrs: ----a Created: 12:14:10 03.11.2010 Modified: 23:32:56 10.04.2009 Accessed: 11:32:38 17.03.2011	Signed
0x8754E000	0x87551505	0x5000	\Driver\TVALZ [0x847FB6D8]	C:\Windows\system32\DRIVERS\TVALZ_O.SYS Description: TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver Company name: TOSHIBA Corporation Size: 16768 Attrs: ----a Created: 01:22:14 06.10.2006 Modified: 01:22:14 06.10.2006 Accessed: 07:55:25 22.01.2011	Signed
0x87553000	0x8759A005	0x4B000	\Driver\tos_sps32 [0x848B6268]	C:\Windows\system32\DRIVERS\tos_sps32.sys Description: tos_sps2 Company name: TOSHIBA Corporation Size: 285184 Attrs: ----a Created: 15:55:55 22.08.2007 Modified: 17:37:20 01.08.2007 Accessed: 07:55:25 22.01.2011	Signed
0x8759E000	0x875A3331	0x8000	\Driver\spldr [0x847E2688]	C:\Windows\System32\Drivers\spldr.sys Description: loader for security processor Company name: Microsoft Corporation Size: 21048 Attrs: ----a Created: 11:36:52 03.11.2010 Modified: 22:41:32 18.01.2008 Accessed: 07:55:24 22.01.2011	Signed
0x875A6000	0x875AA000	0x7000	\Driver\pssnap [0x8480C680]	C:\Windows\system32\DRIVERS\pssnap.sys Description: Backup image protection Company name: Macrium Software Size: 15328 Attrs: ----a Created: 14:03:22 28.09.2010 Modified: 14:03:22 28.09.2010 Accessed: 12:58:20 03.11.2010	Signed
0x875AD000	0x875B9048	0xF000	\FileSystem\Mup [0x847F4648]	C:\Windows\System32\Drivers\mup.sys Description: Multiple UNC Provider driver Company name: Microsoft Corporation Size: 48104 Attrs: ----a Created: 12:14:17 03.11.2010 Modified: 23:32:32 10.04.2009 Accessed: 07:55:21 22.01.2011	Signed
0x875BC000	0x875DE1CE	0x27000	\Driver\Ecache [0x847FE8D8]	C:\Windows\System32\drivers\ecache.sys Description: Special Memory Device Cache Company name: Microsoft Corporation Size: 141288 Attrs: ----a Created: 12:14:27 03.11.2010 Modified: 23:32:44 10.04.2009 Accessed: 07:55:15 22.01.2011	Signed
0x875E3000	0x875F0BBC	0x11000	\Driver\disk [0x849228A8]	C:\Windows\system32\drivers\disk.sys Description: PnP Disk Driver Company name: Microsoft Corporation Size: 53736 Attrs: ----a Created: 12:14:26 03.11.2010 Modified: 23:32:32 10.04.2009 Accessed: 11:32:35 17.03.2011	Signed
0x875F4000	0x875F904D	0x8000	\Driver\AtiPcie [0x847ABAD8]	C:\Windows\system32\DRIVERS\AtiPcie.sys Description: ATI PCIE Driver for ATI PCIE chipset Company name: ATI Technologies Inc. Size: 7680 Attrs: ----a Created: 15:29:58 22.08.2007 Modified: 13:23:12 30.10.2006 Accessed: 07:55:14 22.01.2011	Signed
0x8A600000	0x8AD16005	0x728000	\Driver\atikmdag [0x8545A198]	C:\Windows\system32\DRIVERS\atikmdag.sys Description: ATI Radeon Kernel Mode Driver Company name: ATI Technologies Inc. Size: 2929664 Attrs: ----a Created: 02:36:40 28.07.2007 Modified: 02:36:40 28.07.2007 Accessed: 07:55:14 22.01.2011	Signed
0x8AD28000	0x8ADBD005	0x9F000	\Driver\DXGKrnl [0x85469298]	C:\Windows\System32\drivers\dxgkrnl.sys Description: DirectX Graphics Kernel Company name: Microsoft Corporation Size: 626176 Attrs: ----a Created: 12:14:27 03.11.2010 Modified: 21:23:50 10.04.2009 Accessed: 07:55:15 22.01.2011	Signed
0x8ADC7000	0x8ADD0005	0xC000		C:\Windows\System32\drivers\watchdog.sys Description: Watchdog Driver Company name: Microsoft Corporation Size: 33280 Attrs: ----a Created: 12:14:10 03.11.2010 Modified: 21:22:48 10.04.2009 Accessed: 07:55:26 22.01.2011	Signed
0x8ADD3000	0x8ADDA005	0xA000	\Driver\usbohci [0x8547E330]	C:\Windows\system32\DRIVERS\usbohci.sys Description: OHCI USB Miniport Driver Company name: Microsoft Corporation Size: 19456 Attrs: ----a Created: 12:14:11 03.11.2010 Modified: 21:42:54 10.04.2009 Accessed: 07:55:26 22.01.2011	Signed
0x8ADDD000	0x8ADE9005	0xF000	\Driver\usbehci [0x8547EF38]	C:\Windows\system32\DRIVERS\usbehci.sys Description: EHCI eUSB Miniport Driver Company name: Microsoft Corporation Size: 39936 Attrs: ----a Created: 12:14:06 03.11.2010 Modified: 21:42:54 10.04.2009 Accessed: 07:55:20 22.01.2011	Signed
0x8ADEC000	0x8ADEF4B5	0x4000	\Driver\tdcmdpst [0x8545DD30]	C:\Windows\system32\DRIVERS\tdcmdpst.sys Description: Toshiba ODD Writing Driver For x86. Company name: TOSHIBA Corporation. Size: 16128 Attrs: ----a Created: 14:50:04 18.10.2006 Modified: 14:50:04 18.10.2006 Accessed: 07:55:25 22.01.2011	Signed
0x8ADF0000	0x8ADFC07E	0xF000	\Driver\RasPppoe [0x85531CC8]	C:\Windows\system32\DRIVERS\raspppoe.sys Description: RAS PPPoE mini-port/call-manager driver Company name: Microsoft Corporation Size: 41472 Attrs: ----a Created: 12:14:32 03.11.2010 Modified: 21:46:32 10.04.2009 Accessed: 07:55:23 22.01.2011	Signed
0x8B000000	0x8B000B5D	0x2000	\Driver\swenum [0x85506D30]	C:\Windows\system32\DRIVERS\swenum.sys Description: Plug and Play Software Device Enumerator Company name: Microsoft Corporation Size: 15288 Attrs: ----a Created: 11:36:51 03.11.2010 Modified: 22:41:16 18.01.2008 Accessed: 07:55:24 22.01.2011	Signed
0x8B002000	0x8B00912A	0xA000	\Driver\mssmbios [0x855012E8]	C:\Windows\system32\DRIVERS\mssmbios.sys Description: System Management BIOS Driver Company name: Microsoft Corporation Size: 31288 Attrs: ----a Created: 11:37:42 03.11.2010 Modified: 22:41:50 18.01.2008 Accessed: 07:55:21 22.01.2011	Signed
0x8B00E000	0x8B017A67	0x8D000	\Driver\HDAudBus [0x854CCBE0]	C:\Windows\system32\DRIVERS\HDAudBus.sys Description: High Definition Audio Bus Driver Company name: Microsoft Corporation Size: 561152 Attrs: ----a Created: 12:14:25 03.11.2010 Modified: 21:42:44 10.04.2009 Accessed: 07:55:18 22.01.2011	Signed
0x8B09B000	0x8B0A9055	0x13000	\Driver\i8042prt [0x85463E90]	C:\Windows\system32\DRIVERS\i8042prt.sys Description: i8042 Port Driver Company name: Microsoft Corporation Size: 54784 Attrs: ----a Created: 11:37:05 03.11.2010 Modified: 20:49:20 18.01.2008 Accessed: 07:55:19 22.01.2011	Signed
0x8B0AE000	0x8B0B5802	0xB000	\Driver\kbdclass [0x8553DF38]	C:\Windows\system32\DRIVERS\kbdclass.sys Description: Keyboard Class Driver Company name: Microsoft Corporation Size: 35384 Attrs: ----a Created: 11:37:30 03.11.2010 Modified: 22:41:54 18.01.2008 Accessed: 07:55:19 22.01.2011	Signed
0x8B0B9000	0x8B0DEEB4	0x2D000	\Driver\SynTP [0x854C2A08]	C:\Windows\system32\DRIVERS\SynTP.sys Description: Synaptics Touchpad Driver Company name: Synaptics, Inc. Size: 190384 Attrs: ----a Created: 20:03:36 15.08.2007 Modified: 20:03:36 15.08.2007 Accessed: 07:55:24 22.01.2011	Signed
0x8B0E6000	0x8B0E7105	0x2000		C:\Windows\system32\DRIVERS\USBD.SYS Description: Universal Serial Bus Driver Company name: Microsoft Corporation Size: 5888 Attrs: ----a Created: 11:36:50 03.11.2010 Modified: 20:53:18 18.01.2008 Accessed: 07:55:26 22.01.2011	Signed
0x8B0E8000	0x8B0EF7DD	0xB000	\Driver\mouclass [0x8546DD08]	C:\Windows\system32\DRIVERS\mouclass.sys Description: Mouse Class Driver Company name: Microsoft Corporation Size: 34360 Attrs: ----a Created: 11:37:30 03.11.2010 Modified: 22:41:54 18.01.2008 Accessed: 07:55:20 22.01.2011	Signed
0x8B0F3000	0x8B0FE885	0x10000	\Driver\ohci1394 [0x8562BF38]	C:\Windows\system32\DRIVERS\ohci1394.sys Description: 1394 OpenHCI Port Driver Company name: Microsoft Corporation Size: 62208 Attrs: ----a Created: 12:14:33 03.11.2010 Modified: 21:43:06 10.04.2009 Accessed: 07:55:22 22.01.2011	Signed
0x8B103000	0x8B10ED05	0xE000		C:\Windows\system32\DRIVERS\1394BUS.SYS Description: 1394 Bus Device Driver Company name: Microsoft Corporation Size: 53376 Attrs: ----a Created: 11:37:11 03.11.2010 Modified: 20:53:28 18.01.2008 Accessed: 07:55:13 22.01.2011	Signed
0x8B111000	0x8B126393	0x1A000	\Driver\sdbus [0x8548BB28]	C:\Windows\system32\DRIVERS\sdbus.sys Description: SecureDigital Bus Driver Company name: Microsoft Corporation Size: 89088 Attrs: ----a Created: 12:14:36 03.11.2010 Modified: 21:19:16 10.04.2009 Accessed: 07:55:24 22.01.2011	Signed
0x8B12B000	0x8B137075	0xF000	\Driver\rimmptsk [0x854772C0]	C:\Windows\system32\DRIVERS\rimmptsk.sys Description: RICOH SD Driver Company name: REDC Size: 39936 Attrs: ----a Created: 15:45:08 22.08.2007 Modified: 16:42:22 24.02.2007 Accessed: 07:55:23 22.01.2011	Signed
0x8B13A000	0x8B14B075	0x14000	\Driver\rimsptsk [0x854F4490]	C:\Windows\system32\DRIVERS\rimsptsk.sys Description: RICOH MS Driver Company name: REDC Size: 42496 Attrs: ----a Created: 15:45:08 22.08.2007 Modified: 18:40:20 23.01.2007 Accessed: 07:55:23 22.01.2011	Signed
0x8B14E000	0x8B19C005	0x51000	\Driver\rismxdp [0x854774D8]	C:\Windows\system32\DRIVERS\rixdptsk.sys Description: RICOH XD SM Driver Company name: REDC Size: 37376 Attrs: ----a Created: 15:45:08 22.08.2007 Modified: 01:02:04 22.03.2007 Accessed: 07:55:23 22.01.2011	Signed
0x8B19F000	0x8B1A19BC	0x4000	\Driver\CmBatt [0x85477030]	C:\Windows\system32\DRIVERS\CmBatt.sys Description: Control Method Battery Driver Company name: Microsoft Corporation Size: 14208 Attrs: ----a Created: 11:37:15 03.11.2010 Modified: 20:32:48 18.01.2008 Accessed: 07:55:15 22.01.2011	Signed
0x8B1A3000	0x8B1CE005	0x2F000	\Driver\iScsiPrt [0x85533EB8]	C:\Windows\system32\DRIVERS\msiscsi.sys Description: Microsoft iSCSI Initiator Driver Company name: Microsoft Corporation Size: 180712 Attrs: ----a Created: 12:14:15 03.11.2010 Modified: 23:32:48 10.04.2009 Accessed: 07:55:21 22.01.2011	Signed
0x8B1D2000	0x8B1DA005	0xB000		C:\Windows\system32\DRIVERS\TDI.SYS Description: TDI Wrapper Company name: Microsoft Corporation Size: 20992 Attrs: ----a Created: 11:36:53 03.11.2010 Modified: 20:57:12 18.01.2008 Accessed: 07:55:25 22.01.2011	Signed
0x8B1DD000	0x8B1F1005	0x17000	\Driver\Rasl2tp [0x855336B0]	C:\Windows\system32\DRIVERS\rasl2tp.sys Description: RAS L2TP mini-port/call-manager driver Company name: Microsoft Corporation Size: 76288 Attrs: ----a Created: 11:37:17 03.11.2010 Modified: 20:56:36 18.01.2008 Accessed: 07:55:23 22.01.2011	Signed
0x8B1F4000	0x8B1FC1B5	0xB000	\Driver\NdisTapi [0x8547D338]	C:\Windows\system32\DRIVERS\ndistapi.sys Description: NDIS 3.0 connection wrapper driver Company name: Microsoft Corporation Size: 20992 Attrs: ----a Created: 11:37:33 03.11.2010 Modified: 20:56:26 18.01.2008 Accessed: 07:55:21 22.01.2011	Signed
0x8B407000	0x8B438005	0x35000	\Driver\usbhub [0x85503F38]	C:\Windows\system32\DRIVERS\usbhub.sys Description: Default Hub Driver for USB Company name: Microsoft Corporation Size: 196096 Attrs: ----a Created: 12:14:06 03.11.2010 Modified: 21:43:18 10.04.2009 Accessed: 07:55:26 22.01.2011	Signed
0x8B43C000	0x8B44A293	0x11000	\Driver\NDProxy [0x856A3400]	C:\Windows\System32\Drivers\NDProxy.SYS Description: NDIS Proxy Company name: Microsoft Corporation Size: 49664 Attrs: ----a Created: 11:37:33 03.11.2010 Modified: 20:56:30 18.01.2008 Accessed: 07:55:21 22.01.2011	Signed
0x8B44D000	0x8B558A40	0x11C000	\Driver\AgereSoftModem [0x856FE318]	C:\Windows\system32\DRIVERS\AGRSM.sys Description: SoftModem Device Driver Company name: Agere Systems Size: 1161888 Attrs: ----a Created: 17:11:00 28.11.2006 Modified: 17:11:00 28.11.2006 Accessed: 07:55:14 22.01.2011	Signed
0x8B569000	0x8B57319B	0xD000	\Driver\Modem [0x856F5478]	C:\Windows\system32\drivers\modem.sys Description: Modem Device Driver Company name: Microsoft Corporation Size: 31744 Attrs: ----a Created: 11:37:28 03.11.2010 Modified: 20:57:18 18.01.2008 Accessed: 07:55:20 22.01.2011	Signed
0x8B576000	0x8B59E005	0x2D000		C:\Windows\system32\drivers\portcls.sys Description: Port Class (Class Driver for Port/Miniport Devices) Company name: Microsoft Corporation Size: 167936 Attrs: ----a Created: 12:14:34 03.11.2010 Modified: 21:42:52 10.04.2009 Accessed: 07:55:22 22.01.2011	Signed
0x8B5A3000	0x8B5C403E	0x25000		C:\Windows\system32\drivers\drmk.sys Description: Microsoft Kernel DRM Descrambler Filter Company name: Microsoft Corporation Size: 130048 Attrs: ----a Created: 11:37:13 03.11.2010 Modified: 21:53:04 18.01.2008 Accessed: 07:55:15 22.01.2011	Signed
0x8B5C8000	0x8B5DBF05	0x17000	\Driver\SBRE [0x85763478]	C:\Windows\system32\drivers\SBREdrv.sys Description: Anti-Rootkit Engine Company name: Sunbelt Software Size: 98392 Attrs: ----a Created: 23:41:06 18.03.2011 Modified: 13:56:12 09.11.2010 Accessed: 23:41:06 18.03.2011	Signed
0x8B5DF000	0x8B5E4D85	0x7000		C:\Windows\system32\DRIVERS\HIDPARSE.SYS Description: Hid Parsing Library Company name: Microsoft Corporation Size: 25472 Attrs: ----a Created: 11:37:03 03.11.2010 Modified: 20:53:18 18.01.2008 Accessed: 07:55:18 22.01.2011	Signed
0x8B5E6000	0x8B5EF0C2	0xC000	\Driver\VgaSave [0x8576D3A0]	C:\Windows\System32\drivers\vga.sys Description: VGA/Super VGA Video Driver Company name: Microsoft Corporation Size: 25088 Attrs: ----a Created: 11:36:50 03.11.2010 Modified: 20:52:08 18.01.2008 Accessed: 07:55:26 22.01.2011	Signed
0x8B600000		0x9000		C:\Windows\System32\Drivers\kbdhid.sys Description: HID Keyboard Filter Driver Company name: Microsoft Corporation Size: 17408 Attrs: ----a Created: 12:14:13 03.11.2010 Modified: 21:38:42 10.04.2009 Accessed: 07:55:19 22.01.2011	Signed Unloaded module ( 18:09:12 19.03.2011 )
0x8B600000	0x8B607038	0xA000	\Driver\nsiproxy [0x857F7478]	C:\Windows\system32\drivers\nsiproxy.sys Description: NSI Proxy Company name: Microsoft Corporation Size: 16384 Attrs: ----a Created: 11:37:33 03.11.2010 Modified: 20:55:52 18.01.2008 Accessed: 07:55:21 22.01.2011	Signed
0x8B60B000	0x8B7D9045	0x1D9000	\Driver\IntcAzAudAddService [0x8571B318]	C:\Windows\system32\drivers\RTKVHDA.sys Description: Realtek(r) High Definition Audio Function Driver Company name: Realtek Semiconductor Corp. Size: 1941848 Attrs: ----a Created: 15:39:41 22.08.2007 Modified: 16:49:16 10.08.2007 Accessed: 07:55:23 22.01.2011	Signed
0x8B7E4000	0x8B7EA256	0x9000	\FileSystem\Fs_Rec [0x85744478]	C:\Windows\System32\Drivers\Fs_Rec.SYS Description: File System Recognizer Driver Company name: Microsoft Corporation Size: 12800 Attrs: ----a Created: 11:37:03 03.11.2010 Modified: 20:27:58 18.01.2008 Accessed: 07:55:18 22.01.2011	Signed
0x8B7ED000	0x8B7F1083	0x7000	\Driver\Null [0x85748410]	C:\Windows\System32\Drivers\Null.SYS Description: NULL Driver Company name: Microsoft Corporation Size: 4608 Attrs: ----a Created: 11:37:33 03.11.2010 Modified: 20:49:14 18.01.2008 Accessed: 07:55:22 22.01.2011	Signed
0x8B7F4000	0x8B7F8005	0x7000	\Driver\Beep [0x8573E478]	C:\Windows\System32\Drivers\Beep.SYS Description: BEEP Driver Company name: Microsoft Corporation Size: 6144 Attrs: ----a Created: 11:37:12 03.11.2010 Modified: 20:49:12 18.01.2008 Accessed: 07:55:15 22.01.2011	Signed
0x8BA00000	0x8BA1BE0A	0x21000		C:\Windows\System32\drivers\VIDEOPRT.SYS Description: Video Port Driver Company name: Microsoft Corporation Size: 110080 Attrs: ----a Created: 11:36:50 03.11.2010 Modified: 20:52:14 18.01.2008 Accessed: 07:55:26 22.01.2011	Signed
0x8BA21000	0x8BA26005	0x8000	\Driver\RDPCDD [0x85772318]	C:\Windows\System32\DRIVERS\RDPCDD.sys Description: RDP Miniport Company name: Microsoft Corporation Size: 6144 Attrs: ----a Created: 11:37:17 03.11.2010 Modified: 21:01:10 18.01.2008 Accessed: 07:55:23 22.01.2011	Signed
0x8BA29000	0x8BA2E005	0x8000	\Driver\RDPENCDD [0x8576C478]	C:\Windows\system32\drivers\rdpencdd.sys Description: RDP Miniport Company name: Microsoft Corporation Size: 6144 Attrs: ----a Created: 11:37:17 03.11.2010 Modified: 21:01:10 18.01.2008 Accessed: 07:55:23 22.01.2011	Signed
0x8BA31000	0x8BA3929A	0xB000	\FileSystem\Msfs [0x85775478]	C:\Windows\System32\Drivers\Msfs.SYS Description: Mailslot driver Company name: Microsoft Corporation Size: 22528 Attrs: ----a Created: 11:37:42 03.11.2010 Modified: 20:28:10 18.01.2008 Accessed: 07:55:21 22.01.2011	Signed
