Falsche Weiterleitung im Browser

O15 - Trusted Zone: *.antimalwareguard.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)

Die 2 sachen bitte mit HJT fixen...
Dann mit dem Ccleaner alle Temp daten bereinigen und alle regit fehler beheben
Danach mit Malwarebytes nochmal einen schnell scan mcahen und log posten

...o.k., habe ich gemacht, Log ist hier:

Malwarebytes' Anti-Malware 1.41
Datenbank Version: 3174
Windows 5.1.2600 Service Pack 3

15.11.2009 15:34:10
mbam-log-2009-11-15 (15-34-10).txt

Scan-Methode: Quick-Scan
Durchsuchte Objekte: 113593
Laufzeit: 11 minute(s), 39 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



Gruß
Beggo

Wie läuft der rechner jetzt ?

... muss erst mal ne weile testen, da die sonderbare Weiterleitung immer sporadisch auftrat.
ALLERDINGS kann ich jetzt die Systemwiederherstellung nicht mehr aktivieren (WTF), habe schon verschiedenes probiert.
Gruß
Beggo

... muss erst mal ne weile testen, da die sonderbare Weiterleitung immer sporadisch auftrat.
ALLERDINGS kann ich jetzt die Systemwiederherstellung nicht mehr aktivieren (WTF), habe schon verschiedenes probiert.
Gruß
Beggo

Was passiert den wenn du versucht sie zu aktivieren ?
Mach nochmal einen HJT log...

... die Registerkarte zum Aktivieren ist verschwunden.
Über Dienste starten, kommt die Fehlermeldung Nr.5 : Zugriff verweigert.
Habe die SWH sogar probiert neu zu installieren, aber keinen Erfolg gehabt.

LOG
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:20:12, on 16.11.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
c:\programme\a-squared free\a2service.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\FRITZ!DSL\IGDCTRL.EXE
C:\Programme\avmwlanstick\WlanNetService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Programme\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\avmwlanstick\wlangui.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\BOINC\boinctray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\BOINC\boinc.exe
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BOINC\projects\setiathome.berkeley.edu\AK_v8_win_SSE_P3.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\wlangui.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [boinctray] "C:\Programme\BOINC\boinctray.exe"
O4 - HKLM\..\Run: [boincmgr] "C:\Programme\BOINC\boincmgr.exe" /a /s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://learn.bbwonline.de/wd04bg/awlm/awswax.cab
O16 - DPF: {162247AF-26A7-44FC-A93A-69506EA244F3} (HWTest.HWTestControl) - http://maxdomeservice.1und1.de/de/systemcheck/HWTest.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158865244230
O16 - DPF: {DF6504AC-3EFE-4287-B259-FB299B069C95} (WEBDE Fotoalbum Upload Control) - https://img.web.de/v/mail/activex/fa_os_mms/upload_1132.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\programme\a-squared free\a2service.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Programme\avmwlanstick\WlanNetService.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Programme\RealVNC\VNC4\WinVNC4.exe

--
End of file - 5182 bytes


Gruß
Beggo

Alle Programme>Zubehör>Systemprogramme>Systemwiederherstellung

ist da garnichsmehr  ???




bis du als Admin eingeloggt ?

Kurz unter die Arme greif 

• Lade Random's System Information Tool (RSIT) herunter,
• speichere es auf Deinem Desktop.
• Starte mit Doppelklick die RSIT.exe.
• Klicke auf Continue, um die Nutzungsbedingungen zu akzeptieren.
• Der Scan startet automatisch, RSIT checkt nun einige wichtige System-Bereiche und produziert Logfiles als Analyse-Grundlage.
• Wenn der Scan beendet ist, werden zwei Logfiles erstellt und in Deinem Editor geöffnet.
• Bitte poste den Inhalt von C:\rsit\log.txt und C:\rsit\info.txt

Step 2

Während dieser Scans soll(en):

• alle anderen Scanner gegen Viren, Spyware, usw. deaktiviert sein,
  
• keine Verbindung zu einem Netzwerk/Internet bestehen (WLAN nicht vergessen),
  
• nichts am Rechner getan werden,
  
• nach jedem Scan der Rechner neu gestartet werden.

Rootkitscan mit RootRepeal

• Gehe hierhin, scrolle runter und downloade RootRepeal.zip.
  
• Entpacke die Datei auf Deinen Desktop.
  
• Doppelklicke die RootRepeal.exe, um den Scanner zu starten.
  
• Klicke auf den Reiter Report und dann auf den Button Scan.
  
• Mache einen Haken bei den folgenden Elementen und klicke Ok.

.
Drivers
Files
Processes
SSDT
Stealth Objects
Hidden Services
Shadow SSDT
.

• Im Anschluss wirst Du gefragt, welche Laufwerke gescannt werden sollen.
• Wähle C:\ und klicke wieder Ok.
• Der Suchlauf beginnt automatisch, es wird eine Weile dauern, bitte Geduld.
• Wenn der Suchlauf beendet ist, klicke auf Save Report.
  
• Speichere das Logfile als RootRepeal.txt auf dem Desktop.
  
• Kopiere den Inhalt hier in den Thread.

RSD, mach was draus

Hey,
ja bin als Admin angemeldet.
Nein da ist nix mehr, wenn ichs anklicke kommt die Meldung: Systemwiederherstellung kann nicht sichern, starten sie den Rechner neu. Habe schon vieles probiert.


@HJT-Larusso
ist ein Haufen Zeug:

Die Logs sind so lange, dass sie die maximale Länge übersteigen, splitte sie deshalb...



RSIT

Logfile of random's system information tool 1.06 (written by random/random)
Run by Admin at 2009-11-16 19:38:01
Microsoft Windows XP Professional Service Pack 3
System drive C: has 18 GB (46%) free of 39 GB
Total RAM: 511 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:38:15, on 16.11.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
c:\programme\a-squared free\a2service.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\FRITZ!DSL\IGDCTRL.EXE
C:\Programme\avmwlanstick\WlanNetService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Programme\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\BOINC\boinctray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\avmwlanstick\WLanGUI.exe
C:\Dokumente und Einstellungen\Admin\Desktop\RSIT.exe
C:\Programme\Trend Micro\HijackThis\Admin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\wlangui.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [boinctray] "C:\Programme\BOINC\boinctray.exe"
O4 - HKLM\..\Run: [boincmgr] "C:\Programme\BOINC\boincmgr.exe" /a /s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - http://learn.bbwonline.de/wd04bg/awlm/awswax.cab
O16 - DPF: {162247AF-26A7-44FC-A93A-69506EA244F3} (HWTest.HWTestControl) - http://maxdomeservice.1und1.de/de/systemcheck/HWTest.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158865244230
O16 - DPF: {DF6504AC-3EFE-4287-B259-FB299B069C95} (WEBDE Fotoalbum Upload Control) - https://img.web.de/v/mail/activex/fa_os_mms/upload_1132.cab
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - c:\programme\a-squared free\a2service.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Programme\avmwlanstick\WlanNetService.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Programme\RealVNC\VNC4\WinVNC4.exe

--
End of file - 5084 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\1-Klick-Wartung.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-07-25 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AVMWlanClient"=C:\Programme\avmwlanstick\wlangui.exe [2007-12-20 1748992]
"avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"boinctray"=C:\Programme\BOINC\boinctray.exe [2009-10-28 58112]
"boincmgr"=C:\Programme\BOINC\boincmgr.exe [2009-10-28 4793088]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALDI Foto Service]
C:\Programme\ALDI Sued Foto Service\ALDI_Foto_Service\FotoSuite.exe [2007-01-26 1167360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALDI_SUED_FotoSuite_Download]
C:\Programme\ALDI Sued Foto Service\ALDI_Foto_Service\FotoSuite.exe [2007-01-26 1167360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Programme\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Programme\QuickTime\qttask.exe -atboottime []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"mnmsrvc"=3
"ERSvc"=2
"Messenger"=2
"gusvc"=2

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\RealVNC\VNC4\winvnc4.exe"="C:\Programme\RealVNC\VNC4\winvnc4.exe:*:Enabled:winvnc4"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\Mozilla Firefox\firefox.exe"="C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\WINDOWS\system32\ftp.exe"="C:\WINDOWS\system32\ftp.exe:*:Enabled:Programm zur Dateiübertragung"
"C:\Programme\Gemeinsame Dateien\Ahead\Nero Web\SetupX.exe"="C:\Programme\Gemeinsame Dateien\Ahead\Nero Web\SetupX.exe:*:Disabled:Nero ProductSetup"
"C:\Program Files\WS_FTP\WS_FTP95.exe"="C:\Program Files\WS_FTP\WS_FTP95.exe:*:Disabled:WS_FTP 95"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

 

======List of files/folders created in the last 3 months======

2009-11-16 19:38:01 ----D---- C:\rsit
2009-11-16 19:30:06 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\WEB.DE
2009-11-15 18:27:48 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Ahead
2009-11-15 16:09:51 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\WinRAR
2009-11-15 11:17:05 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Malwarebytes
2009-11-15 11:16:50 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-11-15 11:16:49 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2009-11-15 09:40:41 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\QuickScan
2009-11-15 09:36:31 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla
2009-11-14 15:33:17 ----A---- C:\WINDOWS\system32\TUKernel.exe
2009-11-14 15:21:18 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2009-11-14 15:21:16 ----A---- C:\WINDOWS\system32\TuneUpDefragService.exe
2009-11-13 20:31:01 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2009-11-07 07:06:12 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2009-11-06 19:22:22 ----D---- C:\~ErdUserProfile.$$$
2009-11-06 16:55:46 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\TuneUp Software
2009-11-05 21:05:56 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\TrueCrypt
2009-11-05 21:01:47 ----D---- C:\Programme\TrueCrypt
2009-11-05 19:54:17 ----A---- C:\WINDOWS\system32\ntoskrnl.exe
2009-11-05 19:54:17 ----A---- C:\WINDOWS\system32\ntkrnlpa.exe
2009-11-05 18:47:10 ----N---- C:\WINDOWS\UNNeroBurnRights.exe
2009-11-05 18:46:05 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Macromedia
2009-11-05 18:46:05 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Adobe
2009-11-04 17:37:31 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Opera
2009-11-04 17:25:21 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Sun
2009-11-04 17:19:05 ----D---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Identities
2009-11-04 17:18:27 ----SD---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Microsoft
2009-11-04 17:18:27 ----ASH---- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\desktop.ini
2009-10-31 15:45:23 ----D---- C:\Programme\BOINC
2009-10-31 15:45:23 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BOINC
2009-10-24 08:29:30 ----D---- C:\Programme\Trend Micro
2009-10-20 19:05:14 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2009-10-20 19:04:56 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2009-10-20 19:04:39 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2009-10-20 19:02:44 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2009-10-20 19:01:14 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2009-10-20 18:06:43 ----A---- C:\WINDOWS\system32\TUProgSt.exe
2009-10-20 18:04:56 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
2009-10-20 18:04:50 ----D---- C:\Programme\TuneUp Utilities 2009
2009-10-20 18:02:57 ----SHD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{55A29068-F2CE-456C-9148-C869879E2357}
2009-10-15 19:39:22 ----HDC---- C:\WINDOWS\$NtUninstallKB973525$
2009-10-14 19:10:37 ----D---- C:\Programme\Avira
2009-10-14 19:10:37 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2009-10-12 07:15:29 ----HD---- C:\divx
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\vxblock.dll
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxwave.dll
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxsfs.dll
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxmas.dll
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxinsi64.exe
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxinsa64.exe
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxhpinst.exe
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxdrv.dll
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxcpyi64.exe
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxcpya64.exe
2009-10-08 19:45:25 ----N---- C:\WINDOWS\system32\pxafs.dll
2009-10-08 19:45:23 ----N---- C:\WINDOWS\system32\px.dll
2009-10-08 19:43:49 ----D---- C:\Programme\Gemeinsame Dateien\DivX Shared
2009-09-25 17:41:26 ----A---- C:\WINDOWS\system32\divx_xx16.dll
2009-09-25 17:41:26 ----A---- C:\WINDOWS\system32\divx_xx11.dll
2009-09-25 17:41:26 ----A---- C:\WINDOWS\system32\divx_xx0c.dll
2009-09-25 17:41:26 ----A---- C:\WINDOWS\system32\divx_xx0a.dll
2009-09-25 17:41:26 ----A---- C:\WINDOWS\system32\divx_xx07.dll
2009-09-25 17:41:26 ----A---- C:\WINDOWS\system32\DivX.dll
2009-09-21 18:35:57 ----D---- C:\WINDOWS\A5W_DATA
2009-09-21 18:35:57 ----A---- C:\WINDOWS\A5W.INI
2009-09-21 18:35:52 ----A---- C:\WINDOWS\AWSHKWV.INI
2009-09-18 20:15:18 ----D---- C:\Programme\eSpeak
2009-09-11 15:17:01 ----N---- C:\WINDOWS\system32\SET121.tmp
2009-09-11 15:17:01 ----A---- C:\WINDOWS\system32\SET236.tmp
2009-09-09 06:37:50 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2009-09-09 06:37:37 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2009-09-09 06:37:16 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$
2009-09-04 22:03:28 ----A---- C:\WINDOWS\system32\SET24A.tmp
2009-09-04 22:03:28 ----A---- C:\WINDOWS\system32\SET134.tmp
2009-09-02 12:46:30 ----HD---- C:\a9ae923d36940228a57e
2009-09-02 11:46:13 ----A---- C:\WINDOWS\system32\javaws.exe
2009-09-02 11:46:13 ----A---- C:\WINDOWS\system32\javaw.exe
2009-09-02 11:46:13 ----A---- C:\WINDOWS\system32\java.exe
2009-08-29 08:24:57 ----A---- C:\WINDOWS\system32\SET24F.tmp
2009-08-29 08:24:57 ----A---- C:\WINDOWS\system32\SET24E.tmp
2009-08-29 08:24:56 ----A---- C:\WINDOWS\system32\SET251.tmp
2009-08-29 08:24:56 ----A---- C:\WINDOWS\system32\SET250.tmp
2009-08-29 08:24:55 ----A---- C:\WINDOWS\system32\SET257.tmp
2009-08-29 08:24:53 ----A---- C:\WINDOWS\system32\SET259.tmp
2009-08-29 08:24:53 ----A---- C:\WINDOWS\system32\SET258.tmp
2009-08-29 08:24:51 ----A---- C:\WINDOWS\system32\SET260.tmp
2009-08-29 08:24:51 ----A---- C:\WINDOWS\system32\SET25D.tmp
2009-08-29 08:24:48 ----A---- C:\WINDOWS\system32\SET267.tmp
2009-08-29 08:24:48 ----A---- C:\WINDOWS\system32\SET262.tmp
2009-08-29 08:24:47 ----A---- C:\WINDOWS\system32\SET26B.tmp