0x8BA3C000	0x8BA4758A	0xE000	\FileSystem\Npfs [0x858045C0]	C:\Windows\System32\Drivers\Npfs.SYS Description: NPFS Driver Company name: Microsoft Corporation Size: 35328 Attrs: ----a Created: 12:14:34 03.11.2010 Modified: 21:14:02 10.04.2009 Accessed: 07:55:21 22.01.2011	Signed
0x8BA4A000	0x8BA502B8	0x9000	\Driver\RasAcd [0x8576E3D0]	C:\Windows\System32\DRIVERS\rasacd.sys Description: RAS Automatic Connection Driver Company name: Microsoft Corporation Size: 11776 Attrs: ----a Created: 11:37:20 03.11.2010 Modified: 20:56:32 18.01.2008 Accessed: 07:55:23 22.01.2011	Signed
0x8BA53000	0x8BA66005	0x16000	\Driver\tdx [0x8577D478]	C:\Windows\system32\DRIVERS\tdx.sys Description: TDI Translation Driver Company name: Microsoft Corporation Size: 72192 Attrs: ----a Created: 12:14:04 03.11.2010 Modified: 21:45:58 10.04.2009 Accessed: 07:55:25 22.01.2011	Signed
0x8BA69000	0x8BA794FB	0x14000	\Driver\Smb [0x8578F410]	C:\Windows\system32\DRIVERS\smb.sys Description: SMB Transport driver Company name: Microsoft Corporation Size: 66560 Attrs: ----a Created: 12:14:07 03.11.2010 Modified: 21:45:24 10.04.2009 Accessed: 07:55:24 22.01.2011	Signed
0x8BA7D000	0x8BAB8504	0x48000	\Driver\AFD [0x85780478]	C:\Windows\system32\drivers\afd.sys Description: Ancillary Function Driver for WinSock Company name: Microsoft Corporation Size: 273920 Attrs: ----a Created: 12:14:20 03.11.2010 Modified: 21:47:04 10.04.2009 Accessed: 07:55:13 22.01.2011	Signed
0x8BAC5000	0x8BAC9405	0x6000	\Driver\CSN5PDTS82 [0x8578F318]	C:\Windows\System32\Drivers\CSN5PDTS82.sys Description: Colasoft NDIS 5.0 Protocol Driver Company name: Colasoft Co., Ltd. Size: 28184 Attrs: ----a Created: 15:31:30 03.02.2011 Modified: 16:14:52 20.05.2010 Accessed: 15:31:30 03.02.2011	Signed
0x8BACB000	0x8BAF70B1	0x32000	\Driver\netbt [0x856D34D0]	C:\Windows\System32\DRIVERS\netbt.sys Description: MBT Transport driver Company name: Microsoft Corporation Size: 185856 Attrs: ----a Created: 12:14:17 03.11.2010 Modified: 21:45:38 10.04.2009 Accessed: 07:55:21 22.01.2011	Signed
0x8BAFD000	0x8BB0C005	0x16000	\Driver\PSched [0x856D7108]	C:\Windows\system32\DRIVERS\pacer.sys Description: QoS Packet Scheduler Company name: Microsoft Corporation Size: 72192 Attrs: ----a Created: 12:14:34 03.11.2010 Modified: 21:45:52 10.04.2009 Accessed: 07:55:22 22.01.2011	Signed
0x8BB13000	0x8BB17450	0x5C000	\Driver\pwipf6 [0x857E85B8]	C:\Windows\system32\DRIVERS\pwipf6.sys Description: pwipf6 Company name: Privacyware/PWI, Inc. Size: 112960 Attrs: ----a Created: 16:34:14 24.02.2011 Modified: 18:59:22 26.10.2010 Accessed: 16:34:14 24.02.2011	Signed
0x8BB6F000	0x8BB7A278	0xE000	\FileSystem\NetBIOS [0x857E7980]	C:\Windows\system32\DRIVERS\netbios.sys Description: NetBIOS interface driver Company name: Microsoft Corporation Size: 35840 Attrs: ----a Created: 11:37:33 03.11.2010 Modified: 20:55:46 18.01.2008 Accessed: 07:55:21 22.01.2011	Signed
0x8BB7D000	0x8BB8C4E1	0x13000	\Driver\Wanarpv6 [0x857DF968]	C:\Windows\system32\DRIVERS\wanarp.sys Description: MS Remote Access and Routing ARP Driver Company name: Microsoft Corporation Size: 62464 Attrs: ----a Created: 11:37:00 03.11.2010 Modified: 20:56:32 18.01.2008 Accessed: 07:55:26 22.01.2011	Signed
0x8BB90000	0x8BB90BE0	0x9000	\Driver\VBoxUSBMon [0x859AB890]	C:\Windows\system32\DRIVERS\VBoxUSBMon.sys Description: VirtualBox USB Monitor Driver Company name: Oracle Corporation Size: 41936 Attrs: ----a Created: 22:51:17 03.11.2010 Modified: 14:08:04 05.08.2010 Accessed: 22:51:17 03.11.2010	Signed
0x8BB99000	0x8BB99C90	0x22000	\Driver\VBoxDrv [0x858EF4C8]	C:\Windows\system32\DRIVERS\VBoxDrv.sys Description: VirtualBox Support Driver Company name: Oracle Corporation Size: 143184 Attrs: ----a Created: 22:51:26 03.11.2010 Modified: 14:08:02 05.08.2010 Accessed: 22:51:26 03.11.2010	Signed
0x8BBBB000	0x8BBF11CE	0x3C000	\FileSystem\rdbss [0x859EBF38]	C:\Windows\system32\DRIVERS\rdbss.sys Description: Redirected Drive Buffering SubSystem Driver Company name: Microsoft Corporation Size: 225280 Attrs: ----a Created: 12:14:31 03.11.2010 Modified: 21:14:30 10.04.2009 Accessed: 07:55:23 22.01.2011	Signed
0x8BE09000	0x8BE1C3E1	0x17000	\FileSystem\DfsC [0x857A6DE8]	C:\Windows\System32\Drivers\dfsc.sys Description: DFS Namespace Client Driver Company name: Microsoft Corporation Size: 75264 Attrs: ----a Created: 12:14:26 03.11.2010 Modified: 21:14:14 10.04.2009 Accessed: 07:55:15 22.01.2011	Signed
0x8BE20000	0x8BE3F214	0x23000	\Driver\AntiLog32 [0x8585B640]	C:\Program Files\AntiLogger\AntiLog32.sys Description: Zemana AntiLogger Driver (stand-alone) Company name: Zemana Ltd. Size: 121288 Attrs: ----a Created: 07:46:52 03.01.2011 Modified: 07:46:52 03.01.2011 Accessed: 11:19:39 02.02.2011	Signed
0x8BE43000	0x8BE57005	0x17000	\Driver\usbccgp [0x85884EC0]	C:\Windows\system32\DRIVERS\usbccgp.sys Description: USB Common Class Generic Parent Driver Company name: Microsoft Corporation Size: 73216 Attrs: ----a Created: 11:36:50 03.11.2010 Modified: 20:53:30 18.01.2008 Accessed: 11:32:38 17.03.2011	Signed
0x8BE5A000	0x8BE60005	0x9000	\Driver\HidUsb [0x8588CF38]	C:\Windows\system32\DRIVERS\hidusb.sys Description: USB Miniport Driver for Input Devices Company name: Microsoft Corporation Size: 12800 Attrs: ----a Created: 12:14:24 03.11.2010 Modified: 21:42:50 10.04.2009 Accessed: 07:55:18 22.01.2011	Signed
0x8BE63000	0x8BE70005	0x10000		C:\Windows\system32\DRIVERS\HIDCLASS.SYS Description: Hid Class Library Company name: Microsoft Corporation Size: 39424 Attrs: ----a Created: 12:14:24 03.11.2010 Modified: 21:42:50 10.04.2009 Accessed: 07:55:18 22.01.2011	Signed
0x8BE73000	0x8BE79604	0x9000	\Driver\kbdhid [0x85870F38]	C:\Windows\system32\DRIVERS\kbdhid.sys Description: HID Keyboard Filter Driver Company name: Microsoft Corporation Size: 17408 Attrs: ----a Created: 12:14:13 03.11.2010 Modified: 21:38:42 10.04.2009 Accessed: 07:55:19 22.01.2011	Signed
0x8BE7C000	0x8BE8127D	0x8000	\Driver\mouhid [0x85882808]	C:\Windows\system32\DRIVERS\mouhid.sys Description: HID Mouse Filter Driver Company name: Microsoft Corporation Size: 15872 Attrs: ----a Created: 11:37:30 03.11.2010 Modified: 20:49:18 18.01.2008 Accessed: 07:55:20 22.01.2011	Signed
0x8BE84000	0x8BE922C2	0x46000	\Driver\RTL8187B [0x858C2668]	C:\Windows\system32\DRIVERS\RTL8187B.sys Description: Realtek RTL8187B NDIS Driver Company name: Realtek Semiconductor Corporation Size: 252416 Attrs: ----a Created: 12:24:51 03.11.2010 Modified: 16:07:48 01.06.2007 Accessed: 07:55:24 22.01.2011	Signed
0x8BECA000	0x8BED4005	0xD000		C:\Windows\System32\Drivers\crashdmp.sys Description: Crash Dump Driver Company name: Microsoft Corporation Size: 35304 Attrs: ----a Created: 12:14:20 03.11.2010 Modified: 23:32:32 10.04.2009 Accessed: 07:55:15 22.01.2011	Signed
0x8BED7000	0x8BEDF005	0xB000		C:\Windows\System32\Drivers\dump_dumpata.sys ( dump_ataport.sys )	File doesn't exist
0x8BEE2000	0x8BEE7005	0x8000		C:\Windows\System32\Drivers\dump_atapi.sys	File doesn't exist
0x8BEEA000	0x8BEF1005	0xA000		C:\Windows\System32\drivers\Dxapi.sys Description: DirectX API Driver Company name: Microsoft Corporation Size: 13312 Attrs: ----a Created: 11:37:13 03.11.2010 Modified: 20:36:14 18.01.2008 Accessed: 07:55:15 22.01.2011	Signed
0x8BEF4000	0x8BEF6B02	0xF000	\Driver\monitor [0x85D8B5C0]	C:\Windows\system32\DRIVERS\monitor.sys Description: Monitor Driver Company name: Microsoft Corporation Size: 41984 Attrs: ----a Created: 11:37:29 03.11.2010 Modified: 20:52:20 18.01.2008 Accessed: 07:55:20 22.01.2011	Signed
0x8BF03000	0x8BF162CD	0x1B000	\FileSystem\luafv [0x85EBA518]	C:\Windows\system32\drivers\luafv.sys Description: LUA File Virtualization Filter Driver Company name: Microsoft Corporation Size: 84480 Attrs: ----a Created: 11:37:32 03.11.2010 Modified: 20:30:38 18.01.2008 Accessed: 07:55:20 22.01.2011	Signed
0x8BF1E000	0x8BF2CB3E	0x11000	\FileSystem\a2acc [0x85ECEF38]	C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\a2accx86.sys Description: Emsisoft Anti-Malware File Guard Company name: Emsi Software GmbH Size: 73728 Attrs: ----a Created: 12:26:37 04.03.2011 Modified: 12:36:19 04.03.2011 Accessed: 12:26:37 04.03.2011	Signed
0x8BF2F000		0x8000		C:\Windows\System32\Drivers\drmkaud.sys Description: Microsoft Kernel DRM Audio Descrambler Filter Company name: Microsoft Corporation Size: 5632 Attrs: ----a Created: 11:37:13 03.11.2010 Modified: 20:53:18 18.01.2008 Accessed: 07:55:15 22.01.2011	Signed Unloaded module ( 18:09:57 19.03.2011 )
0x8BF37000	0x8BFE01EB	0xB0000		C:\Windows\system32\drivers\spsys.sys Description: security processor Company name: Microsoft Corporation Size: 684032 Attrs: ----a Created: 12:14:07 03.11.2010 Modified: 19:52:42 10.04.2009 Accessed: 07:55:24 22.01.2011	Signed
0x91280000	0x9146A0EC	0x202000	\Driver\Win32k [0x847147C0]	C:\Windows\System32\win32k.sys Description: Multi-User Win32 Driver Company name: Microsoft Corporation Size: 2034688 Attrs: ----a Created: 12:14:11 03.11.2010 Modified: 21:24:18 10.04.2009 Accessed: 07:58:11 22.01.2011	Signed
0x914A0000	0x914A2145	0x9000		C:\Windows\System32\TSDDD.dll Description: Framebuffer Display Driver Company name: Microsoft Corporation Size: 14336 Attrs: ----a Created: 11:36:50 03.11.2010 Modified: 21:01:10 18.01.2008 Accessed: 07:57:38 22.01.2011	Signed
0x914C0000	0x914C7B84	0xE000		C:\Windows\System32\cdd.dll Description: Canonical Display Driver Company name: Microsoft Corporation Size: 37376 Attrs: ----a Created: 12:14:19 03.11.2010 Modified: 23:21:48 10.04.2009 Accessed: 07:49:59 22.01.2011	Signed
0x94803000	0x9481D844	0x21000	\Driver\SbieDrv [0x85FDC650]	C:\Program Files\Sandboxie\SbieDrv.sys Description: Sandboxie Kernel Mode Driver Company name: SANDBOXIE L.T.D Size: 125672 Attrs: ----a Created: 09:35:48 12.01.2011 Modified: 09:35:48 12.01.2011 Accessed: 07:13:07 12.12.2010	Signed
0x94824000	0x948309E7	0x10000	\Driver\lltdio [0x85FEA868]	C:\Windows\system32\DRIVERS\lltdio.sys Description: Link-Layer Topology Mapper I/O Driver Company name: Microsoft Corporation Size: 47104 Attrs: ----a Created: 11:37:30 03.11.2010 Modified: 20:55:04 18.01.2008 Accessed: 07:55:20 22.01.2011	Signed
0x94834000	0x948593CE	0x2A000	\Driver\NativeWifiP [0x85FEA030]	C:\Windows\system32\DRIVERS\nwifi.sys Description: NativeWiFi Miniport Driver Company name: Microsoft Corporation Size: 148480 Attrs: ----a Created: 12:14:33 03.11.2010 Modified: 21:43:30 10.04.2009 Accessed: 07:55:22 22.01.2011	Signed
0x9485E000	0x948651D4	0xA000	\Driver\Ndisuio [0x85DF2BB8]	C:\Windows\system32\DRIVERS\ndisuio.sys Description: NDIS User mode I/O driver Company name: Microsoft Corporation Size: 16896 Attrs: ----a Created: 11:37:33 03.11.2010 Modified: 20:55:42 18.01.2008 Accessed: 07:55:21 22.01.2011	Signed
0x94868000	0x9487741B	0x13000	\Driver\rspndr [0x85FFBAF8]	C:\Windows\system32\DRIVERS\rspndr.sys Description: Link-Layer Topology Responder Driver for NDIS 6 Company name: Microsoft Corporation Size: 60416 Attrs: ----a Created: 11:37:22 03.11.2010 Modified: 20:55:04 18.01.2008 Accessed: 07:55:23 22.01.2011	Signed
0x9487B000	0x948CD4CB	0x6B000	\Driver\HTTP [0x85A4AF38]	C:\Windows\system32\drivers\HTTP.sys Description: HTTP Protocol Stack Company name: Microsoft Corporation Size: 401408 Attrs: ----a Created: 12:14:24 03.11.2010 Modified: 21:45:34 10.04.2009 Accessed: 07:55:18 22.01.2011	Signed
0x948E6000	0x948F7005	0x15000	\Driver\mpsdrv [0x8605A118]	C:\Windows\System32\drivers\mpsdrv.sys Description: Microsoft Protection Service Driver Company name: Microsoft Corporation Size: 64000 Attrs: ----a Created: 11:37:30 03.11.2010 Modified: 20:54:48 18.01.2008 Accessed: 07:55:20 22.01.2011	Signed
0x948FB000		0x18000		C:\Windows\System32\Drivers\parport.sys Description: Parallel Port Driver Company name: Microsoft Corporation Size: 79360 Attrs: ----a Created: 03:51:30 02.11.2006 Modified: 03:51:30 02.11.2006 Accessed: 07:55:22 22.01.2011	Signed Unloaded module ( 18:09:35 19.03.2011 )
0x94913000	0x949281E5	0x19000	\FileSystem\bowser [0x847B1900]	C:\Windows\system32\DRIVERS\bowser.sys Description: NT Lan Manager Datagram Receiver Driver Company name: Microsoft Corporation Size: 69632 Attrs: ----a Created: 11:37:10 03.11.2010 Modified: 20:28:28 18.01.2008 Accessed: 07:55:15 22.01.2011	Signed
0x9492C000	0x94946005	0x1F000	\FileSystem\mrxsmb [0x860B4E90]	C:\Windows\system32\DRIVERS\mrxsmb.sys Description: Windows NT SMB Minirdr Company name: Microsoft Corporation Size: 105984 Attrs: ----a Created: 12:14:17 03.11.2010 Modified: 21:14:30 10.04.2009 Accessed: 07:55:20 22.01.2011	Signed
0x9494B000	0x9497E005	0x39000	\FileSystem\mrxsmb10 [0x860D8BE8]	C:\Windows\system32\DRIVERS\mrxsmb10.sys Description: Longhorn SMB Downlevel SubRdr Company name: Microsoft Corporation Size: 212992 Attrs: ----a Created: 12:14:17 03.11.2010 Modified: 21:14:38 10.04.2009 Accessed: 07:55:21 22.01.2011	Signed
0x94984000	0x94998005	0x18000	\FileSystem\mrxsmb20 [0x860CE448]	C:\Windows\system32\DRIVERS\mrxsmb20.sys Description: Longhorn SMB 2.0 Redirector Company name: Microsoft Corporation Size: 79360 Attrs: ----a Created: 12:14:17 03.11.2010 Modified: 21:14:30 10.04.2009 Accessed: 07:55:21 22.01.2011	Signed
0x95C0F000	0x95CE8183	0xDE000	\Driver\PEAUTH [0x860E3640]	C:\Windows\system32\drivers\peauth.sys Description: Protected Environment Authentication and Authorization Export Driver Company name: Microsoft Corporation Size: 878080 Attrs: ----a Created: 04:04:34 02.11.2006 Modified: 04:04:35 02.11.2006 Accessed: 07:55:22 22.01.2011	Signed
0x95CED000	0x95CF405F	0xA000	\Driver\secdrv [0x86102610]	C:\Windows\System32\Drivers\secdrv.SYS Description: Macrovision SECURITY Driver Company name: Macrovision Corporation, Macrovision Europe Limited, and Macrov Size: 20480 Attrs: ----a Created: 01:37:21 02.11.2006 Modified: 01:37:21 02.11.2006 Accessed: 07:55:20 22.01.2011	Signed
0x95CF7000	0x95D0F040	0x1D000	\FileSystem\srvnet [0x86105C80]	C:\Windows\System32\DRIVERS\srvnet.sys Description: Server Network driver Company name: Microsoft Corporation Size: 98816 Attrs: ----a Created: 12:14:08 03.11.2010 Modified: 21:15:04 10.04.2009 Accessed: 07:55:24 22.01.2011	Signed
0x95D14000	0x95D1D005	0xC000	\Driver\tcpipreg [0x8609D590]	C:\Windows\System32\drivers\tcpipreg.sys Description: TCP/IP Registry Compatibility Driver Company name: Microsoft Corporation Size: 30720 Attrs: ----a Created: 12:14:05 03.11.2010 Modified: 21:46:08 10.04.2009 Accessed: 07:55:25 22.01.2011	Signed
0x95D20000	0x95D42005	0x27000	\FileSystem\srv2 [0x86144F00]	C:\Windows\System32\DRIVERS\srv2.sys Description: Smb 2.0 Server driver Company name: Microsoft Corporation Size: 144896 Attrs: ----a Created: 12:14:08 03.11.2010 Modified: 21:15:04 10.04.2009 Accessed: 07:55:20 22.01.2011	Signed
0x95D47000	0x95D8B005	0x4C000	\FileSystem\srv [0x86144030]	C:\Windows\System32\DRIVERS\srv.sys Description: Server driver Company name: Microsoft Corporation Size: 288768 Attrs: ----a Created: 12:14:08 03.11.2010 Modified: 21:15:22 10.04.2009 Accessed: 07:55:24 22.01.2011	Signed
0x95D93000	0x95DA5040	0x16000	\FileSystem\cdfs [0x86389570]	C:\Windows\system32\DRIVERS\cdfs.sys Description: CD-ROM File System Driver Company name: Microsoft Corporation Size: 70144 Attrs: ----a Created: 11:37:09 03.11.2010 Modified: 20:28:04 18.01.2008 Accessed: 07:55:15 22.01.2011	Signed
0x95DA9000	0x95DC3006	0x1D000	\Driver\3qyhufha [0x840F1E50]	C:\Windows\system32\drivers\3qyhufha.sys Description: Vba32 AntiRootkit driver Company name: VirusBlokAda Ltd. Size: 109960 Attrs: ----a Created: 18:11:43 19.03.2011 Modified: 18:11:43 19.03.2011 Accessed: 18:11:43 19.03.2011	VBA32 Signed
Total:

Description: NT Layer DLL
Company name: Microsoft Corporation
Size: 1202168 Attrs: ----a

Created: 12:14:34 03.11.2010
Modified: 23:27:50 10.04.2009
Accessed: 07:56:41 22.01.2011

Description: Kernel Debugger HW Extension DLL
Company name: Microsoft Corporation
Size: 17384 Attrs: ----a

Created: 12:14:12 03.11.2010
Modified: 23:32:28 10.04.2009
Accessed: 07:55:52 22.01.2011

Description: Platform Specific Hardware Error Driver
Company name: Microsoft Corporation
Size: 50664 Attrs: ----a

Created: 12:14:31 03.11.2010
Modified: 23:32:54 10.04.2009
Accessed: 07:56:51 22.01.2011

Description: VGA Boot Driver
Company name: Microsoft Corporation
Size: 24120 Attrs: ----a

Created: 11:37:10 03.11.2010
Modified: 22:41:36 18.01.2008
Accessed: 07:49:47 22.01.2011

Description: Common Log File System Driver
Company name: Microsoft Corporation
Size: 245736 Attrs: ----a

Created: 12:14:19 03.11.2010
Modified: 23:32:48 10.04.2009
Accessed: 07:50:01 22.01.2011

Description: Code Integrity Module
Company name: Microsoft Corporation
Size: 614376 Attrs: ----a

Created: 12:14:19 03.11.2010
Modified: 23:33:04 10.04.2009
Accessed: 07:50:01 22.01.2011

Description: WDF Dynamic
Company name: Microsoft Corporation
Size: 503864 Attrs: ----a

Created: 11:36:59 03.11.2010
Modified: 22:43:28 18.01.2008
Accessed: 07:55:26 22.01.2011

Description: WDFLDR
Company name: Microsoft Corporation
Size: 35896 Attrs: ----a

Created: 11:36:59 03.11.2010
Modified: 22:42:00 18.01.2008
Accessed: 07:55:27 22.01.2011

Description: Kernel CSA Library
Company name: Microsoft Corporation
Size: 149504 Attrs: ----a

Created: 12:14:13 03.11.2010
Modified: 21:38:50 10.04.2009
Accessed: 07:55:19 22.01.2011

Description: User-Mode Bus Enumerator
Company name: Microsoft Corporation
Size: 34816 Attrs: ----a

Created: 11:36:50 03.11.2010
Modified: 20:53:42 18.01.2008
Accessed: 07:55:25 22.01.2011

Description: ACPI Driver for NT
Company name: Microsoft Corporation
Size: 265688 Attrs: ----a

Created: 12:14:21 03.11.2010
Modified: 23:32:48 10.04.2009
Accessed: 07:55:13 22.01.2011

Description: WMILIB WMI support library Dll
Company name: Microsoft Corporation
Size: 17976 Attrs: ----a

Created: 11:36:56 03.11.2010
Modified: 22:41:22 18.01.2008
Accessed: 07:55:27 22.01.2011

Description: ISA Driver
Company name: Microsoft Corporation
Size: 16440 Attrs: ----a

Created: 11:37:36 03.11.2010
Modified: 22:41:16 18.01.2008
Accessed: 07:55:21 22.01.2011

Description: NT Plug and Play PCI Enumerator
Company name: Microsoft Corporation
Size: 149480 Attrs: ----a

Created: 12:14:34 03.11.2010
Modified: 23:32:56 10.04.2009
Accessed: 07:55:22 22.01.2011

Description: Partition Management Driver
Company name: Microsoft Corporation
Size: 54248 Attrs: ----a

Created: 12:14:34 03.11.2010
Modified: 23:32:32 10.04.2009
Accessed: 07:55:22 22.01.2011

Description: Composite Battery Driver
Company name: Microsoft Corporation
Size: 20792 Attrs: ----a

Created: 11:37:15 03.11.2010
Modified: 22:41:26 18.01.2008
Accessed: 07:55:15 22.01.2011

Description: Battery Class Driver
Company name: Microsoft Corporation
Size: 28216 Attrs: ----a

Created: 11:37:12 03.11.2010
Modified: 22:41:40 18.01.2008
Accessed: 07:55:15 22.01.2011

Description: Volume Manager Driver
Company name: Microsoft Corporation
Size: 52792 Attrs: ----a

Created: 11:36:50 03.11.2010
Modified: 22:42:20 18.01.2008
Accessed: 07:55:26 22.01.2011

Description: Volume Manager Extension Driver
Company name: Microsoft Corporation
Size: 292840 Attrs: ----a

Created: 12:14:10 03.11.2010
Modified: 23:33:04 10.04.2009
Accessed: 07:55:26 22.01.2011

Description: Generic PCI IDE Bus Driver
Company name: Microsoft Corporation
Size: 14312 Attrs: ----a

Created: 12:14:34 03.11.2010
Modified: 23:32:50 10.04.2009
Accessed: 07:55:22 22.01.2011

Description: PCI IDE Bus Driver Extension
Company name: Microsoft Corporation
Size: 43496 Attrs: ----a

Created: 12:14:34 03.11.2010
Modified: 23:32:54 10.04.2009
Accessed: 07:55:22 22.01.2011

Description: Mount Point Manager
Company name: Microsoft Corporation
Size: 57400 Attrs: ----a

Created: 11:37:29 03.11.2010
Modified: 22:42:30 18.01.2008
Accessed: 07:55:20 22.01.2011

Description: ATAPI IDE Miniport Driver
Company name: Microsoft Corporation
Size: 19944 Attrs: ----a

Created: 12:14:22 03.11.2010
Modified: 23:32:28 10.04.2009
Accessed: 07:55:14 22.01.2011

Description: ATAPI Driver Extension
Company name: Microsoft Corporation
Size: 109032 Attrs: ----a

Created: 12:14:23 03.11.2010
Modified: 23:32:44 10.04.2009
Accessed: 07:55:14 22.01.2011

Description: Microsoft Filesystem Filter Manager
Company name: Microsoft Corporation
Size: 190424 Attrs: ----a

Created: 12:14:24 03.11.2010
Modified: 23:32:48 10.04.2009
Accessed: 07:55:18 22.01.2011

Description: FileInfo Filter Driver
Company name: Microsoft Corporation
Size: 58936 Attrs: ----a

Created: 11:37:14 03.11.2010
Modified: 22:42:32 18.01.2008
Accessed: 07:55:18 22.01.2011

Description: Kernel Security Support Provider Interface
Company name: Microsoft Corporation
Size: 439784 Attrs: ----a

Created: 12:14:13 03.11.2010
Modified: 23:32:50 10.04.2009
Accessed: 07:55:19 22.01.2011

Description: NT Kernel & System
Company name: Microsoft Corporation
Size: 3601896 Attrs: ----a

Created: 12:14:34 03.11.2010
Modified: 23:32:50 10.04.2009
Accessed: 07:56:42 22.01.2011

Description: NT Kernel & System
Company name: Microsoft Corporation
Size: 3601896 Attrs: ----a

Created: 12:14:34 03.11.2010
Modified: 23:32:50 10.04.2009
Accessed: 07:56:42 22.01.2011

Description: NT Kernel & System
Company name: Microsoft Corporation
Size: 3601896 Attrs: ----a

Created: 12:14:34 03.11.2010
Modified: 23:32:50 10.04.2009
Accessed: 07:56:42 22.01.2011

Description: Hardware Abstraction Layer DLL
Company name: Microsoft Corporation
Size: 177128 Attrs: ----a

Created: 05:25:51 02.11.2006
Modified: 23:32:48 10.04.2009
Accessed: 07:55:11 22.01.2011

Description: Consumer IR Class Driver for eHome
Company name: Microsoft Corporation
Size: 35328 Attrs: ----a

Created: 11:37:15 03.11.2010
Modified: 20:53:26 18.01.2008
Accessed: 07:55:15 22.01.2011

Description: NDIS 6.0 wrapper driver
Company name: Microsoft Corporation
Size: 527848 Attrs: ----a

Created: 12:14:17 03.11.2010
Modified: 23:32:50 10.04.2009
Accessed: 07:55:21 22.01.2011

Description: Kernel Remote Procedure Call Provider
Company name: Microsoft Corporation
Size: 161752 Attrs: ----a

Created: 12:14:16 03.11.2010
Modified: 23:32:48 10.04.2009
Accessed: 07:55:21 22.01.2011

Description: Network I/O Subsystem
Company name: Microsoft Corporation
Size: 223208 Attrs: ----a

Created: 12:14:17 03.11.2010
Modified: 23:32:48 10.04.2009
Accessed: 07:55:21 22.01.2011

Description: Microsoft Storage Port Driver
Company name: Microsoft Corporation
Size: 122344 Attrs: ----a

Created: 12:14:08 03.11.2010
Modified: 23:32:56 10.04.2009
Accessed: 07:55:24 22.01.2011

Description: RAS SSTP Miniport Call Manager
Company name: Microsoft Corporation
Size: 69120 Attrs: ----a

Created: 12:14:32 03.11.2010
Modified: 21:46:42 10.04.2009
Accessed: 07:55:23 22.01.2011

Description: Terminal Server Driver
Company name: Microsoft Corporation
Size: 53224 Attrs: ----a

Created: 12:14:04 03.11.2010
Modified: 23:32:54 10.04.2009
Accessed: 07:55:25 22.01.2011

Description: VirtualBox Bridged Networking Driver
Company name: Oracle Corporation
Size: 111312 Attrs: ----a

Created: 22:51:41 03.11.2010
Modified: 14:08:04 05.08.2010
Accessed: 07:55:26 22.01.2011

Description: TCP/IP Driver
Company name: Microsoft Corporation
Size: 897000 Attrs: ----a

Created: 12:14:05 03.11.2010
Modified: 23:33:04 10.04.2009
Accessed: 07:55:24 22.01.2011

Description: FWP/IPsec Kernel-Mode API
Company name: Microsoft Corporation
Size: 99816 Attrs: ----a

Created: 12:14:23 03.11.2010
Modified: 23:32:44 10.04.2009
Accessed: 07:55:18 22.01.2011

Description: SCSI Class System Dll
Company name: Microsoft Corporation
Size: 125928 Attrs: ----a

Created: 12:14:19 03.11.2010
Modified: 23:32:44 10.04.2009
Accessed: 07:55:15 22.01.2011

Description: Disk Block Verification Filter Driver
Company name: Microsoft Corporation
Size: 22632 Attrs: ----a

Created: 03:52:27 02.11.2006
Modified: 04:49:43 02.11.2006
Accessed: 07:55:15 22.01.2011

Description: Crash Dump Driver
Company name: Microsoft Corporation
Size: 35304 Attrs: ----a

Created: 12:14:20 03.11.2010
Modified: 23:32:32 10.04.2009
Accessed: 07:55:15 22.01.2011

Description: Microsoft Tunnel Interface Driver
Company name: Microsoft Corporation
Size: 23040 Attrs: ----a

Created: 11:36:50 03.11.2010
Modified: 20:55:52 18.01.2008
Accessed: 07:55:25 22.01.2011

Description: TOSHIBA Firmware Linkage 32-bit Driver
Company name: TOSHIBA Corporation
Size: 7168 Attrs: ----a

Created: 15:53:00 22.08.2007
Modified: 01:11:14 20.11.2006
Accessed: 07:55:18 22.01.2011

Description: Processor Device Driver
Company name: Microsoft Corporation
Size: 44032 Attrs: ----a

Created: 11:37:11 03.11.2010
Modified: 20:27:22 18.01.2008
Accessed: 07:55:14 22.01.2011

Description: USB 1.1 & 2.0 Port Driver
Company name: Microsoft Corporation
Size: 226304 Attrs: ----a

Created: 12:14:11 03.11.2010
Modified: 21:42:58 10.04.2009
Accessed: 07:55:26 22.01.2011

Description: SCSI CD-ROM Driver
Company name: Microsoft Corporation
Size: 67072 Attrs: ----a

Created: 12:14:19 03.11.2010
Modified: 21:39:18 10.04.2009
Accessed: 07:55:15 22.01.2011

Description: MS PPP Framing Driver (Strong Encryption)
Company name: Microsoft Corporation
Size: 121344 Attrs: ----a

Created: 12:14:17 03.11.2010
Modified: 21:46:34 10.04.2009
Accessed: 07:55:21 22.01.2011

Description: Peer-to-Peer Tunneling Protocol
Company name: Microsoft Corporation
Size: 62976 Attrs: ----a

Created: 11:37:17 03.11.2010
Modified: 20:56:36 18.01.2008
Accessed: 07:55:20 22.01.2011

Description: NT File System Driver
Company name: Microsoft Corporation
Size: 1083880 Attrs: ----a

Created: 12:14:34 03.11.2010
Modified: 23:32:50 10.04.2009
Accessed: 07:55:21 22.01.2011

Description: Volume Shadow Copy Driver
Company name: Microsoft Corporation
Size: 226280 Attrs: ----a

Created: 12:14:10 03.11.2010
Modified: 23:32:56 10.04.2009
Accessed: 11:32:38 17.03.2011

Description: TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Driver
Company name: TOSHIBA Corporation
Size: 16768 Attrs: ----a

Created: 01:22:14 06.10.2006
Modified: 01:22:14 06.10.2006
Accessed: 07:55:25 22.01.2011

Description: tos_sps2
Company name: TOSHIBA Corporation
Size: 285184 Attrs: ----a

Created: 15:55:55 22.08.2007
Modified: 17:37:20 01.08.2007
Accessed: 07:55:25 22.01.2011

Description: loader for security processor
Company name: Microsoft Corporation
Size: 21048 Attrs: ----a

Created: 11:36:52 03.11.2010
Modified: 22:41:32 18.01.2008
Accessed: 07:55:24 22.01.2011

Description: Backup image protection
Company name: Macrium Software
Size: 15328 Attrs: ----a

Created: 14:03:22 28.09.2010
Modified: 14:03:22 28.09.2010
Accessed: 12:58:20 03.11.2010

Description: Multiple UNC Provider driver
Company name: Microsoft Corporation
Size: 48104 Attrs: ----a

Created: 12:14:17 03.11.2010
Modified: 23:32:32 10.04.2009
Accessed: 07:55:21 22.01.2011

Description: Special Memory Device Cache
Company name: Microsoft Corporation
Size: 141288 Attrs: ----a

Created: 12:14:27 03.11.2010
Modified: 23:32:44 10.04.2009
Accessed: 07:55:15 22.01.2011

Description: PnP Disk Driver
Company name: Microsoft Corporation
Size: 53736 Attrs: ----a

Created: 12:14:26 03.11.2010
Modified: 23:32:32 10.04.2009
Accessed: 11:32:35 17.03.2011

Description: ATI PCIE Driver for ATI PCIE chipset
Company name: ATI Technologies Inc.
Size: 7680 Attrs: ----a

Created: 15:29:58 22.08.2007
Modified: 13:23:12 30.10.2006
Accessed: 07:55:14 22.01.2011

Description: ATI Radeon Kernel Mode Driver
Company name: ATI Technologies Inc.
Size: 2929664 Attrs: ----a

Created: 02:36:40 28.07.2007
Modified: 02:36:40 28.07.2007
Accessed: 07:55:14 22.01.2011

Description: DirectX Graphics Kernel
Company name: Microsoft Corporation
Size: 626176 Attrs: ----a

Created: 12:14:27 03.11.2010
Modified: 21:23:50 10.04.2009
Accessed: 07:55:15 22.01.2011

Description: Watchdog Driver
Company name: Microsoft Corporation
Size: 33280 Attrs: ----a

Created: 12:14:10 03.11.2010
Modified: 21:22:48 10.04.2009
Accessed: 07:55:26 22.01.2011

Description: OHCI USB Miniport Driver
Company name: Microsoft Corporation
Size: 19456 Attrs: ----a

Created: 12:14:11 03.11.2010
Modified: 21:42:54 10.04.2009
Accessed: 07:55:26 22.01.2011

Description: EHCI eUSB Miniport Driver
Company name: Microsoft Corporation
Size: 39936 Attrs: ----a

Created: 12:14:06 03.11.2010
Modified: 21:42:54 10.04.2009
Accessed: 07:55:20 22.01.2011

Description: Toshiba ODD Writing Driver For x86.
Company name: TOSHIBA Corporation.
Size: 16128 Attrs: ----a

Created: 14:50:04 18.10.2006
Modified: 14:50:04 18.10.2006
Accessed: 07:55:25 22.01.2011

Description: RAS PPPoE mini-port/call-manager driver
Company name: Microsoft Corporation
Size: 41472 Attrs: ----a

Created: 12:14:32 03.11.2010
Modified: 21:46:32 10.04.2009
Accessed: 07:55:23 22.01.2011

Description: Plug and Play Software Device Enumerator
Company name: Microsoft Corporation
Size: 15288 Attrs: ----a

Created: 11:36:51 03.11.2010
Modified: 22:41:16 18.01.2008
Accessed: 07:55:24 22.01.2011

Description: System Management BIOS Driver
Company name: Microsoft Corporation
Size: 31288 Attrs: ----a

Created: 11:37:42 03.11.2010
Modified: 22:41:50 18.01.2008
Accessed: 07:55:21 22.01.2011

Description: High Definition Audio Bus Driver
Company name: Microsoft Corporation
Size: 561152 Attrs: ----a

Created: 12:14:25 03.11.2010
Modified: 21:42:44 10.04.2009
Accessed: 07:55:18 22.01.2011

Description: i8042 Port Driver
Company name: Microsoft Corporation
Size: 54784 Attrs: ----a

Created: 11:37:05 03.11.2010
Modified: 20:49:20 18.01.2008
Accessed: 07:55:19 22.01.2011

Description: Keyboard Class Driver
Company name: Microsoft Corporation
Size: 35384 Attrs: ----a

Created: 11:37:30 03.11.2010
Modified: 22:41:54 18.01.2008
Accessed: 07:55:19 22.01.2011

Description: Synaptics Touchpad Driver
Company name: Synaptics, Inc.
Size: 190384 Attrs: ----a

Created: 20:03:36 15.08.2007
Modified: 20:03:36 15.08.2007
Accessed: 07:55:24 22.01.2011

Description: Universal Serial Bus Driver
Company name: Microsoft Corporation
Size: 5888 Attrs: ----a

Created: 11:36:50 03.11.2010
Modified: 20:53:18 18.01.2008
Accessed: 07:55:26 22.01.2011

Description: Mouse Class Driver
Company name: Microsoft Corporation
Size: 34360 Attrs: ----a

Created: 11:37:30 03.11.2010
Modified: 22:41:54 18.01.2008
Accessed: 07:55:20 22.01.2011

Description: 1394 OpenHCI Port Driver
Company name: Microsoft Corporation
Size: 62208 Attrs: ----a

Created: 12:14:33 03.11.2010
Modified: 21:43:06 10.04.2009
Accessed: 07:55:22 22.01.2011

Description: 1394 Bus Device Driver
Company name: Microsoft Corporation
Size: 53376 Attrs: ----a

Created: 11:37:11 03.11.2010
Modified: 20:53:28 18.01.2008
Accessed: 07:55:13 22.01.2011

Description: SecureDigital Bus Driver
Company name: Microsoft Corporation
Size: 89088 Attrs: ----a

Created: 12:14:36 03.11.2010
Modified: 21:19:16 10.04.2009
Accessed: 07:55:24 22.01.2011

Description: RICOH SD Driver
Company name: REDC
Size: 39936 Attrs: ----a

Created: 15:45:08 22.08.2007
Modified: 16:42:22 24.02.2007
Accessed: 07:55:23 22.01.2011

Description: RICOH MS Driver
Company name: REDC
Size: 42496 Attrs: ----a

Created: 15:45:08 22.08.2007
Modified: 18:40:20 23.01.2007
Accessed: 07:55:23 22.01.2011

Description: RICOH XD SM Driver
Company name: REDC
Size: 37376 Attrs: ----a

Created: 15:45:08 22.08.2007
Modified: 01:02:04 22.03.2007
Accessed: 07:55:23 22.01.2011

Description: Control Method Battery Driver
Company name: Microsoft Corporation
Size: 14208 Attrs: ----a

Created: 11:37:15 03.11.2010
Modified: 20:32:48 18.01.2008
Accessed: 07:55:15 22.01.2011

Description: Microsoft iSCSI Initiator Driver
Company name: Microsoft Corporation
Size: 180712 Attrs: ----a

Created: 12:14:15 03.11.2010
Modified: 23:32:48 10.04.2009
Accessed: 07:55:21 22.01.2011

Description: TDI Wrapper
Company name: Microsoft Corporation
Size: 20992 Attrs: ----a

Created: 11:36:53 03.11.2010
Modified: 20:57:12 18.01.2008
Accessed: 07:55:25 22.01.2011

Description: RAS L2TP mini-port/call-manager driver
Company name: Microsoft Corporation
Size: 76288 Attrs: ----a

Created: 11:37:17 03.11.2010
Modified: 20:56:36 18.01.2008
Accessed: 07:55:23 22.01.2011

Description: NDIS 3.0 connection wrapper driver
Company name: Microsoft Corporation
Size: 20992 Attrs: ----a

Created: 11:37:33 03.11.2010
Modified: 20:56:26 18.01.2008
Accessed: 07:55:21 22.01.2011

Description: Default Hub Driver for USB
Company name: Microsoft Corporation
Size: 196096 Attrs: ----a

Created: 12:14:06 03.11.2010
Modified: 21:43:18 10.04.2009
Accessed: 07:55:26 22.01.2011

Description: NDIS Proxy
Company name: Microsoft Corporation
Size: 49664 Attrs: ----a

Created: 11:37:33 03.11.2010
Modified: 20:56:30 18.01.2008
Accessed: 07:55:21 22.01.2011

Description: SoftModem Device Driver
Company name: Agere Systems
Size: 1161888 Attrs: ----a

Created: 17:11:00 28.11.2006
Modified: 17:11:00 28.11.2006
Accessed: 07:55:14 22.01.2011

Description: Modem Device Driver
Company name: Microsoft Corporation
Size: 31744 Attrs: ----a

Created: 11:37:28 03.11.2010
Modified: 20:57:18 18.01.2008
Accessed: 07:55:20 22.01.2011

Description: Port Class (Class Driver for Port/Miniport Devices)
Company name: Microsoft Corporation
Size: 167936 Attrs: ----a

Created: 12:14:34 03.11.2010
Modified: 21:42:52 10.04.2009
Accessed: 07:55:22 22.01.2011

Description: Microsoft Kernel DRM Descrambler Filter
Company name: Microsoft Corporation
Size: 130048 Attrs: ----a

Created: 11:37:13 03.11.2010
Modified: 21:53:04 18.01.2008
Accessed: 07:55:15 22.01.2011

Description: Anti-Rootkit Engine
Company name: Sunbelt Software
Size: 98392 Attrs: ----a

Created: 23:41:06 18.03.2011
Modified: 13:56:12 09.11.2010
Accessed: 23:41:06 18.03.2011