======List of files/folders modified in the last 3 months======

2009-11-16 19:36:03 ----D---- C:\TEMP
2009-11-16 19:34:26 ----D---- C:\Programme\Mozilla Firefox
2009-11-16 19:33:29 ----D---- C:\!Downloads
2009-11-16 19:02:05 ----D---- C:\WINDOWS\system32\CatRoot2
2009-11-16 09:31:02 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-11-16 09:26:13 ----SHD---- C:\Config.Msi
2009-11-16 09:26:13 ----RSD---- C:\WINDOWS\assembly
2009-11-16 09:26:12 ----SHD---- C:\WINDOWS\Installer
2009-11-16 09:26:12 ----D---- C:\Programme
2009-11-16 07:49:04 ----D---- C:\WINDOWS\Prefetch
2009-11-16 07:39:38 ----A---- C:\WINDOWS\NeroDigital.ini
2009-11-15 19:00:23 ----D---- C:\WINDOWS
2009-11-15 18:57:12 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-11-15 18:57:06 ----D---- C:\WINDOWS\Temp
2009-11-15 18:57:06 ----D---- C:\WINDOWS\system32\Restore
2009-11-15 18:41:46 ----D---- C:\WINDOWS\system32
2009-11-15 18:41:43 ----D---- C:\WINDOWS\security
2009-11-15 18:41:37 ----D---- C:\WINDOWS\system32\drivers
2009-11-15 11:20:34 ----SHD---- C:\System Volume Information
2009-11-15 11:08:08 ----D---- C:\WINDOWS\Debug
2009-11-15 10:54:56 ----SH---- C:\boot.ini
2009-11-15 07:11:34 ----D---- C:\Programme\a-squared Free
2009-11-14 15:21:22 ----SD---- C:\WINDOWS\Tasks
2009-11-13 20:31:20 ----HD---- C:\WINDOWS\inf
2009-11-13 20:26:04 ----HD---- C:\WINDOWS\$hf_mig$
2009-11-07 09:06:31 ----A---- C:\WINDOWS\CSTBox.INI
2009-11-07 07:06:15 ----D---- C:\WINDOWS\WinSxS
2009-11-07 07:05:55 ----D---- C:\WINDOWS\system32\CatRoot
2009-11-05 20:48:53 ----D---- C:\WINDOWS\Help
2009-11-05 19:22:51 ----SHD---- C:\RECYCLER
2009-11-05 18:59:37 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-11-05 09:36:22 ----A---- C:\WINDOWS\system32\MRT.exe
2009-11-04 17:18:26 ----D---- C:\Dokumente und Einstellungen
2009-10-31 08:44:11 ----D---- C:\WINDOWS\system32\config
2009-10-30 19:58:25 ----D---- C:\Programme\DivX
2009-10-30 06:25:07 ----D---- C:\Programme\Opera
2009-10-20 19:14:22 ----D---- C:\WINDOWS\Microsoft.NET
2009-10-20 19:03:48 ----D---- C:\WINDOWS\system32\de-de
2009-10-20 19:03:47 ----D---- C:\Programme\Internet Explorer
2009-10-20 19:03:25 ----D---- C:\WINDOWS\ie7updates
2009-10-14 19:08:16 ----D---- C:\Programme\Gemeinsame Dateien\Microsoft Shared
2009-10-08 19:43:49 ----D---- C:\Programme\Gemeinsame Dateien
2009-09-25 17:56:30 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-09-21 18:35:07 ----D---- C:\WINDOWS\system32\Macromed
2009-09-21 18:21:32 ----D---- C:\WINDOWS\system
2009-09-19 13:29:07 ----D---- C:\WINDOWS\system32\NtmsData
2009-09-11 15:17:01 ----A---- C:\WINDOWS\system32\msv1_0.dll
2009-09-04 22:03:28 ----A---- C:\WINDOWS\system32\msasn1.dll
2009-09-02 12:48:31 ----D---- C:\WINDOWS\system32\XPSViewer
2009-09-02 12:48:24 ----D---- C:\WINDOWS\system32\en-us
2009-09-02 12:48:12 ----RSD---- C:\WINDOWS\Fonts
2009-09-02 12:43:30 ----D---- C:\Programme\Outlook Express
2009-09-02 12:05:24 ----D---- C:\WINDOWS\SxsCaPendDel
2009-09-02 11:46:10 ----D---- C:\Programme\Java
2009-08-26 09:00:21 ----A---- C:\WINDOWS\system32\strmdll.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 P3;Intel PentiumIII-Prozessortreiber; C:\WINDOWS\System32\DRIVERS\p3.sys [2008-04-14 46848]
R1 truecrypt;truecrypt; C:\WINDOWS\System32\drivers\truecrypt.sys [2009-11-05 223432]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-08-18 12032]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-07-28 55656]
R3 ati2mtag;ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [2004-08-03 701952]
R3 FWLANUSB;AVM FRITZ!WLAN; C:\WINDOWS\System32\DRIVERS\fwlanusb.sys [2007-12-20 265088]
R3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2008-05-15 47360]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB-Standardhubtreiber; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\System32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 VIAudio;VIA AC'97 Audiocontroller (WDM); C:\WINDOWS\system32\drivers\ac97via.sys [2002-08-28 84480]
S3 ati2mtaa;ati2mtaa; C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2004-08-03 327168]
S3 atimtag;atimtag; C:\WINDOWS\System32\DRIVERS\atimtag.sys []
S3 avmeject;AVM Eject; C:\WINDOWS\system32\drivers\avmeject.sys [2007-12-20 4352]
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Programme\MediaCoder\SysInfo.sys []
S3 es1371;Creative AudioPCI (ES1371,ES1373) (WDM); C:\WINDOWS\system32\drivers\es1371mp.sys [2001-08-17 40704]
S3 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
S3 usbscan;USB-Scannertreiber; C:\WINDOWS\System32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WDMWANMP;NDIS WAN miniport; C:\WINDOWS\System32\DRIVERS\wdmwanmp.sys [2002-03-21 26067]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 a2free;a-squared Free Service; c:\programme\a-squared free\a2service.exe [2009-09-26 1858144]
R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 AVM IGD CTRL Service;AVM IGD CTRL Service; C:\Programme\FRITZ!DSL\IGDCTRL.EXE [2005-11-21 81920]
R2 AVM WLAN Connection Service;AVM WLAN Connection Service; C:\Programme\avmwlanstick\WlanNetService.exe [2007-12-20 364544]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service; C:\WINDOWS\System32\TUProgSt.exe [2009-11-14 604488]
R2 UxTuneUp;TuneUp Designerweiterung; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 WinVNC4;VNC Server Version 4; C:\Programme\RealVNC\VNC4\WinVNC4.exe [2006-05-12 439248]
S3 aspnet_state;ASP.NET-Zustandsdienst; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 de_serv;AVM FRITZ!web Routing Service; C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe [2005-11-21 315392]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst; C:\WINDOWS\System32\TuneUpDefragService.exe [2009-11-14 361288]
S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\System32\wdfmgr.exe [2006-10-18 8704]
S4 NetTcpPortSharing;Net.Tcp-Portfreigabedienst; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 NMIndexingService;NMIndexingService; C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe []

-----------------EOF-----------------

info.txt logfile of random's system information tool 1.06 2009-11-16 19:38:20

======Uninstall list======

-->C:\Programme\DivX\DivXConverterUninstall.exe /CONVERTER
-->C:\Programme\Gemeinsame Dateien\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\Programme\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.57-->"C:\Programme\7-Zip\Uninstall.exe"
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Reader 7.0.9 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A70900000002}
Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Aldi Süd Fotoservice-->"C:\Programme\Aldi Sued Fotoservice\unins000.exe"
ALDI Sued Foto Service-->C:\Programme\ALDI Sued Foto Service\ALDI_Foto_Service\instslct.exe /p
ArcSoft PhotoStudio 5-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{03F1CC67-5BD8-4C36-8394-76311B2AE69A}\setup.exe" -l0x7  -uninst
a-squared Free 2.0-->"C:\Programme\a-squared Free\unins000.exe"
AudioCon-->C:\Programme\Basement Softworks\AudioCon\Uninstall.exe
Avira AntiVir Personal - Free Antivirus-->C:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE
AVM FRITZ!Box Dokumentation-->C:\Programme\FRITZ!Box\install.exe -d
AVM FRITZ!DSL-->C:\WINDOWS\IsUn0407.exe -fC:\Programme\FRITZ!DSL\WebUnins.isu -cC:\Programme\FRITZ!DSL\Webunins.dll
AVM FRITZ!WLAN-->C:\Programme\avmwlanstick\instwcli.exe -d1
BOINC-->MsiExec.exe /I{76B830B5-AFE2-498E-8A0E-0BB64B5EC87E}
Canon CanoScan Toolbox 4.1-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{BCE46757-7674-4416-BEDB-68205A60409E}\setup.exe" -l0x7
Canon PIXMA iP3000-->C:\WINDOWS\System32\CNMCP61.exe "-PRINTERNAMECanon PIXMA iP3000" "-HELPERDLLC:\BJPrinter\CNMWINDOWS\Canon PIXMA iP3000 Installer\Inst2\cnmis.dll" "-RCDLLC:\BJPrinter\CNMWINDOWS\Canon PIXMA iP3000 Installer\Inst2\cnmi0407.dll"
Cartes du Ciel-->"C:\Programme\Ciel\Uninstall.exe" "C:\Programme\Ciel\install.log"
CCleaner-->"C:\Programme\CCleaner\uninst.exe"
CopyToDVD 4-->"C:\Programme\VSO\unins000.exe"
DivX Codec-->C:\Programme\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Programme\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Programme\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Programme\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Web Player-->C:\Programme\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Energiewelten-->C:\WINDOWS\unin0407.exe -fc:\programme\Energiewelten\DeIsL1.isu  -cc:\programme\Energiewelten\_ISREG32.DLL
eSpeak version 1.41.01-->"C:\Programme\eSpeak\unins000.exe"
foobar2000 v0.9.5.1-->"C:\Programme\foobar2000\uninstall.exe"
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
HijackThis 2.0.2-->"C:\Programme\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix für Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
J2SE Runtime Environment 5.0 Update 10-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100}
J2SE Runtime Environment 5.0 Update 11-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110}
J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
J2SE Runtime Environment 5.0 Update 9-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090}
Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Malwarebytes' Anti-Malware-->"C:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
MediaCoder 0.6.2-->C:\Programme\MediaCoder\uninst.exe
Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU-->MsiExec.exe /I{9309DD7E-EBFE-3C95-8B47-30D3A012F606}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU-->MsiExec.exe /I{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack - DEU-->c:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack - deu\setup.exe
Microsoft .NET Framework 3.5 Language Pack - deu-->MsiExec.exe /I{1545207E-C6F3-31D7-9918-BDBB65075FBF}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110407-6000-11D3-8CFE-0150048383C9}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
Nero 7 Ultra Edition-->MsiExec.exe /I{5241FB1B-9CF5-448C-3BFD-1AE58B061031}
Nero BurnRights-->C:\WINDOWS\UNNeroBurnRights.exe /UNINSTALL
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
OmniPage SE-->MsiExec.exe /I{6249C22D-E6A8-407B-BA8B-40298848ED94}
Opera 10.01-->MsiExec.exe /X{4B296228-DF7C-43EA-8DED-76027355B219}
Physik Klasse 5-10-->MsiExec.exe /I{9877FA05-D6A3-464C-882D-DBE5A301D6D0}
PowerDVD-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe"  -uninstall
QuickTime-->MsiExec.exe /I{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8}
ratDVD 0.78.1444-->C:\Programme\ratDVD\uninst.exe
RealPlayer-->C:\Programme\Gemeinsame Dateien\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
RedShift 6 Kompakt-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{92B8D056-3B61-40E8-97B4-062BEAFFD7AB}\Setup.EXE" -l0x7
S500/S600 USB Driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{514DF7BB-D192-417C-BB60-58BF1FD34253}\Setup.exe"  anything
Sicherheitsupdate für Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB969897)-->"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB972260)-->"C:\WINDOWS\ie7updates\KB972260-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB913433)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB913433.inf
Sicherheitsupdate für Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Tom Clancy's Splinter Cell-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{A174402A-2EE6-4B86-A930-7BC85A9933BD}\setup.exe" -l0x7
TrueCrypt-->"C:\Programme\TrueCrypt\TrueCrypt Setup.exe" /u
TuneUp Utilities 2009-->MsiExec.exe /I{55A29068-F2CE-456C-9148-C869879E2357}
Umwelt: Technik Arbeitsblätter 1-->C:\WINDOWS\IsUn0407.exe -f"c:\Klett Werkstatt\Technik\Umwelt Technik Arbeitsblätter 1\Unins001.isu"
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
VideoLAN VLC media player 0.8.6f-->C:\Programme\VideoLAN\VLC\uninstall.exe
VNC Free Edition 4.1.2-->"C:\Programme\RealVNC\VNC4\unins000.exe"
WEB.DE Club SmartFax-->C:\Programme\WEB.DE\WEB.DE Club SmartFax\uninst.exe
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Media Format Runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player 10-->"C:\Programme\Windows Media Player\Setup_wm.exe" /Uninstall
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR-->C:\Programme\WinRAR\uninstall.exe
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
Xvid 1.1.3 final uninstall-->"C:\Programme\Xvid\unins000.exe"

 

=====HijackThis Backups=====

O15 - Trusted Zone: *.gomyhit.com (HKLM) [2009-11-15]
O15 - Trusted Zone: *.antimalwareguard.com (HKLM) [2009-11-15]

======Hosts File======

127.0.0.1   www.007guard.com
127.0.0.1   007guard.com
127.0.0.1   008i.com
127.0.0.1   www.008k.com
127.0.0.1   008k.com
127.0.0.1   www.00hq.com
127.0.0.1   00hq.com
127.0.0.1   010402.com
127.0.0.1   www.032439.com
127.0.0.1   032439.com

======Security center information======

AV: Avira AntiVir PersonalEdition Classic
AV: AntiVir Desktop (disabled)
AV: Avira AntiVir PersonalEdition Classic
AV: Avira AntiVir PersonalEdition Classic

======System event log======

Computer Name: ROCKET
Event Code: 7036
Message: Dienst "Telefonie" befindet sich jetzt im Status "Ausgeführt".

Record Number: 648
Source Name: Service Control Manager
Time Written: 20091026171330.000000+060
Event Type: Informationen
User:

Computer Name: ROCKET
Event Code: 7036
Message: Dienst "IMAPI-CD-Brenn-COM-Dienste" befindet sich jetzt im Status "Beendet".

Record Number: 647
Source Name: Service Control Manager
Time Written: 20091026171330.000000+060
Event Type: Informationen
User:

Computer Name: ROCKET
Event Code: 7036
Message: Dienst "Gatewaydienst auf Anwendungsebene" befindet sich jetzt im Status "Ausgeführt".

Record Number: 646
Source Name: Service Control Manager
Time Written: 20091026171329.000000+060
Event Type: Informationen
User:

Computer Name: ROCKET
Event Code: 7035
Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "Gatewaydienst auf Anwendungsebene" gesendet.

Record Number: 645
Source Name: Service Control Manager
Time Written: 20091026171329.000000+060
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: ROCKET
Event Code: 7036
Message: Dienst "NLA (Network Location Awareness)" befindet sich jetzt im Status "Ausgeführt".

Record Number: 644
Source Name: Service Control Manager
Time Written: 20091026171323.000000+060
Event Type: Informationen
User:

=====Application event log=====

Computer Name: ROCKET
Event Code: 1000
Message: Die Leistungsindikatoren für den Dienst aspnet_state (ASP.NET-Zustandsdienst) wurden geladen.
Die Daten enthalten die dem Dienst zugeordneten neuen Indexwerte.

Record Number: 5
Source Name: LoadPerf
Time Written: 20091020201229.000000+120
Event Type: Informationen
User:

Computer Name: ROCKET
Event Code: 1001
Message: Die Leistungsindikatoren für den Dienst aspnet_state (ASP.NET-Zustandsdienst) wurden entfernt. Die Daten
enthalten die neuen Werte der Registrierungseinträge Last Counter
und Last Help.

Record Number: 4
Source Name: LoadPerf
Time Written: 20091020201228.000000+120
Event Type: Informationen
User:

Computer Name: ROCKET
Event Code: 1001
Message: Die Leistungsindikatoren für den Dienst ASP.NET_2.0.50727 (ASP.NET_2.0.50727) wurden entfernt. Die Daten
enthalten die neuen Werte der Registrierungseinträge Last Counter
und Last Help.

Record Number: 3
Source Name: LoadPerf
Time Written: 20091020201220.000000+120
Event Type: Informationen
User:

Computer Name: ROCKET
Event Code: 1017
Message: ASP.NET (Version 2.0.50727.0) registrieren (internes Flag: 0x00000406)

Record Number: 2
Source Name: ASP.NET 2.0.50727.0
Time Written: 20091020201218.000000+120
Event Type: Informationen
User:

Computer Name: ROCKET
Event Code: 1025
Message: Produkt: Microsoft .NET Framework 2.0 Service Pack 2. Die Datei c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll wird von folgendem Prozess verwendet: jqs, Kennung 524.