Description: Hid Parsing Library
Company name: Microsoft Corporation
Size: 25472 Attrs: ----a

Created: 11:37:03 03.11.2010
Modified: 20:53:18 18.01.2008
Accessed: 07:55:18 22.01.2011

Description: VGA/Super VGA Video Driver
Company name: Microsoft Corporation
Size: 25088 Attrs: ----a

Created: 11:36:50 03.11.2010
Modified: 20:52:08 18.01.2008
Accessed: 07:55:26 22.01.2011

Module	Type	Number	Name	Base Value	Current Value	Driver	State
C:\Windows\system32\ntkrnlpa.exe	Code Modification (3 bytes)	-	PAGE +0x10A9B2	0x81D54000	-
C:\Windows\system32\ntkrnlpa.exe	Code Modification (4 bytes)	-	PAGE +0x1043DC	0x81D54000	-
C:\Windows\system32\ntkrnlpa.exe	Code Modification (4 bytes)	-	PAGE +0x0D2E55	0x81D54000	-
C:\Windows\system32\ntkrnlpa.exe	Code Modification (6 bytes)	-	.text +0x02A328	0x81C1C000	-
C:\Windows\system32\ntkrnlpa.exe	SSDT	383	NtCreateUserProcess	0x81DE4B82	0x8BB1FBF0	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	358	NtWriteVirtualMemory	0x81E284D9	0x8BE232AA	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	Code Modification - Relative Jump	-	NtTraceEvent +0x0000	0x81C46326	0x934B9C00
C:\Windows\system32\ntkrnlpa.exe	SSDT	335	NtTerminateThread	0x81E370CF	0x8BB1F560	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	334	NtTerminateProcess	0x81E0BD5D	0x8BE23BAE	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	324	NtSetValueKey	0x81DF9022	0x8BE23EC2	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	317	NtSetSystemInformation	0x81E01B16	0x8BE237A0	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	289	NtSetContextThread	0x81EAD253	0x8BE23378	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	286	NtSecureConnectPort	0x81DE8680	0x8BE2441C	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	282	NtResumeThread	0x81E366E5	0x8BB1FB40	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	Code Modification - Relative Jump	-	NtRequestWaitReplyPort +0x0002	0x81E5E9AE	0x934B9D40
C:\Windows\system32\ntkrnlpa.exe	Code Modification - Relative Jump	-	NtRequestPort +0x0002	0x81E26E52	0x934B9CA0
C:\Windows\system32\ntkrnlpa.exe	SSDT	255	NtQueueApcThread	0x81DCC813	0x8BE238BE	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	210	NtProtectVirtualMemory	0x81E34E7D	0x8BE24484	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	201	NtOpenThread	0x81E3709A	0x8BE239E0	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	197	NtOpenSection	0x81E2C219	0x8BE23A96	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	194	NtOpenProcess	0x81E3BB48	0x8BE23930	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	189	NtOpenKey	0x81E23243	0x8BE23FC2	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	186	NtOpenFile	0x81E20F99	0x8BE242EE	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	177	NtMapViewOfSection	0x81E2B446	0x8BE233E6	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	165	NtLoadDriver	0x81D86DF0	0x8BE23644	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	127	NtDeviceIoControlFile	0x81E62EE6	0x8BE24562	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	126	NtDeleteValueKey	0x81DC8C74	0x8BE23CC8	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	123	NtDeleteKey	0x81DCD6D3	0x8BE23DF6	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	116	NtDebugActiveProcess	0x81E7F6EA	0x8BB1DDB0	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	78	NtCreateThread	0x81EAC580	0x8BE2380E	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	77	NtCreateSymbolicLinkObject	0x81DDB306	0x8BE244C4	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	71	NtCreatePort	0x81DA0A40	0x8BB20390	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	64	NtCreateKey	0x81E09D5D	0x8BB1E2F0	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	60	NtCreateFile	0x81E5CD59	0x8BE24008	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	SSDT	54	NtConnectPort	0x81DE8AA7	0x8BB20070	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\system32\ntkrnlpa.exe	Code Modification - Relative Jump	-	NtAlpcSendWaitReceivePort +0x0002	0x81E583D9	0x934B9DE0
C:\Windows\system32\ntkrnlpa.exe	SSDT	12	NtAdjustPrivilegesToken	0x81E0B26F	0x8BB1E650	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\System32\win32k.sys	Code Modification (4 bytes)	-	.text +0x128FB0	0x91281000	-
C:\Windows\System32\win32k.sys	Code Modification - Ret	-	.text +0x11BCF7	0x91281000	-
C:\Windows\System32\win32k.sys	Code Modification (4 bytes)	-	.text +0x0F90FB	0x91281000	-
C:\Windows\System32\win32k.sys	Code Modification (5 bytes)	-	.text +0x0D5541	0x91281000	-
C:\Windows\System32\win32k.sys	Code Modification (4 bytes)	-	.text +0x0BE030	0x91281000	-
C:\Windows\System32\win32k.sys	Code Modification (4 bytes)	-	.text +0x0BCDA6	0x91281000	-
C:\Windows\System32\win32k.sys	Code Modification (3 bytes)	-	.text +0x0A5AFE	0x91281000	-
C:\Windows\System32\win32k.sys	Code Modification (4 bytes)	-	.text +0x09C6D0	0x91281000	-
C:\Windows\System32\win32k.sys	Code Modification (4 bytes)	-	.text +0x0988D2	0x91281000	-
C:\Windows\System32\win32k.sys	Code Modification (6 bytes)	-	.text +0x091F07	0x91281000	-
C:\Windows\System32\win32k.sys	Code Modification (5 bytes)	-	.text +0x0517E7	0x91281000	-
C:\Windows\System32\win32k.sys	Code Modification (6 bytes)	-	.text +0x04EC92	0x91281000	-
C:\Windows\System32\win32k.sys	Code Modification (4 bytes)	-	.text +0x0411DF	0x91281000	-
C:\Windows\System32\win32k.sys	Code Modification - Relative Jump	-	NtUserSystemParametersInfo +0x0000	0x91326AFC	0x934B9A20
C:\Windows\System32\win32k.sys	Code Modification - Relative Jump	-	NtUserShowWindow +0x0002	0x912D27E4	0x934B9700
C:\Windows\System32\win32k.sys	Code Modification - Relative Jump	-	NtUserSetWinEventHook +0x0002	0x912C21DC	0x934B9980
C:\Windows\System32\win32k.sys	Shadow SSDT	576	NtUserSetWinEventHook	0x912C21DC	0x8BB1CEB0	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\System32\win32k.sys	Code Modification - Relative Jump	-	NtUserSetWindowsHookEx +0x0000	0x91312F05	0x934B98E0
C:\Windows\System32\win32k.sys	Shadow SSDT	573	NtUserSetWindowsHookEx	0x91312F05	0x8BB1CDD0	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\System32\win32k.sys	Code Modification - Relative Jump	-	NtUserSetSystemCursor +0x0002	0x913A9FAD	0x934B9B60
C:\Windows\System32\win32k.sys	Code Modification - Relative Jump	-	NtUserSetSysColors +0x0000	0x9135653F	0x934B9AC0
C:\Windows\System32\win32k.sys	Shadow SSDT	532	NtUserSetClipboardViewer	0x91374939	0x8BE22F06	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\System32\win32k.sys	Code Modification - Relative Jump	-	NtUserSendInput +0x0000	0x9139CCF5	0x934B97A0
C:\Windows\System32\win32k.sys	Shadow SSDT	525	NtUserSendInput	0x9139CCF5	0x8BB1D880	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\System32\win32k.sys	Shadow SSDT	513	NtUserRegisterRawInputDevices	0x9129FC70	0x8BB1D580	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\System32\win32k.sys	Code Modification - Relative Jump	-	NtUserPostThreadMessage +0x0002	0x9131D6CD	0x934B9520
C:\Windows\System32\win32k.sys	Shadow SSDT	498	NtUserPostThreadMessage	0x9131D6CD	0x8BB1D300	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\System32\win32k.sys	Code Modification - Relative Jump	-	NtUserPostMessage +0x0002	0x9133F02D	0x934B9480
C:\Windows\System32\win32k.sys	Shadow SSDT	497	NtUserPostMessage	0x9133F02D	0x8BB1D180	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\System32\win32k.sys	Code Modification - Relative Jump	-	NtUserMessageCall +0x0002	0x9133DDA3	0x934B93E0
C:\Windows\System32\win32k.sys	Shadow SSDT	479	NtUserMessageCall	0x9133DDA3	0x8BB1CFF0	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\System32\win32k.sys	Shadow SSDT	430	NtUserGetKeyState	0x91340E5A	0x8BB1D6E0	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\System32\win32k.sys	Shadow SSDT	401	NtUserGetClassInfoEx	0x9131DBA8	0x8BE231EC	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\System32\win32k.sys	Shadow SSDT	397	NtUserGetAsyncKeyState	0x912AFDAA	0x8BB1D7B0	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\System32\win32k.sys	Code Modification - Relative Jump	-	NtUserDestroyWindow +0x0002	0x913198CF	0x934B9660
C:\Windows\System32\win32k.sys	Code Modification - Relative Jump	-	NtUserCallHwndParamLock +0x0002	0x912CFC8F	0x934B95C0
C:\Windows\System32\win32k.sys	Code Modification - Relative Jump	-	NtUserBlockInput +0x0002	0x9137A0F8	0x934B9840
C:\Windows\System32\win32k.sys	Shadow SSDT	317	NtUserAttachThreadInput	0x91396C3C	0x8BB1D470	C:\Windows\system32\DRIVERS\pwipf6.sys	Signed
C:\Windows\System32\win32k.sys	Shadow SSDT	307	NtGdiTransparentBlt	0x912B9B7B	0x8BE22D8C	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\System32\win32k.sys	Shadow SSDT	301	NtGdiStretchBlt	0x91344EEB	0x8BE22BDE	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\System32\win32k.sys	Shadow SSDT	245	NtGdiPlgBlt	0x9137DC27	0x8BE22D0E	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\System32\win32k.sys	Shadow SSDT	241	NtGdiOpenDCW	0x913105C2	0x8BE22AB8	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\System32\win32k.sys	Shadow SSDT	235	NtGdiMaskBlt	0x912B8DB0	0x8BE22C76	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\System32\win32k.sys	Shadow SSDT	198	NtGdiGetPixel	0x912C30F1	0x8BE22E88	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\System32\win32k.sys	Shadow SSDT	124	NtGdiDeleteObjectApp	0x9134B583	0x8BE22A9E	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\System32\win32k.sys	Shadow SSDT	13	NtGdiBitBlt	0x9134EC59	0x8BE22B46	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
C:\Windows\System32\win32k.sys	Shadow SSDT	7	NtGdiAlphaBlend	0x91323C34	0x8BE22E0A	C:\Program Files\AntiLogger\AntiLog32.sys	Signed
Total:

Type	Current Address	Driver	Addition	State
Registry Callback	0x8BE2138E	C:\Program Files\AntiLogger\AntiLog32.sys		Signed
LoadImage	0x8633D3D8	Vba32 AntiRootKit Handler		VBA32
LoadImage	0x948157D8	C:\Program Files\Sandboxie\SbieDrv.sys		Signed
LoadImage	0x8BE21312	C:\Program Files\AntiLogger\AntiLog32.sys		Signed
LoadImage	0x81E3982B	C:\Windows\system32\ntkrnlpa.exe		Signed
CreateThread	0x8BB1AB80	C:\Windows\system32\DRIVERS\pwipf6.sys		Signed
CreateProcess	0x95CD3C4A	C:\Windows\system32\drivers\peauth.sys		Signed
CreateProcess	0x9481569A	C:\Program Files\Sandboxie\SbieDrv.sys		Signed
CreateProcess	0x8BE21208	C:\Program Files\AntiLogger\AntiLog32.sys		Signed
CreateProcess	0x8BB1B270	C:\Windows\system32\DRIVERS\pwipf6.sys		Signed
CreateProcess	0x80535B47	C:\Windows\system32\CI.dll		Signed
CreateProcess	0x872553EE	C:\Windows\System32\drivers\tcpip.sys		Signed
CreateProcess	0x807C5F8E	C:\Windows\System32\Drivers\ksecdd.sys		Signed
CreateProcess	0x81C442DD	C:\Windows\system32\ntkrnlpa.exe		Signed
SeFileSystem	0x8BF11B5A	C:\Windows\system32\drivers\luafv.sys		Signed
Shutdown	0x81C439D2	C:\Windows\system32\ntkrnlpa.exe	DeviceObject = 0x839686B8	Signed
Shutdown	0x81EAFFE4	C:\Windows\system32\ntkrnlpa.exe	DeviceObject = 0x846D1B98	Signed
Shutdown	0x8071663A	C:\Windows\System32\drivers\mountmgr.sys	DeviceObject = 0x847154E8	Signed
Shutdown	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	DeviceObject = 0x8553CAE8	Signed
Shutdown	0x8B42955E	C:\Windows\system32\DRIVERS\usbhub.sys	DeviceObject = 0x85488028	Signed
Shutdown	0x8B42955E	C:\Windows\system32\DRIVERS\usbhub.sys	DeviceObject = 0x85464028	Signed
Shutdown	0x8B42955E	C:\Windows\system32\DRIVERS\usbhub.sys	DeviceObject = 0x8547A028	Signed
Shutdown	0x8B42955E	C:\Windows\system32\DRIVERS\usbhub.sys	DeviceObject = 0x85555028	Signed
Shutdown	0x8B42955E	C:\Windows\system32\DRIVERS\usbhub.sys	DeviceObject = 0x85588028	Signed
Shutdown	0x8B42955E	C:\Windows\system32\DRIVERS\usbhub.sys	DeviceObject = 0x855F8028	Signed
Shutdown	0x8BA0910D	C:\Windows\System32\drivers\VIDEOPRT.SYS	DeviceObject = 0x857C7040	Signed
Shutdown	0x8BA0910D	C:\Windows\System32\drivers\VIDEOPRT.SYS	DeviceObject = 0x857C5840	Signed
Shutdown	0x8BA0910D	C:\Windows\System32\drivers\VIDEOPRT.SYS	DeviceObject = 0x857C7C48	Signed
LastChanceShutdown	0x806A8B84	C:\Windows\system32\drivers\volmgr.sys	DeviceObject = 0x84715C20	Signed
LastChanceShutdown	0x8B5CCADC	C:\Windows\system32\drivers\SBREdrv.sys	DeviceObject = 0x857423F0	Signed
BugCheckReason	0x8072F0C2	C:\Windows\system32\drivers\ataport.SYS	CallbackRecord = 0x8073B0C0	Signed
BugCheckReason	0x80580A31	C:\Windows\system32\drivers\Wdf01000.sys	CallbackRecord = 0x83D7A264	Signed
BugCheckReason	0x80580A31	C:\Windows\system32\drivers\Wdf01000.sys	CallbackRecord = 0x8546AFB4	Signed
BugCheckReason	0x8AD3A0B8	C:\Windows\System32\drivers\dxgkrnl.sys	CallbackRecord = 0x8AD472E4	Signed
BugCheckReason	0x8739A4CC	C:\Windows\system32\DRIVERS\USBPORT.SYS	CallbackRecord = 0x8546E5B8	Signed
BugCheckReason	0x8739A526	C:\Windows\system32\DRIVERS\USBPORT.SYS	CallbackRecord = 0x8549CED0	Signed
BugCheckReason	0x8739A46F	C:\Windows\system32\DRIVERS\USBPORT.SYS	CallbackRecord = 0x85469070	Signed
BugCheckReason	0x8B0724FF	C:\Windows\system32\DRIVERS\HDAudBus.sys	CallbackRecord = 0x8547E7CC	Signed
BugCheckReason	0x80580A31	C:\Windows\system32\drivers\Wdf01000.sys	CallbackRecord = 0x854C089C	Signed
BugCheckReason	0x80580A31	C:\Windows\system32\drivers\Wdf01000.sys	CallbackRecord = 0x855007F4	Signed
BugCheckReason	0x8B003E06	C:\Windows\system32\DRIVERS\mssmbios.sys	CallbackRecord = 0x8B0074E0	Signed
BugCheckReason	0x8B003E4E	C:\Windows\system32\DRIVERS\mssmbios.sys	CallbackRecord = 0x8B0074A0	Signed
BugCheckReason	0x8B003E9E	C:\Windows\system32\DRIVERS\mssmbios.sys	CallbackRecord = 0x8B007480	Signed
BugCheckReason	0x8B003EE6	C:\Windows\system32\DRIVERS\mssmbios.sys	CallbackRecord = 0x8B0074C0	Signed
BugCheckReason	0x80580A31	C:\Windows\system32\drivers\Wdf01000.sys	CallbackRecord = 0x854FFFB4	Signed
BugCheckReason	0x8B4295B0	C:\Windows\system32\DRIVERS\usbhub.sys	CallbackRecord = 0x85529730	Signed
BugCheckReason	0x8B429605	C:\Windows\system32\DRIVERS\usbhub.sys	CallbackRecord = 0x855288D8	Signed
BugCheckReason	0x8BA03FB7	C:\Windows\System32\drivers\VIDEOPRT.SYS	CallbackRecord = 0x8BA07100	Signed
BugCheckReason	0x80580A31	C:\Windows\system32\drivers\Wdf01000.sys	CallbackRecord = 0x8587AD7C	Signed
BugCheckReason	0x80580A31	C:\Windows\system32\drivers\Wdf01000.sys	CallbackRecord = 0x859BAA94	Signed
BugCheckReason	0x80580A31	C:\Windows\system32\drivers\Wdf01000.sys	CallbackRecord = 0x860E4DAC	Signed
BugCheck	0x81FE1F60	C:\Windows\system32\hal.dll	CallbackRecord = 0x81FEEE60	Signed
BugCheck	0x82240D2F	C:\Windows\system32\drivers\ndis.sys	CallbackRecord = 0x8547172C	Signed
BugCheck	0x82240D2F	C:\Windows\system32\drivers\ndis.sys	CallbackRecord = 0x8547072C	Signed
BugCheck	0x82240D2F	C:\Windows\system32\drivers\ndis.sys	CallbackRecord = 0x8549372C	Signed
Total:

Short Name	Modules	Create Time	Read Operation Count	Debug Port
PID	Handles	Exit Time	Write Operation Count	Full Path
Parent PID	PEB	Peak Virtual Size	Other Operation Count	Anomalies
Eprocess	Base Priority	Virtual Size	Read Transfer Count	State
Session Id	Priority Class	Peak Working Set Size	Write Transfer Count
User Name	Kernel Time	Working Set Size	Other Transfer Count
Threads	User Time	Page Fault Count	Job

Short Name	PID	Parent PID	Eprocess	Session Id	User Name	Threads	Modules	Handles	PEB	Base Priority	Priority Class	Kernel Time	User Time	Create Time	Exit Time	Peak Virtual Size	Virtual Size	Peak Working Set Size	Working Set Size	Page Fault Count	Read Operation Count	Write Operation Count	Other Operation Count	Read Transfer Count	Write Transfer count	Other Transfer Count	Job	Full Path	Anomalies	State
System	4	0	0x83973910		NT AUTHORITY\SYSTEM	109	156	919		8	Normal	0:00:03.837	0:00:00.000	18:09:13 19.03.2011		10.69 Mb	6.96 Mb	9.61 Mb	4.03 Mb	25521	107	18249	8622	1.61 Mb	91.30 Mb	1003.23 Kb			No corresponding start module ( Start Address = 0x8399A214 ): Thread = 0x8399A020 (TID: 72) No corresponding start module ( Start Address = 0x92DB71C0 ): Thread = 0x839992D8 (TID: 68) No corresponding start module ( Start Address = 0x8CD9D628 ): Thread = 0x83999580 (TID: 64) No corresponding start module ( Start Address = 0x83999CC4 ): Thread = 0x83999AD0 (TID: 56) No corresponding start module ( Start Address = 0x94570C00 ): Thread = 0x83999D78 (TID: 52) No corresponding start module ( Start Address = 0x83999214 ): Thread = 0x83999020 (TID: 48) No corresponding start module ( Start Address = 0x87C72128 ): Thread = 0x83973668 (TID: 8)	Anomaly detected
svchost.exe	328	624	0x860DA480	0	NT AUTHORITY\LOCAL SERVICE	2	25	57	0x7FFDE000	8	Normal	0:00:00.000	0:00:00.000	18:09:35 19.03.2011		31.22 Mb	31.05 Mb	2.92 Mb	2.41 Mb	899	5	5	371	0.35 Kb	0.37 Kb	0.86 Kb		C:\Windows\System32\svchost.exe Description: Host Process for Windows Services Company name: Microsoft Corporation Size: 21504 Attrs: ----a Created: 11:36:51 03.11.2010 Modified: 22:33:34 18.01.2008 Accessed: 07:57:36 22.01.2011		Signed
svchost.exe	448	624	0x86044AC0	0	NT AUTHORITY\LOCAL SERVICE	8	48	143	0x7FFDA000	8	Normal	0:00:00.000	0:00:00.000	18:09:36 19.03.2011		57.30 Mb	56.55 Mb	5.85 Mb	4.46 Mb	1645	6	6	300	0.42 Kb	0.48 Kb	2.39 Kb		C:\Windows\System32\svchost.exe Description: Host Process for Windows Services Company name: Microsoft Corporation Size: 21504 Attrs: ----a Created: 11:36:51 03.11.2010 Modified: 22:33:34 18.01.2008 Accessed: 07:57:36 22.01.2011		Signed
smss.exe	456	4	0x855EDAA0		NT AUTHORITY\SYSTEM	4	2	28	0x7FFDF000	11	Normal	0:00:00.000	0:00:00.000	18:09:13 19.03.2011		14.68 Mb	4.36 Mb	732.00 Kb	584.00 Kb	265	10	8	355	4.53 Kb	0.90 Kb	9.09 Kb		C:\Windows\System32\smss.exe Description: Windows Session Manager Company name: Microsoft Corporation Size: 64000 Attrs: ----a Created: 12:14:07 03.11.2010 Modified: 23:28:06 10.04.2009 Accessed: 07:57:10 22.01.2011		Signed
svchost.exe	480	624	0x860F6B88	0	NT AUTHORITY\LOCAL SERVICE	2	24	53	0x7FFD6000	8	Normal	0:00:00.000	0:00:00.000	18:09:35 19.03.2011		23.06 Mb	23.06 Mb	2.71 Mb	2.25 Mb	694	5	5	71	0.35 Kb	0.37 Kb	0.86 Kb		C:\Windows\System32\svchost.exe Description: Host Process for Windows Services Company name: Microsoft Corporation Size: 21504 Attrs: ----a Created: 11:36:51 03.11.2010 Modified: 22:33:34 18.01.2008 Accessed: 07:57:36 22.01.2011		Signed
svchost.exe	492	624	0x860F1020	0	NT AUTHORITY\NETWORK SERVICE	6	44	127	0x7FFDF000	8	Normal	0:00:00.000	0:00:00.000	18:09:35 19.03.2011		41.18 Mb	40.68 Mb	5.05 Mb	4.23 Mb	1500	11	11	1269	0.88 Kb	1.05 Kb	23.03 Kb		C:\Windows\System32\svchost.exe Description: Host Process for Windows Services Company name: Microsoft Corporation Size: 21504 Attrs: ----a Created: 11:36:51 03.11.2010 Modified: 22:33:34 18.01.2008 Accessed: 07:57:36 22.01.2011		Signed
ReflectService.exe	504	624	0x860EF6A8	0	NT AUTHORITY\SYSTEM	2	33	74	0x7FFD6000	8	Normal	0:00:00.000	0:00:00.000	18:09:35 19.03.2011		41.69 Mb	40.51 Mb	3.81 Mb	3.43 Mb	985	4	4	190	0.25 Kb	0.25 Kb	5.91 Kb		C:\Program Files\Macrium\Reflect\ReflectService.exe Description: Reflect Service - Enables mounting of images Company name: Size: 220128 Attrs: ----a Created: 14:02:58 28.09.2010 Modified: 14:02:58 28.09.2010 Accessed: 12:58:20 03.11.2010		Signed
SnareCore.exe	512	624	0x86103B88	0	NT AUTHORITY\SYSTEM	7	34	118	0x7FFDC000	8	Normal	0:00:00.748	0:00:08.314	18:09:35 19.03.2011		61.24 Mb	58.17 Mb	12.17 Mb	6.04 Mb	12114	5	5	663	0.32 Kb	0.37 Kb	165.33 Kb		C:\Program Files\Snare\SnareCore.exe Description: SNARE Service Company name: InterSect Alliance Pty Ltd Size: 282624 Attrs: ----a Created: 14:17:48 02.02.2011 Modified: 10:42:12 03.12.2010 Accessed: 14:17:48 02.02.2011
csrss.exe	524	512	0x85BE0D90	0	NT AUTHORITY\SYSTEM	10	33	943	0x7FFD9000	13	Normal	0:00:01.872	0:00:00.000	18:09:25 19.03.2011		112.03 Mb	93.64 Mb	5.07 Mb	4.63 Mb	3247	186	0	1593	3.36 Mb	0.00 Kb	29.28 Kb		C:\Windows\System32\csrss.exe Description: Client Server Runtime Process Company name: Microsoft Corporation Size: 6144 Attrs: ----a Created: 11:37:16 03.11.2010 Modified: 22:33:06 18.01.2008 Accessed: 07:50:25 22.01.2011		Signed
wininit.exe	580	512	0x85A0ED90	0	NT AUTHORITY\SYSTEM	5	28	103	0x7FFD4000	13	High	0:00:00.156	0:00:00.015	18:09:28 19.03.2011		57.18 Mb	45.55 Mb	4.00 Mb	3.31 Mb	1627	2	1	3180	6.09 Kb	0.11 Kb	625.70 Kb		C:\Windows\System32\wininit.exe Description: Windows Start-Up Application Company name: Microsoft Corporation Size: 96768 Attrs: ----a Created: 11:37:00 03.11.2010 Modified: 22:33:38 18.01.2008 Accessed: 07:58:15 22.01.2011		Signed
csrss.exe	592	572	0x85A0DD90	1	NT AUTHORITY\SYSTEM	11	35	521	0x7FFDF000	13	Normal	0:00:00.421	0:00:00.000	18:09:28 19.03.2011		169.56 Mb	114.32 Mb	10.48 Mb	9.12 Mb	11309	4417	0	2513	683.59 Kb	0.00 Kb	22.18 Kb		C:\Windows\System32\csrss.exe Description: Client Server Runtime Process Company name: Microsoft Corporation Size: 6144 Attrs: ----a Created: 11:37:16 03.11.2010 Modified: 22:33:06 18.01.2008 Accessed: 07:50:25 22.01.2011		Signed
services.exe	624	580	0x85D310A8	0	NT AUTHORITY\SYSTEM	27	34	268	0x7FFD3000	9	Normal	0:00:02.074	0:00:00.296	18:09:28 19.03.2011		43.67 Mb	36.56 Mb	6.29 Mb	5.36 Mb	3643	83	20	4205	6.80 Kb	53.25 Kb	636.18 Kb		C:\Windows\System32\services.exe Description: Services and Controller app Company name: Microsoft Corporation Size: 279552 Attrs: ----a Created: 12:14:29 03.11.2010 Modified: 23:28:00 10.04.2009 Accessed: 07:57:05 22.01.2011		Signed
lsass.exe	640	580	0x85DBF680	0	NT AUTHORITY\SYSTEM	19	68	582	0x7FFD6000	9	Normal	0:00:00.904	0:00:00.702	18:09:28 19.03.2011		50.56 Mb	49.05 Mb	8.17 Mb	1.02 Mb	3005	10083	9699	18676	562.08 Kb	926.08 Kb	264.12 Kb		C:\Windows\System32\lsass.exe Description: Local Security Authority Process Company name: Microsoft Corporation Size: 9728 Attrs: ----a Created: 11:37:32 03.11.2010 Modified: 22:33:16 18.01.2008 Accessed: 07:55:55 22.01.2011		Signed
lsm.exe	652	580	0x85DB6020	0	NT AUTHORITY\SYSTEM	14	33	204	0x7FFDF000	8	Normal	0:00:00.031	0:00:00.015	18:09:28 19.03.2011		34.22 Mb	33.47 Mb	4.68 Mb	3.75 Mb	1339	2	2	158	0.16 Kb	0.18 Kb	0.92 Kb		C:\Windows\System32\lsm.exe Description: Local Session Manager Service Company name: Microsoft Corporation Size: 229888 Attrs: ----a Created: 11:37:32 03.11.2010 Modified: 22:33:16 18.01.2008 Accessed: 07:55:55 22.01.2011		Signed
winlogon.exe	680	572	0x85DC4B60	1	NT AUTHORITY\SYSTEM	8	32	125	0x7FFDA000	13	High	0:00:00.296	0:00:00.109	18:09:28 19.03.2011		58.57 Mb	42.61 Mb	6.34 Mb	4.23 Mb	2518	6	2	2661	11.80 Kb	0.18 Kb	18.22 Kb		C:\Windows\System32\winlogon.exe Description: Windows Logon Application Company name: Microsoft Corporation Size: 314368 Attrs: ----a Created: 12:14:09 03.11.2010 Modified: 23:28:14 10.04.2009 Accessed: 07:58:15 22.01.2011		Signed
svchost.exe	836	624	0x85D8C878	0	NT AUTHORITY\SYSTEM	13	42	298	0x7FFD7000	8	Normal	0:00:01.528	0:00:00.748	18:09:29 19.03.2011		45.04 Mb	41.13 Mb	5.74 Mb	4.68 Mb	4566	14	14	2261	0.92 Kb	0.82 Kb	2.68 Mb		C:\Windows\System32\svchost.exe Description: Host Process for Windows Services Company name: Microsoft Corporation Size: 21504 Attrs: ----a Created: 11:36:51 03.11.2010 Modified: 22:33:34 18.01.2008 Accessed: 07:57:36 22.01.2011		Signed
a2service.exe	880	624	0x85ECA4D0	0	NT AUTHORITY\SYSTEM	21	59	156	0x7FFDA000	8	Normal	0:00:00.000	0:00:00.000	18:09:29 19.03.2011		305.07 Mb	299.15 Mb	149.29 Mb	980.00 Kb	128730	40452	15	4174	68.11 Mb	1.50 Kb	91.87 Kb		C:\Program Files\Emsisoft Anti-Malware\a2service.exe Description: Emsisoft Anti-Malware Service Company name: Emsi Software GmbH Size: 2855440 Attrs: ----a Created: 12:26:36 04.03.2011 Modified: 12:36:27 04.03.2011 Accessed: 12:36:27 04.03.2011		Signed
svchost.exe	988	624	0x85F38570	0	NT AUTHORITY\NETWORK SERVICE	18	36	271	0x7FFDF000	8	Normal	0:00:00.202	0:00:00.202	18:09:30 19.03.2011		40.07 Mb	39.82 Mb	5.63 Mb	4.71 Mb	1729	8	8	1146	0.59 Kb	0.71 Kb	18.65 Kb		C:\Windows\System32\svchost.exe Description: Host Process for Windows Services Company name: Microsoft Corporation Size: 21504 Attrs: ----a Created: 11:36:51 03.11.2010 Modified: 22:33:34 18.01.2008 Accessed: 07:57:36 22.01.2011		Signed
svchost.exe	1024	624	0x85EF3D90	0	NT AUTHORITY\SYSTEM	130	55	431	0x7FFDD000	8	Normal	0:00:01.622	0:00:03.931	18:09:30 19.03.2011		68.47 Mb	63.99 Mb	12.07 Mb	7.62 Mb	30905	1115	26	10784	36.15 Mb	2.59 Kb	211.29 Kb		C:\Windows\System32\svchost.exe Description: Host Process for Windows Services Company name: Microsoft Corporation Size: 21504 Attrs: ----a Created: 11:36:51 03.11.2010 Modified: 22:33:34 18.01.2008 Accessed: 07:57:36 22.01.2011		Signed
TNaviSrv.exe	1088	624	0x86110D90	0	NT AUTHORITY\SYSTEM	3	21	46	0x7FFDF000	8	Normal	0:00:00.000	0:00:00.000	18:09:36 19.03.2011		39.41 Mb	38.41 Mb	3.19 Mb	2.69 Mb	865	2	2	88	0.06 Kb	0.03 Kb	0.50 Kb		C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe Description: TOSHIBA Navi Support Service Company name: TOSHIBA Corporation Size: 77824 Attrs: ----a Created: 15:59:52 22.08.2007 Modified: 17:39:18 01.08.2007 Accessed: 07:09:39 22.01.2011
Ati2evxx.exe	1124	624	0x85EF4020	0	NT AUTHORITY\SYSTEM	6	29	113	0x7FFDB000	8	Normal	0:00:00.000	0:00:00.015	18:09:30 19.03.2011		36.05 Mb	34.85 Mb	3.72 Mb	2.93 Mb	975	20	20	191	16.17 Kb	1.18 Kb	1.98 Kb		C:\Windows\System32\Ati2evxx.exe Description: ATI External Event Utility EXE Module Company name: ATI Technologies Inc. Size: 610304 Attrs: ----a Created: 02:24:46 28.07.2007 Modified: 02:24:46 28.07.2007 Accessed: 07:49:41 22.01.2011		Signed
svchost.exe	1144	624	0x85F50850	0	NT AUTHORITY\LOCAL SERVICE	43	82	371	0x7FFD4000	8	Normal	0:00:09.640	0:00:06.708	18:09:30 19.03.2011		86.22 Mb	75.01 Mb	12.14 Mb	10.46 Mb	190230	1025	429	84126	8.18 Mb	3.79 Mb	67.19 Kb		C:\Windows\System32\svchost.exe Description: Host Process for Windows Services Company name: Microsoft Corporation Size: 21504 Attrs: ----a Created: 11:36:51 03.11.2010 Modified: 22:33:34 18.01.2008 Accessed: 07:57:36 22.01.2011	Hidden module: [0x757B0000-0x757EFFFF] C:\Windows\System32\wevtapi.dll Hidden module: [0x73DE0000-0x73E6EFFF] C:\Windows\System32\gpsvc.dll Hidden module: [0x73D70000-0x73D98FFF] C:\Windows\System32\profsvc.dll Hidden module: [0x736C0000-0x736EFFFF] C:\Windows\System32\WUDFPlatform.dll Hidden module: [0x73520000-0x735A1FFF] C:\Windows\System32\wlansvc.dll Hidden module: [0x731C0000-0x73253FFF] C:\Windows\System32\schedsvc.dll Hidden module: [0x72E50000-0x72E72FFF] C:\Windows\System32\dps.dll Hidden module: [0x72BA0000-0x72C2CFFF] C:\Windows\System32\emdmgmt.dll Hidden module: [0x727D0000-0x728DAFFF] C:\Windows\System32\diagperf.dll Hidden module: [0x69760000-0x6976FFFF] C:\Windows\System32\tbssvc.dll Hidden module: [0x667D0000-0x6698EFFF] C:\Windows\System32\qmgr.dll Hidden module: [0x66620000-0x667C0FFF] C:\Windows\System32\wuaueng.dll Hidden module: [0x4B8C0000-0x4B8D0FFF] C:\Windows\System32\PSHED.DLL Hidden module: [0x28B10000-0x28BEFFFF] C:\Windows\System32\ci.dll Hidden module: [0x01600000-0x0164FFFF] C:\Windows\System32\winlogon.exe Hidden module: [0x00720000-0x00751FFF] C:\Windows\System32\drivers\fltMgr.sys	Signed Anomaly detected
svchost.exe	1168	624	0x85F55D90	0	NT AUTHORITY\SYSTEM	59	102	507	0x7FFD9000	8	Normal	0:00:07.456	0:00:00.374	18:09:30 19.03.2011		145.78 Mb	127.63 Mb	45.89 Mb	39.24 Mb	19647	164	129	55565	22.21 Mb	4.17 Mb	1.31 Mb		C:\Windows\System32\svchost.exe Description: Host Process for Windows Services Company name: Microsoft Corporation Size: 21504 Attrs: ----a Created: 11:36:51 03.11.2010 Modified: 22:33:34 18.01.2008 Accessed: 07:57:36 22.01.2011		Signed
svchost.exe	1216	624	0x85F78628	0	NT AUTHORITY\SYSTEM	111	122	923	0x7FFDB000	8	Normal	0:00:01.201	0:00:01.170	18:09:31 19.03.2011		156.21 Mb	145.73 Mb	20.54 Mb	18.92 Mb	10741	8455	406	10784	64.93 Mb	1.17 Mb	637.14 Kb		C:\Windows\System32\svchost.exe Description: Host Process for Windows Services Company name: Microsoft Corporation Size: 21504 Attrs: ----a Created: 11:36:51 03.11.2010 Modified: 22:33:34 18.01.2008 Accessed: 07:57:36 22.01.2011		Signed
audiodg.exe	1304	1144	0x85FA38A0	0	NT AUTHORITY\LOCAL SERVICE	15	44	105	0x7FFDF000	8	Normal	0:00:00.109	0:00:00.015	18:09:31 19.03.2011		53.14 Mb	48.89 Mb	17.31 Mb	6.94 Mb	5405	22	22	679	1.77 Kb	1.58 Kb	13.39 Kb		C:\Windows\System32\audiodg.exe Description: Windows Audio Device Graph Isolation Company name: Microsoft Corporation Size: 88576 Attrs: ----a Created: 12:14:23 03.11.2010 Modified: 23:27:22 10.04.2009 Accessed: 07:49:43 22.01.2011		Signed
dllhost.exe	1340	836	0x84054020	1	Inyostar\Punymicro	5		0	0x7FFDE000	8	Normal	0:00:00.046	0:00:00.015	18:10:59 19.03.2011	18:11:05 19.03.2011	54.69 Mb	31.22 Mb	4.09 Mb	24.00 Kb	1214	2	1	247	14.99 Kb	0.11 Kb	2.57 Kb		C:\Windows\System32\dllhost.exe Description: COM Surrogate Company name: Microsoft Corporation Size: 7168 Attrs: ----a Created: 03:50:22 02.11.2006 Modified: 04:45:02 02.11.2006 Accessed: 07:50:32 22.01.2011		Zombie process Signed
TODDSrv.exe	1356	624	0x861174C0	0	NT AUTHORITY\SYSTEM	4	24	61	0x7FFD9000	8	Normal	0:00:00.000	0:00:00.000	18:09:36 19.03.2011		38.24 Mb	37.24 Mb	3.46 Mb	2.91 Mb	923	2	2	93	0.06 Kb	0.03 Kb	0.13 Kb		C:\Windows\System32\TODDSrv.exe Description: TDCSrv Application Company name: TOSHIBA Corporation Size: 114688 Attrs: ----a Created: 15:54:43 22.08.2007 Modified: 21:30:16 25.05.2006 Accessed: 07:57:37 22.01.2011
SLsvc.exe	1364	624	0x85FBB020	0	NT AUTHORITY\NETWORK SERVICE	5	24	93	0x7FFDD000	8	Normal	0:00:00.904	0:00:00.873	18:09:31 19.03.2011		51.82 Mb	50.96 Mb	15.14 Mb	3.40 Mb	9914	1206	11	268	2.42 Mb	21.21 Kb	15.13 Kb		C:\Windows\System32\SLsvc.exe Description: Microsoft Software Licensing Service Company name: Microsoft Corporation Size: 3408896 Attrs: ----a Created: 12:14:07 03.11.2010 Modified: 23:27:50 10.04.2009 Accessed: 07:57:09 22.01.2011		Signed
svchost.exe	1428	624	0x86027548	0	NT AUTHORITY\LOCAL SERVICE	41	76	342	0x7FFDF000	8	Normal	0:00:00.078	0:00:00.031	18:09:31 19.03.2011		61.76 Mb	58.93 Mb	8.46 Mb	6.52 Mb	2602	59	30	1647	2.73 Kb	1.79 Kb	24.01 Kb		C:\Windows\System32\svchost.exe Description: Host Process for Windows Services Company name: Microsoft Corporation Size: 21504 Attrs: ----a Created: 11:36:51 03.11.2010 Modified: 22:33:34 18.01.2008 Accessed: 07:57:36 22.01.2011		Signed
TosBtSrv.exe	1492	624	0x86113478	0	NT AUTHORITY\SYSTEM	3	25	74	0x7FFD8000	8	Normal	0:00:00.000	0:00:00.000	18:09:36 19.03.2011		49.23 Mb	46.23 Mb	3.49 Mb	2.96 Mb	899	9	7	131	0.70 Kb	0.19 Kb	1.72 Kb		C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe Description: TOSHIBA Bluetooth Service Company name: TOSHIBA CORPORATION Size: 125048 Attrs: ----a Created: 23:55:18 25.02.2007 Modified: 23:55:18 25.02.2007 Accessed: 07:09:35 22.01.2011		Signed
Ati2evxx.exe	1520	1124	0x85FD9908	1	NT AUTHORITY\SYSTEM	9	36	132	0x7FFDF000	8	Normal	0:00:00.078	0:00:00.078	18:09:31 19.03.2011		58.71 Mb	53.65 Mb	5.82 Mb	4.61 Mb	1669	43	13	1978	7.45 Kb	1.10 Kb	2.97 Kb		C:\Windows\System32\Ati2evxx.exe Description: ATI External Event Utility EXE Module Company name: ATI Technologies Inc. Size: 610304 Attrs: ----a Created: 02:24:46 28.07.2007 Modified: 02:24:46 28.07.2007 Accessed: 07:49:41 22.01.2011		Signed
SbieSvc.exe	1528	624	0x85FDB4A0	0	NT AUTHORITY\SYSTEM	6	36	79	0x7FFD4000	8	Normal	0:00:00.015	0:00:00.000	18:09:32 19.03.2011		35.59 Mb	34.73 Mb	3.66 Mb	2.89 Mb	957	6	6	177	0.42 Kb	0.48 Kb	0.87 Kb		C:\Program Files\Sandboxie\SbieSvc.exe Description: Sandboxie Service Company name: SANDBOXIE L.T.D Size: 69864 Attrs: ----a Created: 09:35:52 12.01.2011 Modified: 09:35:52 12.01.2011 Accessed: 07:13:07 12.12.2010		Signed
pfsvc.exe	1640	624	0x8600B238	0	NT AUTHORITY\SYSTEM	25	40	123	0x7FFD8000	8	Normal	0:00:00.000	0:00:00.000	18:09:32 19.03.2011		84.86 Mb	62.86 Mb	5.83 Mb	4.79 Mb	2023	20	19	1502	11.55 Kb	1.95 Kb	15.18 Kb		C:\Program Files\Privacyware\Privatefirewall 7.0\pfsvc.exe Description: Privatefirewall Network Service Company name: Privacyware/PWI, Inc. Size: 361112 Attrs: ----a Created: 20:43:44 05.01.2011 Modified: 20:43:44 05.01.2011 Accessed: 16:34:12 24.02.2011		Signed
spoolsv.exe	1768	624	0x86055518	0	NT AUTHORITY\SYSTEM	20	94	304	0x7FFDB000	8	Normal	0:00:00.046	0:00:00.015	18:09:33 19.03.2011		96.47 Mb	93.74 Mb	10.61 Mb	6.69 Mb	5122	14	25	4210	1.43 Kb	16.14 Kb	26.64 Kb		C:\Windows\System32\spoolsv.exe Description: Spooler SubSystem App Company name: Microsoft Corporation Size: 127488 Attrs: ----a Created: 12:14:07 03.11.2010 Modified: 23:28:06 10.04.2009 Accessed: 07:49:34 22.01.2011		Signed
svchost.exe	1796	624	0x86040870	0	NT AUTHORITY\LOCAL SERVICE	40	59	299	0x7FFD9000	8	Normal	0:00:00.655	0:00:00.702	18:09:33 19.03.2011		103.04 Mb	71.45 Mb	41.16 Mb	7.93 Mb	20728	893	762	5343	60.16 Mb	3.22 Mb	318.37 Kb		C:\Windows\System32\svchost.exe Description: Host Process for Windows Services Company name: Microsoft Corporation Size: 21504 Attrs: ----a Created: 11:36:51 03.11.2010 Modified: 22:33:34 18.01.2008 Accessed: 07:57:36 22.01.2011		Signed
ULCDRSvr.exe	1856	624	0x86114D68	0	NT AUTHORITY\SYSTEM	2	6	22	0x7FFD6000	8	Normal	0:00:00.000	0:00:00.000	18:09:36 19.03.2011		12.38 Mb	12.38 Mb	1.56 Mb	1.27 Mb	394	2	2	8	0.08 Kb	0.03 Kb	0.00 Kb		C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe Description: ULCDRSvr Company name: Ulead Systems, Inc. Size: 49152 Attrs: ----a Created: 16:15:30 22.08.2007 Modified: 19:39:48 23.08.2006 Accessed: 07:02:56 22.01.2011