Record Number: 1
Source Name: MsiInstaller
Time Written: 20091020201026.000000+120
Event Type: Informationen
User: ROCKET\Mr. C

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"NUMBER_OF_PROCESSORS"=1
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programme\QuickTime\QTSystem\;C:\Programme\Gemeinsame Dateien\DivX Shared\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 8 Stepping 6, GenuineIntel
"PROCESSOR_LEVEL"=6
"PROCESSOR_REVISION"=0806
"TEMP"=C:\TEMP
"TMP"=C:\TEMP
"windir"=%SystemRoot%
"CLASSPATH"=.;C:\Programme\Java\jre1.5.0_06\lib\ext\QTJava.zip
"QTJAVA"=C:\Programme\Java\jre1.5.0_06\lib\ext\QTJava.zip

-----------------EOF-----------------
 

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:      2009/11/16 19:53
Program Version:      Version 1.3.5.0
Windows Version:      Windows XP SP3
==================================================

Drivers
-------------------
Name: ac97via.sys
Image Path: C:\WINDOWS\system32\drivers\ac97via.sys
Address: 0xF7BE2000   Size: 84480   File Visible: -   Signed: -
Status: -

Name: ACPI.sys
Image Path: ACPI.sys
Address: 0xF84E6000   Size: 188800   File Visible: -   Signed: -
Status: -

Name: ACPI_HAL
Image Path: \Driver\ACPI_HAL
Address: 0x804D7000   Size: 2331136   File Visible: -   Signed: -
Status: -

Name: afd.sys
Image Path: C:\WINDOWS\System32\drivers\afd.sys
Address: 0xF18A8000   Size: 138496   File Visible: -   Signed: -
Status: -

Name: atapi.sys
Image Path: atapi.sys
Address: 0xF8478000   Size: 96512   File Visible: -   Signed: -
Status: -

Name: ati2cqag.dll
Image Path: C:\WINDOWS\System32\ati2cqag.dll
Address: 0xBFA0C000   Size: 229376   File Visible: -   Signed: -
Status: -

Name: ati2dvag.dll
Image Path: C:\WINDOWS\System32\ati2dvag.dll
Address: 0xBF9D6000   Size: 221184   File Visible: -   Signed: -
Status: -

Name: ati2mtag.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ati2mtag.sys
Address: 0xF7C52000   Size: 815104   File Visible: -   Signed: -
Status: -

Name: ati3d1ag.dll
Image Path: C:\WINDOWS\System32\ati3d1ag.dll
Address: 0xBFA44000   Size: 872448   File Visible: -   Signed: -
Status: -

Name: ATMFD.DLL
Image Path: C:\WINDOWS\System32\ATMFD.DLL
Address: 0xBFFA0000   Size: 286720   File Visible: -   Signed: -
Status: -

Name: audstub.sys
Image Path: C:\WINDOWS\System32\DRIVERS\audstub.sys
Address: 0xF8C86000   Size: 3072   File Visible: -   Signed: -
Status: -

Name: avgio.sys
Image Path: C:\Programme\Avira\AntiVir Desktop\avgio.sys
Address: 0xF8A7C000   Size: 6144   File Visible: -   Signed: -
Status: -

Name: avgntflt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\avgntflt.sys
Address: 0xF1562000   Size: 81920   File Visible: -   Signed: -
Status: -

Name: avipbb.sys
Image Path: C:\WINDOWS\system32\DRIVERS\avipbb.sys
Address: 0xF16CE000   Size: 114688   File Visible: -   Signed: -
Status: -

Name: Beep.SYS
Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS
Address: 0xF8A74000   Size: 4224   File Visible: -   Signed: -
Status: -

Name: BOOTVID.dll
Image Path: C:\WINDOWS\system32\BOOTVID.dll
Address: 0xF8946000   Size: 12288   File Visible: -   Signed: -
Status: -

Name: Cdfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS
Address: 0xF86D6000   Size: 63744   File Visible: -   Signed: -
Status: -

Name: cdrom.sys
Image Path: C:\WINDOWS\System32\DRIVERS\cdrom.sys
Address: 0xF7D79000   Size: 62976   File Visible: -   Signed: -
Status: -

Name: CLASSPNP.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS
Address: 0xF8576000   Size: 53248   File Visible: -   Signed: -
Status: -

Name: disk.sys
Image Path: disk.sys
Address: 0xF8566000   Size: 36352   File Visible: -   Signed: -
Status: -

Name: dmio.sys
Image Path: dmio.sys
Address: 0xF8490000   Size: 154112   File Visible: -   Signed: -
Status: -

Name: dmload.sys
Image Path: dmload.sys
Address: 0xF8A3C000   Size: 5888   File Visible: -   Signed: -
Status: -

Name: drmk.sys
Image Path: C:\WINDOWS\system32\drivers\drmk.sys
Address: 0xF7D49000   Size: 61440   File Visible: -   Signed: -
Status: -

Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF16B6000   Size: 98304   File Visible: No   Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF8A7E000   Size: 8192   File Visible: No   Signed: -
Status: -

Name: Dxapi.sys
Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys
Address: 0xF7B01000   Size: 12288   File Visible: -   Signed: -
Status: -

Name: dxg.sys
Image Path: C:\WINDOWS\System32\drivers\dxg.sys
Address: 0xBF9C4000   Size: 73728   File Visible: -   Signed: -
Status: -

Name: dxgthk.sys
Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys
Address: 0xF8BCF000   Size: 4096   File Visible: -   Signed: -
Status: -

Name: Fastfat.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fastfat.SYS
Address: 0xF12BE000   Size: 143744   File Visible: -   Signed: -
Status: -

Name: fdc.sys
Image Path: C:\WINDOWS\System32\DRIVERS\fdc.sys
Address: 0xF88A6000   Size: 27392   File Visible: -   Signed: -
Status: -

Name: Fips.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fips.SYS
Address: 0xF8696000   Size: 44672   File Visible: -   Signed: -
Status: -

Name: flpydisk.sys
Image Path: C:\WINDOWS\System32\DRIVERS\flpydisk.sys
Address: 0xF88D6000   Size: 20480   File Visible: -   Signed: -
Status: -

Name: fltmgr.sys
Image Path: fltmgr.sys
Address: 0xF8458000   Size: 129792   File Visible: -   Signed: -
Status: -

Name: Fs_Rec.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS
Address: 0xF8A64000   Size: 7936   File Visible: -   Signed: -
Status: -

Name: ftdisk.sys
Image Path: ftdisk.sys
Address: 0xF84B6000   Size: 126336   File Visible: -   Signed: -
Status: -

Name: fwlanusb.sys
Image Path: C:\WINDOWS\System32\DRIVERS\fwlanusb.sys
Address: 0xF197E000   Size: 265088   File Visible: -   Signed: -
Status: -

Name: gameenum.sys
Image Path: C:\WINDOWS\System32\DRIVERS\gameenum.sys
Address: 0xF829A000   Size: 10624   File Visible: -   Signed: -
Status: -

Name: hal.dll
Image Path: C:\WINDOWS\system32\hal.dll
Address: 0x80711000   Size: 81152   File Visible: -   Signed: -
Status: -

Name: HIDCLASS.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\HIDCLASS.SYS
Address: 0xF8676000   Size: 36864   File Visible: -   Signed: -
Status: -

Name: HIDPARSE.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\HIDPARSE.SYS
Address: 0xF88F6000   Size: 28672   File Visible: -   Signed: -
Status: -

Name: hidusb.sys
Image Path: C:\WINDOWS\System32\DRIVERS\hidusb.sys
Address: 0xF8282000   Size: 10368   File Visible: -   Signed: -
Status: -

Name: i8042prt.sys
Image Path: C:\WINDOWS\System32\DRIVERS\i8042prt.sys
Address: 0xF7D29000   Size: 52992   File Visible: -   Signed: -
Status: -

Name: imapi.sys
Image Path: C:\WINDOWS\System32\DRIVERS\imapi.sys
Address: 0xF7D59000   Size: 42112   File Visible: -   Signed: -
Status: -

Name: ipnat.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ipnat.sys
Address: 0xF17B2000   Size: 152832   File Visible: -   Signed: -
Status: -

Name: ipsec.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ipsec.sys
Address: 0xF194B000   Size: 75264   File Visible: -   Signed: -
Status: -

Name: isapnp.sys
Image Path: isapnp.sys
Address: 0xF8536000   Size: 37632   File Visible: -   Signed: -
Status: -

Name: kbdclass.sys
Image Path: C:\WINDOWS\System32\DRIVERS\kbdclass.sys
Address: 0xF88AE000   Size: 25216   File Visible: -   Signed: -
Status: -

Name: KDCOM.DLL
Image Path: C:\WINDOWS\system32\KDCOM.DLL
Address: 0xF8A36000   Size: 8192   File Visible: -   Signed: -
Status: -

Name: kmixer.sys
Image Path: C:\WINDOWS\system32\drivers\kmixer.sys
Address: 0xF0879000   Size: 172416   File Visible: -   Signed: -
Status: -

Name: ks.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ks.sys
Address: 0xF7C1B000   Size: 143360   File Visible: -   Signed: -
Status: -

Name: KSecDD.sys
Image Path: KSecDD.sys
Address: 0xF842F000   Size: 92928   File Visible: -   Signed: -
Status: -

 

Name: mnmdd.SYS
Image Path: C:\WINDOWS\System32\Drivers\mnmdd.SYS
Address: 0xF8A76000   Size: 4224   File Visible: -   Signed: -
Status: -

Name: mouclass.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mouclass.sys
Address: 0xF88CE000   Size: 23552   File Visible: -   Signed: -
Status: -

Name: mouhid.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mouhid.sys
Address: 0xF89C2000   Size: 12288   File Visible: -   Signed: -
Status: -

Name: MountMgr.sys
Image Path: MountMgr.sys
Address: 0xF8546000   Size: 42368   File Visible: -   Signed: -
Status: -

Name: mrxsmb.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
Address: 0xF17D8000   Size: 455296   File Visible: -   Signed: -
Status: -

Name: Msfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS
Address: 0xF890E000   Size: 19072   File Visible: -   Signed: -
Status: -

Name: msgpc.sys
Image Path: C:\WINDOWS\System32\DRIVERS\msgpc.sys
Address: 0xF85F6000   Size: 35072   File Visible: -   Signed: -
Status: -

Name: mssmbios.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mssmbios.sys
Address: 0xF8A1E000   Size: 15488   File Visible: -   Signed: -
Status: -

Name: Mup.sys
Image Path: Mup.sys
Address: 0xF82CA000   Size: 105344   File Visible: -   Signed: -
Status: -

Name: NDIS.sys
Image Path: NDIS.sys
Address: 0xF8375000   Size: 182656   File Visible: -   Signed: -
Status: -

Name: ndistapi.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ndistapi.sys
Address: 0xF8A02000   Size: 10112   File Visible: -   Signed: -
Status: -

Name: ndiswan.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ndiswan.sys
Address: 0xF7B93000   Size: 91520   File Visible: -   Signed: -
Status: -

Name: NDProxy.SYS
Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS
Address: 0xF8626000   Size: 40576   File Visible: -   Signed: -
Status: -

Name: netbios.sys
Image Path: C:\WINDOWS\System32\DRIVERS\netbios.sys
Address: 0xF8686000   Size: 34688   File Visible: -   Signed: -
Status: -

Name: netbt.sys
Image Path: C:\WINDOWS\System32\DRIVERS\netbt.sys
Address: 0xF18CA000   Size: 162816   File Visible: -   Signed: -
Status: -

Name: Npfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS
Address: 0xF8916000   Size: 30848   File Visible: -   Signed: -
Status: -

Name: Ntfs.sys
Image Path: Ntfs.sys
Address: 0xF83A2000   Size: 574976   File Visible: -   Signed: -
Status: -

Name: Null.SYS
Image Path: C:\WINDOWS\System32\Drivers\Null.SYS
Address: 0xF8B78000   Size: 2944   File Visible: -   Signed: -
Status: -

Name: p3.sys
Image Path: C:\WINDOWS\System32\DRIVERS\p3.sys
Address: 0xF7D89000   Size: 46848   File Visible: -   Signed: -
Status: -

Name: parport.sys
Image Path: C:\WINDOWS\System32\DRIVERS\parport.sys
Address: 0xF7BAA000   Size: 80384   File Visible: -   Signed: -
Status: -

Name: PartMgr.sys
Image Path: PartMgr.sys
Address: 0xF87BE000   Size: 19712   File Visible: -   Signed: -
Status: -

Name: ParVdm.SYS
Image Path: C:\WINDOWS\System32\Drivers\ParVdm.SYS
Address: 0xF8A72000   Size: 7040   File Visible: -   Signed: -
Status: -

Name: pci.sys
Image Path: pci.sys
Address: 0xF84D5000   Size: 68224   File Visible: -   Signed: -
Status: -

Name: PCIIDEX.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS
Address: 0xF87B6000   Size: 28672   File Visible: -   Signed: -
Status: -

Name: pcouffin.sys
Image Path: C:\WINDOWS\System32\Drivers\pcouffin.sys
Address: 0xF8606000   Size: 47360   File Visible: -   Signed: -
Status: -

Name: PnpManager
Image Path: \Driver\PnpManager
Address: 0x804D7000   Size: 2331136   File Visible: -   Signed: -
Status: -

Name: portcls.sys
Image Path: C:\WINDOWS\system32\drivers\portcls.sys
Address: 0xF7BBE000   Size: 147456   File Visible: -   Signed: -
Status: -

Name: psched.sys
Image Path: C:\WINDOWS\System32\DRIVERS\psched.sys
Address: 0xF7B82000   Size: 69120   File Visible: -   Signed: -
Status: -

Name: ptilink.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ptilink.sys
Address: 0xF88BE000   Size: 17792   File Visible: -   Signed: -
Status: -

Name: PxHelp20.sys
Image Path: PxHelp20.sys
Address: 0xF8586000   Size: 35712   File Visible: -   Signed: -
Status: -

Name: rasacd.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rasacd.sys
Address: 0xF89C6000   Size: 8832   File Visible: -   Signed: -
Status: -

Name: rasl2tp.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rasl2tp.sys
Address: 0xF7D19000   Size: 51328   File Visible: -   Signed: -
Status: -

Name: raspppoe.sys
Image Path: C:\WINDOWS\System32\DRIVERS\raspppoe.sys
Address: 0xF85D6000   Size: 41472   File Visible: -   Signed: -
Status: -

Name: raspptp.sys
Image Path: C:\WINDOWS\System32\DRIVERS\raspptp.sys
Address: 0xF85E6000   Size: 48384   File Visible: -   Signed: -
Status: -

Name: raspti.sys
Image Path: C:\WINDOWS\System32\DRIVERS\raspti.sys
Address: 0xF88C6000   Size: 16512   File Visible: -   Signed: -
Status: -

Name: RAW
Image Path: \FileSystem\RAW
Address: 0x804D7000   Size: 2331136   File Visible: -   Signed: -
Status: -

Name: rdbss.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rdbss.sys
Address: 0xF1848000   Size: 175744   File Visible: -   Signed: -
Status: -

Name: RDPCDD.sys
Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys
Address: 0xF8A78000   Size: 4224   File Visible: -   Signed: -
Status: -

Name: rdpdr.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rdpdr.sys
Address: 0xF7B0D000   Size: 196224   File Visible: -   Signed: -
Status: -

Name: redbook.sys
Image Path: C:\WINDOWS\System32\DRIVERS\redbook.sys
Address: 0xF7D69000   Size: 57728   File Visible: -   Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF0D66000   Size: 49152   File Visible: No   Signed: -
Status: -

Name: serenum.sys
Image Path: C:\WINDOWS\System32\DRIVERS\serenum.sys
Address: 0xF89FE000   Size: 15744   File Visible: -   Signed: -
Status: -

Name: serial.sys
Image Path: C:\WINDOWS\System32\DRIVERS\serial.sys
Address: 0xF7D39000   Size: 65536   File Visible: -   Signed: -
Status: -

Name: sr.sys
Image Path: sr.sys
Address: 0xF8446000   Size: 73472   File Visible: -   Signed: -
Status: -

Name: srv.sys
Image Path: C:\WINDOWS\System32\DRIVERS\srv.sys
Address: 0xF0DEE000   Size: 333952   File Visible: -   Signed: -
Status: -

Name: swenum.sys
Image Path: C:\WINDOWS\System32\DRIVERS\swenum.sys
Address: 0xF8A60000   Size: 4352   File Visible: -   Signed: -
Status: -

Name: sysaudio.sys
Image Path: C:\WINDOWS\system32\drivers\sysaudio.sys
Address: 0xF16FA000   Size: 60800   File Visible: -   Signed: -
Status: -

Name: tcpip.sys
Image Path: C:\WINDOWS\System32\DRIVERS\tcpip.sys
Address: 0xF18F2000   Size: 361600   File Visible: -   Signed: -
Status: -

Name: TDI.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\TDI.SYS
Address: 0xF88B6000   Size: 20480   File Visible: -   Signed: -
Status: -

Name: termdd.sys
Image Path: C:\WINDOWS\System32\DRIVERS\termdd.sys
Address: 0xF8616000   Size: 40704   File Visible: -   Signed: -
Status: -

Name: truecrypt.sys
Image Path: C:\WINDOWS\System32\drivers\truecrypt.sys
Address: 0xF1873000   Size: 215808   File Visible: -   Signed: -
Status: -

Name: TUKERNEL.EXE
Image Path: C:\WINDOWS\system32\TUKERNEL.EXE
Address: 0x804D7000   Size: 2331136   File Visible: -   Signed: -
Status: -

Name: update.sys
Image Path: C:\WINDOWS\System32\DRIVERS\update.sys
Address: 0xF7A87000   Size: 384768   File Visible: -   Signed: -
Status: -

Name: USBD.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\USBD.SYS
Address: 0xF8A62000   Size: 8192   File Visible: -   Signed: -
Status: -

Name: usbehci.sys
Image Path: C:\WINDOWS\System32\DRIVERS\usbehci.sys
Address: 0xF889E000   Size: 30208   File Visible: -   Signed: -
Status: -

Name: usbhub.sys
Image Path: C:\WINDOWS\System32\DRIVERS\usbhub.sys
Address: 0xF8656000   Size: 59520   File Visible: -   Signed: -
Status: -

Name: USBPORT.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\USBPORT.SYS
Address: 0xF7BF7000   Size: 147456   File Visible: -   Signed: -
Status: -

Name: usbprint.sys
Image Path: C:\WINDOWS\System32\DRIVERS\usbprint.sys
Address: 0xF88FE000   Size: 25856   File Visible: -   Signed: -
Status: -

Name: usbuhci.sys
Image Path: C:\WINDOWS\System32\DRIVERS\usbuhci.sys
Address: 0xF8896000   Size: 20608   File Visible: -   Signed: -
Status: -

Name: vga.sys
Image Path: C:\WINDOWS\System32\drivers\vga.sys
Address: 0xF8906000   Size: 20992   File Visible: -   Signed: -
Status: -

Name: viaagp.sys
Image Path: viaagp.sys
Address: 0xF8596000   Size: 42240   File Visible: -   Signed: -
Status: -

Name: viaide.sys
Image Path: viaide.sys
Address: 0xF8A3A000   Size: 5376   File Visible: -   Signed: -
Status: -

Name: VIDEOPRT.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS
Address: 0xF7C3E000   Size: 81920   File Visible: -   Signed: -
Status: -

Name: VolSnap.sys
Image Path: VolSnap.sys
Address: 0xF8556000   Size: 53760   File Visible: -   Signed: -
Status: -

Name: wanarp.sys
Image Path: C:\WINDOWS\System32\DRIVERS\wanarp.sys
Address: 0xF86A6000   Size: 34560   File Visible: -   Signed: -
Status: -

Name: watchdog.sys
Image Path: C:\WINDOWS\System32\watchdog.sys
Address: 0xF891E000   Size: 20480   File Visible: -   Signed: -
Status: -

Name: wdmaud.sys
Image Path: C:\WINDOWS\system32\drivers\wdmaud.sys
Address: 0xF11E1000   Size: 83072   File Visible: -   Signed: -
Status: -

Name: WDMCAPI.sys
Image Path: WDMCAPI.sys
Address: 0xF82E4000   Size: 590592   File Visible: -   Signed: -
Status: -

Name: Win32k
Image Path: \Driver\Win32k
Address: 0xBF800000   Size: 1851392   File Visible: -   Signed: -
Status: -

Name: win32k.sys
Image Path: C:\WINDOWS\System32\win32k.sys
Address: 0xBF800000   Size: 1851392   File Visible: -   Signed: -
Status: -

Name: WMILIB.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\WMILIB.SYS
Address: 0xF8A38000   Size: 8192   File Visible: -   Signed: -
Status: -

Name: WMIxWDM
Image Path: \Driver\WMIxWDM
Address: 0x804D7000   Size: 2331136   File Visible: -   Signed: -
Status: -

Name: ws2ifsl.sys
Image Path: C:\WINDOWS\System32\drivers\ws2ifsl.sys
Address: 0xF89CA000   Size: 12032   File Visible: -   Signed: -
Status: -

 

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:      2009/11/16 20:20
Program Version:      Version 1.3.5.0
Windows Version:      Windows XP SP3
==================================================

Hidden/Locked Files
-------------------
 

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:      2009/11/16 20:20
Program Version:      Version 1.3.5.0
Windows Version:      Windows XP SP3
==================================================

Processes
-------------------
Path: System
PID: 4   Status: -

Path: C:\WINDOWS\system32\TUProgSt.exe
PID: 280   Status: -

Path: C:\Programme\RealVNC\VNC4\winvnc4.exe
PID: 440   Status: -

Path: C:\WINDOWS\system32\smss.exe
PID: 544   Status: -

Path: C:\WINDOWS\system32\csrss.exe
PID: 700   Status: -

Path: C:\Programme\Avira\AntiVir Desktop\avguard.exe
PID: 720   Status: -

Path: C:\WINDOWS\system32\winlogon.exe
PID: 760   Status: -

Path: C:\WINDOWS\system32\services.exe
PID: 824   Status: -

Path: C:\WINDOWS\system32\lsass.exe
PID: 836   Status: -

Path: C:\WINDOWS\system32\svchost.exe
PID: 1052   Status: -

Path: C:\WINDOWS\system32\svchost.exe
PID: 1152   Status: -

Path: C:\WINDOWS\system32\svchost.exe
PID: 1268   Status: -

Path: C:\Programme\a-squared Free\a2service.exe
PID: 1328   Status: -

Path: C:\WINDOWS\system32\svchost.exe
PID: 1432   Status: -

Path: C:\Programme\FRITZ!DSL\IGDCTRL.EXE
PID: 1496   Status: -

Path: C:\Programme\avmwlanstick\WLanNetService.exe
PID: 1588   Status: -

Path: C:\WINDOWS\system32\svchost.exe
PID: 1612   Status: -

Path: C:\WINDOWS\system32\spoolsv.exe
PID: 1776   Status: -

Path: C:\Programme\Avira\AntiVir Desktop\sched.exe
PID: 1844   Status: -

Path: C:\WINDOWS\system32\svchost.exe
PID: 1980   Status: -

Path: C:\WINDOWS\system32\alg.exe
PID: 2396   Status: -

Path: C:\WINDOWS\explorer.exe
PID: 2892   Status: -

Path: C:\Dokumente und Einstellungen\Admin\Desktop\RootRepeal\RootRepeal.exe
PID: 3000   Status: -

Path: C:\Programme\avmwlanstick\WLanGUI.exe
PID: 3156   Status: -

Path: C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PID: 3168   Status: -

Path: C:\Programme\BOINC\boinctray.exe
PID: 3228   Status: -

Path: C:\WINDOWS\system32\ctfmon.exe
PID: 3280   Status: -

 

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:      2009/11/16 20:21
Program Version:      Version 1.3.5.0
Windows Version:      Windows XP SP3
==================================================

SSDT
-------------------
#: 000   Function Name: NtAcceptConnectPort
Status: Not hooked

#: 001   Function Name: NtAccessCheck
Status: Not hooked

#: 002   Function Name: NtAccessCheckAndAuditAlarm
Status: Not hooked

#: 003   Function Name: NtAccessCheckByType
Status: Not hooked

#: 004   Function Name: NtAccessCheckByTypeAndAuditAlarm
Status: Not hooked

#: 005   Function Name: NtAccessCheckByTypeResultList
Status: Not hooked

#: 006   Function Name: NtAccessCheckByTypeResultListAndAuditAlarm
Status: Not hooked

#: 007   Function Name: NtAccessCheckByTypeResultListAndAuditAlarmByHandle
Status: Not hooked

#: 008   Function Name: NtAddAtom
Status: Not hooked

#: 009   Function Name: NtAddBootEntry
Status: Not hooked

#: 010   Function Name: NtAdjustGroupsToken
Status: Not hooked

#: 011   Function Name: NtAdjustPrivilegesToken
Status: Not hooked

#: 012   Function Name: NtAlertResumeThread
Status: Not hooked

#: 013   Function Name: NtAlertThread
Status: Not hooked

#: 014   Function Name: NtAllocateLocallyUniqueId
Status: Not hooked

#: 015   Function Name: NtAllocateUserPhysicalPages
Status: Not hooked

#: 016   Function Name: NtAllocateUuids
Status: Not hooked

#: 017   Function Name: NtAllocateVirtualMemory
Status: Not hooked

#: 018   Function Name: NtAreMappedFilesTheSame
Status: Not hooked

#: 019   Function Name: NtAssignProcessToJobObject
Status: Not hooked

#: 020   Function Name: NtCallbackReturn
Status: Not hooked

#: 021   Function Name: NtCancelDeviceWakeupRequest
Status: Not hooked

#: 022   Function Name: NtCancelIoFile
Status: Not hooked

#: 023   Function Name: NtCancelTimer
Status: Not hooked

#: 024   Function Name: NtClearEvent
Status: Not hooked

#: 025   Function Name: NtClose
Status: Not hooked

#: 026   Function Name: NtCloseObjectAuditAlarm
Status: Not hooked

#: 027   Function Name: NtCompactKeys
Status: Not hooked

#: 028   Function Name: NtCompareTokens
Status: Not hooked

#: 029   Function Name: NtCompleteConnectPort
Status: Not hooked

#: 030   Function Name: NtCompressKey
Status: Not hooked

#: 031   Function Name: NtConnectPort
Status: Not hooked

#: 032   Function Name: NtContinue
Status: Not hooked

#: 033   Function Name: NtCreateDebugObject
Status: Not hooked

#: 034   Function Name: NtCreateDirectoryObject
Status: Not hooked

#: 035   Function Name: NtCreateEvent
Status: Not hooked

#: 036   Function Name: NtCreateEventPair
Status: Not hooked

#: 037   Function Name: NtCreateFile
Status: Not hooked

#: 038   Function Name: NtCreateIoCompletion
Status: Not hooked

#: 039   Function Name: NtCreateJobObject
Status: Not hooked

#: 040   Function Name: NtCreateJobSet
Status: Not hooked

#: 041   Function Name: NtCreateKey
Status: Hooked by "<unknown>" at address 0xf8ba2976

#: 042   Function Name: NtCreateMailslotFile
Status: Not hooked

#: 043   Function Name: NtCreateMutant
Status: Not hooked

#: 044   Function Name: NtCreateNamedPipeFile
Status: Not hooked

#: 045   Function Name: NtCreatePagingFile
Status: Not hooked

#: 046   Function Name: NtCreatePort
Status: Not hooked

#: 047   Function Name: NtCreateProcess
Status: Not hooked

#: 048   Function Name: NtCreateProcessEx
Status: Not hooked

#: 049   Function Name: NtCreateProfile
Status: Not hooked

#: 050   Function Name: NtCreateSection
Status: Not hooked

#: 051   Function Name: NtCreateSemaphore
Status: Not hooked

#: 052   Function Name: NtCreateSymbolicLinkObject
Status: Not hooked

#: 053   Function Name: NtCreateThread
Status: Hooked by "<unknown>" at address 0xf8ba296c

#: 054   Function Name: NtCreateTimer
Status: Not hooked

#: 055   Function Name: NtCreateToken
Status: Not hooked

#: 056   Function Name: NtCreateWaitablePort
Status: Not hooked

#: 057   Function Name: NtDebugActiveProcess
Status: Not hooked

#: 058   Function Name: NtDebugContinue
Status: Not hooked

#: 059   Function Name: NtDelayExecution
Status: Not hooked

#: 060   Function Name: NtDeleteAtom
Status: Not hooked

#: 061   Function Name: NtDeleteBootEntry
Status: Not hooked

#: 062   Function Name: NtDeleteFile
Status: Not hooked

#: 063   Function Name: NtDeleteKey
Status: Hooked by "<unknown>" at address 0xf8ba297b

#: 064   Function Name: NtDeleteObjectAuditAlarm
Status: Not hooked

#: 065   Function Name: NtDeleteValueKey
Status: Hooked by "<unknown>" at address 0xf8ba2985

#: 066   Function Name: NtDeviceIoControlFile
Status: Not hooked

#: 067   Function Name: NtDisplayString
Status: Not hooked

#: 068   Function Name: NtDuplicateObject
Status: Not hooked

#: 069   Function Name: NtDuplicateToken
Status: Not hooked

#: 070   Function Name: NtEnumerateBootEntries
Status: Not hooked

#: 071   Function Name: NtEnumerateKey
Status: Not hooked

#: 072   Function Name: NtEnumerateSystemEnvironmentValuesEx
Status: Not hooked

#: 073   Function Name: NtEnumerateValueKey
Status: Not hooked

#: 074   Function Name: NtExtendSection
Status: Not hooked

#: 075   Function Name: NtFilterToken
Status: Not hooked

#: 076   Function Name: NtFindAtom
Status: Not hooked

#: 077   Function Name: NtFlushBuffersFile
Status: Not hooked

#: 078   Function Name: NtFlushInstructionCache
Status: Not hooked

#: 079   Function Name: NtFlushKey
Status: Not hooked

#: 080   Function Name: NtFlushVirtualMemory
Status: Not hooked

#: 081   Function Name: NtFlushWriteBuffer
Status: Not hooked

#: 082   Function Name: NtFreeUserPhysicalPages
Status: Not hooked

#: 083   Function Name: NtFreeVirtualMemory
Status: Not hooked

#: 084   Function Name: NtFsControlFile
Status: Not hooked

#: 085   Function Name: NtGetContextThread
Status: Not hooked

#: 086   Function Name: NtGetDevicePowerState
Status: Not hooked

#: 087   Function Name: NtGetPlugPlayEvent
Status: Not hooked

#: 088   Function Name: NtGetWriteWatch
Status: Not hooked

#: 089   Function Name: NtImpersonateAnonymousToken
Status: Not hooked

#: 090   Function Name: NtImpersonateClientOfPort
Status: Not hooked

#: 091   Function Name: NtImpersonateThread
Status: Not hooked

#: 092   Function Name: NtInitializeRegistry
Status: Not hooked

#: 093   Function Name: NtInitiatePowerAction
Status: Not hooked

#: 094   Function Name: NtIsProcessInJob
Status: Not hooked

#: 095   Function Name: NtIsSystemResumeAutomatic
Status: Not hooked

#: 096   Function Name: NtListenPort
Status: Not hooked

#: 097   Function Name: NtLoadDriver
Status: Not hooked

#: 098   Function Name: NtLoadKey
Status: Hooked by "<unknown>" at address 0xf8ba298a

#: 099   Function Name: NtLoadKey2
Status: Not hooked

#: 100   Function Name: NtLockFile
Status: Not hooked

#: 101   Function Name: NtLockProductActivationKeys
Status: Not hooked

#: 102   Function Name: NtLockRegistryKey
Status: Not hooked

#: 103   Function Name: NtLockVirtualMemory
Status: Not hooked

#: 104   Function Name: NtMakePermanentObject
Status: Not hooked

#: 105   Function Name: NtMakeTemporaryObject
Status: Not hooked

#: 106   Function Name: NtMapUserPhysicalPages
Status: Not hooked

#: 107   Function Name: NtMapUserPhysicalPagesScatter
Status: Not hooked

#: 108   Function Name: NtMapViewOfSection
Status: Not hooked

#: 109   Function Name: NtModifyBootEntry
Status: Not hooked

#: 110   Function Name: NtNotifyChangeDirectoryFile
Status: Not hooked

#: 111   Function Name: NtNotifyChangeKey
Status: Not hooked

#: 112   Function Name: NtNotifyChangeMultipleKeys
Status: Not hooked

#: 113   Function Name: NtOpenDirectoryObject
Status: Not hooked

#: 114   Function Name: NtOpenEvent
Status: Not hooked

#: 115   Function Name: NtOpenEventPair
Status: Not hooked

#: 116   Function Name: NtOpenFile
Status: Not hooked

#: 117   Function Name: NtOpenIoCompletion
Status: Not hooked

#: 118   Function Name: NtOpenJobObject
Status: Not hooked

#: 119   Function Name: NtOpenKey
Status: Not hooked

#: 120   Function Name: NtOpenMutant
Status: Not hooked

#: 121   Function Name: NtOpenObjectAuditAlarm
Status: Not hooked

#: 122   Function Name: NtOpenProcess
Status: Hooked by "<unknown>" at address 0xf8ba2958

#: 123   Function Name: NtOpenProcessToken
Status: Not hooked

#: 124   Function Name: NtOpenProcessTokenEx
Status: Not hooked

#: 125   Function Name: NtOpenSection
Status: Not hooked

#: 126   Function Name: NtOpenSemaphore
Status: Not hooked

#: 127   Function Name: NtOpenSymbolicLinkObject
Status: Not hooked

#: 128   Function Name: NtOpenThread
Status: Hooked by "<unknown>" at address 0xf8ba295d

#: 129   Function Name: NtOpenThreadToken
Status: Not hooked

#: 130   Function Name: NtOpenThreadTokenEx
Status: Not hooked

#: 131   Function Name: NtOpenTimer
Status: Not hooked

#: 132   Function Name: NtPlugPlayControl
Status: Not hooked

#: 133   Function Name: NtPowerInformation
Status: Not hooked

#: 134   Function Name: NtPrivilegeCheck
Status: Not hooked

#: 135   Function Name: NtPrivilegeObjectAuditAlarm
Status: Not hooked

#: 136   Function Name: NtPrivilegedServiceAuditAlarm
Status: Not hooked

#: 137   Function Name: NtProtectVirtualMemory
Status: Not hooked

#: 138   Function Name: NtPulseEvent
Status: Not hooked

#: 139   Function Name: NtQueryAttributesFile
Status: Not hooked

 

#: 140   Function Name: NtQueryBootEntryOrder
Status: Not hooked

#: 141   Function Name: NtQueryBootOptions
Status: Not hooked

#: 142   Function Name: NtQueryDebugFilterState
Status: Not hooked

#: 143   Function Name: NtQueryDefaultLocale
Status: Not hooked

#: 144   Function Name: NtQueryDefaultUILanguage
Status: Not hooked

#: 145   Function Name: NtQueryDirectoryFile
Status: Not hooked

#: 146   Function Name: NtQueryDirectoryObject
Status: Not hooked

#: 147   Function Name: NtQueryEaFile
Status: Not hooked

#: 148   Function Name: NtQueryEvent
Status: Not hooked

#: 149   Function Name: NtQueryFullAttributesFile
Status: Not hooked

#: 150   Function Name: NtQueryInformationAtom
Status: Not hooked

#: 151   Function Name: NtQueryInformationFile
Status: Not hooked

#: 152   Function Name: NtQueryInformationJobObject
Status: Not hooked

#: 153   Function Name: NtQueryInformationPort
Status: Not hooked

#: 154   Function Name: NtQueryInformationProcess
Status: Not hooked

#: 155   Function Name: NtQueryInformationThread
Status: Not hooked

#: 156   Function Name: NtQueryInformationToken
Status: Not hooked

#: 157   Function Name: NtQueryInstallUILanguage
Status: Not hooked

#: 158   Function Name: NtQueryIntervalProfile
Status: Not hooked

#: 159   Function Name: NtQueryIoCompletion
Status: Not hooked

#: 160   Function Name: NtQueryKey
Status: Not hooked

#: 161   Function Name: NtQueryMultipleValueKey
Status: Not hooked

#: 162   Function Name: NtQueryMutant
Status: Not hooked

#: 163   Function Name: NtQueryObject
Status: Not hooked

#: 164   Function Name: NtQueryOpenSubKeys
Status: Not hooked

#: 165   Function Name: NtQueryPerformanceCounter
Status: Not hooked

#: 166   Function Name: NtQueryQuotaInformationFile
Status: Not hooked

#: 167   Function Name: NtQuerySection
Status: Not hooked

#: 168   Function Name: NtQuerySecurityObject
Status: Not hooked

#: 169   Function Name: NtQuerySemaphore
Status: Not hooked

#: 170   Function Name: NtQuerySymbolicLinkObject
Status: Not hooked

#: 171   Function Name: NtQuerySystemEnvironmentValue
Status: Not hooked

#: 172   Function Name: NtQuerySystemEnvironmentValueEx
Status: Not hooked

#: 173   Function Name: NtQuerySystemInformation
Status: Not hooked

#: 174   Function Name: NtQuerySystemTime
Status: Not hooked

#: 175   Function Name: NtQueryTimer
Status: Not hooked

#: 176   Function Name: NtQueryTimerResolution
Status: Not hooked

#: 177   Function Name: NtQueryValueKey
Status: Not hooked

#: 178   Function Name: NtQueryVirtualMemory
Status: Not hooked

#: 179   Function Name: NtQueryVolumeInformationFile
Status: Not hooked

#: 180   Function Name: NtQueueApcThread
Status: Not hooked

#: 181   Function Name: NtRaiseException
Status: Not hooked

#: 182   Function Name: NtRaiseHardError
Status: Not hooked

#: 183   Function Name: NtReadFile
Status: Not hooked

#: 184   Function Name: NtReadFileScatter
Status: Not hooked

#: 185   Function Name: NtReadRequestData
Status: Not hooked

#: 186   Function Name: NtReadVirtualMemory
Status: Not hooked

#: 187   Function Name: NtRegisterThreadTerminatePort
Status: Not hooked

#: 188   Function Name: NtReleaseMutant
Status: Not hooked

#: 189   Function Name: NtReleaseSemaphore
Status: Not hooked

#: 190   Function Name: NtRemoveIoCompletion
Status: Not hooked

#: 191   Function Name: NtRemoveProcessDebug
Status: Not hooked

#: 192   Function Name: NtRenameKey
Status: Not hooked

#: 193   Function Name: NtReplaceKey
Status: Hooked by "<unknown>" at address 0xf8ba2994

#: 194   Function Name: NtReplyPort
Status: Not hooked

#: 195   Function Name: NtReplyWaitReceivePort
Status: Not hooked

#: 196   Function Name: NtReplyWaitReceivePortEx
Status: Not hooked

#: 197   Function Name: NtReplyWaitReplyPort
Status: Not hooked

#: 198   Function Name: NtRequestDeviceWakeup
Status: Not hooked

#: 199   Function Name: NtRequestPort
Status: Not hooked

#: 200   Function Name: NtRequestWaitReplyPort
Status: Not hooked

#: 201   Function Name: NtRequestWakeupLatency
Status: Not hooked

#: 202   Function Name: NtResetEvent
Status: Not hooked

#: 203   Function Name: NtResetWriteWatch
Status: Not hooked

#: 204   Function Name: NtRestoreKey
Status: Hooked by "<unknown>" at address 0xf8ba298f

#: 205   Function Name: NtResumeProcess
Status: Not hooked

#: 206   Function Name: NtResumeThread
Status: Not hooked

#: 207   Function Name: NtSaveKey
Status: Not hooked

#: 208   Function Name: NtSaveKeyEx
Status: Not hooked

#: 209   Function Name: NtSaveMergedKeys
Status: Not hooked

#: 210   Function Name: NtSecureConnectPort
Status: Not hooked

#: 211   Function Name: NtSetBootEntryOrder
Status: Not hooked

#: 212   Function Name: NtSetBootOptions
Status: Not hooked

#: 213   Function Name: NtSetContextThread
Status: Not hooked

#: 214   Function Name: NtSetDebugFilterState
Status: Not hooked

#: 215   Function Name: NtSetDefaultHardErrorPort
Status: Not hooked

#: 216   Function Name: NtSetDefaultLocale
Status: Not hooked

#: 217   Function Name: NtSetDefaultUILanguage
Status: Not hooked

#: 218   Function Name: NtSetEaFile
Status: Not hooked

#: 219   Function Name: NtSetEvent
Status: Not hooked

#: 220   Function Name: NtSetEventBoostPriority
Status: Not hooked

#: 221   Function Name: NtSetHighEventPair
Status: Not hooked

#: 222   Function Name: NtSetHighWaitLowEventPair
Status: Not hooked

#: 223   Function Name: NtSetInformationDebugObject
Status: Not hooked

#: 224   Function Name: NtSetInformationFile
Status: Not hooked

#: 225   Function Name: NtSetInformationJobObject
Status: Not hooked

#: 226   Function Name: NtSetInformationKey
Status: Not hooked

#: 227   Function Name: NtSetInformationObject
Status: Not hooked

#: 228   Function Name: NtSetInformationProcess
Status: Not hooked

#: 229   Function Name: NtSetInformationThread
Status: Not hooked

#: 230   Function Name: NtSetInformationToken
Status: Not hooked

#: 231   Function Name: NtSetIntervalProfile
Status: Not hooked

#: 232   Function Name: NtSetIoCompletion
Status: Not hooked

#: 233   Function Name: NtSetLdtEntries
Status: Not hooked

#: 234   Function Name: NtSetLowEventPair
Status: Not hooked

#: 235   Function Name: NtSetLowWaitHighEventPair
Status: Not hooked

#: 236   Function Name: NtSetQuotaInformationFile
Status: Not hooked

#: 237   Function Name: NtSetSecurityObject
Status: Not hooked

#: 238   Function Name: NtSetSystemEnvironmentValue
Status: Not hooked

#: 239   Function Name: NtSetSystemEnvironmentValueEx
Status: Not hooked

#: 240   Function Name: NtSetSystemInformation
Status: Not hooked

#: 241   Function Name: NtSetSystemPowerState
Status: Not hooked

#: 242   Function Name: NtSetSystemTime
Status: Not hooked

#: 243   Function Name: NtSetThreadExecutionState
Status: Not hooked

#: 244   Function Name: NtSetTimer
Status: Not hooked

#: 245   Function Name: NtSetTimerResolution
Status: Not hooked

#: 246   Function Name: NtSetUuidSeed
Status: Not hooked

#: 247   Function Name: NtSetValueKey
Status: Hooked by "<unknown>" at address 0xf8ba2980

#: 248   Function Name: NtSetVolumeInformationFile
Status: Not hooked

#: 249   Function Name: NtShutdownSystem
Status: Not hooked

#: 250   Function Name: NtSignalAndWaitForSingleObject
Status: Not hooked

#: 251   Function Name: NtStartProfile
Status: Not hooked

#: 252   Function Name: NtStopProfile
Status: Not hooked

#: 253   Function Name: NtSuspendProcess
Status: Not hooked

#: 254   Function Name: NtSuspendThread
Status: Not hooked

#: 255   Function Name: NtSystemDebugControl
Status: Not hooked

#: 256   Function Name: NtTerminateJobObject
Status: Not hooked

#: 257   Function Name: NtTerminateProcess
Status: Hooked by "<unknown>" at address 0xf8ba2967

#: 258   Function Name: NtTerminateThread
Status: Not hooked

#: 259   Function Name: NtTestAlert
Status: Not hooked

#: 260   Function Name: NtTraceEvent
Status: Not hooked

#: 261   Function Name: NtTranslateFilePath
Status: Not hooked

#: 262   Function Name: NtUnloadDriver
Status: Not hooked

#: 263   Function Name: NtUnloadKey
Status: Not hooked

#: 264   Function Name: NtUnloadKeyEx
Status: Not hooked

#: 265   Function Name: NtUnlockFile
Status: Not hooked

#: 266   Function Name: NtUnlockVirtualMemory
Status: Not hooked

#: 267   Function Name: NtUnmapViewOfSection
Status: Not hooked

#: 268   Function Name: NtVdmControl
Status: Not hooked

#: 269   Function Name: NtWaitForDebugEvent
Status: Not hooked

#: 270   Function Name: NtWaitForMultipleObjects
Status: Not hooked

#: 271   Function Name: NtWaitForSingleObject
Status: Not hooked

#: 272   Function Name: NtWaitHighEventPair
Status: Not hooked

#: 273   Function Name: NtWaitLowEventPair
Status: Not hooked

#: 274   Function Name: NtWriteFile
Status: Not hooked

#: 275   Function Name: NtWriteFileGather
Status: Not hooked

#: 276   Function Name: NtWriteRequestData
Status: Not hooked

#: 277   Function Name: NtWriteVirtualMemory
Status: Not hooked

#: 278   Function Name: NtYieldExecution
Status: Not hooked

#: 279   Function Name: NtCreateKeyedEvent
Status: Not hooked

#: 280   Function Name: NtOpenKeyedEvent
Status: Not hooked

#: 281   Function Name: NtReleaseKeyedEvent
Status: Not hooked

#: 282   Function Name: NtWaitForKeyedEvent
Status: Not hooked

#: 283   Function Name: NtQueryPortInformationProcess
Status: Not hooked
 

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:      2009/11/16 20:21
Program Version:      Version 1.3.5.0
Windows Version:      Windows XP SP3
==================================================

Stealth Objects
-------------------
Object: Hidden Module [Name: tdlcmd.dll]
Process: svchost.exe (PID: 1052)   Address: 0x10000000   Size: 20480

Object: Hidden Module [Name: tdlwsp.dll]
Process: Explorer.EXE (PID: 2892)   Address: 0x10000000   Size: 32768

Object: Hidden Code [Driver: WDMCAPI, IRP_MJ_READ]
Process: System   Address: 0x00000000   Size: 4096

Object: Hidden Code [Driver: WDMCAPI, IRP_MJ_WRITE]
Process: System   Address: 0x00000000   Size: 4096

 

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:      2009/11/16 20:22
Program Version:      Version 1.3.5.0
Windows Version:      Windows XP SP3
==================================================

Hidden Services
-------------------
 

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:      2009/11/16 20:23
Program Version:      Version 1.3.5.0
Windows Version:      Windows XP SP3
==================================================

Shadow SSDT
-------------------
#: 000   Function Name: NtGdiAbortDoc
Status: Not hooked

#: 001   Function Name: NtGdiAbortPath
Status: Not hooked

#: 002   Function Name: NtGdiAddFontResourceW
Status: Not hooked

#: 003   Function Name: NtGdiAddRemoteFontToDC
Status: Not hooked

#: 004   Function Name: NtGdiAddFontMemResourceEx
Status: Not hooked

#: 005   Function Name: NtGdiRemoveMergeFont
Status: Not hooked

#: 006   Function Name: NtGdiAddRemoteMMInstanceToDC
Status: Not hooked

#: 007   Function Name: NtGdiAlphaBlend
Status: Not hooked

#: 008   Function Name: NtGdiAngleArc
Status: Not hooked

#: 009   Function Name: NtGdiAnyLinkedFonts
Status: Not hooked

#: 010   Function Name: NtGdiFontIsLinked
Status: Not hooked

#: 011   Function Name: NtGdiArcInternal
Status: Not hooked

#: 012   Function Name: NtGdiBeginPath
Status: Not hooked

#: 013   Function Name: NtGdiBitBlt
Status: Not hooked

#: 014   Function Name: NtGdiCancelDC
Status: Not hooked

#: 015   Function Name: NtGdiCheckBitmapBits
Status: Not hooked

#: 016   Function Name: NtGdiCloseFigure
Status: Not hooked

#: 017   Function Name: NtGdiClearBitmapAttributes
Status: Not hooked

#: 018   Function Name: NtGdiClearBrushAttributes
Status: Not hooked

#: 019   Function Name: NtGdiColorCorrectPalette
Status: Not hooked

#: 020   Function Name: NtGdiCombineRgn
Status: Not hooked

#: 021   Function Name: NtGdiCombineTransform
Status: Not hooked

#: 022   Function Name: NtGdiComputeXformCoefficients
Status: Not hooked

#: 023   Function Name: NtGdiConsoleTextOut
Status: Not hooked

#: 024   Function Name: NtGdiConvertMetafileRect
Status: Not hooked

#: 025   Function Name: NtGdiCreateBitmap
Status: Not hooked

#: 026   Function Name: NtGdiCreateClientObj
Status: Not hooked

#: 027   Function Name: NtGdiCreateColorSpace
Status: Not hooked

#: 028   Function Name: NtGdiCreateColorTransform
Status: Not hooked

#: 029   Function Name: NtGdiCreateCompatibleBitmap
Status: Not hooked

#: 030   Function Name: NtGdiCreateCompatibleDC
Status: Not hooked

#: 031   Function Name: NtGdiCreateDIBBrush
Status: Not hooked

#: 032   Function Name: NtGdiCreateDIBitmapInternal
Status: Not hooked

#: 033   Function Name: NtGdiCreateDIBSection
Status: Not hooked

#: 034   Function Name: NtGdiCreateEllipticRgn
Status: Not hooked

#: 035   Function Name: NtGdiCreateHalftonePalette
Status: Not hooked

#: 036   Function Name: NtGdiCreateHatchBrushInternal
Status: Not hooked

#: 037   Function Name: NtGdiCreateMetafileDC
Status: Not hooked

#: 038   Function Name: NtGdiCreatePaletteInternal
Status: Not hooked

#: 039   Function Name: NtGdiCreatePatternBrushInternal
Status: Not hooked

#: 040   Function Name: NtGdiCreatePen
Status: Not hooked

#: 041   Function Name: NtGdiCreateRectRgn
Status: Not hooked

#: 042   Function Name: NtGdiCreateRoundRectRgn
Status: Not hooked

#: 043   Function Name: NtGdiCreateServerMetaFile
Status: Not hooked

#: 044   Function Name: NtGdiCreateSolidBrush
Status: Not hooked

#: 045   Function Name: NtGdiD3dContextCreate
Status: Not hooked

#: 046   Function Name: NtGdiD3dContextDestroy
Status: Not hooked

#: 047   Function Name: NtGdiD3dContextDestroyAll
Status: Not hooked

#: 048   Function Name: NtGdiD3dValidateTextureStageState
Status: Not hooked

#: 049   Function Name: NtGdiD3dDrawPrimitives2
Status: Not hooked

#: 050   Function Name: NtGdiDdGetDriverState
Status: Not hooked

#: 051   Function Name: NtGdiDdAddAttachedSurface
Status: Not hooked

#: 052   Function Name: NtGdiDdAlphaBlt
Status: Not hooked

#: 053   Function Name: NtGdiDdAttachSurface
Status: Not hooked

#: 054   Function Name: NtGdiDdBeginMoCompFrame
Status: Not hooked

#: 055   Function Name: NtGdiDdBlt
Status: Not hooked

#: 056   Function Name: NtGdiDdCanCreateSurface
Status: Not hooked

#: 057   Function Name: NtGdiDdCanCreateD3DBuffer
Status: Not hooked

#: 058   Function Name: NtGdiDdColorControl
Status: Not hooked

#: 059   Function Name: NtGdiDdCreateDirectDrawObject
Status: Not hooked

#: 060   Function Name: NtGdiDdCreateSurface
Status: Not hooked

#: 061   Function Name: NtGdiDdCreateD3DBuffer
Status: Not hooked

#: 062   Function Name: NtGdiDdCreateMoComp
Status: Not hooked

#: 063   Function Name: NtGdiDdCreateSurfaceObject
Status: Not hooked

#: 064   Function Name: NtGdiDdDeleteDirectDrawObject
Status: Not hooked

#: 065   Function Name: NtGdiDdDeleteSurfaceObject
Status: Not hooked

#: 066   Function Name: NtGdiDdDestroyMoComp
Status: Not hooked

#: 067   Function Name: NtGdiDdDestroySurface
Status: Not hooked

#: 068   Function Name: NtGdiDdDestroyD3DBuffer
Status: Not hooked

#: 069   Function Name: NtGdiDdEndMoCompFrame
Status: Not hooked

#: 070   Function Name: NtGdiDdFlip
Status: Not hooked

#: 071   Function Name: NtGdiDdFlipToGDISurface
Status: Not hooked

#: 072   Function Name: NtGdiDdGetAvailDriverMemory
Status: Not hooked

#: 073   Function Name: NtGdiDdGetBltStatus
Status: Not hooked

#: 074   Function Name: NtGdiDdGetDC
Status: Not hooked

#: 075   Function Name: NtGdiDdGetDriverInfo
Status: Not hooked

#: 076   Function Name: NtGdiDdGetDxHandle
Status: Not hooked

#: 077   Function Name: NtGdiDdGetFlipStatus
Status: Not hooked

#: 078   Function Name: NtGdiDdGetInternalMoCompInfo
Status: Not hooked

#: 079   Function Name: NtGdiDdGetMoCompBuffInfo
Status: Not hooked

#: 080   Function Name: NtGdiDdGetMoCompGuids
Status: Not hooked

#: 081   Function Name: NtGdiDdGetMoCompFormats
Status: Not hooked

#: 082   Function Name: NtGdiDdGetScanLine
Status: Not hooked

#: 083   Function Name: NtGdiDdLock
Status: Not hooked

#: 084   Function Name: NtGdiDdLockD3D
Status: Not hooked

#: 085   Function Name: NtGdiDdQueryDirectDrawObject
Status: Not hooked

#: 086   Function Name: NtGdiDdQueryMoCompStatus
Status: Not hooked

#: 087   Function Name: NtGdiDdReenableDirectDrawObject
Status: Not hooked

#: 088   Function Name: NtGdiDdReleaseDC
Status: Not hooked

#: 089   Function Name: NtGdiDdRenderMoComp
Status: Not hooked

#: 090   Function Name: NtGdiDdResetVisrgn
Status: Not hooked

#: 091   Function Name: NtGdiDdSetColorKey
Status: Not hooked

#: 092   Function Name: NtGdiDdSetExclusiveMode
Status: Not hooked

#: 093   Function Name: NtGdiDdSetGammaRamp
Status: Not hooked

#: 094   Function Name: NtGdiDdCreateSurfaceEx
Status: Not hooked

#: 095   Function Name: NtGdiDdSetOverlayPosition
Status: Not hooked

#: 096   Function Name: NtGdiDdUnattachSurface
Status: Not hooked

#: 097   Function Name: NtGdiDdUnlock
Status: Not hooked

#: 098   Function Name: NtGdiDdUnlockD3D
Status: Not hooked

#: 099   Function Name: NtGdiDdUpdateOverlay
Status: Not hooked

#: 100   Function Name: NtGdiDdWaitForVerticalBlank
Status: Not hooked

#: 101   Function Name: NtGdiDvpCanCreateVideoPort
Status: Not hooked

#: 102   Function Name: NtGdiDvpColorControl
Status: Not hooked

#: 103   Function Name: NtGdiDvpCreateVideoPort
Status: Not hooked

#: 104   Function Name: NtGdiDvpDestroyVideoPort
Status: Not hooked

#: 105   Function Name: NtGdiDvpFlipVideoPort
Status: Not hooked

#: 106   Function Name: NtGdiDvpGetVideoPortBandwidth
Status: Not hooked

#: 107   Function Name: NtGdiDvpGetVideoPortField
Status: Not hooked

#: 108   Function Name: NtGdiDvpGetVideoPortFlipStatus
Status: Not hooked

#: 109   Function Name: NtGdiDvpGetVideoPortInputFormats
Status: Not hooked

#: 110   Function Name: NtGdiDvpGetVideoPortLine
Status: Not hooked

#: 111   Function Name: NtGdiDvpGetVideoPortOutputFormats
Status: Not hooked

#: 112   Function Name: NtGdiDvpGetVideoPortConnectInfo
Status: Not hooked

#: 113   Function Name: NtGdiDvpGetVideoSignalStatus
Status: Not hooked

#: 114   Function Name: NtGdiDvpUpdateVideoPort
Status: Not hooked

#: 115   Function Name: NtGdiDvpWaitForVideoPortSync
Status: Not hooked

#: 116   Function Name: NtGdiDvpAcquireNotification
Status: Not hooked

#: 117   Function Name: NtGdiDvpReleaseNotification
Status: Not hooked

#: 118   Function Name: NtGdiDxgGenericThunk
Status: Not hooked

#: 119   Function Name: NtGdiDeleteClientObj
Status: Not hooked

#: 120   Function Name: NtGdiDeleteColorSpace
Status: Not hooked

#: 121   Function Name: NtGdiDeleteColorTransform
Status: Not hooked

#: 122   Function Name: NtGdiDeleteObjectApp
Status: Not hooked

#: 123   Function Name: NtGdiDescribePixelFormat
Status: Not hooked

#: 124   Function Name: NtGdiGetPerBandInfo
Status: Not hooked

#: 125   Function Name: NtGdiDoBanding
Status: Not hooked

#: 126   Function Name: NtGdiDoPalette
Status: Not hooked

#: 127   Function Name: NtGdiDrawEscape
Status: Not hooked

#: 128   Function Name: NtGdiEllipse
Status: Not hooked

#: 129   Function Name: NtGdiEnableEudc
Status: Not hooked

#: 130   Function Name: NtGdiEndDoc
Status: Not hooked

#: 131   Function Name: NtGdiEndPage
Status: Not hooked

#: 132   Function Name: NtGdiEndPath
Status: Not hooked

#: 133   Function Name: NtGdiEnumFontChunk
Status: Not hooked

#: 134   Function Name: NtGdiEnumFontClose
Status: Not hooked

#: 135   Function Name: NtGdiEnumFontOpen
Status: Not hooked

#: 136   Function Name: NtGdiEnumObjects
Status: Not hooked

#: 137   Function Name: NtGdiEqualRgn
Status: Not hooked

#: 138   Function Name: NtGdiEudcLoadUnloadLink
Status: Not hooked

#: 139   Function Name: NtGdiExcludeClipRect
Status: Not hooked

#: 140   Function Name: NtGdiExtCreatePen
Status: Not hooked

#: 141   Function Name: NtGdiExtCreateRegion
Status: Not hooked

#: 142   Function Name: NtGdiExtEscape
Status: Not hooked

#: 143   Function Name: NtGdiExtFloodFill
Status: Not hooked

#: 144   Function Name: NtGdiExtGetObjectW
Status: Not hooked

#: 145   Function Name: NtGdiExtSelectClipRgn
Status: Not hooked

#: 146   Function Name: NtGdiExtTextOutW
Status: Not hooked

#: 147   Function Name: NtGdiFillPath
Status: Not hooked

#: 148   Function Name: NtGdiFillRgn
Status: Not hooked

#: 149   Function Name: NtGdiFlattenPath
Status: Not hooked

#: 150   Function Name: NtGdiFlushUserBatch
Status: Not hooked

#: 151   Function Name: NtGdiFlush
Status: Not hooked

#: 152   Function Name: NtGdiForceUFIMapping
Status: Not hooked

#: 153   Function Name: NtGdiFrameRgn
Status: Not hooked

#: 154   Function Name: NtGdiFullscreenControl
Status: Not hooked

#: 155   Function Name: NtGdiGetAndSetDCDword
Status: Not hooked

#: 156   Function Name: NtGdiGetAppClipBox
Status: Not hooked

#: 157   Function Name: NtGdiGetBitmapBits
Status: Not hooked

#: 158   Function Name: NtGdiGetBitmapDimension
Status: Not hooked

#: 159   Function Name: NtGdiGetBoundsRect
Status: Not hooked

#: 160   Function Name: NtGdiGetCharABCWidthsW
Status: Not hooked

#: 161   Function Name: NtGdiGetCharacterPlacementW
Status: Not hooked

#: 162   Function Name: NtGdiGetCharSet
Status: Not hooked

#: 163   Function Name: NtGdiGetCharWidthW
Status: Not hooked

#: 164   Function Name: NtGdiGetCharWidthInfo
Status: Not hooked

#: 165   Function Name: NtGdiGetColorAdjustment
Status: Not hooked

#: 166   Function Name: NtGdiGetColorSpaceforBitmap
Status: Not hooked

#: 167   Function Name: NtGdiGetDCDword
Status: Not hooked

#: 168   Function Name: NtGdiGetDCforBitmap
Status: Not hooked

#: 169   Function Name: NtGdiGetDCObject
Status: Not hooked

#: 170   Function Name: NtGdiGetDCPoint
Status: Not hooked

#: 171   Function Name: NtGdiGetDeviceCaps
Status: Not hooked

#: 172   Function Name: NtGdiGetDeviceGammaRamp
Status: Not hooked

#: 173   Function Name: NtGdiGetDeviceCapsAll
Status: Not hooked

#: 174   Function Name: NtGdiGetDIBitsInternal
Status: Not hooked

#: 175   Function Name: NtGdiGetETM
Status: Not hooked

#: 176   Function Name: NtGdiGetEudcTimeStampEx
Status: Not hooked

#: 177   Function Name: NtGdiGetFontData
Status: Not hooked

#: 178   Function Name: NtGdiGetFontResourceInfoInternalW
Status: Not hooked

#: 179   Function Name: NtGdiGetGlyphIndicesW
Status: Not hooked

#: 180   Function Name: NtGdiGetGlyphIndicesWInternal
Status: Not hooked

#: 181   Function Name: NtGdiGetGlyphOutline
Status: Not hooked

#: 182   Function Name: NtGdiGetKerningPairs
Status: Not hooked

#: 183   Function Name: NtGdiGetLinkedUFIs
Status: Not hooked

#: 184   Function Name: NtGdiGetMiterLimit
Status: Not hooked

#: 185   Function Name: NtGdiGetMonitorID
Status: Not hooked

#: 186   Function Name: NtGdiGetNearestColor
Status: Not hooked

#: 187   Function Name: NtGdiGetNearestPaletteIndex
Status: Not hooked

#: 188   Function Name: NtGdiGetObjectBitmapHandle
Status: Not hooked

#: 189   Function Name: NtGdiGetOutlineTextMetricsInternalW
Status: Not hooked

#: 190   Function Name: NtGdiGetPath
Status: Not hooked

#: 191   Function Name: NtGdiGetPixel
Status: Not hooked

#: 192   Function Name: NtGdiGetRandomRgn
Status: Not hooked

#: 193   Function Name: NtGdiGetRasterizerCaps
Status: Not hooked

#: 194   Function Name: NtGdiGetRealizationInfo
Status: Not hooked

#: 195   Function Name: NtGdiGetRegionData
Status: Not hooked

#: 196   Function Name: NtGdiGetRgnBox
Status: Not hooked

#: 197   Function Name: NtGdiGetServerMetaFileBits
Status: Not hooked

#: 198   Function Name: NtGdiGetSpoolMessage
Status: Not hooked

#: 199   Function Name: NtGdiGetStats
Status: Not hooked

 

#: 200   Function Name: NtGdiGetStockObject
Status: Not hooked

#: 201   Function Name: NtGdiGetStringBitmapW
Status: Not hooked

#: 202   Function Name: NtGdiGetSystemPaletteUse
Status: Not hooked

#: 203   Function Name: NtGdiGetTextCharsetInfo
Status: Not hooked

#: 204   Function Name: NtGdiGetTextExtent
Status: Not hooked

#: 205   Function Name: NtGdiGetTextExtentExW
Status: Not hooked

#: 206   Function Name: NtGdiGetTextFaceW
Status: Not hooked

#: 207   Function Name: NtGdiGetTextMetricsW
Status: Not hooked

#: 208   Function Name: NtGdiGetTransform
Status: Not hooked

#: 209   Function Name: NtGdiGetUFI
Status: Not hooked

#: 210   Function Name: NtGdiGetEmbUFI
Status: Not hooked

#: 211   Function Name: NtGdiGetUFIPathname
Status: Not hooked

#: 212   Function Name: NtGdiGetEmbedFonts
Status: Not hooked

#: 213   Function Name: NtGdiChangeGhostFont
Status: Not hooked

#: 214   Function Name: NtGdiAddEmbFontToDC
Status: Not hooked

#: 215   Function Name: NtGdiGetFontUnicodeRanges
Status: Not hooked

#: 216   Function Name: NtGdiGetWidthTable
Status: Not hooked

#: 217   Function Name: NtGdiGradientFill
Status: Not hooked

#: 218   Function Name: NtGdiHfontCreate
Status: Not hooked

#: 219   Function Name: NtGdiIcmBrushInfo
Status: Not hooked

#: 220   Function Name: NtGdiInit
Status: Not hooked

#: 221   Function Name: NtGdiInitSpool
Status: Not hooked

#: 222   Function Name: NtGdiIntersectClipRect
Status: Not hooked

#: 223   Function Name: NtGdiInvertRgn
Status: Not hooked

#: 224   Function Name: NtGdiLineTo
Status: Not hooked

#: 225   Function Name: NtGdiMakeFontDir
Status: Not hooked

#: 226   Function Name: NtGdiMakeInfoDC
Status: Not hooked

#: 227   Function Name: NtGdiMaskBlt
Status: Not hooked

#: 228   Function Name: NtGdiModifyWorldTransform
Status: Not hooked

#: 229   Function Name: NtGdiMonoBitmap
Status: Not hooked

#: 230   Function Name: NtGdiMoveTo
Status: Not hooked

#: 231   Function Name: NtGdiOffsetClipRgn
Status: Not hooked

#: 232   Function Name: NtGdiOffsetRgn
Status: Not hooked

#: 233   Function Name: NtGdiOpenDCW
Status: Not hooked

#: 234   Function Name: NtGdiPatBlt
Status: Not hooked

#: 235   Function Name: NtGdiPolyPatBlt
Status: Not hooked

#: 236   Function Name: NtGdiPathToRegion
Status: Not hooked

#: 237   Function Name: NtGdiPlgBlt
Status: Not hooked

#: 238   Function Name: NtGdiPolyDraw
Status: Not hooked

#: 239   Function Name: NtGdiPolyPolyDraw
Status: Not hooked

#: 240   Function Name: NtGdiPolyTextOutW
Status: Not hooked

#: 241   Function Name: NtGdiPtInRegion
Status: Not hooked

#: 242   Function Name: NtGdiPtVisible
Status: Not hooked

#: 243   Function Name: NtGdiQueryFonts
Status: Not hooked

#: 244   Function Name: NtGdiQueryFontAssocInfo
Status: Not hooked

#: 245   Function Name: NtGdiRectangle
Status: Not hooked

#: 246   Function Name: NtGdiRectInRegion
Status: Not hooked

#: 247   Function Name: NtGdiRectVisible
Status: Not hooked

#: 248   Function Name: NtGdiRemoveFontResourceW
Status: Not hooked

#: 249   Function Name: NtGdiRemoveFontMemResourceEx
Status: Not hooked

#: 250   Function Name: NtGdiResetDC
Status: Not hooked

#: 251   Function Name: NtGdiResizePalette
Status: Not hooked

#: 252   Function Name: NtGdiRestoreDC
Status: Not hooked

#: 253   Function Name: NtGdiRoundRect
Status: Not hooked

#: 254   Function Name: NtGdiSaveDC
Status: Not hooked

#: 255   Function Name: NtGdiScaleViewportExtEx
Status: Not hooked

#: 256   Function Name: NtGdiScaleWindowExtEx
Status: Not hooked

#: 257   Function Name: NtGdiSelectBitmap
Status: Not hooked

#: 258   Function Name: NtGdiSelectBrush
Status: Not hooked

#: 259   Function Name: NtGdiSelectClipPath
Status: Not hooked

#: 260   Function Name: NtGdiSelectFont
Status: Not hooked

#: 261   Function Name: NtGdiSelectPen
Status: Not hooked

#: 262   Function Name: NtGdiSetBitmapAttributes
Status: Not hooked

#: 263   Function Name: NtGdiSetBitmapBits
Status: Not hooked

#: 264   Function Name: NtGdiSetBitmapDimension
Status: Not hooked

#: 265   Function Name: NtGdiSetBoundsRect
Status: Not hooked

#: 266   Function Name: NtGdiSetBrushAttributes
Status: Not hooked

#: 267   Function Name: NtGdiSetBrushOrg
Status: Not hooked

#: 268   Function Name: NtGdiSetColorAdjustment
Status: Not hooked

#: 269   Function Name: NtGdiSetColorSpace
Status: Not hooked

#: 270   Function Name: NtGdiSetDeviceGammaRamp
Status: Not hooked

#: 271   Function Name: NtGdiSetDIBitsToDeviceInternal
Status: Not hooked

#: 272   Function Name: NtGdiSetFontEnumeration
Status: Not hooked

#: 273   Function Name: NtGdiSetFontXform
Status: Not hooked

#: 274   Function Name: NtGdiSetIcmMode
Status: Not hooked

#: 275   Function Name: NtGdiSetLinkedUFIs
Status: Not hooked

#: 276   Function Name: NtGdiSetMagicColors
Status: Not hooked

#: 277   Function Name: NtGdiSetMetaRgn
Status: Not hooked

#: 278   Function Name: NtGdiSetMiterLimit
Status: Not hooked

#: 279   Function Name: NtGdiGetDeviceWidth
Status: Not hooked

#: 280   Function Name: NtGdiMirrorWindowOrg
Status: Not hooked

#: 281   Function Name: NtGdiSetLayout
Status: Not hooked

#: 282   Function Name: NtGdiSetPixel
Status: Not hooked

#: 283   Function Name: NtGdiSetPixelFormat
Status: Not hooked

#: 284   Function Name: NtGdiSetRectRgn
Status: Not hooked

#: 285   Function Name: NtGdiSetSystemPaletteUse
Status: Not hooked

#: 286   Function Name: NtGdiSetTextJustification
Status: Not hooked

#: 287   Function Name: NtGdiSetupPublicCFONT
Status: Not hooked

#: 288   Function Name: NtGdiSetVirtualResolution
Status: Not hooked

#: 289   Function Name: NtGdiSetSizeDevice
Status: Not hooked

#: 290   Function Name: NtGdiStartDoc
Status: Not hooked

#: 291   Function Name: NtGdiStartPage
Status: Not hooked

#: 292   Function Name: NtGdiStretchBlt
Status: Not hooked

#: 293   Function Name: NtGdiStretchDIBitsInternal
Status: Not hooked

#: 294   Function Name: NtGdiStrokeAndFillPath
Status: Not hooked

#: 295   Function Name: NtGdiStrokePath
Status: Not hooked

#: 296   Function Name: NtGdiSwapBuffers
Status: Not hooked

#: 297   Function Name: NtGdiTransformPoints
Status: Not hooked

#: 298   Function Name: NtGdiTransparentBlt
Status: Not hooked

#: 299   Function Name: NtGdiUnloadPrinterDriver
Status: Not hooked

#: 300   Function Name: NtGdiUnmapMemFont
Status: Not hooked

#: 301   Function Name: NtGdiUnrealizeObject
Status: Not hooked

#: 302   Function Name: NtGdiUpdateColors
Status: Not hooked

#: 303   Function Name: NtGdiWidenPath
Status: Not hooked

#: 304   Function Name: NtUserActivateKeyboardLayout
Status: Not hooked

#: 305   Function Name: NtUserAlterWindowStyle
Status: Not hooked

#: 306   Function Name: NtUserAssociateInputContext
Status: Not hooked

#: 307   Function Name: NtUserAttachThreadInput
Status: Not hooked

#: 308   Function Name: NtUserBeginPaint
Status: Not hooked

#: 309   Function Name: NtUserBitBltSysBmp
Status: Not hooked

#: 310   Function Name: NtUserBlockInput
Status: Not hooked

#: 311   Function Name: NtUserBuildHimcList
Status: Not hooked

#: 312   Function Name: NtUserBuildHwndList
Status: Not hooked

#: 313   Function Name: NtUserBuildNameList
Status: Not hooked

#: 314   Function Name: NtUserBuildPropList
Status: Not hooked

#: 315   Function Name: NtUserCallHwnd
Status: Not hooked

#: 316   Function Name: NtUserCallHwndLock
Status: Not hooked

#: 317   Function Name: NtUserCallHwndOpt
Status: Not hooked

#: 318   Function Name: NtUserCallHwndParam
Status: Not hooked

#: 319   Function Name: NtUserCallHwndParamLock
Status: Not hooked

#: 320   Function Name: NtUserCallMsgFilter
Status: Not hooked

#: 321   Function Name: NtUserCallNextHookEx
Status: Not hooked

#: 322   Function Name: NtUserCallNoParam
Status: Not hooked

#: 323   Function Name: NtUserCallOneParam
Status: Not hooked

#: 324   Function Name: NtUserCallTwoParam
Status: Not hooked

#: 325   Function Name: NtUserChangeClipboardChain
Status: Not hooked

#: 326   Function Name: NtUserChangeDisplaySettings
Status: Not hooked

#: 327   Function Name: NtUserCheckImeHotKey
Status: Not hooked

#: 328   Function Name: NtUserCheckMenuItem
Status: Not hooked

#: 329   Function Name: NtUserChildWindowFromPointEx
Status: Not hooked

#: 330   Function Name: NtUserClipCursor
Status: Not hooked

#: 331   Function Name: NtUserCloseClipboard
Status: Not hooked

#: 332   Function Name: NtUserCloseDesktop
Status: Not hooked

#: 333   Function Name: NtUserCloseWindowStation
Status: Not hooked

#: 334   Function Name: NtUserConsoleControl
Status: Not hooked

#: 335   Function Name: NtUserConvertMemHandle
Status: Not hooked

#: 336   Function Name: NtUserCopyAcceleratorTable
Status: Not hooked

#: 337   Function Name: NtUserCountClipboardFormats
Status: Not hooked

#: 338   Function Name: NtUserCreateAcceleratorTable
Status: Not hooked

#: 339   Function Name: NtUserCreateCaret
Status: Not hooked

#: 340   Function Name: NtUserCreateDesktop
Status: Not hooked

#: 341   Function Name: NtUserCreateInputContext
Status: Not hooked

#: 342   Function Name: NtUserCreateLocalMemHandle
Status: Not hooked

#: 343   Function Name: NtUserCreateWindowEx
Status: Not hooked

#: 344   Function Name: NtUserCreateWindowStation
Status: Not hooked

#: 345   Function Name: NtUserDdeGetQualityOfService
Status: Not hooked

#: 346   Function Name: NtUserDdeInitialize
Status: Not hooked

#: 347   Function Name: NtUserDdeSetQualityOfService
Status: Not hooked

#: 348   Function Name: NtUserDeferWindowPos
Status: Not hooked

#: 349   Function Name: NtUserDefSetText
Status: Not hooked

#: 350   Function Name: NtUserDeleteMenu
Status: Not hooked

#: 351   Function Name: NtUserDestroyAcceleratorTable
Status: Not hooked

#: 352   Function Name: NtUserDestroyCursor
Status: Not hooked

#: 353   Function Name: NtUserDestroyInputContext
Status: Not hooked

#: 354   Function Name: NtUserDestroyMenu
Status: Not hooked

#: 355   Function Name: NtUserDestroyWindow
Status: Not hooked

#: 356   Function Name: NtUserDisableThreadIme
Status: Not hooked

#: 357   Function Name: NtUserDispatchMessage
Status: Not hooked

#: 358   Function Name: NtUserDragDetect
Status: Not hooked

#: 359   Function Name: NtUserDragObject
Status: Not hooked

#: 360   Function Name: NtUserDrawAnimatedRects
Status: Not hooked

#: 361   Function Name: NtUserDrawCaption
Status: Not hooked

#: 362   Function Name: NtUserDrawCaptionTemp
Status: Not hooked

#: 363   Function Name: NtUserDrawIconEx
Status: Not hooked

#: 364   Function Name: NtUserDrawMenuBarTemp
Status: Not hooked

#: 365   Function Name: NtUserEmptyClipboard
Status: Not hooked

#: 366   Function Name: NtUserEnableMenuItem
Status: Not hooked

#: 367   Function Name: NtUserEnableScrollBar
Status: Not hooked

#: 368   Function Name: NtUserEndDeferWindowPosEx
Status: Not hooked

#: 369   Function Name: NtUserEndMenu
Status: Not hooked

#: 370   Function Name: NtUserEndPaint
Status: Not hooked

#: 371   Function Name: NtUserEnumDisplayDevices
Status: Not hooked

#: 372   Function Name: NtUserEnumDisplayMonitors
Status: Not hooked

#: 373   Function Name: NtUserEnumDisplaySettings
Status: Not hooked

#: 374   Function Name: NtUserEvent
Status: Not hooked

#: 375   Function Name: NtUserExcludeUpdateRgn
Status: Not hooked

#: 376   Function Name: NtUserFillWindow
Status: Not hooked

#: 377   Function Name: NtUserFindExistingCursorIcon
Status: Not hooked

#: 378   Function Name: NtUserFindWindowEx
Status: Not hooked

#: 379   Function Name: NtUserFlashWindowEx
Status: Not hooked

#: 380   Function Name: NtUserGetAltTabInfo
Status: Not hooked

#: 381   Function Name: NtUserGetAncestor
Status: Not hooked

#: 382   Function Name: NtUserGetAppImeLevel
Status: Not hooked

#: 383   Function Name: NtUserGetAsyncKeyState
Status: Not hooked

#: 384   Function Name: NtUserGetAtomName
Status: Not hooked

#: 385   Function Name: NtUserGetCaretBlinkTime
Status: Not hooked

#: 386   Function Name: NtUserGetCaretPos
Status: Not hooked

#: 387   Function Name: NtUserGetClassInfo
Status: Not hooked

#: 388   Function Name: NtUserGetClassName
Status: Not hooked

#: 389   Function Name: NtUserGetClipboardData
Status: Not hooked

#: 390   Function Name: NtUserGetClipboardFormatName
Status: Not hooked

#: 391   Function Name: NtUserGetClipboardOwner
Status: Not hooked

#: 392   Function Name: NtUserGetClipboardSequenceNumber
Status: Not hooked

#: 393   Function Name: NtUserGetClipboardViewer
Status: Not hooked

#: 394   Function Name: NtUserGetClipCursor
Status: Not hooked

#: 395   Function Name: NtUserGetComboBoxInfo
Status: Not hooked

#: 396   Function Name: NtUserGetControlBrush
Status: Not hooked

#: 397   Function Name: NtUserGetControlColor
Status: Not hooked

#: 398   Function Name: NtUserGetCPD
Status: Not hooked

#: 399   Function Name: NtUserGetCursorFrameInfo
Status: Not hooked

#: 400   Function Name: NtUserGetCursorInfo
Status: Not hooked

#: 401   Function Name: NtUserGetDC
Status: Not hooked

#: 402   Function Name: NtUserGetDCEx
Status: Not hooked

#: 403   Function Name: NtUserGetDoubleClickTime
Status: Not hooked

#: 404   Function Name: NtUserGetForegroundWindow
Status: Not hooked

#: 405   Function Name: NtUserGetGuiResources
Status: Not hooked

#: 406   Function Name: NtUserGetGUIThreadInfo
Status: Not hooked

#: 407   Function Name: NtUserGetIconInfo
Status: Not hooked

#: 408   Function Name: NtUserGetIconSize
Status: Not hooked

#: 409   Function Name: NtUserGetImeHotKey
Status: Not hooked

#: 410   Function Name: NtUserGetImeInfoEx
Status: Not hooked

#: 411   Function Name: NtUserGetInternalWindowPos
Status: Not hooked

#: 412   Function Name: NtUserGetKeyboardLayoutList
Status: Not hooked

#: 413   Function Name: NtUserGetKeyboardLayoutName
Status: Not hooked

#: 414   Function Name: NtUserGetKeyboardState
Status: Not hooked

#: 415   Function Name: NtUserGetKeyNameText
Status: Not hooked

#: 416   Function Name: NtUserGetKeyState
Status: Not hooked

#: 417   Function Name: NtUserGetListBoxInfo
Status: Not hooked

#: 418   Function Name: NtUserGetMenuBarInfo
Status: Not hooked

#: 419   Function Name: NtUserGetMenuIndex
Status: Not hooked

#: 420   Function Name: NtUserGetMenuItemRect
Status: Not hooked

#: 421   Function Name: NtUserGetMessage
Status: Not hooked

#: 422   Function Name: NtUserGetMouseMovePointsEx
Status: Not hooked

#: 423   Function Name: NtUserGetObjectInformation
Status: Not hooked

#: 424   Function Name: NtUserGetOpenClipboardWindow
Status: Not hooked

#: 425   Function Name: NtUserGetPriorityClipboardFormat
Status: Not hooked

#: 426   Function Name: NtUserGetProcessWindowStation
Status: Not hooked

#: 427   Function Name: NtUserGetRawInputBuffer
Status: Not hooked

#: 428   Function Name: NtUserGetRawInputData
Status: Not hooked

#: 429   Function Name: NtUserGetRawInputDeviceInfo
Status: Not hooked

#: 430   Function Name: NtUserGetRawInputDeviceList
Status: Not hooked

#: 431   Function Name: NtUserGetRegisteredRawInputDevices
Status: Not hooked

#: 432   Function Name: NtUserGetScrollBarInfo
Status: Not hooked

#: 433   Function Name: NtUserGetSystemMenu
Status: Not hooked

#: 434   Function Name: NtUserGetThreadDesktop
Status: Not hooked

#: 435   Function Name: NtUserGetThreadState
Status: Not hooked

#: 436   Function Name: NtUserGetTitleBarInfo
Status: Not hooked

#: 437   Function Name: NtUserGetUpdateRect
Status: Not hooked

#: 438   Function Name: NtUserGetUpdateRgn
Status: Not hooked

#: 439   Function Name: NtUserGetWindowDC
Status: Not hooked

#: 440   Function Name: NtUserGetWindowPlacement
Status: Not hooked

#: 441   Function Name: NtUserGetWOWClass
Status: Not hooked

#: 442   Function Name: NtUserHardErrorControl
Status: Not hooked

#: 443   Function Name: NtUserHideCaret
Status: Not hooked

#: 444   Function Name: NtUserHiliteMenuItem
Status: Not hooked

#: 445   Function Name: NtUserImpersonateDdeClientWindow
Status: Not hooked

#: 446   Function Name: NtUserInitialize
Status: Not hooked

#: 447   Function Name: NtUserInitializeClientPfnArrays
Status: Not hooked

#: 448   Function Name: NtUserInitTask
Status: Not hooked

#: 449   Function Name: NtUserInternalGetWindowText
Status: Not hooked

#: 450   Function Name: NtUserInvalidateRect
Status: Not hooked

#: 451   Function Name: NtUserInvalidateRgn
Status: Not hooked

#: 452   Function Name: NtUserIsClipboardFormatAvailable
Status: Not hooked

#: 453   Function Name: NtUserKillTimer
Status: Not hooked

#: 454   Function Name: NtUserLoadKeyboardLayoutEx
Status: Not hooked

#: 455   Function Name: NtUserLockWindowStation
Status: Not hooked

#: 456   Function Name: NtUserLockWindowUpdate
Status: Not hooked

#: 457   Function Name: NtUserLockWorkStation
Status: Not hooked

#: 458   Function Name: NtUserMapVirtualKeyEx
Status: Not hooked

#: 459   Function Name: NtUserMenuItemFromPoint
Status: Not hooked

#: 460   Function Name: NtUserMessageCall
Status: Not hooked

#: 461   Function Name: NtUserMinMaximize
Status: Not hooked

#: 462   Function Name: NtUserMNDragLeave
Status: Not hooked

#: 463   Function Name: NtUserMNDragOver
Status: Not hooked

#: 464   Function Name: NtUserModifyUserStartupInfoFlags
Status: Not hooked

#: 465   Function Name: NtUserMoveWindow
Status: Not hooked

#: 466   Function Name: NtUserNotifyIMEStatus
Status: Not hooked

#: 467   Function Name: NtUserNotifyProcessCreate
Status: Not hooked

#: 468   Function Name: NtUserNotifyWinEvent
Status: Not hooked

#: 469   Function Name: NtUserOpenClipboard
Status: Not hooked

#: 470   Function Name: NtUserOpenDesktop
Status: Not hooked

#: 471   Function Name: NtUserOpenInputDesktop
Status: Not hooked

#: 472   Function Name: NtUserOpenWindowStation
Status: Not hooked

#: 473   Function Name: NtUserPaintDesktop
Status: Not hooked

#: 474   Function Name: NtUserPeekMessage
Status: Not hooked

#: 475   Function Name: NtUserPostMessage
Status: Not hooked

#: 476   Function Name: NtUserPostThreadMessage
Status: Not hooked

#: 477   Function Name: NtUserPrintWindow
Status: Not hooked

#: 478   Function Name: NtUserProcessConnect
Status: Not hooked

#: 479   Function Name: NtUserQueryInformationThread
Status: Not hooked

#: 480   Function Name: NtUserQueryInputContext
Status: Not hooked

#: 481   Function Name: NtUserQuerySendMessage
Status: Not hooked

#: 482   Function Name: NtUserQueryUserCounters
Status: Not hooked

#: 483   Function Name: NtUserQueryWindow
Status: Not hooked

#: 484   Function Name: NtUserRealChildWindowFromPoint
Status: Not hooked

#: 485   Function Name: NtUserRealInternalGetMessage
Status: Not hooked

#: 486   Function Name: NtUserRealWaitMessageEx
Status: Not hooked

#: 487   Function Name: NtUserRedrawWindow
Status: Not hooked

#: 488   Function Name: NtUserRegisterClassExWOW
Status: Not hooked

#: 489   Function Name: NtUserRegisterUserApiHook
Status: Not hooked

#: 490   Function Name: NtUserRegisterHotKey
Status: Not hooked

#: 491   Function Name: NtUserRegisterRawInputDevices
Status: Not hooked

#: 492   Function Name: NtUserRegisterTasklist
Status: Not hooked

#: 493   Function Name: NtUserRegisterWindowMessage
Status: Not hooked

#: 494   Function Name: NtUserRemoveMenu
Status: Not hooked

#: 495   Function Name: NtUserRemoveProp
Status: Not hooked

#: 496   Function Name: NtUserResolveDesktop
Status: Not hooked

#: 497   Function Name: NtUserResolveDesktopForWOW
Status: Not hooked

#: 498   Function Name: NtUserSBGetParms
Status: Not hooked

#: 499   Function Name: NtUserScrollDC
Status: Not hooked

#: 500   Function Name: NtUserScrollWindowEx
Status: Not hooked

#: 501   Function Name: NtUserSelectPalette
Status: Not hooked

#: 502   Function Name: NtUserSendInput
Status: Not hooked

#: 503   Function Name: NtUserSetActiveWindow
Status: Not hooked

#: 504   Function Name: NtUserSetAppImeLevel
Status: Not hooked

#: 505   Function Name: NtUserSetCapture
Status: Not hooked

#: 506   Function Name: NtUserSetClassLong
Status: Not hooked

#: 507   Function Name: NtUserSetClassWord
Status: Not hooked

#: 508   Function Name: NtUserSetClipboardData
Status: Not hooked

#: 509   Function Name: NtUserSetClipboardViewer
Status: Not hooked

#: 510   Function Name: NtUserSetConsoleReserveKeys
Status: Not hooked

#: 511   Function Name: NtUserSetCursor
Status: Not hooked

#: 512   Function Name: NtUserSetCursorContents
Status: Not hooked

#: 513   Function Name: NtUserSetCursorIconData
Status: Not hooked

#: 514   Function Name: NtUserSetDbgTag
Status: Not hooked

#: 515   Function Name: NtUserSetFocus
Status: Not hooked

#: 516   Function Name: NtUserSetImeHotKey
Status: Not hooked

#: 517   Function Name: NtUserSetImeInfoEx
Status: Not hooked

#: 518   Function Name: NtUserSetImeOwnerWindow
Status: Not hooked

#: 519   Function Name: NtUserSetInformationProcess
Status: Not hooked

#: 520   Function Name: NtUserSetInformationThread
Status: Not hooked

#: 521   Function Name: NtUserSetInternalWindowPos
Status: Not hooked

#: 522   Function Name: NtUserSetKeyboardState
Status: Not hooked

#: 523   Function Name: NtUserSetLogonNotifyWindow
Status: Not hooked

#: 524   Function Name: NtUserSetMenu
Status: Not hooked

#: 525   Function Name: NtUserSetMenuContextHelpId
Status: Not hooked

#: 526   Function Name: NtUserSetMenuDefaultItem
Status: Not hooked

#: 527   Function Name: NtUserSetMenuFlagRtoL
Status: Not hooked

#: 528   Function Name: NtUserSetObjectInformation
Status: Not hooked

#: 529   Function Name: NtUserSetParent
Status: Not hooked

#: 530   Function Name: NtUserSetProcessWindowStation
Status: Not hooked

#: 531   Function Name: NtUserSetProp
Status: Not hooked

#: 532   Function Name: NtUserSetRipFlags
Status: Not hooked

#: 533   Function Name: NtUserSetScrollInfo
Status: Not hooked

#: 534   Function Name: NtUserSetShellWindowEx
Status: Not hooked

#: 535   Function Name: NtUserSetSysColors
Status: Not hooked

#: 536   Function Name: NtUserSetSystemCursor
Status: Not hooked

#: 537   Function Name: NtUserSetSystemMenu
Status: Not hooked

#: 538   Function Name: NtUserSetSystemTimer
Status: Not hooked

#: 539   Function Name: NtUserSetThreadDesktop
Status: Not hooked

#: 540   Function Name: NtUserSetThreadLayoutHandles
Status: Not hooked

#: 541   Function Name: NtUserSetThreadState
Status: Not hooked

#: 542   Function Name: NtUserSetTimer
Status: Not hooked

#: 543   Function Name: NtUserSetWindowFNID
Status: Not hooked

#: 544   Function Name: NtUserSetWindowLong
Status: Not hooked

#: 545   Function Name: NtUserSetWindowPlacement
Status: Not hooked

#: 546   Function Name: NtUserSetWindowPos
Status: Not hooked

#: 547   Function Name: NtUserSetWindowRgn
Status: Not hooked

#: 548   Function Name: NtUserSetWindowsHookAW
Status: Not hooked

#: 549   Function Name: NtUserSetWindowsHookEx
Status: Not hooked

#: 550   Function Name: NtUserSetWindowStationUser
Status: Not hooked

#: 551   Function Name: NtUserSetWindowWord
Status: Not hooked

#: 552   Function Name: NtUserSetWinEventHook
Status: Not hooked

#: 553   Function Name: NtUserShowCaret
Status: Not hooked

#: 554   Function Name: NtUserShowScrollBar
Status: Not hooked

#: 555   Function Name: NtUserShowWindow
Status: Not hooked

#: 556   Function Name: NtUserShowWindowAsync
Status: Not hooked

#: 557   Function Name: NtUserSoundSentry
Status: Not hooked

#: 558   Function Name: NtUserSwitchDesktop
Status: Not hooked

#: 559   Function Name: NtUserSystemParametersInfo
Status: Not hooked

#: 560   Function Name: NtUserTestForInteractiveUser
Status: Not hooked

#: 561   Function Name: NtUserThunkedMenuInfo
Status: Not hooked

#: 562   Function Name: NtUserThunkedMenuItemInfo
Status: Not hooked

#: 563   Function Name: NtUserToUnicodeEx
Status: Not hooked

#: 564   Function Name: NtUserTrackMouseEvent
Status: Not hooked

#: 565   Function Name: NtUserTrackPopupMenuEx
Status: Not hooked

#: 566   Function Name: NtUserCalcMenuBar
Status: Not hooked

#: 567   Function Name: NtUserPaintMenuBar
Status: Not hooked

#: 568   Function Name: NtUserTranslateAccelerator
Status: Not hooked

#: 569   Function Name: NtUserTranslateMessage
Status: Not hooked

#: 570   Function Name: NtUserUnhookWindowsHookEx
Status: Not hooked

#: 571   Function Name: NtUserUnhookWinEvent
Status: Not hooked

#: 572   Function Name: NtUserUnloadKeyboardLayout
Status: Not hooked

#: 573   Function Name: NtUserUnlockWindowStation
Status: Not hooked

#: 574   Function Name: NtUserUnregisterClass
Status: Not hooked

#: 575   Function Name: NtUserUnregisterUserApiHook
Status: Not hooked

#: 576   Function Name: NtUserUnregisterHotKey
Status: Not hooked

#: 577   Function Name: NtUserUpdateInputContext
Status: Not hooked

#: 578   Function Name: NtUserUpdateInstance
Status: Not hooked

#: 579   Function Name: NtUserUpdateLayeredWindow
Status: Not hooked

#: 580   Function Name: NtUserGetLayeredWindowAttributes
Status: Not hooked

#: 581   Function Name: NtUserSetLayeredWindowAttributes
Status: Not hooked

#: 582   Function Name: NtUserUpdatePerUserSystemParameters
Status: Not hooked

#: 583   Function Name: NtUserUserHandleGrantAccess
Status: Not hooked

#: 584   Function Name: NtUserValidateHandleSecure
Status: Not hooked

#: 585   Function Name: NtUserValidateRect
Status: Not hooked

#: 586   Function Name: NtUserValidateTimerCallback
Status: Not hooked

#: 587   Function Name: NtUserVkKeyScanEx
Status: Not hooked

#: 588   Function Name: NtUserWaitForInputIdle
Status: Not hooked

#: 589   Function Name: NtUserWaitForMsgAndEvent
Status: Not hooked

#: 590   Function Name: NtUserWaitMessage
Status: Not hooked

#: 591   Function Name: NtUserWin32PoolAllocationStats
Status: Not hooked

#: 592   Function Name: NtUserWindowFromPoint
Status: Not hooked

#: 593   Function Name: NtUserYieldTask
Status: Not hooked

#: 594   Function Name: NtUserRemoteConnect
Status: Not hooked

#: 595   Function Name: NtUserRemoteRedrawRectangle
Status: Not hooked

#: 596   Function Name: NtUserRemoteRedrawScreen
Status: Not hooked

#: 597   Function Name: NtUserRemoteStopScreenUpdates
Status: Not hooked

#: 598   Function Name: NtUserCtxDisplayIOCtl
Status: Not hooked

#: 599   Function Name: NtGdiEngAssociateSurface
Status: Not hooked

 

#: 600   Function Name: NtGdiEngCreateBitmap
Status: Not hooked

#: 601   Function Name: NtGdiEngCreateDeviceSurface
Status: Not hooked

#: 602   Function Name: NtGdiEngCreateDeviceBitmap
Status: Not hooked

#: 603   Function Name: NtGdiEngCreatePalette
Status: Not hooked

#: 604   Function Name: NtGdiEngComputeGlyphSet
Status: Not hooked

#: 605   Function Name: NtGdiEngCopyBits
Status: Not hooked

#: 606   Function Name: NtGdiEngDeletePalette
Status: Not hooked

#: 607   Function Name: NtGdiEngDeleteSurface
Status: Not hooked

#: 608   Function Name: NtGdiEngEraseSurface
Status: Not hooked

#: 609   Function Name: NtGdiEngUnlockSurface
Status: Not hooked

#: 610   Function Name: NtGdiEngLockSurface
Status: Not hooked

#: 611   Function Name: NtGdiEngBitBlt
Status: Not hooked

#: 612   Function Name: NtGdiEngStretchBlt
Status: Not hooked

#: 613   Function Name: NtGdiEngPlgBlt
Status: Not hooked

#: 614   Function Name: NtGdiEngMarkBandingSurface
Status: Not hooked

#: 615   Function Name: NtGdiEngStrokePath
Status: Not hooked

#: 616   Function Name: NtGdiEngFillPath
Status: Not hooked

#: 617   Function Name: NtGdiEngStrokeAndFillPath
Status: Not hooked

#: 618   Function Name: NtGdiEngPaint
Status: Not hooked

#: 619   Function Name: NtGdiEngLineTo
Status: Not hooked

#: 620   Function Name: NtGdiEngAlphaBlend
Status: Not hooked

#: 621   Function Name: NtGdiEngGradientFill
Status: Not hooked

#: 622   Function Name: NtGdiEngTransparentBlt
Status: Not hooked

#: 623   Function Name: NtGdiEngTextOut
Status: Not hooked

#: 624   Function Name: NtGdiEngStretchBltROP
Status: Not hooked

#: 625   Function Name: NtGdiXLATEOBJ_cGetPalette
Status: Not hooked

#: 626   Function Name: NtGdiXLATEOBJ_iXlate
Status: Not hooked

#: 627   Function Name: NtGdiXLATEOBJ_hGetColorTransform
Status: Not hooked

#: 628   Function Name: NtGdiCLIPOBJ_bEnum
Status: Not hooked

#: 629   Function Name: NtGdiCLIPOBJ_cEnumStart
Status: Not hooked

#: 630   Function Name: NtGdiCLIPOBJ_ppoGetPath
Status: Not hooked

#: 631   Function Name: NtGdiEngDeletePath
Status: Not hooked

#: 632   Function Name: NtGdiEngCreateClip
Status: Not hooked

#: 633   Function Name: NtGdiEngDeleteClip
Status: Not hooked

#: 634   Function Name: NtGdiBRUSHOBJ_ulGetBrushColor
Status: Not hooked

#: 635   Function Name: NtGdiBRUSHOBJ_pvAllocRbrush
Status: Not hooked

#: 636   Function Name: NtGdiBRUSHOBJ_pvGetRbrush
Status: Not hooked

#: 637   Function Name: NtGdiBRUSHOBJ_hGetColorTransform
Status: Not hooked

#: 638   Function Name: NtGdiXFORMOBJ_bApplyXform
Status: Not hooked

#: 639   Function Name: NtGdiXFORMOBJ_iGetXform
Status: Not hooked

#: 640   Function Name: NtGdiFONTOBJ_vGetInfo
Status: Not hooked

#: 641   Function Name: NtGdiFONTOBJ_pxoGetXform
Status: Not hooked

#: 642   Function Name: NtGdiFONTOBJ_cGetGlyphs
Status: Not hooked

#: 643   Function Name: NtGdiFONTOBJ_pifi
Status: Not hooked

#: 644   Function Name: NtGdiFONTOBJ_pfdg
Status: Not hooked

#: 645   Function Name: NtGdiFONTOBJ_pQueryGlyphAttrs
Status: Not hooked

#: 646   Function Name: NtGdiFONTOBJ_pvTrueTypeFontFile
Status: Not hooked

#: 647   Function Name: NtGdiFONTOBJ_cGetAllGlyphHandles
Status: Not hooked

#: 648   Function Name: NtGdiSTROBJ_bEnum
Status: Not hooked

#: 649   Function Name: NtGdiSTROBJ_bEnumPositionsOnly
Status: Not hooked

#: 650   Function Name: NtGdiSTROBJ_bGetAdvanceWidths
Status: Not hooked

#: 651   Function Name: NtGdiSTROBJ_vEnumStart
Status: Not hooked

#: 652   Function Name: NtGdiSTROBJ_dwGetCodePage
Status: Not hooked

#: 653   Function Name: NtGdiPATHOBJ_vGetBounds
Status: Not hooked

#: 654   Function Name: NtGdiPATHOBJ_bEnum
Status: Not hooked

#: 655   Function Name: NtGdiPATHOBJ_vEnumStart
Status: Not hooked

#: 656   Function Name: NtGdiPATHOBJ_vEnumStartClipLines
Status: Not hooked

#: 657   Function Name: NtGdiPATHOBJ_bEnumClipLines
Status: Not hooked

#: 658   Function Name: NtGdiGetDhpdev
Status: Not hooked

#: 659   Function Name: NtGdiEngCheckAbort
Status: Not hooked

#: 660   Function Name: NtGdiHT_Get8BPPFormatPalette
Status: Not hooked

#: 661   Function Name: NtGdiHT_Get8BPPMaskPalette
Status: Not hooked

#: 662   Function Name: NtGdiUpdateTransform
Status: Not hooked

#: 663   Function Name: NtGdiSetPUMPDOBJ
Status: Not hooked

#: 664   Function Name: NtGdiBRUSHOBJ_DeleteRbrush
Status: Not hooked

#: 665   Function Name: NtGdiUnmapMemFont
Status: Not hooked

#: 666   Function Name: NtGdiDrawStream
Status: Not hooked


Das wars
Gruß
Beggo

Solang ich hier in ruhe arbeiten kann, werde ich weiter machen.

Solltest du noch irgendetwas mit dem Computer verbinden, wie Memorysticks, Speicherkarten, Digitalkameras, Handy, externe Laufwerke, ... dann stecke vor dem Scan alles an.

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix

hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.[/list]

Schliesse alle Programme, vor allem dein

Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.[/list]

Starte

cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.[/list]

Im Anschluss öffnet sich automatisch eine

combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.[/list]
Wichtiger Hinweis:Combofix sollte niemals in eigenregie ausgeführt werden.

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hey,
kann man aus den bisherigen Logfiles nix herauslesen?
Das Problem mit Combofix ist, dass ich keinen Wiederherstellungspunkt erstellen kann. Und bei Combofix kann das System crashen? Dann habe ich ein echtes Problem.-
Gruß
Beggo

Sicher, aber iwie müssen wir das auch weg bekommen und da bleibt mir eigentlich nur dieser weg oder format C