agrsmsvc.exe	1940	624	0x86075D90	0	NT AUTHORITY\SYSTEM	2	18	36	0x7FFDB000	8	Normal	0:00:00.000	0:00:00.000	18:09:35 19.03.2011		20.96 Mb	20.96 Mb	2.29 Mb	1.93 Mb	585	2	2	37	0.07 Kb	0.03 Kb	0.00 Kb		C:\Windows\System32\agrsmsvc.exe Description: Agere Soft Modem Call Progress Service Company name: Agere Systems Size: 9216 Attrs: ----a Created: 15:10:12 05.10.2006 Modified: 15:10:12 05.10.2006 Accessed: 07:49:40 22.01.2011		Signed
svchost.exe	1956	624	0x8607A020	0	NT AUTHORITY\NETWORK SERVICE	26	72	316	0x7FFD4000	8	Normal	0:00:00.296	0:00:00.234	18:09:35 19.03.2011		87.55 Mb	86.49 Mb	10.89 Mb	7.98 Mb	4570	60	67	5732	183.24 Kb	50.49 Kb	167.95 Kb		C:\Windows\System32\svchost.exe Description: Host Process for Windows Services Company name: Microsoft Corporation Size: 21504 Attrs: ----a Created: 11:36:51 03.11.2010 Modified: 22:33:34 18.01.2008 Accessed: 07:57:36 22.01.2011		Signed
svchost.exe	1968	624	0x8613ED90	0	NT AUTHORITY\SYSTEM	4	10	46	0x7FFD9000	8	Normal	0:00:00.015	0:00:00.000	18:09:36 19.03.2011		14.91 Mb	14.91 Mb	2.09 Mb	1.81 Mb	547	11	11	129	0.85 Kb	0.96 Kb	2.90 Kb		C:\Windows\System32\svchost.exe Description: Host Process for Windows Services Company name: Microsoft Corporation Size: 21504 Attrs: ----a Created: 11:36:51 03.11.2010 Modified: 22:33:34 18.01.2008 Accessed: 07:57:36 22.01.2011		Signed
PresentationFontCache.exe	1980	624	0x86098B88	0	NT AUTHORITY\LOCAL SERVICE	6	34	130	0x7FFD7000	8	Normal	0:00:00.000	0:00:00.046	18:09:35 19.03.2011		124.74 Mb	122.74 Mb	9.84 Mb	6.06 Mb	2723	18	3	420	1.04 Mb	0.14 Kb	2.34 Kb		C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe Description: PresentationFontCache.exe Company name: Microsoft Corporation Size: 43904 Attrs: ----a Created: 12:14:31 03.11.2010 Modified: 10:39:22 18.02.2009 Accessed: 07:48:15 22.01.2011		Signed
taskeng.exe	2228	1216	0x86176020	0	NT AUTHORITY\SYSTEM	24	25	81	0x7FFDE000	6	Below normal	0:00:00.093	0:00:00.218	18:09:45 19.03.2011		50.71 Mb	46.26 Mb	4.46 Mb	3.75 Mb	2561	26	2	1516	45.34 Kb	0.23 Kb	3.55 Mb		C:\Windows\System32\taskeng.exe Description: Task Scheduler Engine Company name: Microsoft Corporation Size: 169984 Attrs: ----a Created: 12:14:05 03.11.2010 Modified: 23:28:08 10.04.2009 Accessed: 07:57:19 22.01.2011		Signed
dllhost.exe	2404	836	0x8401A020	1	Inyostar\Punymicro	5		0	0x7FFDB000	8	Normal	0:00:00.046	0:00:00.062	18:10:54 19.03.2011	18:10:59 19.03.2011	54.69 Mb	31.47 Mb	4.07 Mb	24.00 Kb	1209	2	1	249	14.98 Kb	0.11 Kb	2.57 Kb		C:\Windows\System32\dllhost.exe Description: COM Surrogate Company name: Microsoft Corporation Size: 7168 Attrs: ----a Created: 03:50:22 02.11.2006 Modified: 04:45:02 02.11.2006 Accessed: 07:50:32 22.01.2011		Zombie process Signed
taskeng.exe	2460	1216	0x86239280	1	Inyostar\Punymicro	17	68	312	0x7FFDF000	8	Normal	0:00:00.140	0:00:00.015	18:09:47 19.03.2011		86.89 Mb	80.49 Mb	9.13 Mb	7.31 Mb	3544	12	2	1441	15.92 Kb	0.23 Kb	31.52 Kb		C:\Windows\System32\taskeng.exe Description: Task Scheduler Engine Company name: Microsoft Corporation Size: 169984 Attrs: ----a Created: 12:14:05 03.11.2010 Modified: 23:28:08 10.04.2009 Accessed: 07:57:19 22.01.2011		Signed
dwm.exe	2508	1168	0x86242A70	1	Inyostar\Punymicro	7	34	123	0x7FFDA000	13	High	0:00:00.015	0:00:00.000	18:09:47 19.03.2011		111.84 Mb	105.61 Mb	40.51 Mb	29.09 Mb	28898	2	2	249	0.18 Kb	0.23 Kb	1.81 Kb		C:\Windows\System32\dwm.exe Description: Desktop Window Manager Company name: Microsoft Corporation Size: 81920 Attrs: ----a Created: 12:14:27 03.11.2010 Modified: 23:27:34 10.04.2009 Accessed: 07:55:10 22.01.2011		Signed
explorer.exe	2612	2420	0x86265B88	1	Inyostar\Punymicro	73	153	654	0x7FFDF000	8	Normal	0:00:02.761	0:00:01.560	18:09:47 19.03.2011		225.13 Mb	219.72 Mb	49.04 Mb	40.30 Mb	37496	1043	147	19008	6.28 Mb	1.88 Mb	2.65 Mb		C:\Windows\explorer.exe Description: Windows Explorer Company name: Microsoft Corporation Size: 2926592 Attrs: ----a Created: 12:14:26 03.11.2010 Modified: 23:27:38 10.04.2009 Accessed: 04:41:01 22.01.2011		Signed
RtHDVCpl.exe	2760	2612	0x862D3020	1	Inyostar\Punymicro	10	49	199	0x7FFDF000	8	Normal	0:00:00.000	0:00:00.000	18:09:49 19.03.2011		95.14 Mb	86.55 Mb	8.59 Mb	4.88 Mb	2680	3	3	1839	0.27 Kb	0.34 Kb	70.41 Kb	0x862A6970	C:\Windows\RtHDVCpl.exe Description: HD Audio Control Panel Company name: Realtek Semiconductor Size: 4702208 Attrs: ----a Created: 15:39:41 22.08.2007 Modified: 22:26:42 09.08.2007 Accessed: 04:41:02 22.01.2011		Signed
SynTPStart.exe	2780	2612	0x862DB778	1	Inyostar\Punymicro	4	25	85	0x7FFDF000	8	Normal	0:00:00.000	0:00:00.000	18:09:49 19.03.2011		62.03 Mb	58.03 Mb	4.65 Mb	4.00 Mb	1326	9	6	509	1.15 Kb	0.68 Kb	9.88 Kb	0x862A6970	C:\Program Files\Synaptics\SynTP\SynTPStart.exe Description: Synaptics Pointing Device starter Company name: Synaptics, Inc. Size: 102400 Attrs: ----a Created: 18:31:50 15.08.2007 Modified: 18:31:50 15.08.2007 Accessed: 07:09:23 22.01.2011		Signed
AntiLogger.exe	2824	2612	0x8626E3F0	1	Inyostar\Punymicro	16	76	295	0x7FFDD000	8	Normal	0:00:00.000	0:00:00.046	18:09:49 19.03.2011		123.45 Mb	119.75 Mb	27.13 Mb	11.93 Mb	32046	1284	47	3502	51.14 Mb	6.06 Kb	66.34 Kb	0x862A6970	C:\Program Files\AntiLogger\AntiLogger.exe Description: Zemana AntiLogger User Interface Company name: Zemana Ltd. Size: 9340872 Attrs: ----a Created: 07:46:48 03.01.2011 Modified: 07:46:48 03.01.2011 Accessed: 11:19:39 02.02.2011		Signed
PFGUI.exe	2832	2612	0x862E0020	1	Inyostar\Punymicro	20	123	471	0x7FFDF000	8	Normal	0:00:00.000	0:00:00.000	18:09:49 19.03.2011		298.50 Mb	213.24 Mb	30.06 Mb	20.88 Mb	31290	924	200	39913	2.04 Mb	480.67 Kb	781.82 Kb	0x862A6970	C:\Program Files\Privacyware\Privatefirewall 7.0\PFGUI.exe Description: Privatefirewall 7.0 Application Company name: Privacyware/PWI, Inc. Size: 2482912 Attrs: ----a Created: 20:43:42 05.01.2011 Modified: 20:43:42 05.01.2011 Accessed: 16:34:12 24.02.2011		Signed
jusched.exe	2840	2612	0x862DD310	1	Inyostar\Punymicro	3	25	51	0x7FFDF000	8	Normal	0:00:00.000	0:00:00.000	18:09:49 19.03.2011		53.41 Mb	52.76 Mb	3.72 Mb	3.18 Mb	3445	0	4	123	0.00 Kb	0.39 Kb	0.83 Kb	0x862A6970	C:\Program Files\Common Files\Java\Java Update\jusched.exe Description: Java(TM) Update Scheduler Company name: Sun Microsystems, Inc. Size: 249064 Attrs: ----a Created: 14:49:28 29.10.2010 Modified: 14:49:28 29.10.2010 Accessed: 05:51:21 16.03.2011		Signed
TOSCDSPD.exe	2856	2612	0x8626ED90	1	Inyostar\Punymicro	2	18	35	0x7FFDC000	8	Normal	0:00:00.000	0:00:00.000	18:09:49 19.03.2011		51.45 Mb	48.45 Mb	3.06 Mb	2.53 Mb	803	0	0	65	0.00 Kb	0.00 Kb	0.59 Kb	0x862A6970	C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe Description: En-us Company name: Size: 430080 Attrs: ----a Created: 15:50:29 22.08.2007 Modified: 06:43:00 18.05.2007 Accessed: 07:09:35 22.01.2011
SbieCtrl.exe	2872	2612	0x862C0278	1	Inyostar\Punymicro	5	34	78	0x7FFD3000	8	Normal	0:00:00.000	0:00:00.000	18:09:49 19.03.2011		76.25 Mb	72.87 Mb	7.46 Mb	5.94 Mb	2100	2	2	5750	0.18 Kb	0.23 Kb	2.20 Kb	0x862A6970	C:\Program Files\Sandboxie\SbieCtrl.exe Description: Sandboxie Control Company name: SANDBOXIE L.T.D Size: 405736 Attrs: ----a Created: 09:35:54 12.01.2011 Modified: 09:35:54 12.01.2011 Accessed: 07:13:07 12.12.2010		Signed
rundll32.exe	2900	2228	0x83F8D3E0	0	NT AUTHORITY\SYSTEM	2		0	0x7FFD7000	6	Below normal	0:00:00.062	0:00:00.031	18:10:45 19.03.2011	18:10:45 19.03.2011	51.55 Mb	45.43 Mb	4.40 Mb	24.00 Kb	1233	0	0	157	0.00 Kb	0.00 Kb	1.84 Kb		C:\Windows\System32\rundll32.exe Description: Windows host process (Rundll32) Company name: Microsoft Corporation Size: 44544 Attrs: ----a Created: 03:48:33 02.11.2006 Modified: 04:45:37 02.11.2006 Accessed: 07:56:45 22.01.2011		Zombie process Signed
rundll32.exe	2960	2228	0x83FC3CA0	0	NT AUTHORITY\SYSTEM	2		0	0x7FFD3000	6	Below normal	0:00:00.031	0:00:00.031	18:10:49 19.03.2011	18:10:49 19.03.2011	51.55 Mb	45.43 Mb	4.39 Mb	24.00 Kb	1230	0	0	157	0.00 Kb	0.00 Kb	1.84 Kb		C:\Windows\System32\rundll32.exe Description: Windows host process (Rundll32) Company name: Microsoft Corporation Size: 44544 Attrs: ----a Created: 03:48:33 02.11.2006 Modified: 04:45:37 02.11.2006 Accessed: 07:56:45 22.01.2011		Zombie process Signed
MOM.exe	3004	2788	0x863095A8	1	Inyostar\Punymicro	20	61	307	0x7FFD6000	8	Normal	0:00:00.062	0:00:00.046	18:09:50 19.03.2011		163.93 Mb	161.93 Mb	15.15 Mb	3.02 Mb	5165	37	19	1463	75.02 Kb	4.57 Kb	325.88 Kb	0x862A6970	C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe Description: Catalyst Control Center: Monitoring program Company name: Advanced Micro Devices Inc. Size: 49152 Attrs: ----a Created: 13:52:10 01.06.2007 Modified: 13:52:10 01.06.2007 Accessed: 07:01:49 22.01.2011	Hidden module: [0x03CC0000-0x03CC9FFF] C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2729.30184__90ba9c70f846762e\NEWAEM.Foundation.DLL Hidden module: [0x03CB0000-0x03CBDFFF] C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.2764.39436__90ba9c70f846762e\AEM.Server.DLL Hidden module: [0x03C20000-0x03C27FFF] C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2729.30211__90ba9c70f846762e\LOG.Foundation.Implementation.Private.DLL Hidden module: [0x03BF0000-0x03BF7FFF] C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.2729.30207__90ba9c70f846762e\MOM.Foundation.DLL Hidden module: [0x03BD0000-0x03BE1FFF] C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.2764.39729__90ba9c70f846762e\LOG.Foundation.Implementation.DLL Hidden module: [0x03BC0000-0x03BCBFFF] C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2729.30188__90ba9c70f846762e\LOG.Foundation.Private.DLL Hidden module: [0x00B00000-0x00B0BFFF] C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.2729.30174__90ba9c70f846762e\LOG.Foundation.DLL Hidden module: [0x009D0000-0x009EBFFF] C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.2764.39730__90ba9c70f846762e\MOM.Implementation.DLL	Anomaly detected
consent.exe	3160	1216	0x83FD05F0	1	NT AUTHORITY\SYSTEM	5		0	0x7FFDF000	13	High	0:00:00.156	0:00:00.109	18:10:49 19.03.2011	18:10:50 19.03.2011	84.59 Mb	56.06 Mb	7.16 Mb	24.00 Kb	2739	24	9	1342	38.42 Kb	0.93 Kb	323.31 Kb		C:\Windows\System32\consent.exe Description: Consent UI for administrative applications Company name: Microsoft Corporation Size: 81920 Attrs: ----a Created: 11:37:14 03.11.2010 Modified: 22:33:06 18.01.2008 Accessed: 07:50:24 22.01.2011		Zombie process Signed
AntiLogger.exe	3216	2824	0x8631E6C8	1	Inyostar\Punymicro	1		0	0x7FFDE000	6	Below normal	0:00:00.062	0:00:00.015	18:09:51 19.03.2011	18:09:51 19.03.2011	78.09 Mb	63.92 Mb	6.22 Mb	24.00 Kb	4830	1	0	269	1.48 Kb	0.00 Kb	3.16 Kb	0x862A6970	C:\Program Files\AntiLogger\AntiLogger.exe Description: Zemana AntiLogger User Interface Company name: Zemana Ltd. Size: 9340872 Attrs: ----a Created: 07:46:48 03.01.2011 Modified: 07:46:48 03.01.2011 Accessed: 11:19:39 02.02.2011		Zombie process Signed
dllhost.exe	3224	836	0x83FF2BB0	0	NT AUTHORITY\SYSTEM	5		0	0x7FFD9000	8	Normal	0:00:00.046	0:00:00.015	18:10:50 19.03.2011	18:10:55 19.03.2011	31.72 Mb	30.22 Mb	3.45 Mb	24.00 Kb	1048	2	1	273	15.73 Kb	0.11 Kb	2.55 Kb		C:\Windows\System32\dllhost.exe Description: COM Surrogate Company name: Microsoft Corporation Size: 7168 Attrs: ----a Created: 03:50:22 02.11.2006 Modified: 04:45:02 02.11.2006 Accessed: 07:50:32 22.01.2011		Zombie process Signed
SynTPEnh.exe	3264	2780	0x8543A5C8	1	Inyostar\Punymicro	6	31	94	0x7FFD8000	10	Above normal	0:00:00.000	0:00:00.000	18:09:51 19.03.2011		62.43 Mb	59.29 Mb	6.25 Mb	3.90 Mb	1778	3	3	697	0.27 Kb	0.34 Kb	14.28 Kb	0x862A6970	C:\Program Files\Synaptics\SynTP\SynTPEnh.exe Description: Synaptics TouchPad Enhancements Company name: Synaptics, Inc. Size: 1021224 Attrs: ----a Created: 20:03:32 15.08.2007 Modified: 20:03:32 15.08.2007 Accessed: 07:09:23 22.01.2011		Signed
CCC.exe	3276	3004	0x86284020	1	Inyostar\Punymicro	73	260	614	0x7FFDA000	8	Normal	0:00:00.358	0:00:00.530	18:09:51 19.03.2011		228.69 Mb	222.67 Mb	39.52 Mb	9.89 Mb	17222	60	48	7195	134.67 Kb	114.68 Kb	95.16 Kb	0x862A6970	C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe Description: Catalyst Control Centre: Host application Company name: ATI Technologies Inc. Size: 49152 Attrs: ----a Created: 13:52:34 01.06.2007 Modified: 13:52:34 01.06.2007 Accessed: 07:01:48 22.01.2011	Hidden module: [0x089E0000-0x08AA3FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.2764.39611__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.DLL Hidden module: [0x08940000-0x089D3FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.2764.39516__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.DLL Hidden module: [0x088E0000-0x08933FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.2764.39676__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.DLL Hidden module: [0x084E0000-0x085BDFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.2764.39711__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.DLL Hidden module: [0x08240000-0x082A5FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.2764.39655__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.DLL Hidden module: [0x081C0000-0x08237FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.2764.39603__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.DLL Hidden module: [0x08020000-0x081BBFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.2764.39489__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.DLL Hidden module: [0x07EC0000-0x07EDFFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.2764.39634__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.DLL Hidden module: [0x07E80000-0x07EB5FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.2764.39509__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.DLL Hidden module: [0x07E00000-0x07E6DFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.2764.39467__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.DLL Hidden module: [0x07DD0000-0x07DF3FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.2764.39752__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.DLL Hidden module: [0x07DC0000-0x07DC7FFF] C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.2729.30241__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.DLL Hidden module: [0x07DA0000-0x07DB5FFF] C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.2764.39459__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.DLL Hidden module: [0x07D90000-0x07D97FFF] C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.2729.30214__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.DLL Hidden module: [0x07C10000-0x07D83FFF] C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.2764.39454__90ba9c70f846762e\CLI.Component.Dashboard.DLL Hidden module: [0x07BB0000-0x07C0BFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.2764.39718__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.DLL Hidden module: [0x07A90000-0x07A97FFF] C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.2729.30199__90ba9c70f846762e\CLI.Component.Dashboard.Shared.DLL Hidden module: [0x07A50000-0x07A7FFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.2764.39503__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.DLL Hidden module: [0x06D90000-0x06DF5FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.2764.39695__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.DLL Hidden module: [0x06D80000-0x06D87FFF] C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.DLL Hidden module: [0x06D20000-0x06D6DFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.2764.39522__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.DLL Hidden module: [0x06CA0000-0x06D19FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.2764.39745__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.DLL Hidden module: [0x06C20000-0x06C95FFF] C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.2764.39475__90ba9c70f846762e\CLI.Component.Wizard.DLL Hidden module: [0x06B10000-0x06B1DFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.2729.30264__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.DLL Hidden module: [0x06AD0000-0x06AE9FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.2764.39682__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.DLL Hidden module: [0x06AC0000-0x06ACDFFF] C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.2764.39480__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.DLL Hidden module: [0x068B0000-0x068B7FFF] C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.2729.30216__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.DLL Hidden module: [0x068A0000-0x068A9FFF] C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.2729.30258__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.DLL Hidden module: [0x06890000-0x06897FFF] C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll Hidden module: [0x06780000-0x06787FFF] C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.2729.30211__90ba9c70f846762e\CLI.Component.Wizard.Shared.DLL Hidden module: [0x06750000-0x06757FFF] C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.2729.30185__90ba9c70f846762e\CLI.Component.Client.Shared.DLL Hidden module: [0x066E0000-0x0674FFFF] C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.2764.39723__90ba9c70f846762e\CLI.Component.Systemtray.DLL Hidden module: [0x065D0000-0x065DDFFF] C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.2729.30205__90ba9c70f846762e\CLI.Component.Client.Shared.Private.DLL Hidden module: [0x06450000-0x06457FFF] C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.2729.30208__90ba9c70f846762e\APM.Foundation.DLL Hidden module: [0x06440000-0x0644DFFF] C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.2764.39437__90ba9c70f846762e\APM.Server.DLL Hidden module: [0x06320000-0x06329FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.2729.30262__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.DLL Hidden module: [0x06310000-0x0631DFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.2764.39738__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.DLL Hidden module: [0x061E0000-0x061EDFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.2729.30227__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.DLL Hidden module: [0x061C0000-0x061D3FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.2764.39609__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.DLL Hidden module: [0x06170000-0x06181FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.2764.39675__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.DLL Hidden module: [0x05B50000-0x05B5FFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.2729.30231__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.DLL Hidden module: [0x05B40000-0x05B4DFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.2729.30225__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.DLL Hidden module: [0x05B20000-0x05B31FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.2764.39601__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.DLL Hidden module: [0x05A00000-0x05A09FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.2729.30259__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.DLL Hidden module: [0x059F0000-0x059FBFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.2764.39654__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.DLL Hidden module: [0x059E0000-0x059EFFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.2729.30226__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.DLL Hidden module: [0x059C0000-0x059CDFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.2764.39609__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.DLL Hidden module: [0x05990000-0x05999FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.2729.30228__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.DLL Hidden module: [0x05980000-0x0598BFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.2764.39633__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.DLL Hidden module: [0x05970000-0x05979FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.2729.30219__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.DLL Hidden module: [0x05950000-0x0595DFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.2764.39521__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.DLL Hidden module: [0x05940000-0x05947FFF] C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.2729.30224__90ba9c70f846762e\AEM.Plugin.GD.Shared.DLL Hidden module: [0x05930000-0x0593FFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Shared\2.0.2729.30219__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Shared.DLL Hidden module: [0x05920000-0x0592BFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Runtime\2.0.2764.39502__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Runtime.DLL Hidden module: [0x05800000-0x05813FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.2729.30231__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.DLL Hidden module: [0x056C0000-0x056D5FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.2764.39709__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.DLL Hidden module: [0x05450000-0x0545BFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.2729.30213__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.DLL Hidden module: [0x05240000-0x0524BFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.2764.39601__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.DLL Hidden module: [0x05230000-0x05239FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.2729.30212__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.DLL Hidden module: [0x05220000-0x0522DFFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.2729.30230__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.DLL Hidden module: [0x05210000-0x05217FFF] C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.2729.30243__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.DLL Hidden module: [0x051F0000-0x05203FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.2764.39668__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.DLL Hidden module: [0x051E0000-0x051E7FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.2729.30216__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.DLL Hidden module: [0x050D0000-0x050D7FFF] C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.2764.39466__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.DLL Hidden module: [0x050A0000-0x050A7FFF] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0703.dll Hidden module: [0x05050000-0x05063FFF] C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.2764.39438__90ba9c70f846762e\ATIDEMOS.DLL Hidden module: [0x05040000-0x05047FFF] C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.2729.30242__90ba9c70f846762e\DEM.OS.DLL Hidden module: [0x04F30000-0x04F37FFF] C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.2729.30197__90ba9c70f846762e\AEM.Actions.CCAA.Shared.DLL Hidden module: [0x04EE0000-0x04F1DFFF] C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.2764.39446__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.DLL Hidden module: [0x04DD0000-0x04DD7FFF] C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.2729.30259__90ba9c70f846762e\DEM.OS.I0602.DLL Hidden module: [0x04DC0000-0x04DC9FFF] C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.DLL Hidden module: [0x04DB0000-0x04DBFFFF] C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.2729.30199__90ba9c70f846762e\CLI.Caste.Graphics.Shared.DLL Hidden module: [0x04900000-0x0495DFFF] C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll Hidden module: [0x048A0000-0x048F7FFF] C:\Windows\System32\ATIDEMGX.dll Hidden module: [0x04790000-0x04797FFF] C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.2729.30256__90ba9c70f846762e\DEM.Graphics.DLL Hidden module: [0x04780000-0x04787FFF] C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.DLL Hidden module: [0x04760000-0x0476DFFF] C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.DLL Hidden module: [0x04750000-0x04757FFF] C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.2729.30202__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.DLL Hidden module: [0x04740000-0x04747FFF] C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.2729.30222__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.DLL Hidden module: [0x04620000-0x0462BFFF] C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.2764.39776__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.DLL Hidden module: [0x04610000-0x04617FFF] C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.2729.30201__90ba9c70f846762e\AEM.Server.Shared.DLL Hidden module: [0x04600000-0x04607FFF] C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.2729.30212__90ba9c70f846762e\AEM.Plugin.EEU.Shared.DLL Hidden module: [0x03FF0000-0x03FF9FFF] C:\Windows\assembly\GAC_MSIL\AEM.Foundation\2.0.2729.30176__90ba9c70f846762e\AEM.Foundation.DLL Hidden module: [0x03FE0000-0x03FE7FFF] C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.2764.39436__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.DLL Hidden module: [0x03FD0000-0x03FD9FFF] C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2729.30184__90ba9c70f846762e\NEWAEM.Foundation.DLL Hidden module: [0x03EA0000-0x03EADFFF] C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.2764.39436__90ba9c70f846762e\AEM.Server.DLL Hidden module: [0x03DD0000-0x03DDBFFF] C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.DLL Hidden module: [0x03DC0000-0x03DC7FFF] C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.2729.30203__90ba9c70f846762e\CLI.Component.Runtime.Shared.DLL Hidden module: [0x03DB0000-0x03DBDFFF] C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.2729.30193__90ba9c70f846762e\CLI.Foundation.Private.DLL Hidden module: [0x03DA0000-0x03DADFFF] C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.2729.30209__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.DLL Hidden module: [0x03B80000-0x03B93FFF] C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.2764.39438__90ba9c70f846762e\CLI.Component.Runtime.DLL Hidden module: [0x03B70000-0x03B79FFF] C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.2729.30313__90ba9c70f846762e\CLI.Foundation.XManifest.DLL Hidden module: [0x01B40000-0x01B5BFFF] C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.2764.39730__90ba9c70f846762e\MOM.Implementation.DLL Hidden module: [0x019F0000-0x019FBFFF] C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2729.30188__90ba9c70f846762e\LOG.Foundation.Private.DLL Hidden module: [0x019C0000-0x019D1FFF] C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.2764.39729__90ba9c70f846762e\LOG.Foundation.Implementation.DLL Hidden module: [0x019B0000-0x019B7FFF] C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2729.30211__90ba9c70f846762e\LOG.Foundation.Implementation.Private.DLL Hidden module: [0x00A10000-0x00A1FFFF] C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.2729.30178__90ba9c70f846762e\CLI.Foundation.DLL Hidden module: [0x00A00000-0x00A07FFF] C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.2729.30207__90ba9c70f846762e\MOM.Foundation.DLL Hidden module: [0x009E0000-0x009EBFFF] C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.2729.30174__90ba9c70f846762e\LOG.Foundation.DLL Hidden module: [0x009C0000-0x009CBFFF] C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.2764.39730__90ba9c70f846762e\CCC.Implementation.DLL	Anomaly detected
SynToshiba.exe	3316	3264	0x86337D90	1	Inyostar\Punymicro	2	23	49	0x7FFDD000	8	Normal	0:00:00.000	0:00:00.000	18:09:52 19.03.2011		50.64 Mb	49.64 Mb	3.93 Mb	2.94 Mb	1026	0	0	107	0.00 Kb	0.00 Kb	1.75 Kb	0x862A6970	C:\Program Files\Synaptics\SynTP\SynToshiba.exe Description: Toshiba Custom PlugIn Application Company name: Synaptics, Inc. Size: 200704 Attrs: ----a Created: 17:58:02 15.08.2007 Modified: 17:58:02 15.08.2007 Accessed: 07:09:23 22.01.2011		Signed
SynTPEnh.exe	3488	2780	0x83FAFBE8	1	Inyostar\Punymicro	1		0	0x7FFDA000	10	Above normal	0:00:00.031	0:00:00.000	18:10:50 19.03.2011	18:10:50 19.03.2011	51.05 Mb	38.95 Mb	4.05 Mb	24.00 Kb	1049	0	0	106	0.00 Kb	0.00 Kb	2.79 Kb		C:\Program Files\Synaptics\SynTP\SynTPEnh.exe Description: Synaptics TouchPad Enhancements Company name: Synaptics, Inc. Size: 1021224 Attrs: ----a Created: 20:03:32 15.08.2007 Modified: 20:03:32 15.08.2007 Accessed: 07:09:23 22.01.2011		Zombie process Signed
WmiPrvSE.exe	3532	836	0x863A2300	0	NT AUTHORITY\NETWORK SERVICE	3		0	0x7FFDB000	8	Normal	0:00:00.265	0:00:00.093	18:09:55 19.03.2011	18:11:30 19.03.2011	53.00 Mb	39.26 Mb	7.37 Mb	24.00 Kb	4220	9	9	2482	0.79 Kb	0.80 Kb	5.45 Kb	0x8639B0E0	C:\Windows\System32\wbem\WmiPrvSE.exe Description: WMI Provider Host Company name: Microsoft Corporation Size: 247296 Attrs: ----a Created: 12:14:09 03.11.2010 Modified: 23:28:16 10.04.2009 Accessed: 07:57:56 22.01.2011		Zombie process Signed
WmiPrvSE.exe	3592	836	0x863E26F8	0	NT AUTHORITY\SYSTEM	6		0	0x7FFDB000	8	Normal	0:00:02.886	0:00:01.404	18:09:55 19.03.2011	18:11:56 19.03.2011	98.54 Mb	97.47 Mb	20.87 Mb	24.00 Kb	9633	128	138	1732	1.44 Mb	9.09 Kb	123.52 Kb	0x8639B0E0	C:\Windows\System32\wbem\WmiPrvSE.exe Description: WMI Provider Host Company name: Microsoft Corporation Size: 247296 Attrs: ----a Created: 12:14:09 03.11.2010 Modified: 23:28:16 10.04.2009 Accessed: 07:57:56 22.01.2011		Zombie process Signed
WmiApSrv.exe	3652	624	0x8645D020	0	NT AUTHORITY\SYSTEM	5		0	0x7FFDA000	8	Normal	0:00:00.093	0:00:00.015	18:09:56 19.03.2011	18:11:56 19.03.2011	38.16 Mb	33.05 Mb	4.72 Mb	24.00 Kb	1378	9	17	1205	0.71 Kb	1.19 Kb	128.99 Kb		C:\Windows\System32\wbem\WmiApSrv.exe Description: WMI Performance Reverse Adapter Company name: Microsoft Corporation Size: 137728 Attrs: ----a Created: 12:14:08 03.11.2010 Modified: 23:28:16 10.04.2009 Accessed: 07:57:55 22.01.2011		Zombie process Signed
dllhost.exe	4304	836	0x840D1020	1	Inyostar\Punymicro	5		0	0x7FFDC000	8	Normal	0:00:00.046	0:00:00.015	18:11:19 19.03.2011	18:11:24 19.03.2011	54.69 Mb	31.47 Mb	4.07 Mb	24.00 Kb	1203	2	1	275	16.20 Kb	0.11 Kb	2.63 Kb		C:\Windows\System32\dllhost.exe Description: COM Surrogate Company name: Microsoft Corporation Size: 7168 Attrs: ----a Created: 03:50:22 02.11.2006 Modified: 04:45:02 02.11.2006 Accessed: 07:50:32 22.01.2011		Zombie process Signed
consent.exe	4364	1216	0x84153020	1	NT AUTHORITY\SYSTEM	11		0	0x7FFD8000	13	High	0:00:00.156	0:00:00.234	18:11:22 19.03.2011	18:11:23 19.03.2011	100.54 Mb	61.82 Mb	13.65 Mb	24.00 Kb	6893	16	10	1394	124.63 Kb	1.13 Kb	321.15 Kb		C:\Windows\System32\consent.exe Description: Consent UI for administrative applications Company name: Microsoft Corporation Size: 81920 Attrs: ----a Created: 11:37:14 03.11.2010 Modified: 22:33:06 18.01.2008 Accessed: 07:50:24 22.01.2011		Zombie process Signed
dllhost.exe	4484	836	0x841769F0	1	NT AUTHORITY\SYSTEM	5		0	0x7FFDF000	8	Normal	0:00:00.062	0:00:00.000	18:11:23 19.03.2011	18:11:28 19.03.2011	44.51 Mb	31.16 Mb	3.93 Mb	24.00 Kb	1172	2	1	275	16.08 Kb	0.11 Kb	2.61 Kb		C:\Windows\System32\dllhost.exe Description: COM Surrogate Company name: Microsoft Corporation Size: 7168 Attrs: ----a Created: 03:50:22 02.11.2006 Modified: 04:45:02 02.11.2006 Accessed: 07:50:32 22.01.2011		Zombie process Signed
dllhost.exe	4512	836	0x8415A640	0	NT AUTHORITY\SYSTEM	5		0	0x7FFDD000	8	Normal	0:00:00.015	0:00:00.000	18:11:23 19.03.2011	18:11:29 19.03.2011	31.72 Mb	29.97 Mb	3.44 Mb	24.00 Kb	1047	2	1	271	16.08 Kb	0.11 Kb	2.55 Kb		C:\Windows\System32\dllhost.exe Description: COM Surrogate Company name: Microsoft Corporation Size: 7168 Attrs: ----a Created: 03:50:22 02.11.2006 Modified: 04:45:02 02.11.2006 Accessed: 07:50:32 22.01.2011		Zombie process Signed
Vba32arkit.exe	4552	2612	0x84174D90	1	Inyostar\Punymicro	20	75	324	0x7FFD3000	8	Normal	0:00:00.000	0:00:00.000	18:11:24 19.03.2011		169.78 Mb	166.68 Mb	28.79 Mb	28.79 Mb	91189	946	12	19137	29.49 Mb	219.94 Kb	11.07 Mb		C:\Users\Punymicro\Desktop\backup\vba32arkit_beta\Vba32arkit.exe Description: Vba32 AntiRootkit Company name: VirusBlokAda Ltd. Size: 461192 Attrs: ----a Created: 15:26:20 12.03.2011 Modified: 18:10:59 19.03.2011 Accessed: 15:26:20 12.03.2011		ADS:Yes Signed
ctfmon.exe	4564	4552	0x8403D800	1	Inyostar\Punymicro	2		0	0x7FFDC000	8	Normal	0:00:00.031	0:00:00.000	18:11:24 19.03.2011	18:11:31 19.03.2011	46.92 Mb	34.66 Mb	4.11 Mb	24.00 Kb	1626	3	3	252	0.27 Kb	0.34 Kb	4.19 Kb		C:\Windows\System32\ctfmon.exe Description: CTF Loader Company name: Microsoft Corporation Size: 8704 Attrs: ----a Created: 03:38:31 02.11.2006 Modified: 04:45:00 02.11.2006 Accessed: 07:50:25 22.01.2011		Zombie process Signed
ctfmon.exe	4644	4552	0x862A8C20	1	Inyostar\Punymicro	2	24	99	0x7FFDD000	8	Normal	0:00:00.000	0:00:00.000	18:11:35 19.03.2011		46.92 Mb	46.89 Mb	4.12 Mb	4.09 Mb	1621	4	3	432	14.75 Kb	0.34 Kb	3.39 Kb		C:\Windows\System32\ctfmon.exe Description: CTF Loader Company name: Microsoft Corporation Size: 8704 Attrs: ----a Created: 03:38:31 02.11.2006 Modified: 04:45:00 02.11.2006 Accessed: 07:50:25 22.01.2011		Signed
rundll32.exe	4704	2228	0x84025518	0	NT AUTHORITY\SYSTEM	2		0	0x7FFDA000	6	Below normal	0:00:00.015	0:00:00.031	18:11:48 19.03.2011	18:11:57 19.03.2011	51.55 Mb	45.43 Mb	4.41 Mb	24.00 Kb	1231	0	0	163	0.00 Kb	0.00 Kb	1.90 Kb		C:\Windows\System32\rundll32.exe Description: Windows host process (Rundll32) Company name: Microsoft Corporation Size: 44544 Attrs: ----a Created: 03:48:33 02.11.2006 Modified: 04:45:37 02.11.2006 Accessed: 07:56:45 22.01.2011		Zombie process Signed
WmiPrvSE.exe	4828	836	0x863FD668	0	NT AUTHORITY\SYSTEM	7	41	114	0x7FFDF000	8	Normal	0:00:00.062	0:00:00.046	18:11:56 19.03.2011		35.88 Mb	34.57 Mb	5.18 Mb	5.14 Mb	1567	8	23	416	0.68 Kb	1.75 Kb	18.03 Kb	0x8639B0E0	C:\Windows\System32\wbem\WmiPrvSE.exe Description: WMI Provider Host Company name: Microsoft Corporation Size: 247296 Attrs: ----a Created: 12:14:09 03.11.2010 Modified: 23:28:16 10.04.2009 Accessed: 07:57:56 22.01.2011		Signed
rundll32.exe	4904	2228	0x86218B88	0	NT AUTHORITY\SYSTEM	2		0	0x7FFDB000	6	Below normal	0:00:00.093	0:00:00.015	18:11:58 19.03.2011	18:11:59 19.03.2011	51.55 Mb	45.43 Mb	4.43 Mb	24.00 Kb	1241	1	0	1767	168.71 Kb	0.00 Kb	8.09 Kb		C:\Windows\System32\rundll32.exe Description: Windows host process (Rundll32) Company name: Microsoft Corporation Size: 44544 Attrs: ----a Created: 03:48:33 02.11.2006 Modified: 04:45:37 02.11.2006 Accessed: 07:56:45 22.01.2011		Zombie process Signed
WmiPrvSE.exe	5456	836	0x841DFA90	0	NT AUTHORITY\NETWORK SERVICE	4		0	0x7FFDF000	8	Normal	0:00:00.078	0:00:00.031	18:13:19 19.03.2011	18:13:20 19.03.2011	34.74 Mb	33.79 Mb	4.52 Mb	24.00 Kb	1223	6	5	399	23.40 Kb	0.46 Kb	3.43 Kb		C:\Windows\System32\wbem\WmiPrvSE.exe Description: WMI Provider Host Company name: Microsoft Corporation Size: 247296 Attrs: ----a Created: 12:14:09 03.11.2010 Modified: 23:28:16 10.04.2009 Accessed: 07:57:56 22.01.2011		Zombie process Signed
WMIADAP.exe	5548	1216	0x841DB4A8	0	NT AUTHORITY\SYSTEM	3		0	0x7FFDF000	8	Normal	0:00:00.031	0:00:00.062	18:13:36 19.03.2011	18:13:37 19.03.2011	33.12 Mb	31.30 Mb	3.97 Mb	24.00 Kb	1087	5	5	116	0.43 Kb	0.46 Kb	2.32 Kb		C:\Windows\System32\wbem\WMIADAP.exe Description: WMI Reverse Performance Adapter Maintenance Utility Company name: Microsoft Corporation Size: 117248 Attrs: ----a Created: 12:14:08 03.11.2010 Modified: 23:28:16 10.04.2009 Accessed: 07:57:55 22.01.2011		Zombie process Signed
WmiPrvSE.exe	5648	836	0x8421A020	0	NT AUTHORITY\NETWORK SERVICE	3		0	0x7FFDF000	8	Normal	0:00:00.078	0:00:00.078	18:13:50 19.03.2011	18:13:50 19.03.2011	34.74 Mb	32.79 Mb	4.30 Mb	24.00 Kb	1169	6	5	315	22.94 Kb	0.46 Kb	3.14 Kb		C:\Windows\System32\wbem\WmiPrvSE.exe Description: WMI Provider Host Company name: Microsoft Corporation Size: 247296 Attrs: ----a Created: 12:14:09 03.11.2010 Modified: 23:28:16 10.04.2009 Accessed: 07:57:56 22.01.2011		Zombie process Signed
Total:

Ethread	System Thread	Stack Limit	Wait Time	Freeze Count
TID	TEB	Priority	Create Time	Suspend Count
State	Start Address	Base Priority	Kernel Time	Hidden From Debugger
GUI Thread	Start Module	Context Switches	User Time	Information
Service Table	Stack Base	Wait Reason	Previous Mode

Vba32 AntiRootKit Log

Kernel modules

Kernel-Mode Hooks

Kernel-Mode Notificators

Driver Input/Output Handler's Hooks (IRP & FastIo)

Processes

Threads

Modules

Autorun objects

Network objects

LSP Providers

Hosts\LmHosts Files

Drivers\Services (from Registry)

Driver Object	Handler Name	Current Address	Driver	State
\Driver\monitor	IRP_MJ_PNP	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_SET_QUOTA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_QUERY_QUOTA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_DEVICE_CHANGE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_SYSTEM_CONTROL	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_POWER	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_SET_SECURITY	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_QUERY_SECURITY	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_CREATE_MAILSLOT	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_CLEANUP	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_LOCK_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_SHUTDOWN	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_INTERNAL_DEVICE_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_DEVICE_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_FILE_SYSTEM_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_DIRECTORY_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_SET_VOLUME_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_QUERY_VOLUME_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_FLUSH_BUFFERS	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_SET_EA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_QUERY_EA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_SET_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_QUERY_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_WRITE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_READ	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_CLOSE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_CREATE_NAMED_PIPE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\monitor	IRP_MJ_CREATE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_PNP	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_SET_QUOTA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_QUERY_QUOTA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_DEVICE_CHANGE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_SYSTEM_CONTROL	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_POWER	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_SET_SECURITY	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_QUERY_SECURITY	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_CREATE_MAILSLOT	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_CLEANUP	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_LOCK_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_SHUTDOWN	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_INTERNAL_DEVICE_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_DEVICE_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_FILE_SYSTEM_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_DIRECTORY_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_SET_VOLUME_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_QUERY_VOLUME_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_FLUSH_BUFFERS	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_SET_EA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_QUERY_EA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_SET_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_QUERY_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_WRITE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_READ	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_CLOSE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_CREATE_NAMED_PIPE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\msisadrv	IRP_MJ_CREATE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_PNP	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_SET_QUOTA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_QUERY_QUOTA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_DEVICE_CHANGE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_SYSTEM_CONTROL	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_POWER	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_SET_SECURITY	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_QUERY_SECURITY	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_CREATE_MAILSLOT	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_CLEANUP	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_LOCK_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_SHUTDOWN	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_INTERNAL_DEVICE_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_DEVICE_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_FILE_SYSTEM_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_DIRECTORY_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_SET_VOLUME_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_QUERY_VOLUME_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_FLUSH_BUFFERS	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_SET_EA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_QUERY_EA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_SET_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_QUERY_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_WRITE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_READ	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_CLOSE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_CREATE_NAMED_PIPE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\circlass	IRP_MJ_CREATE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_PNP	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_SET_QUOTA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_QUERY_QUOTA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_DEVICE_CHANGE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_SYSTEM_CONTROL	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_POWER	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_SET_SECURITY	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_QUERY_SECURITY	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_CREATE_MAILSLOT	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_CLEANUP	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_LOCK_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_SHUTDOWN	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_INTERNAL_DEVICE_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_DEVICE_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_FILE_SYSTEM_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_DIRECTORY_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_SET_VOLUME_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_QUERY_VOLUME_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_FLUSH_BUFFERS	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_SET_EA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_QUERY_EA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_SET_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_QUERY_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_WRITE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_READ	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_CLOSE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_CREATE_NAMED_PIPE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\PEAUTH	IRP_MJ_CREATE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_PNP	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_SET_QUOTA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_QUERY_QUOTA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_DEVICE_CHANGE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_SYSTEM_CONTROL	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_POWER	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_SET_SECURITY	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_QUERY_SECURITY	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_CREATE_MAILSLOT	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_CLEANUP	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_LOCK_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_SHUTDOWN	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_INTERNAL_DEVICE_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_DEVICE_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_FILE_SYSTEM_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_DIRECTORY_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_SET_VOLUME_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_QUERY_VOLUME_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_FLUSH_BUFFERS	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_SET_EA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_QUERY_EA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_SET_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_QUERY_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_WRITE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_READ	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_CLOSE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_CREATE_NAMED_PIPE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\AmdK8	IRP_MJ_CREATE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\atikmdag	IRP_MJ_PNP	0x8AD6705D	C:\Windows\System32\drivers\dxgkrnl.sys	Signed
\Driver\atikmdag	IRP_MJ_SYSTEM_CONTROL	0x8AD87948	C:\Windows\System32\drivers\dxgkrnl.sys	Signed
\Driver\atikmdag	IRP_MJ_POWER	0x8ADA9826	C:\Windows\System32\drivers\dxgkrnl.sys	Signed
\Driver\atikmdag	IRP_MJ_INTERNAL_DEVICE_CONTROL	0x8AD663DE	C:\Windows\System32\drivers\dxgkrnl.sys	Signed
\Driver\atikmdag	IRP_MJ_DEVICE_CONTROL	0x8AD6C5B8	C:\Windows\System32\drivers\dxgkrnl.sys	Signed
\Driver\atikmdag	IRP_MJ_CLOSE	0x8AD5FE16	C:\Windows\System32\drivers\dxgkrnl.sys	Signed
\Driver\atikmdag	IRP_MJ_CREATE	0x8AD5FD47	C:\Windows\System32\drivers\dxgkrnl.sys	Signed
\Driver\umbus	IRP_MJ_PNP	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_SET_QUOTA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_QUERY_QUOTA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_DEVICE_CHANGE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_SYSTEM_CONTROL	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_POWER	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_SET_SECURITY	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_QUERY_SECURITY	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_CREATE_MAILSLOT	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_CLEANUP	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_LOCK_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_SHUTDOWN	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_INTERNAL_DEVICE_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_DEVICE_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_FILE_SYSTEM_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_DIRECTORY_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_SET_VOLUME_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_QUERY_VOLUME_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_FLUSH_BUFFERS	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_SET_EA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_QUERY_EA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_SET_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_QUERY_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_WRITE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_READ	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_CLOSE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_CREATE_NAMED_PIPE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\umbus	IRP_MJ_CREATE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_PNP	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_SET_QUOTA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_QUERY_QUOTA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_DEVICE_CHANGE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_SYSTEM_CONTROL	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_POWER	0x8057880D	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_SET_SECURITY	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_QUERY_SECURITY	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_CREATE_MAILSLOT	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_CLEANUP	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_LOCK_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_SHUTDOWN	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_INTERNAL_DEVICE_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_DEVICE_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_FILE_SYSTEM_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_DIRECTORY_CONTROL	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_SET_VOLUME_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_QUERY_VOLUME_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_FLUSH_BUFFERS	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_SET_EA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_QUERY_EA	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_SET_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_QUERY_INFORMATION	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_WRITE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_READ	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_CLOSE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_CREATE_NAMED_PIPE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
\Driver\SynTP	IRP_MJ_CREATE	0x805785E6	C:\Windows\system32\drivers\Wdf01000.sys	Signed
Total:

Name	Image Path	State
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{0642EFCB-8E53-40C6-82BB-3788A1190ACD}] DATAGRAM 5	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{0642EFCB-8E53-40C6-82BB-3788A1190ACD}] SEQPACKET 5	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{427FC2B9-0450-48F8-A590-EBFD0BB7A64C}] DATAGRAM 1	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{427FC2B9-0450-48F8-A590-EBFD0BB7A64C}] SEQPACKET 1	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{A8332E4F-D1D9-44E2-9974-27D861DDE347}] DATAGRAM 6	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{A8332E4F-D1D9-44E2-9974-27D861DDE347}] SEQPACKET 6	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{B6ADC866-5359-4E36-98D8-22F3A492C77B}] DATAGRAM 2	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{B6ADC866-5359-4E36-98D8-22F3A492C77B}] SEQPACKET 2	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{F7132328-D1EE-4FE8-AA4B-7B96B24A5CCB}] DATAGRAM 8	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{F7132328-D1EE-4FE8-AA4B-7B96B24A5CCB}] SEQPACKET 8	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD NetBIOS [\Device\NetBT_Tcpip_{0642EFCB-8E53-40C6-82BB-3788A1190ACD}] DATAGRAM 4	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD NetBIOS [\Device\NetBT_Tcpip_{0642EFCB-8E53-40C6-82BB-3788A1190ACD}] SEQPACKET 4	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD NetBIOS [\Device\NetBT_Tcpip_{427FC2B9-0450-48F8-A590-EBFD0BB7A64C}] DATAGRAM 0	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD NetBIOS [\Device\NetBT_Tcpip_{427FC2B9-0450-48F8-A590-EBFD0BB7A64C}] SEQPACKET 0	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD NetBIOS [\Device\NetBT_Tcpip_{A8332E4F-D1D9-44E2-9974-27D861DDE347}] DATAGRAM 3	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD NetBIOS [\Device\NetBT_Tcpip_{A8332E4F-D1D9-44E2-9974-27D861DDE347}] SEQPACKET 3	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD Tcpip [RAW/IP]	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD Tcpip [RAW/IPv6]	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD Tcpip [TCP/IP]	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD Tcpip [TCP/IPv6]	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD Tcpip [UDP/IP]	%SystemRoot%\system32\mswsock.dll	Signed
MSAFD Tcpip [UDP/IPv6]	%SystemRoot%\system32\mswsock.dll	Signed
RSVP TCP Service Provider	%SystemRoot%\system32\mswsock.dll	Signed
RSVP TCPv6 Service Provider	%SystemRoot%\system32\mswsock.dll	Signed
RSVP UDP Service Provider	%SystemRoot%\system32\mswsock.dll	Signed
RSVP UDPv6 Service Provider	%SystemRoot%\system32\mswsock.dll	Signed
Total:

Ethread	TID	State	GUI Thread	Service Table	System Thread	Start Address	Start Module	Stack Base	Stack Limit	Priority	Base Priority	Context Switches	Wait Reason	Wait Time	Create Time	Kernel Time	User Time	Previous Mode	Freeze Count	Suspend Count	Hidden From Debugger	Information
System ( PID : 4 )
0x84FA1D78	216	Terminated	No	0x81D52B00	Yes	0x875C8F68	ecache.sys	0x898D3000	0x898D0000	25	25	8941	Executive	2071	18:09:05 19.03.2011	0:00:00.031	0:00:00.000	Kernel Mode	0	0	No	Terminated
0x84001228	5140	Waiting	No	0x81D52B00	Yes	0x95DAA006	3qyhufha.sys	0x96430000	0x9642D000	9	8	2956	Executive	28785	18:12:12 19.03.2011	0:00:05.709	0:00:00.000	Kernel Mode	0	0	No
0x840F5020	4292	Waiting	No	0x81D52B00	Yes	0x81E476F9	ntkrnlpa.exe	0x803FD000	0x803FA000	15	15	1	Executive	8884	18:11:18 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x83EF0BA0	1608	Waiting	No	0x81D52B00	Yes	0x81E476F9	ntkrnlpa.exe	0x9342A000	0x93427000	15	15	1	Executive	6002	18:10:33 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x83ED14C0	4056	Waiting	No	0x81D52B00	Yes	0x81E476F9	ntkrnlpa.exe	0x8825D000	0x8825A000	15	15	357	Executive	28728	18:10:31 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x85D949D8	3996	Waiting	No	0x81D52B00	Yes	0x81E5EB62	ntkrnlpa.exe	0x89952000	0x8994F000	7	7	1568	Executive	28740	18:10:16 19.03.2011	0:00:00.171	0:00:00.000	Kernel Mode	0	0	No
0x85A5AD78	3496	Waiting	No	0x81D52B00	Yes	0x81E476F9	ntkrnlpa.exe	0x94BEC000	0x94BE9000	15	15	19	Executive	11302	18:09:54 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x8622F460	2448	Waiting	No	0x81D52B00	Yes	0x81E476F9	ntkrnlpa.exe	0x94FB4000	0x94FB1000	15	15	1	Executive	3003	18:09:47 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x8607D2A0	1892	Waiting	No	0x81D52B00	Yes	0x948F1BE0	mpsdrv.sys	0x934A5000	0x934A2000	8	8	13	Executive	2506	18:09:35 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x86049580	1764	Waiting	No	0x81D52B00	Yes	0x948A2409	HTTP.sys	0x90683000	0x90680000	8	8	9	Executive	25465	18:09:33 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x86049828	1760	Waiting	No	0x81D52B00	Yes	0x948A2005	HTTP.sys	0x9067F000	0x9067C000	11	11	1	Executive	2128	18:09:33 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x86049AD0	1756	Waiting	No	0x81D52B00	Yes	0x948A2005	HTTP.sys	0x9067B000	0x90678000	8	8	1	Executive	2129	18:09:33 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x86049D78	1752	Waiting	No	0x81D52B00	Yes	0x948A2005	HTTP.sys	0x90666000	0x90663000	8	8	1	Executive	2128	18:09:33 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x86049020	1748	Waiting	No	0x81D52B00	Yes	0x948A2005	HTTP.sys	0x90656000	0x90653000	8	8	1	Executive	2129	18:09:33 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x86048280	1744	Waiting	No	0x81D52B00	Yes	0x948A2005	HTTP.sys	0x90652000	0x9064F000	8	8	4	Executive	21362	18:09:33 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x86048528	1740	Waiting	No	0x81D52B00	Yes	0x948A2005	HTTP.sys	0x9064E000	0x9064B000	8	8	4	Executive	25209	18:09:33 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x860487D0	1736	Waiting	No	0x81D52B00	Yes	0x948A2005	HTTP.sys	0x9065C000	0x90659000	8	8	1	Executive	2128	18:09:33 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x86048A78	1732	Waiting	No	0x81D52B00	Yes	0x948A2005	HTTP.sys	0x9356D000	0x9356A000	8	8	106	Executive	28467	18:09:33 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x85FC86D8	1480	Waiting	No	0x81D52B00	Yes	0x8BF97115	spsys.sys	0x92541000	0x9253E000	8	8	1	Executive	2031	18:09:31 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x85D8C020	876	Waiting	No	0x81D52B00	Yes	0x8BF0C5C2	luafv.sys	0x92548000	0x92545000	9	8	779	Executive	24672	18:09:29 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x85D8F658	696	Waiting	No	0x81D52B00	Yes	0x81E476F9	ntkrnlpa.exe	0x87FCC000	0x87FC9000	15	15	16	Executive	3443	18:09:28 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x85E6EB00	604	Waiting	No	0x81D52B00	Yes	0x82324411	msrpc.sys	0x87FE3000	0x87FE0000	11	8	173	WrQueue	10032	18:09:28 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x85BEDCD0	548	Waiting	No	0x81D52B00	Yes	0x8AD9356F	dxgkrnl.sys	0x9069D000	0x9069A000	15	15	93	Executive	9280	18:09:28 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x85A4BD78	544	Waiting	No	0x81D52B00	Yes	0x8A6306D6	atikmdag.sys	0x8996B000	0x89968000	8	8	1	Executive	1679	18:09:26 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x85BECD78	540	Waiting	No	0x81D52B00	Yes	0x8A703EE8	atikmdag.sys	0x89907000	0x89904000	8	8	1	Executive	1658	18:09:26 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x85BE3D78	536	Waiting	No	0x81D52B00	Yes	0x8ACEF9C8	atikmdag.sys	0x803C5000	0x803C2000	8	8	1	Executive	1658	18:09:26 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x8586FD78	452	Waiting	No	0x81D52B00	Yes	0x81DDC228	ntkrnlpa.exe	0x8822A000	0x88227000	9	8	56	WrLpcReceive	11554	18:09:13 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x85850D78	444	Waiting	No	0x81D52B00	Yes	0x8BBC0EC6	rdbss.sys	0x883EA000	0x883E7000	8	8	8	Executive	27753	18:09:13 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x857D32D0	440	Waiting	No	0x81D52B00	Yes	0x8BBE9B32	rdbss.sys	0x883E6000	0x883E3000	8	8	1	WrQueue	825	18:09:13 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x857D3578	436	Waiting	No	0x81D52B00	Yes	0x8BBE9B32	rdbss.sys	0x883E2000	0x883DF000	8	8	1	WrQueue	825	18:09:13 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x857D3820	432	Waiting	No	0x81D52B00	Yes	0x8BBE9B32	rdbss.sys	0x883DE000	0x883DB000	8	8	1	WrQueue	825	18:09:13 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x857F7560	428	Waiting	No	0x81D52B00	Yes	0x8BBE9B32	rdbss.sys	0x883DA000	0x883D7000	8	8	1	WrQueue	825	18:09:13 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x857FAD78	424	Waiting	No	0x81D52B00	Yes	0x8BBE9B32	rdbss.sys	0x883D6000	0x883D3000	8	8	1	WrQueue	825	18:09:13 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x857F6178	420	Waiting	No	0x81D52B00	Yes	0x8BBE9B32	rdbss.sys	0x89854000	0x89851000	8	8	1	WrQueue	825	18:09:13 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x859E3970	416	Waiting	No	0x81D52B00	Yes	0x8BBE9B32	rdbss.sys	0x89850000	0x8984D000	8	8	1	WrQueue	825	18:09:13 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x857F4D78	412	Waiting	No	0x81D52B00	Yes	0x8BBE9B32	rdbss.sys	0x882F9000	0x882F6000	8	8	1	WrQueue	825	18:09:13 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x857F3D78	408	Waiting	No	0x81D52B00	Yes	0x8BBE9B32	rdbss.sys	0x882E0000	0x882DD000	8	8	1	WrQueue	825	18:09:13 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x856D9088	392	Waiting	No	0x81D52B00	Yes	0x8BA4BF6C	rasacd.sys	0x89840000	0x8983D000	8	8	1	Executive	814	18:09:12 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No
0x857A58D0	388	Waiting	No	0x81D52B00	Yes	0x8B5CCF8E	SBREdrv.sys	0x8983A000	0x89837000	16	8	1	Executive	806	18:09:12 19.03.2011	0:00:00.000	0:00:00.000	Kernel Mode	0	0	No

Name	Image Path	State
Quick Launch (6 objects)Quick Launch (0 objects) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList, ProfileImagePath
C:\Users\Punymicro\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk	C:\PROGRA~1\INTERN~1\iexplore.exe, C:\Program Files\Internet Explorer\iexplore.exe	Signed
C:\Users\Punymicro\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk	C:\PROGRA~1\MOZILL~1\firefox.exe, C:\Program Files\Mozilla Firefox\firefox.exe, C:\Program Files\Mozilla Firefox\firefox.exe	Signed
C:\Users\Punymicro\Application Data\Microsoft\Internet Explorer\Quick Launch\Sandboxed Web Browser.lnk	C:\PROGRA~1\SANDBO~1\Start.exe, C:\Program Files\Sandboxie\Start.exe, default_browser	Signed
C:\Users\Punymicro\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk	%SystemRoot%\system32\imageres.dll	Signed
C:\Users\Punymicro\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk	%SystemRoot%\explorer.exe	Signed
C:\Users\Punymicro\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk	C:\PROGRA~1\WI4EB4~1\wmplayer.exe, C:\Program Files\Windows Media Player\wmplayer.exe, /prefetch:1	Signed
Registry\Autostart Keys (11 objects)Registry\Autostart Keys (3 objects) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\RunOnce HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
SandboxieControl HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run	"C:\Program Files\Sandboxie\SbieCtrl.exe"	Signed
TOSCDSPD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run	C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
AntiLogger HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	"C:\Program Files\AntiLogger\AntiLogger.exe" /minimized	Signed
Malwarebytes' Anti-Malware (reboot) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	"C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript	Signed
Privatefirewall HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	C:\Program Files\Privacyware\Privatefirewall 7.0\PFGUI.exe	Signed
RtHDVCpl HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	RtHDVCpl.exe	Signed
StartCCC HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
SunJavaUpdateSched HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	"C:\Program Files\Common Files\Java\Java Update\jusched.exe"	Signed
SynTPStart HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	C:\Program Files\Synaptics\SynTP\SynTPStart.exe	Signed
SandboxieControl HKEY_USERS\S-1-5-21-2717895717-2037363117-1118420484-1000\Software\Microsoft\Windows\CurrentVersion\Run	"C:\Program Files\Sandboxie\SbieCtrl.exe"	Signed
TOSCDSPD HKEY_USERS\S-1-5-21-2717895717-2037363117-1118420484-1000\Software\Microsoft\Windows\CurrentVersion\Run	C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
Registry\Windows WinLogon (3 objects)Registry\Windows WinLogon (0 objects) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon, Userinit HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon, System HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon, VmApplet HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon, Taskman HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon, UIHost HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows, load HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows, run HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows, load HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows, run HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell
Shell HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon	Explorer.exe	Signed
Userinit HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon	C:\Windows\system32\userinit.exe,	Signed
VmApplet HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon	rundll32 shell32,Control_RunDLL "sysdm.cpl"	Signed
Registry\ActiveX (9 objects)Registry\ActiveX (0 objects) HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components, StubPath
>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	C:\Windows\system32\unregmp2.exe /ShowWMP	Signed
>{26923b43-4d38-484f-9b9e-de460746276c}	C:\Windows\system32\ie4uinit.exe -UserIconConfig	Signed
>{60B49E34-C7CC-11D0-8953-00A0C90347FF}	RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP	Signed
{2C7339CF-2B09-4501-B3F3-F3508C9228ED}	%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll	Signed
{44BBA840-CC51-11CF-AAFA-00AA00B6015C}	"%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE	Signed
{6BF52A52-394A-11d3-B153-00C04F79FAA6}	%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI	Signed
{89820200-ECBD-11cf-8B85-00AA005B4340}	regsvr32.exe /s /n /i:U shell32.dll	Signed
{89820200-ECBD-11cf-8B85-00AA005B4383}	C:\Windows\system32\ie4uinit.exe -BaseSettings	Signed
{89B4C1CD-B018-4511-B0A1-5476DBF70820}	C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install	Signed
Registry\WinLogon Notify (12 objects)Registry\WinLogon Notify (0 objects) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify, DllName HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions, DllName
{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63}	wlgpclnt.dll	Signed
{25537BA6-77A8-11D2-9B6C-0000F8080861} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}	fdeploy.dll	Signed
{3610eda5-77ef-11d2-8dc5-00c04fa31a66} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}	%SystemRoot%\System32\dskquota.dll	Signed
{426031c0-0b47-4852-b0ca-ac3d37bfcb39} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}	gptext.dll	Signed
{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}	iedkcs32.dll	Signed
{7933F41E-56F8-41d6-A31C-4148A711EE93} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}	%SystemRoot%\System32\srchadmin.dll	Signed

Hosts HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, DataBasePath ( C:\Windows\System32\drivers\etc\Hosts )
Hosts file is empty or not present
LmHosts C:\Windows\System32\drivers\etc\Lmhosts
LmHosts file is empty or not present

Network Address	Netmask	Gateway Address	Metric
0.0.0.0	0.0.0.0	192.168.1.1	-1
Total: