controllo log

[ivan92]

e un altro pezzo.

.text C:\Windows\system32\svchost.exe[1252] WS2_32.dll!socket 773736D1 5 Bytes JMP 001A0FE5
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!GetStartupInfoW 76C01929 5 Bytes JMP 00DA00AE
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!GetStartupInfoA 76C019C9 5 Bytes JMP 00DA009D
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!CreateProcessW 76C01C01 5 Bytes JMP 00DA0F43
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!CreateProcessA 76C01C36 5 Bytes JMP 00DA00DA
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!VirtualProtect 76C01DD1 5 Bytes JMP 00DA0F7C
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!CreateNamedPipeW 76C05C44 5 Bytes JMP 00DA0FC3
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!LoadLibraryExW 76C230C3 5 Bytes JMP 00DA0F8D
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!LoadLibraryW 76C2361F 5 Bytes JMP 00DA0FA8
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!VirtualProtectEx 76C28D7E 5 Bytes JMP 00DA0067
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!LoadLibraryExA 76C29469 5 Bytes JMP 00DA004A
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!LoadLibraryA 76C29491 5 Bytes JMP 00DA002F
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!CreatePipe 76C30284 5 Bytes JMP 00DA0082
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!GetProcAddress 76C4B8B6 5 Bytes JMP 00DA0F1E
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!CreateFileW 76C4CC4E 5 Bytes JMP 00DA0014
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!CreateFileA 76C4CF71 5 Bytes JMP 00DA0FEF
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!CreateNamedPipeA 76C941F6 5 Bytes JMP 00DA0FDE
.text C:\Windows\system32\svchost.exe[1308] kernel32.dll!WinExec 76C953E7 5 Bytes JMP 00DA00BF
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegCreateKeyExA 7687B5E7 5 Bytes JMP 00610FCA
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegCreateKeyA 7687B8AE 5 Bytes JMP 0061005B
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegOpenKeyA 76880BF5 5 Bytes JMP 00610000
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegCreateKeyW 7688B83D 5 Bytes JMP 0061006C
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegCreateKeyExW 7688BCE1 5 Bytes JMP 0061007D
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegOpenKeyExA 7688D4E8 5 Bytes JMP 00610036
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegOpenKeyW 76893CB0 5 Bytes JMP 0061001B
.text C:\Windows\system32\svchost.exe[1308] ADVAPI32.dll!RegOpenKeyExW 7689F09D 5 Bytes JMP 00610FEF
.text C:\Windows\system32\svchost.exe[1308] WS2_32.dll!socket 773736D1 5 Bytes JMP 00DB0000
.text C:\Windows\system32\svchost.exe[1308] WinInet.dll!InternetOpenA 76B503DD 5 Bytes JMP 00D50FEF
.text C:\Windows\system32\svchost.exe[1308] WinInet.dll!InternetOpenUrlA 76B520A3 5 Bytes JMP 00D50FCD
.text C:\Windows\system32\svchost.exe[1308] WinInet.dll!InternetOpenW 76B52A58 5 Bytes JMP 00D50FDE
.text C:\Windows\system32\svchost.exe[1308] WinInet.dll!InternetOpenUrlW 76B9AF79 5 Bytes JMP 00D5001E
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!GetStartupInfoW 76C01929 5 Bytes JMP 004F0F65
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!GetStartupInfoA 76C019C9 5 Bytes JMP 004F0F80
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!CreateProcessW 76C01C01 5 Bytes JMP 004F0F1B
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!CreateProcessA 76C01C36 5 Bytes JMP 004F0F40
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!VirtualProtect 76C01DD1 5 Bytes JMP 004F007F
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!CreateNamedPipeW 76C05C44 5 Bytes JMP 004F0036
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!LoadLibraryExW 76C230C3 5 Bytes JMP 004F0FA5
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!LoadLibraryW 76C2361F 5 Bytes JMP 004F0FC0
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!VirtualProtectEx 76C28D7E 5 Bytes JMP 004F009A
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!LoadLibraryExA 76C29469 5 Bytes JMP 004F0062
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!LoadLibraryA 76C29491 5 Bytes JMP 004F0047
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!CreatePipe 76C30284 3 Bytes JMP 004F00AB
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!CreatePipe + 4 76C30288 1 Byte [ 89 ]
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!GetProcAddress 76C4B8B6 5 Bytes JMP 004F00CD
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!CreateFileW 76C4CC4E 5 Bytes JMP 004F000A
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!CreateFileA 76C4CF71 5 Bytes JMP 004F0FEF
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!CreateNamedPipeA 76C941F6 5 Bytes JMP 004F0025
.text C:\Windows\system32\svchost.exe[1424] kernel32.dll!WinExec 76C953E7 5 Bytes JMP 004F00BC
.text C:\Windows\system32\svchost.exe[1424] ADVAPI32.dll!RegCreateKeyExA 7687B5E7 5 Bytes JMP 004E0036
.text C:\Windows\system32\svchost.exe[1424] ADVAPI32.dll!RegCreateKeyA 7687B8AE 5 Bytes JMP 004E0FB9
.text C:\Windows\system32\svchost.exe[1424] ADVAPI32.dll!RegOpenKeyA 76880BF5 5 Bytes JMP 004E0FEF
.text C:\Windows\system32\svchost.exe[1424] ADVAPI32.dll!RegCreateKeyW 7688B83D 5 Bytes JMP 004E0F9E
.text C:\Windows\system32\svchost.exe[1424] ADVAPI32.dll!RegCreateKeyExW 7688BCE1 5 Bytes JMP 004E0F79
.text C:\Windows\system32\svchost.exe[1424] ADVAPI32.dll!RegOpenKeyExA 7688D4E8 5 Bytes JMP 004E0025
.text C:\Windows\system32\svchost.exe[1424] ADVAPI32.dll!RegOpenKeyW 76893CB0 5 Bytes JMP 004E000A
.text C:\Windows\system32\svchost.exe[1424] ADVAPI32.dll!RegOpenKeyExW 7689F09D 5 Bytes JMP 004E0FD4
.text C:\Windows\system32\svchost.exe[1424] WS2_32.dll!socket 773736D1 5 Bytes JMP 00510000
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!GetStartupInfoW 76C01929 5 Bytes JMP 00A3009A
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!GetStartupInfoA 76C019C9 5 Bytes JMP 00A30089
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!CreateProcessW 76C01C01 5 Bytes JMP 00A300C6
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!CreateProcessA 76C01C36 5 Bytes JMP 00A30F2F
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!VirtualProtect 76C01DD1 5 Bytes JMP 00A30064
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!CreateNamedPipeW 76C05C44 5 Bytes JMP 00A30FB9
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!LoadLibraryExW 76C230C3 3 Bytes JMP 00A30053
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!LoadLibraryExW + 4 76C230C7 1 Byte [ 89 ]
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!LoadLibraryW 76C2361F 5 Bytes JMP 00A3002C
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!VirtualProtectEx 76C28D7E 5 Bytes JMP 00A30F6F
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!LoadLibraryExA 76C29469 5 Bytes JMP 00A30F8A
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!LoadLibraryA 76C29491 5 Bytes JMP 00A3001B
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!CreatePipe 76C30284 5 Bytes JMP 00A30F54
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!GetProcAddress 76C4B8B6 5 Bytes JMP 00A30F0A
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!CreateFileW 76C4CC4E 5 Bytes JMP 00A30FE5
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!CreateFileA 76C4CF71 5 Bytes JMP 00A30000
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!CreateNamedPipeA 76C941F6 5 Bytes JMP 00A30FCA
.text C:\Windows\system32\svchost.exe[1856] kernel32.dll!WinExec 76C953E7 5 Bytes JMP 00A300B5
.text C:\Windows\system32\svchost.exe[1856] ADVAPI32.dll!RegCreateKeyExA 7687B5E7 5 Bytes JMP 00A20040
.text C:\Windows\system32\svchost.exe[1856] ADVAPI32.dll!RegCreateKeyA 7687B8AE 5 Bytes JMP 00A20025
.text C:\Windows\system32\svchost.exe[1856] ADVAPI32.dll!RegOpenKeyA 76880BF5 5 Bytes JMP 00A20FEF
.text C:\Windows\system32\svchost.exe[1856] ADVAPI32.dll!RegCreateKeyW 7688B83D 5 Bytes JMP 00A20F9E
.text C:\Windows\system32\svchost.exe[1856] ADVAPI32.dll!RegCreateKeyExW 7688BCE1 5 Bytes JMP 00A20F83
.text C:\Windows\system32\svchost.exe[1856] ADVAPI32.dll!RegOpenKeyExA 7688D4E8 5 Bytes JMP 00A20FB9
.text C:\Windows\system32\svchost.exe[1856] ADVAPI32.dll!RegOpenKeyW 76893CB0 5 Bytes JMP 00A20FD4
.text C:\Windows\system32\svchost.exe[1856] ADVAPI32.dll!RegOpenKeyExW 7689F09D 5 Bytes JMP 00A2000A
.text C:\Windows\system32\svchost.exe[1856] WS2_32.dll!socket 773736D1 5 Bytes JMP 00A4000A
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!GetStartupInfoW 76C01929 1 Byte [ E9 ]
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!GetStartupInfoW + 2 76C0192B 3 Bytes [ F5, B4, 89 ]
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!GetStartupInfoA 76C019C9 5 Bytes JMP 00750F48
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!CreateProcessW 76C01C01 5 Bytes JMP 007500A2
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!CreateProcessA 76C01C36 5 Bytes JMP 00750F01
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!VirtualProtect 76C01DD1 5 Bytes JMP 00750058
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!CreateNamedPipeW 76C05C44 5 Bytes JMP 00750FB9
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!LoadLibraryExW 76C230C3 5 Bytes JMP 00750047
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!LoadLibraryW 76C2361F 5 Bytes JMP 00750F94
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!VirtualProtectEx 76C28D7E 5 Bytes JMP 00750F63
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!LoadLibraryExA 76C29469 5 Bytes JMP 00750036
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!LoadLibraryA 76C29491 5 Bytes JMP 00750025
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!CreatePipe 76C30284 5 Bytes JMP 00750069
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!GetProcAddress 76C4B8B6 5 Bytes JMP 007500BD
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!CreateFileW 76C4CC4E 5 Bytes JMP 00750FDE
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!CreateFileA 76C4CF71 5 Bytes JMP 00750FEF
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!CreateNamedPipeA 76C941F6 5 Bytes JMP 0075000A
.text C:\Windows\system32\svchost.exe[2484] kernel32.dll!WinExec 76C953E7 5 Bytes JMP 00750F12
.text C:\Windows\system32\svchost.exe[2484] ADVAPI32.dll!RegCreateKeyExA 7687B5E7 5 Bytes JMP 00610036
.text C:\Windows\system32\svchost.exe[2484] ADVAPI32.dll!RegCreateKeyA 7687B8AE 5 Bytes JMP 00610FB9
.text C:\Windows\system32\svchost.exe[2484] ADVAPI32.dll!RegOpenKeyA 76880BF5 5 Bytes JMP 0061000A
.text C:\Windows\system32\svchost.exe[2484] ADVAPI32.dll!RegCreateKeyW 7688B83D 5 Bytes JMP 00610F9E
.text C:\Windows\system32\svchost.exe[2484] ADVAPI32.dll!RegCreateKeyExW 7688BCE1 5 Bytes JMP 00610F79
.text C:\Windows\system32\svchost.exe[2484] ADVAPI32.dll!RegOpenKeyExA 7688D4E8 5 Bytes JMP 00610FE5
.text C:\Windows\system32\svchost.exe[2484] ADVAPI32.dll!RegOpenKeyW 76893CB0 5 Bytes JMP 0061001B
.text C:\Windows\system32\svchost.exe[2484] ADVAPI32.dll!RegOpenKeyExW 7689F09D 5 Bytes JMP 00610FD4
.text C:\Windows\system32\svchost.exe[2484] WS2_32.dll!socket 773736D1 5 Bytes JMP 00760FEF
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!GetStartupInfoW 76C01929 5 Bytes JMP 04050F60
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!GetStartupInfoA 76C019C9 5 Bytes JMP 040500A6
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!CreateProcessW 76C01C01 5 Bytes JMP 040500D5
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!CreateProcessA 76C01C36 5 Bytes JMP 04050F3E
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!VirtualProtect 76C01DD1 5 Bytes JMP 04050066
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!CreateNamedPipeW 76C05C44 5 Bytes JMP 04050033
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!LoadLibraryExW 76C230C3 5 Bytes JMP 04050055
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!LoadLibraryW 76C2361F 5 Bytes JMP 04050FAC
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!VirtualProtectEx 76C28D7E 5 Bytes JMP 04050F7B
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!LoadLibraryExA 76C29469 5 Bytes JMP 04050044
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!LoadLibraryA 76C29491 5 Bytes JMP 04050FBD
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!CreatePipe 76C30284 5 Bytes JMP 04050095
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!GetProcAddress 76C4B8B6 5 Bytes JMP 040500E6
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!CreateFileW 76C4CC4E 5 Bytes JMP 04050011
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!CreateFileA 76C4CF71 5 Bytes JMP 04050000
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!CreateNamedPipeA 76C941F6 5 Bytes JMP 04050022
.text C:\Windows\Explorer.EXE[2800] kernel32.dll!WinExec 76C953E7 5 Bytes JMP 04050F4F
.text C:\Windows\Explorer.EXE[2800] ADVAPI32.dll!RegCreateKeyExA 7687B5E7 5 Bytes JMP 03B00040
.text C:\Windows\Explorer.EXE[2800] ADVAPI32.dll!RegCreateKeyA 7687B8AE 5 Bytes JMP 03B00FB9
.text C:\Windows\Explorer.EXE[2800] ADVAPI32.dll!RegOpenKeyA 76880BF5 5 Bytes JMP 03B00FEF
.text C:\Windows\Explorer.EXE[2800] ADVAPI32.dll!RegCreateKeyW 7688B83D 5 Bytes JMP 03B00F9E
.text C:\Windows\Explorer.EXE[2800] ADVAPI32.dll!RegCreateKeyExW 7688BCE1 5 Bytes JMP 03B00F79
.text C:\Windows\Explorer.EXE[2800] ADVAPI32.dll!RegOpenKeyExA 7688D4E8 5 Bytes JMP 03B0000A
.text C:\Windows\Explorer.EXE[2800] ADVAPI32.dll!RegOpenKeyW 76893CB0 5 Bytes JMP 03B00FD4
.text C:\Windows\Explorer.EXE[2800] ADVAPI32.dll!RegOpenKeyExW 7689F09D 5 Bytes JMP 03B00025
.text C:\Windows\Explorer.EXE[2800] WS2_32.dll!socket 773736D1 5 Bytes JMP 04060FEF
.text C:\Windows\Explorer.EXE[2800] WININET.dll!InternetOpenA 76B503DD 5 Bytes JMP 04040FEF
.text C:\Windows\Explorer.EXE[2800] WININET.dll!InternetOpenUrlA 76B520A3 5 Bytes JMP 04040FCA
.text C:\Windows\Explorer.EXE[2800] WININET.dll!InternetOpenW 76B52A58 5 Bytes JMP 04040000
.text C:\Windows\Explorer.EXE[2800] WININET.dll!InternetOpenUrlW

[ivan92]

.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] kernel32.dll!FindResourceExA 76C308DD 7 Bytes JMP 28001D80 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] kernel32.dll!FindResourceA 76C309A5 5 Bytes JMP 28001CF0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] kernel32.dll!CreateEventA 76C44AD8 5 Bytes JMP 28001840 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] kernel32.dll!LockResource 76C47F1F 5 Bytes JMP 28001F50 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] kernel32.dll!FindResourceExW 76C4813B 1 Byte [ E9 ]
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] kernel32.dll!FindResourceExW + 2 76C4813D 5 Bytes [ 9B, 3B, B1, CC, CC ]
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] kernel32.dll!LoadResource 76C48213 7 Bytes JMP 28001E20 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] kernel32.dll!FindResourceW 76C497C7 5 Bytes JMP 28001BE0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] kernel32.dll!SizeofResource 76C497E5 7 Bytes JMP 28001EE0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] kernel32.dll!GetProcAddress 76C4B8B6 5 Bytes JMP 005CED60 C:\Program Files\McAfee\SiteAdvisor\saPlugin.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] ADVAPI32.dll!CryptDeriveKey 7686E6F6 7 Bytes JMP 28001000 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] ADVAPI32.dll!CryptDecrypt 7686E8D9 7 Bytes JMP 28001060 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] USER32.dll!SetWindowPlacement 76E379BB 5 Bytes JMP 28005DC0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] USER32.dll!SetWindowRgn 76E395E2 7 Bytes JMP 28005F00 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] USER32.dll!LoadImageW 76E3D61D 5 Bytes JMP 28006690 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] USER32.dll!LoadIconW 76E3EC94 5 Bytes JMP 28006880 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] USER32.dll!CreateWindowExW 76E43D67 5 Bytes JMP 28003CA0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] USER32.dll!GetWindowLongW 76E4F67F 7 Bytes JMP 28006A20 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] USER32.dll!PeekMessageW 76E4FD9F 5 Bytes JMP 280045E0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] USER32.dll!TrackPopupMenuEx 76E60F4D 5 Bytes JMP 28004EC0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] USER32.dll!CreateDialogParamW 76E61C58 5 Bytes JMP 28006040 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] USER32.dll!MessageBoxIndirectW 76E8D56B 5 Bytes JMP 28006230 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] WS2_32.dll!closesocket 7737330C 5 Bytes JMP 2800BC20 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] WS2_32.dll!recv 7737343A 5 Bytes JMP 2800B440 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] WS2_32.dll!WSASend 77374496 5 Bytes JMP 2800B9E0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] WS2_32.dll!send 7737659B 5 Bytes JMP 2800B800 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] WS2_32.dll!WSARecv 77378400 5 Bytes JMP 2800B5E0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] SHELL32.dll!Shell_NotifyIconW 75AFC808 5 Bytes JMP 28003400 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] ole32.dll!CoRegisterClassObject 76CF45AC 5 Bytes JMP 28002360 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] ole32.dll!CoInitializeEx 76D2B89A 5 Bytes JMP 28002260 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] ole32.dll!CoCreateInstance 76D2E188 5 Bytes JMP 28002600 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] WININET.dll!HttpOpenRequestA 76B406D6 5 Bytes JMP 2800A2C0 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] WININET.dll!InternetCloseHandle 76B4607B 5 Bytes JMP 2800A600 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] WININET.dll!InternetReadFile 76B4A067 5 Bytes JMP 2800A450 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Program Files\Windows Live\Messenger\msnmsgr.exe[3404] WININET.dll!HttpSendRequestA 76B508C5 5 Bytes JMP 2800A530 C:\Program Files\Messenger Plus! Live\MsgPlusLive.dll
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!GetStartupInfoW 76C01929 5 Bytes JMP 005D0F32
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!GetStartupInfoA 76C019C9 5 Bytes JMP 005D0F43
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!CreateProcessW 76C01C01 5 Bytes JMP 005D0EF5
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!CreateProcessA 76C01C36 5 Bytes JMP 005D0F10
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!VirtualProtect 76C01DD1 5 Bytes JMP 005D0F6F
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!CreateNamedPipeW 76C05C44 5 Bytes JMP 005D0FC0
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!LoadLibraryExW 76C230C3 5 Bytes JMP 005D0F8A
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!LoadLibraryW 76C2361F 5 Bytes JMP 005D003D
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!VirtualProtectEx 76C28D7E 5 Bytes JMP 005D0F5E
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!LoadLibraryExA 76C29469 5 Bytes JMP 005D0F9B
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!LoadLibraryA 76C29491 5 Bytes JMP 005D002C
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!CreatePipe 76C30284 5 Bytes JMP 005D006E
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!GetProcAddress 76C4B8B6 5 Bytes JMP 005D0EE4
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!CreateFileW 76C4CC4E 5 Bytes JMP 005D0000
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!CreateFileA 76C4CF71 5 Bytes JMP 005D0FE5
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!CreateNamedPipeA 76C941F6 5 Bytes JMP 005D0011
.text C:\Windows\system32\svchost.exe[3536] kernel32.dll!WinExec 76C953E7 5 Bytes JMP 005D0F21
.text C:\Windows\system32\svchost.exe[3536] ADVAPI32.dll!RegCreateKeyExA 7687B5E7 5 Bytes JMP 00580F7C
.text C:\Windows\system32\svchost.exe[3536] ADVAPI32.dll!RegCreateKeyA 7687B8AE 5 Bytes JMP 00580FA8
.text C:\Windows\system32\svchost.exe[3536] ADVAPI32.dll!RegOpenKeyA 76880BF5 5 Bytes JMP 00580FEF
.text C:\Windows\system32\svchost.exe[3536] ADVAPI32.dll!RegCreateKeyW 7688B83D 5 Bytes JMP 00580F8D
.text C:\Windows\system32\svchost.exe[3536] ADVAPI32.dll!RegCreateKeyExW 7688BCE1 5 Bytes JMP 00580F6B
.text C:\Windows\system32\svchost.exe[3536] ADVAPI32.dll!RegOpenKeyExA 7688D4E8 5 Bytes JMP 00580FC3
.text C:\Windows\system32\svchost.exe[3536] ADVAPI32.dll!RegOpenKeyW 76893CB0 5 Bytes JMP 00580FDE
.text C:\Windows\system32\svchost.exe[3536] ADVAPI32.dll!RegOpenKeyExW 7689F09D 5 Bytes JMP 0058000A
.text C:\Windows\system32\svchost.exe[3536] WS2_32.dll!socket 773736D1 5 Bytes JMP 005E0000
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!GetStartupInfoW 76C01929 5 Bytes JMP 00070F50
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!GetStartupInfoA 76C019C9 5 Bytes JMP 00070096
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!CreateProcessW 76C01C01 5 Bytes JMP 000700D6
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!CreateProcessA 76C01C36 5 Bytes JMP 00070F35
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!VirtualProtect 76C01DD1 5 Bytes JMP 00070F6B
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!CreateNamedPipeW 76C05C44 5 Bytes JMP 00070FB9
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!LoadLibraryExW 76C230C3 5 Bytes JMP 00070F7C
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!LoadLibraryW 76C2361F 5 Bytes JMP 00070F9E
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!VirtualProtectEx 76C28D7E 5 Bytes JMP 0007006A
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!LoadLibraryExA 76C29469 5 Bytes JMP 00070F8D
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!LoadLibraryA 76C29491 5 Bytes JMP 00070025
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!CreatePipe 76C30284 5 Bytes JMP 0007007B
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!GetProcAddress 76C4B8B6 5 Bytes JMP 00070F1A
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!CreateFileW 76C4CC4E 5 Bytes JMP 00070FDE
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!CreateFileA 76C4CF71 5 Bytes JMP 00070FEF
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!CreateNamedPipeA 76C941F6 5 Bytes JMP 0007000A
.text C:\Windows\System32\svchost.exe[3648] kernel32.dll!WinExec 76C953E7 5 Bytes JMP 000700B1
.text C:\Windows\System32\svchost.exe[3648] ADVAPI32.dll!RegCreateKeyExA 7687B5E7 5 Bytes JMP 00060FB9
.text C:\Windows\System32\svchost.exe[3648] ADVAPI32.dll!RegCreateKeyA 7687B8AE 5 Bytes JMP 00060FD4
.text C:\Windows\System32\svchost.exe[3648] ADVAPI32.dll!RegOpenKeyA 76880BF5 5 Bytes JMP 0006000A
.text C:\Windows\System32\svchost.exe[3648] ADVAPI32.dll!RegCreateKeyW 7688B83D 5 Bytes JMP 0006005B
.text C:\Windows\System32\svchost.exe[3648] ADVAPI32.dll!RegCreateKeyExW 7688BCE1 5 Bytes JMP 00060FA8
.text C:\Windows\System32\svchost.exe[3648] ADVAPI32.dll!RegOpenKeyExA 7688D4E8 5 Bytes JMP 00060036
.text C:\Windows\System32\svchost.exe[3648] ADVAPI32.dll!RegOpenKeyW 76893CB0 5 Bytes JMP 00060025
.text C:\Windows\System32\svchost.exe[3648] ADVAPI32.dll!RegOpenKeyExW 7689F09D 5 Bytes JMP 00060FEF

---- Kernel IAT/EAT - GMER 1.0.13 ----

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [8288F6D2] \SystemRoot\System32\Drivers\spjp.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [8288F040] \SystemRoot\System32\Drivers\spjp.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [8288F7FC] \SystemRoot\System32\Drivers\spjp.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [8288F0BE] \SystemRoot\System32\Drivers\spjp.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8288F13C] \SystemRoot\System32\Drivers\spjp.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [8289F048] \SystemRoot\System32\Drivers\spjp.sys
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortNotification] F73BFF33
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortWritePortUchar] B85F0B75
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortWritePortUlong] FFFFFFFE
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortGetPhysicalAddress] 08C25D5E
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] 5D8B5300
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortGetScatterGatherList] 74DF3B0C
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortReadPortUchar] 01FB8311
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortStallExecution] 5F5B0C74
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortGetParentBusType] FFFFFEB8
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortRequestCallback] C25D5EFF
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortWritePortBufferUshort] 7E390008
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortGetUnCachedExtension] C7077524
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortCompleteRequest] 51642446
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortMoveMemory] 7E398C99
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] C7077528
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] 51902846
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 468B8C99
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortReadPortUshort] 244E8B2C
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortReadPortBufferUshort] 7468016A
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortInitialize] 500000FA
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortGetDeviceBase] C73BD1FF
IAT \SystemRoot\System32\Drivers\arokya7l.SYS[ataport.SYS!AtaPortDeviceStateChange] 5F5B0C75

[ivan92]

---- User IAT/EAT - GMER 1.0.13 ----

IAT C:\Windows\system32\rundll32.exe[1668] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Windows\system32\rundll32.exe[1668] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Windows\system32\rundll32.exe[1668] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Windows\system32\rundll32.exe[1668] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Windows\system32\rundll32.exe[1668] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Windows\system32\rundll32.exe[1668] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Windows\system32\rundll32.exe[1668] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!CreateProcessW] [73461BEB] C:\Windows\AppPatch\AcLayers.DLL
IAT C:\Windows\system32\rundll32.exe[1668] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Windows\system32\rundll32.exe[1668] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Windows\system32\rundll32.exe[1668] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Windows\system32\rundll32.exe[1668] @ C:\Windows\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Windows\system32\rundll32.exe[1668] @ C:\Windows\system32\SAMLIB.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CopyFileW] [6722EBDE] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!MoveFileW] [6722EE17] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!DeleteFileW] [6722ED4D] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateFileW] [67230679] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegOpenKeyExW] [6722FAFD] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegCreateKeyExW] [6722F921] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegSetValueExW] [6722FE8F] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CopyFileW] [6722EBDE] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CreateFileW] [67230679] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!DeleteFileW] [6722ED4D] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!OpenFile] [6722EF6C] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!CopyFileW] [6722EBDE] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!DeleteFileW] [6722ED4D] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!MoveFileW] [6722EE17] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!CreateFileW] [67230679] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!CreateFileW] [67230679] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\RPCRT4.dll [ADVAPI32.dll!RegCreateKeyExA] [6722F812] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\RPCRT4.dll [ADVAPI32.dll!RegSetValueExA] [6722FDE3] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\RPCRT4.dll [ADVAPI32.dll!RegOpenKeyExA] [6722FA29] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\RPCRT4.dll [ADVAPI32.dll!RegOpenKeyExW] [6722FAFD] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!CreateProcessW] [67225ED4] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!DeleteFileW] [6722ED4D] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!GetFileAttributesExW] [67225CBE] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!CreateFileW] [67230679] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!GetFileAttributesW] [67225AC0] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!AccessCheck] [6722EB22] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegSetValueW] [6722FD3B] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegDeleteValueW] [6722FFE1] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegOpenKeyExW] [6722FAFD] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegSetValueExW] [6722FE8F] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegCreateKeyExW] [6722F921] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegOpenKeyExA] [6722FA29] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!DeleteFileW] [6722ED4D] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesW] [6722F28E] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileW] [67230679] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesA] [6722F236] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileA] [6723055D] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegSetValueExA] [6722FDE3] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegCreateKeyExA] [6722F812] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegOpenKeyExA] [6722FA29] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegDeleteValueA] [6722FF3F] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegCreateKeyExW] [6722F921] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegOpenKeyExW] [6722FAFD] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegSetValueExW] [6722FE8F] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegDeleteValueW] [6722FFE1] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\NETAPI32.dll [ADVAPI32.dll!RegSetValueExW] [6722FE8F] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\NETAPI32.dll [ADVAPI32.dll!SetFileSecurityW] [672300DC] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\NETAPI32.dll [ADVAPI32.dll!RegOpenKeyExA] [6722FA29] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\NETAPI32.dll [ADVAPI32.dll!RegCreateKeyExW] [6722F921] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\NETAPI32.dll [ADVAPI32.dll!RegOpenKeyExW] [6722FAFD] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\NETAPI32.dll [ADVAPI32.dll!AccessCheck] [6722EB22] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\NETAPI32.dll [KERNEL32.dll!CreateFileW] [67230679] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\NETAPI32.dll [KERNEL32.dll!MoveFileExW] [6722EEFC] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CopyFileW] [6722EBDE] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileW] [6722EE17] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!DeleteFileW] [6722ED4D] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!SetFileAttributesW] [6722F28E] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileExW] [6722EEFC] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CreateFileW] [67230679] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegOpenKeyExW] [6722FAFD] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegSetValueExW] [6722FE8F] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegCreateKeyExW] [6722F921] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegDeleteValueW] [6722FFE1] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegSetValueW] [6722FD3B] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!AccessCheck] [6722EB22] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegCreateKeyW] [6722F780] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!SetFileSecurityW] [672300DC] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegOpenKeyExA] [6722FA29] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!PrivCopyFileExW] [6722F1D2] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!MoveFileExW] [6722EEFC] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!DeleteFileW] [6722ED4D] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!CreateFileW] [67230679] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!SetFileAttributesW] [6722F28E] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USERENV.dll [ADVAPI32.dll!SetFileSecurityW] [672300DC] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USERENV.dll [ADVAPI32.dll!RegCreateKeyExW] [6722F921] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USERENV.dll [ADVAPI32.dll!RegSetValueExW] [6722FE8F] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\USERENV.dll [ADVAPI32.dll!RegOpenKeyExW] [6722FAFD] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!CreateFileW] [67230679] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [73574618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\Secur32.dll [ADVAPI32.dll!RegCreateKeyExW] [6722F921] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\Secur32.dll [ADVAPI32.dll!RegSetValueExW] [6722FE8F] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Utente\Desktop\gmer.exe[2604] @ C:\Windows\system32\Secur32.dll [ADVAPI32.dll!RegOpenKeyExW] [6722FAFD] C:\Windows\AppPatch\AcGenral.DLL

[ivan92]

Device \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA 8521F1F8
Device \FileSystem\Ntfs \Ntfs IRP_MJ_PNP 8521F1F8

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [8CD3CDD4] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [8CD3CDD4] mfehidk.sys

Device \Driver\netbt \Device\NetBT_Tcpip_{3BDC32BC-0385-4214-B7B2-D7462D4A6E1E} IRP_MJ_CREATE 8DAC31F8
Device \Driver\netbt \Device\NetBT_Tcpip_{3BDC32BC-0385-4214-B7B2-D7462D4A6E1E} IRP_MJ_CLOSE 8DAC31F8
Device \Driver\netbt \Device\NetBT_Tcpip_{3BDC32BC-0385-4214-B7B2-D7462D4A6E1E} IRP_MJ_DEVICE_CONTROL 8DAC31F8
Device \Driver\netbt \Device\NetBT_Tcpip_{3BDC32BC-0385-4214-B7B2-D7462D4A6E1E} IRP_MJ_INTERNAL_DEVICE_CONTROL 8DAC31F8
Device \Driver\netbt \Device\NetBT_Tcpip_{3BDC32BC-0385-4214-B7B2-D7462D4A6E1E} IRP_MJ_CLEANUP 8DAC31F8
Device \Driver\netbt \Device\NetBT_Tcpip_{3BDC32BC-0385-4214-B7B2-D7462D4A6E1E} IRP_MJ_PNP 8DAC31F8

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_NAMED_PIPE [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_CLOSE [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_READ [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_WRITE [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_INFORMATION [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SET_INFORMATION [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_EA [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SET_EA [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_FLUSH_BUFFERS [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_VOLUME_INFORMATION [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SET_VOLUME_INFORMATION [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_DIRECTORY_CONTROL [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_FILE_SYSTEM_CONTROL [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CONTROL [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_INTERNAL_DEVICE_CONTROL [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SHUTDOWN [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_LOCK_CONTROL [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_CLEANUP [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_MAILSLOT [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_SECURITY [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SET_SECURITY [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_POWER [8283880D] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SYSTEM_CONTROL [8283880D] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CHANGE [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_QUOTA [828385E6] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SET_QUOTA [828385E6] Wdf01000.sys

Device \Driver\volmgr \Device\VolMgrControl IRP_MJ_CREATE 8448B1F8
Device \Driver\volmgr \Device\VolMgrControl IRP_MJ_READ 8448B1F8
Device \Driver\volmgr \Device\VolMgrControl IRP_MJ_WRITE 8448B1F8
Device \Driver\volmgr \Device\VolMgrControl IRP_MJ_FLUSH_BUFFERS 8448B1F8
Device \Driver\volmgr \Device\VolMgrControl IRP_MJ_DEVICE_CONTROL 8448B1F8
Device \Driver\volmgr \Device\VolMgrControl IRP_MJ_INTERNAL_DEVICE_CONTROL 8448B1F8
Device \Driver\volmgr \Device\VolMgrControl IRP_MJ_SHUTDOWN 8448B1F8
Device \Driver\volmgr \Device\VolMgrControl IRP_MJ_CLEANUP 8448B1F8
Device \Driver\volmgr \Device\VolMgrControl IRP_MJ_POWER 8448B1F8
Device \Driver\volmgr \Device\VolMgrControl IRP_MJ_SYSTEM_CONTROL 8448B1F8
Device \Driver\volmgr \Device\VolMgrControl IRP_MJ_PNP 8448B1F8
Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_CREATE 862F71F8
Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_CLOSE 862F71F8
Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_INTERNAL_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_POWER 862F71F8
Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_SYSTEM_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBPDO-0 IRP_MJ_PNP 862F71F8
Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_CREATE 862F71F8
Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_CLOSE 862F71F8
Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_INTERNAL_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_POWER 862F71F8
Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_SYSTEM_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBPDO-1 IRP_MJ_PNP 862F71F8
Device \Driver\usbehci \Device\USBPDO-2 IRP_MJ_CREATE 862F51F8
Device \Driver\usbehci \Device\USBPDO-2 IRP_MJ_CLOSE 862F51F8
Device \Driver\usbehci \Device\USBPDO-2 IRP_MJ_DEVICE_CONTROL 862F51F8
Device \Driver\usbehci \Device\USBPDO-2 IRP_MJ_INTERNAL_DEVICE_CONTROL 862F51F8
Device \Driver\usbehci \Device\USBPDO-2 IRP_MJ_POWER 862F51F8
Device \Driver\usbehci \Device\USBPDO-2 IRP_MJ_SYSTEM_CONTROL 862F51F8
Device \Driver\usbehci \Device\USBPDO-2 IRP_MJ_PNP 862F51F8
Device \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_CREATE 862F71F8
Device \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_CLOSE 862F71F8
Device \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_INTERNAL_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_POWER 862F71F8
Device \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_SYSTEM_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBPDO-3 IRP_MJ_PNP 862F71F8
Device \Driver\netbt \Device\NetBT_Tcpip_{244C70DF-2565-42C8-AE80-B873490A88FA} IRP_MJ_CREATE 8DAC31F8
Device \Driver\netbt \Device\NetBT_Tcpip_{244C70DF-2565-42C8-AE80-B873490A88FA} IRP_MJ_CLOSE 8DAC31F8
Device \Driver\netbt \Device\NetBT_Tcpip_{244C70DF-2565-42C8-AE80-B873490A88FA} IRP_MJ_DEVICE_CONTROL 8DAC31F8
Device \Driver\netbt \Device\NetBT_Tcpip_{244C70DF-2565-42C8-AE80-B873490A88FA} IRP_MJ_INTERNAL_DEVICE_CONTROL 8DAC31F8
Device \Driver\netbt \Device\NetBT_Tcpip_{244C70DF-2565-42C8-AE80-B873490A88FA} IRP_MJ_CLEANUP 8DAC31F8
Device \Driver\netbt \Device\NetBT_Tcpip_{244C70DF-2565-42C8-AE80-B873490A88FA} IRP_MJ_PNP 8DAC31F8
Device \Driver\usbuhci \Device\USBPDO-4 IRP_MJ_CREATE 862F71F8
Device \Driver\usbuhci \Device\USBPDO-4 IRP_MJ_CLOSE 862F71F8
Device \Driver\usbuhci \Device\USBPDO-4 IRP_MJ_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBPDO-4 IRP_MJ_INTERNAL_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBPDO-4 IRP_MJ_POWER 862F71F8
Device \Driver\usbuhci \Device\USBPDO-4 IRP_MJ_SYSTEM_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBPDO-4 IRP_MJ_PNP 862F71F8

[ivan92]

AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_CREATE [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_CREATE_NAMED_PIPE [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_CLOSE [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_READ [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_WRITE [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_QUERY_INFORMATION [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_SET_INFORMATION [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_QUERY_EA [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_SET_EA [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_FLUSH_BUFFERS [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_QUERY_VOLUME_INFORMATION [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_SET_VOLUME_INFORMATION [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_DIRECTORY_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_FILE_SYSTEM_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_DEVICE_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_SHUTDOWN [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_LOCK_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_CLEANUP [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_CREATE_MAILSLOT [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_QUERY_SECURITY [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_SET_SECURITY [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_POWER [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_SYSTEM_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_DEVICE_CHANGE [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_QUERY_QUOTA [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Tcp IRP_MJ_SET_QUOTA [8DD050EC] Mpfp.sys

Device \Driver\usbuhci \Device\USBPDO-5 IRP_MJ_CREATE 862F71F8
Device \Driver\usbuhci \Device\USBPDO-5 IRP_MJ_CLOSE 862F71F8
Device \Driver\usbuhci \Device\USBPDO-5 IRP_MJ_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBPDO-5 IRP_MJ_INTERNAL_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBPDO-5 IRP_MJ_POWER 862F71F8
Device \Driver\usbuhci \Device\USBPDO-5 IRP_MJ_SYSTEM_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBPDO-5 IRP_MJ_PNP 862F71F8
Device \Driver\usbehci \Device\USBPDO-6 IRP_MJ_CREATE 862F51F8
Device \Driver\usbehci \Device\USBPDO-6 IRP_MJ_CLOSE 862F51F8
Device \Driver\usbehci \Device\USBPDO-6 IRP_MJ_DEVICE_CONTROL 862F51F8
Device \Driver\usbehci \Device\USBPDO-6 IRP_MJ_INTERNAL_DEVICE_CONTROL 862F51F8
Device \Driver\usbehci \Device\USBPDO-6 IRP_MJ_POWER 862F51F8
Device \Driver\usbehci \Device\USBPDO-6 IRP_MJ_SYSTEM_CONTROL 862F51F8
Device \Driver\usbehci \Device\USBPDO-6 IRP_MJ_PNP 862F51F8
Device \Driver\volmgr \Device\HarddiskVolume1 IRP_MJ_CREATE 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume1 IRP_MJ_READ 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume1 IRP_MJ_WRITE 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume1 IRP_MJ_FLUSH_BUFFERS 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume1 IRP_MJ_DEVICE_CONTROL 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume1 IRP_MJ_INTERNAL_DEVICE_CONTROL 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume1 IRP_MJ_SHUTDOWN 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume1 IRP_MJ_CLEANUP 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume1 IRP_MJ_POWER 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume1 IRP_MJ_SYSTEM_CONTROL 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume1 IRP_MJ_PNP 8448B1F8
Device \Driver\cdrom \Device\CdRom0 IRP_MJ_CREATE 864291F8
Device \Driver\cdrom \Device\CdRom0 IRP_MJ_CLOSE 864291F8
Device \Driver\cdrom \Device\CdRom0 IRP_MJ_READ 864291F8
Device \Driver\cdrom \Device\CdRom0 IRP_MJ_WRITE 864291F8
Device \Driver\cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 864291F8
Device \Driver\cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 864291F8
Device \Driver\cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 864291F8
Device \Driver\cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 864291F8
Device \Driver\cdrom \Device\CdRom0 IRP_MJ_POWER 864291F8
Device \Driver\cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 864291F8
Device \Driver\cdrom \Device\CdRom0 IRP_MJ_PNP 864291F8
Device \Driver\volmgr \Device\HarddiskVolume2 IRP_MJ_CREATE 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume2 IRP_MJ_READ 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume2 IRP_MJ_WRITE 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume2 IRP_MJ_FLUSH_BUFFERS 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume2 IRP_MJ_DEVICE_CONTROL 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume2 IRP_MJ_INTERNAL_DEVICE_CONTROL 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume2 IRP_MJ_SHUTDOWN 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume2 IRP_MJ_CLEANUP 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume2 IRP_MJ_POWER 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume2 IRP_MJ_SYSTEM_CONTROL 8448B1F8
Device \Driver\volmgr \Device\HarddiskVolume2 IRP_MJ_PNP 8448B1F8
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_CREATE [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_CREATE_NAMED_PIPE [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_CLOSE [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_READ [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_WRITE [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_QUERY_INFORMATION [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_SET_INFORMATION [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_QUERY_EA [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_SET_EA [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_FLUSH_BUFFERS [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_QUERY_VOLUME_INFORMATION [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_SET_VOLUME_INFORMATION [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_DIRECTORY_CONTROL [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_FILE_SYSTEM_CONTROL [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_DEVICE_CONTROL [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_INTERNAL_DEVICE_CONTROL [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_SHUTDOWN [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_LOCK_CONTROL [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_CLEANUP [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_CREATE_MAILSLOT [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_QUERY_SECURITY [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_SET_SECURITY [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_POWER [82895E1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_SYSTEM_CONTROL [828AA514] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_DEVICE_CHANGE [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_QUERY_QUOTA [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_SET_QUOTA [828D1B1C] spjp.sys
Device \Driver\PCI_PNP5330 \Device\00000059 IRP_MJ_PNP [828CEE8A] spjp.sys
Device \Driver\netbt \Device\NetBT_Tcpip_{035A7A39-03E6-4522-9147-59CAF8CF44C6} IRP_MJ_CREATE 8DAC31F8
Device \Driver\netbt \Device\NetBT_Tcpip_{035A7A39-03E6-4522-9147-59CAF8CF44C6} IRP_MJ_CLOSE 8DAC31F8
Device \Driver\netbt \Device\NetBT_Tcpip_{035A7A39-03E6-4522-9147-59CAF8CF44C6} IRP_MJ_DEVICE_CONTROL 8DAC31F8
Device \Driver\netbt \Device\NetBT_Tcpip_{035A7A39-03E6-4522-9147-59CAF8CF44C6} IRP_MJ_INTERNAL_DEVICE_CONTROL 8DAC31F8
Device \Driver\netbt \Device\NetBT_Tcpip_{035A7A39-03E6-4522-9147-59CAF8CF44C6} IRP_MJ_CLEANUP 8DAC31F8
Device \Driver\netbt \Device\NetBT_Tcpip_{035A7A39-03E6-4522-9147-59CAF8CF44C6} IRP_MJ_PNP 8DAC31F8
Device \Driver\cdrom \Device\CdRom1 IRP_MJ_CREATE 864291F8
Device \Driver\cdrom \Device\CdRom1 IRP_MJ_CLOSE 864291F8
Device \Driver\cdrom \Device\CdRom1 IRP_MJ_READ 864291F8
Device \Driver\cdrom \Device\CdRom1 IRP_MJ_WRITE 864291F8
Device \Driver\cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 864291F8
Device \Driver\cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 864291F8
Device \Driver\cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 864291F8
Device \Driver\cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 864291F8
Device \Driver\cdrom \Device\CdRom1 IRP_MJ_POWER 864291F8
Device \Driver\cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 864291F8
Device \Driver\cdrom \Device\CdRom1 IRP_MJ_PNP 864291F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 IRP_MJ_CREATE 8521D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 IRP_MJ_CLOSE 8521D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 IRP_MJ_DEVICE_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 IRP_MJ_INTERNAL_DEVICE_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 IRP_MJ_POWER 8521D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 IRP_MJ_SYSTEM_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 IRP_MJ_PNP 8521D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-4 IRP_MJ_CREATE 8521D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-4 IRP_MJ_CLOSE 8521D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-4 IRP_MJ_DEVICE_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-4 IRP_MJ_INTERNAL_DEVICE_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-4 IRP_MJ_POWER 8521D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-4 IRP_MJ_SYSTEM_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-4 IRP_MJ_PNP 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLOSE 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_POWER 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SYSTEM_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_PNP 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLOSE 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_INTERNAL_DEVICE_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_POWER 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SYSTEM_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_PNP 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort2 IRP_MJ_CREATE 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort2 IRP_MJ_CLOSE 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort2 IRP_MJ_DEVICE_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort2 IRP_MJ_INTERNAL_DEVICE_CONTROL

[ivan92]

Device \Driver\atapi \Device\Ide\IdePort2 IRP_MJ_POWER 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort2 IRP_MJ_SYSTEM_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort2 IRP_MJ_PNP 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort3 IRP_MJ_CREATE 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort3 IRP_MJ_CLOSE 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort3 IRP_MJ_DEVICE_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort3 IRP_MJ_INTERNAL_DEVICE_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort3 IRP_MJ_POWER 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort3 IRP_MJ_SYSTEM_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort3 IRP_MJ_PNP 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort4 IRP_MJ_CREATE 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort4 IRP_MJ_CLOSE 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort4 IRP_MJ_DEVICE_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort4 IRP_MJ_INTERNAL_DEVICE_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort4 IRP_MJ_POWER 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort4 IRP_MJ_SYSTEM_CONTROL 8521D1F8
Device \Driver\atapi \Device\Ide\IdePort4 IRP_MJ_PNP 8521D1F8
Device \Driver\msahci \Device\Ide\PciIde1Channel0 IRP_MJ_POWER 8521E1F8
Device \Driver\msahci \Device\Ide\PciIde1Channel0 IRP_MJ_SYSTEM_CONTROL 8521E1F8
Device \Driver\msahci \Device\Ide\PciIde1Channel0 IRP_MJ_PNP 8521E1F8
Device \Driver\msahci \Device\Ide\PciIde1Channel1 IRP_MJ_POWER 8521E1F8
Device \Driver\msahci \Device\Ide\PciIde1Channel1 IRP_MJ_SYSTEM_CONTROL 8521E1F8
Device \Driver\msahci \Device\Ide\PciIde1Channel1 IRP_MJ_PNP 8521E1F8
Device \Driver\msahci \Device\Ide\PciIde1Channel2 IRP_MJ_POWER 8521E1F8
Device \Driver\msahci \Device\Ide\PciIde1Channel2 IRP_MJ_SYSTEM_CONTROL 8521E1F8
Device \Driver\msahci \Device\Ide\PciIde1Channel2 IRP_MJ_PNP 8521E1F8
Device \Driver\netbt \Device\NetBt_Wins_Export IRP_MJ_CREATE 8DAC31F8
Device \Driver\netbt \Device\NetBt_Wins_Export IRP_MJ_CLOSE 8DAC31F8
Device \Driver\netbt \Device\NetBt_Wins_Export IRP_MJ_DEVICE_CONTROL 8DAC31F8
Device \Driver\netbt \Device\NetBt_Wins_Export IRP_MJ_INTERNAL_DEVICE_CONTROL 8DAC31F8
Device \Driver\netbt \Device\NetBt_Wins_Export IRP_MJ_CLEANUP 8DAC31F8
Device \Driver\netbt \Device\NetBt_Wins_Export IRP_MJ_PNP 8DAC31F8
Device \Driver\Smb \Device\NetbiosSmb IRP_MJ_CREATE 8DA051F8
Device \Driver\Smb \Device\NetbiosSmb IRP_MJ_CLOSE 8DA051F8
Device \Driver\Smb \Device\NetbiosSmb IRP_MJ_DEVICE_CONTROL 8DA051F8
Device \Driver\Smb \Device\NetbiosSmb IRP_MJ_INTERNAL_DEVICE_CONTROL 8DA051F8
Device \Driver\Smb \Device\NetbiosSmb IRP_MJ_CLEANUP 8DA051F8
Device \Driver\Smb \Device\NetbiosSmb IRP_MJ_PNP 8DA051F8
Device \Driver\iScsiPrt \Device\RaidPort0 IRP_MJ_CREATE 8638E500
Device \Driver\iScsiPrt \Device\RaidPort0 IRP_MJ_CLOSE 8638E500
Device \Driver\iScsiPrt \Device\RaidPort0 IRP_MJ_DEVICE_CONTROL 8638E500
Device \Driver\iScsiPrt \Device\RaidPort0 IRP_MJ_INTERNAL_DEVICE_CONTROL 8638E500
Device \Driver\iScsiPrt \Device\RaidPort0 IRP_MJ_POWER 8638E500
Device \Driver\iScsiPrt \Device\RaidPort0 IRP_MJ_SYSTEM_CONTROL 8638E500
Device \Driver\iScsiPrt \Device\RaidPort0 IRP_MJ_PNP 8638E500

AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_CREATE [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_CREATE_NAMED_PIPE [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_CLOSE [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_READ [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_WRITE [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_QUERY_INFORMATION [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_SET_INFORMATION [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_QUERY_EA [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_SET_EA [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_FLUSH_BUFFERS [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_QUERY_VOLUME_INFORMATION [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_SET_VOLUME_INFORMATION [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_DIRECTORY_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_FILE_SYSTEM_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_DEVICE_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_INTERNAL_DEVICE_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_SHUTDOWN [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_LOCK_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_CLEANUP [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_CREATE_MAILSLOT [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_QUERY_SECURITY [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_SET_SECURITY [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_POWER [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_SYSTEM_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_DEVICE_CHANGE [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_QUERY_QUOTA [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\Udp IRP_MJ_SET_QUOTA [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_CREATE [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_CREATE_NAMED_PIPE [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_CLOSE [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_READ [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_WRITE [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_QUERY_INFORMATION [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_SET_INFORMATION [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_QUERY_EA [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_SET_EA [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_FLUSH_BUFFERS [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_QUERY_VOLUME_INFORMATION [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_SET_VOLUME_INFORMATION [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_DIRECTORY_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_FILE_SYSTEM_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_DEVICE_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_INTERNAL_DEVICE_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_SHUTDOWN [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_LOCK_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_CLEANUP [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_CREATE_MAILSLOT [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_QUERY_SECURITY [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_SET_SECURITY [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_POWER [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_SYSTEM_CONTROL [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_DEVICE_CHANGE [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_QUERY_QUOTA [8DD050EC] Mpfp.sys
AttachedDevice \Driver\tdx \Device\RawIp IRP_MJ_SET_QUOTA

[ivan92]

Device \Driver\sptd \Device\4153057342 IRP_MJ_CREATE [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_CREATE_NAMED_PIPE [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_CLOSE [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_READ [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_WRITE [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_QUERY_INFORMATION [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_SET_INFORMATION [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_QUERY_EA [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_SET_EA [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_FLUSH_BUFFERS [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_QUERY_VOLUME_INFORMATION [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_SET_VOLUME_INFORMATION [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_DIRECTORY_CONTROL [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_FILE_SYSTEM_CONTROL [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_DEVICE_CONTROL [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_INTERNAL_DEVICE_CONTROL [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_SHUTDOWN [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_LOCK_CONTROL [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_CLEANUP [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_CREATE_MAILSLOT [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_QUERY_SECURITY [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_SET_SECURITY [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_POWER [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_SYSTEM_CONTROL [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_DEVICE_CHANGE [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_QUERY_QUOTA [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_SET_QUOTA [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 IRP_MJ_PNP [8288E000] spjp.sys
Device \Driver\sptd \Device\4153057342 FastIoDeviceControl [8289894C] spjp.sys
Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_CREATE 862F71F8
Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_CLOSE 862F71F8
Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_INTERNAL_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_POWER 862F71F8
Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_SYSTEM_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBFDO-0 IRP_MJ_PNP 862F71F8
Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_CREATE 862F71F8
Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_CLOSE 862F71F8
Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_INTERNAL_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_POWER 862F71F8
Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_SYSTEM_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBFDO-1 IRP_MJ_PNP 862F71F8
Device \Driver\usbehci \Device\USBFDO-2 IRP_MJ_CREATE 862F51F8
Device \Driver\usbehci \Device\USBFDO-2 IRP_MJ_CLOSE 862F51F8
Device \Driver\usbehci \Device\USBFDO-2 IRP_MJ_DEVICE_CONTROL 862F51F8
Device \Driver\usbehci \Device\USBFDO-2 IRP_MJ_INTERNAL_DEVICE_CONTROL 862F51F8
Device \Driver\usbehci \Device\USBFDO-2 IRP_MJ_POWER 862F51F8
Device \Driver\usbehci \Device\USBFDO-2 IRP_MJ_SYSTEM_CONTROL 862F51F8
Device \Driver\usbehci \Device\USBFDO-2 IRP_MJ_PNP 862F51F8
Device \Driver\usbuhci \Device\USBFDO-3 IRP_MJ_CREATE 862F71F8
Device \Driver\usbuhci \Device\USBFDO-3 IRP_MJ_CLOSE 862F71F8
Device \Driver\usbuhci \Device\USBFDO-3 IRP_MJ_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBFDO-3 IRP_MJ_INTERNAL_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBFDO-3 IRP_MJ_POWER 862F71F8
Device \Driver\usbuhci \Device\USBFDO-3 IRP_MJ_SYSTEM_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBFDO-3 IRP_MJ_PNP 862F71F8
Device \Driver\usbuhci \Device\USBFDO-4 IRP_MJ_CREATE 862F71F8
Device \Driver\usbuhci \Device\USBFDO-4 IRP_MJ_CLOSE 862F71F8
Device \Driver\usbuhci \Device\USBFDO-4 IRP_MJ_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBFDO-4 IRP_MJ_INTERNAL_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBFDO-4 IRP_MJ_POWER 862F71F8
Device \Driver\usbuhci \Device\USBFDO-4 IRP_MJ_SYSTEM_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBFDO-4 IRP_MJ_PNP 862F71F8
Device \Driver\usbuhci \Device\USBFDO-5 IRP_MJ_CREATE 862F71F8
Device \Driver\usbuhci \Device\USBFDO-5 IRP_MJ_CLOSE 862F71F8
Device \Driver\usbuhci \Device\USBFDO-5 IRP_MJ_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBFDO-5 IRP_MJ_INTERNAL_DEVICE_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBFDO-5 IRP_MJ_POWER 862F71F8
Device \Driver\usbuhci \Device\USBFDO-5 IRP_MJ_SYSTEM_CONTROL 862F71F8
Device \Driver\usbuhci \Device\USBFDO-5 IRP_MJ_PNP 862F71F8
Device \Driver\usbehci \Device\USBFDO-6 IRP_MJ_CREATE 862F51F8
Device \Driver\usbehci \Device\USBFDO-6 IRP_MJ_CLOSE 862F51F8
Device \Driver\usbehci \Device\USBFDO-6 IRP_MJ_DEVICE_CONTROL 862F51F8
Device \Driver\usbehci \Device\USBFDO-6 IRP_MJ_INTERNAL_DEVICE_CONTROL 862F51F8
Device \Driver\usbehci \Device\USBFDO-6 IRP_MJ_POWER 862F51F8
Device \Driver\usbehci \Device\USBFDO-6 IRP_MJ_SYSTEM_CONTROL 862F51F8
Device \Driver\usbehci \Device\USBFDO-6 IRP_MJ_PNP 862F51F8
Device \Driver\arokya7l \Device\Scsi\arokya7l1 IRP_MJ_CREATE 8638D1F8
Device \Driver\arokya7l \Device\Scsi\arokya7l1 IRP_MJ_CLOSE 8638D1F8
Device \Driver\arokya7l \Device\Scsi\arokya7l1 IRP_MJ_DEVICE_CONTROL 8638D1F8
Device \Driver\arokya7l \Device\Scsi\arokya7l1 IRP_MJ_INTERNAL_DEVICE_CONTROL 8638D1F8
Device \Driver\arokya7l \Device\Scsi\arokya7l1 IRP_MJ_POWER 8638D1F8
Device \Driver\arokya7l \Device\Scsi\arokya7l1 IRP_MJ_SYSTEM_CONTROL 8638D1F8
Device \Driver\arokya7l \Device\Scsi\arokya7l1 IRP_MJ_PNP 8638D1F8
Device \Driver\arokya7l \Device\Scsi\arokya7l1Port6Path0Target0Lun0 IRP_MJ_CREATE 8638D1F8
Device \Driver\arokya7l \Device\Scsi\arokya7l1Port6Path0Target0Lun0 IRP_MJ_CLOSE 8638D1F8
Device \Driver\arokya7l \Device\Scsi\arokya7l1Port6Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 8638D1F8
Device \Driver\arokya7l \Device\Scsi\arokya7l1Port6Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 8638D1F8
Device \Driver\arokya7l \Device\Scsi\arokya7l1Port6Path0Target0Lun0 IRP_MJ_POWER 8638D1F8
Device \Driver\arokya7l \Device\Scsi\arokya7l1Port6Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 8638D1F8
Device \Driver\arokya7l \Device\Scsi\arokya7l1Port6Path0Target0Lun0 IRP_MJ_PNP 8638D1F8
Device \FileSystem\cdfs \Cdfs IRP_MJ_CREATE 982251F8
Device \FileSystem\cdfs \Cdfs IRP_MJ_CLOSE 982251F8
Device \FileSystem\cdfs \Cdfs IRP_MJ_READ 982251F8
Device \FileSystem\cdfs \Cdfs IRP_MJ_WRITE 982251F8
Device \FileSystem\cdfs \Cdfs IRP_MJ_QUERY_INFORMATION 982251F8
Device \FileSystem\cdfs \Cdfs IRP_MJ_SET_INFORMATION 982251F8
Device \FileSystem\cdfs \Cdfs IRP_MJ_QUERY_VOLUME_INFORMATION 982251F8
Device \FileSystem\cdfs \Cdfs IRP_MJ_DIRECTORY_CONTROL 982251F8
Device \FileSystem\cdfs \Cdfs IRP_MJ_FILE_SYSTEM_CONTROL 982251F8
Device \FileSystem\cdfs \Cdfs IRP_MJ_DEVICE_CONTROL 982251F8
Device \FileSystem\cdfs \Cdfs IRP_MJ_SHUTDOWN 982251F8
Device \FileSystem\cdfs \Cdfs IRP_MJ_LOCK_CONTROL 982251F8
Device \FileSystem\cdfs \Cdfs IRP_MJ_CLEANUP 982251F8
Device \FileSystem\cdfs \Cdfs IRP_MJ_PNP 982251F8

---- Registry - GMER 1.0.13 ----

Reg \Registry\USER\S-1-5-21-603610610-2782796317-2799079916-1000\Software\SecuROM\License information@datasecu 0x3F 0x87 0xCC 0x42 ...
Reg \Registry\USER\S-1-5-21-603610610-2782796317-2799079916-1000\Software\SecuROM\License information@rkeysecu 0x05 0xFA 0xDD 0xA0 ...

---- Files - GMER 1.0.13 ----

ADS C:\Users\Utente\AppData\Local\Microsoft\Messenger\ivan.pino@hotmail.it\SharingMetadata\lezier@hotmail.it\DFSR\Staging\CS{C6429CFA-9568-2F68-D791-15653995DEFC}\01\10-{C6429CFA-9568-2F68-D791-15653995DEFC}-v1-{65C88ADF-8F2C-49D8-B963-5E96FDC46932}-v10-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
ADS C:\Users\Utente\AppData\Local\Microsoft\Messenger\ivan.pino@hotmail.it\SharingMetadata\lezier@hotmail.it\DFSR\Staging\CS{C6429CFA-9568-2F68-D791-15653995DEFC}\11\11-{65C88ADF-8F2C-49D8-B963-5E96FDC46932}-v11-{65C88ADF-8F2C-49D8-B963-5E96FDC46932}-v11-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
ADS C:\Users\Utente\AppData\Local\Microsoft\Messenger\ivan.pino@hotmail.it\SharingMetadata\lezier@hotmail.it\DFSR\Staging\CS{C6429CFA-9568-2F68-D791-15653995DEFC}\17\17-{65C88ADF-8F2C-49D8-B963-5E96FDC46932}-v17-{65C88ADF-8F2C-49D8-B963-5E96FDC46932}-v17-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1
ADS C:\Users\Utente\AppData\Local\Microsoft\Messenger\ivan.pino@hotmail.it\SharingMetadata\lezier@hotmail.it\DFSR\Staging\CS{C6429CFA-9568-2F68-D791-15653995DEFC}\17\17-{65C88ADF-8F2C-49D8-B963-5E96FDC46932}-v17-{65C88ADF-8F2C-49D8-B963-5E96FDC46932}-v17-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
ADS C:\Users\Utente\AppData\Local\Microsoft\Messenger\ivan.pino@hotmail.it\SharingMetadata\lezier@hotmail.it\DFSR\Staging\CS{C6429CFA-9568-2F68-D791-15653995DEFC}\22\22-{65C88ADF-8F2C-49D8-B963-5E96FDC46932}-v22-{65C88ADF-8F2C-49D8-B963-5E96FDC46932}-v22-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
ADS C:\Users\Utente\AppData\Local\Microsoft\Messenger\ivan.pino@hotmail.it\SharingMetadata\lezier@hotmail.it\DFSR\Staging\CS{C6429CFA-9568-2F68-D791-15653995DEFC}\23\23-{65C88ADF-8F2C-49D8-B963-5E96FDC46932}-v23-{65C88ADF-8F2C-49D8-B963-5E96FDC46932}-v23-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
ADS C:\Users\Utente\AppData\Local\Microsoft\Messenger\ivan.pino@hotmail.it\SharingMetadata\lezier@hotmail.it\DFSR\Staging\CS{C6429CFA-9568-2F68-D791-15653995DEFC}\59\59-{65C88ADF-8F2C-49D8-B963-5E96FDC46932}-v59-{65C88ADF-8F2C-49D8-B963-5E96FDC46932}-v59-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS

---- EOF - GMER 1.0.13 ----

[ivan92]

scusate per tutti questi log ma era molto lungo...qui adesso posto il log dell'"autostart"

GMER 1.0.13.12551 - http://www.gmer.net
Autostart scan 2009-02-25 11:33:55
Windows 6.0.6001 Service Pack 1


HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit = C:\Windows\system32\userinit.exe,

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui@DLLName = igfxdev.dll /*file not found*/

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs = APSHook.dll

HKLM\SYSTEM\CurrentControlSet\Services\ >>>
CLTNetCnService /*Symantec Lic NetConnect service*/@ = "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon /*file not found*/
gusvc /*Google Updater Service*/@ = "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
HP Health Check Service /*HP Health Check Service*/@ = "C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe"
hpqwmiex /*hpqwmiex*/@ = C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
LightScribeService /*LightScribeService Direct Disc Labeling Service*/@ = "C:\Program Files\Common Files\LightScribe\LSSrvc.exe"
LiveUpdate Notice Ex /*LiveUpdate Notice Service Ex*/@ = "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon /*file not found*/
LiveUpdate Notice Service /*LiveUpdate Notice Service*/@ = "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll"
McAfee SiteAdvisor Service /*McAfee SiteAdvisor Service*/@ = "C:\Program Files\McAfee\SiteAdvisor\McSACore.exe"
mcmscsvc /*McAfee Services*/@ = C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
McNASvc /*McAfee Network Agent*/@ = "c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe"
McProxy /*McAfee Proxy Service*/@ = c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
McShield /*McAfee Real-time Scanner*/@ = C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
MpfService /*McAfee Personal Firewall Service*/@ = "C:\Program Files\McAfee\MPF\MPFSrv.exe"
MSK80Service /*McAfee Anti-Spam Service*/@ = "C:\Program Files\McAfee\MSK\MskSrver.exe"
nvsvc /*NVIDIA Display Driver Service*/@ = %SystemRoot%\system32\nvvsvc.exe
PLFlash DeviceIoControl Service /*PLFlash DeviceIoControl Service*/@ = C:\Windows\system32\IoctlSvc.exe
PnkBstrA /*PnkBstrA*/@ = C:\Windows\system32\PnkBstrA.exe
QPCapSvc /*QuickPlay Background Capture Service (QBCS)*/@ = "C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe" ? C:\Program Files\HP\QuickPlay\Kernel\TV\Ca
QPSched /*QuickPlay Task Scheduler (QTS)*/@ = "C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe" a y \ K e r n e l \ T V \ Q P C a p S v c . e x e
SeaPort /*SeaPort*/@ = "C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe"

HKLM\SYSTEM\CurrentControlSet\Services\slsvc /*@%SystemRoot%\system32\SLsvc.exe,-101*/@ = %SystemRoot%\system32\SLsvc.exe

HKLM\SYSTEM\CurrentControlSet\Services\Spooler /*@%systemroot%\system32\spoolsv.exe,-1*/@ = %SystemRoot%\System32\spoolsv.exe

HKLM\SYSTEM\CurrentControlSet\Services\Utilità di pianificazione di LiveUpdate automatico /*Utilità di pianificazione di LiveUpdate automatico*/@ = "C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"

HKLM\SYSTEM\CurrentControlSet\Services\WSearch /*@%systemroot%\system32\SearchIndexer.exe,-103*/@ = %systemroot%\system32\SearchIndexer.exe /Embedding

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@Windows Defender%ProgramFiles%\Windows Defender\MSASCui.exe -hide /*file not found*/ = %ProgramFiles%\Windows Defender\MSASCui.exe -hide /*file not found*/
@SMSERIALC:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe = C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
@SynTPEnhC:\Program Files\Synaptics\SynTP\SynTPEnh.exe = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
@RtHDVCplRtHDVCpl.exe = RtHDVCpl.exe
@QlbCtrl%ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start /*file not found*/ = %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start /*file not found*/
@HP Health Check SchedulerC:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe = C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
@hpWirelessAssistant%ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe /*file not found*/ = %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe /*file not found*/
@WAWifiMessage%ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe /*file not found*/ = %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe /*file not found*/
@SunJavaUpdateSched"C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" = "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
@CognizanceTSrundll32.exe c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll,RegisterModule = rundll32.exe c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll,RegisterModule
@Symantec PIF AlertEng"C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" = "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
@QuickTime Task"C:\Program Files\QuickTime\qttask.exe" -atboottime = "C:\Program Files\QuickTime\qttask.exe" -atboottime
@SSBkgdUpdate"C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot = "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
@OpwareSE4"C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" = "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
@mcagent_exe"C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey = "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
@McENUIC:\PROGRA~1\McAfee\MHN\McENUI.exe /hide = C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
@hpqSRMonC:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe = C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
@Adobe Reader Speed Launcher"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" = "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
@NvCplDaemonRUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup = RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
@NvMediaCenterRUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit = RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
@QPService"C:\Program Files\HP\QuickPlay\QPService.exe" = "C:\Program Files\HP\QuickPlay\QPService.exe"

HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@SidebarC:\Program Files\Windows Sidebar\sidebar.exe /autoRun /*file not found*/ = C:\Program Files\Windows Sidebar\sidebar.exe /autoRun /*file not found*/
@OM2_Monitor"C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" = "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe"
@MsnMsgr"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background = "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
@ISUSPM StartupC:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup = C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
@ehTray.exeC:\Windows\ehome\ehTray.exe = C:\Windows\ehome\ehTray.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{F02C1A0D-BE21-4350-88B0-7367FC96EF3C} /*Computers and Devices*/%systemroot%\system32\NetworkExplorer.dll = %systemroot%\system32\NetworkExplorer.dll
@{4A1E5ACD-A108-4100-9E26-D2FAFA1BA486} /*IGD Property Sheet Handler*/%SystemRoot%\System32\icsigd.dll = %SystemRoot%\System32\icsigd.dll
@{92dbad9f-5025-49b0-9078-2d78f935e341} /*Microsoft Windows Mail Html Preview Handler*/%SystemRoot%\system32\inetcomm.dll = %SystemRoot%\system32\inetcomm.dll
@{b9815375-5d7f-4ce2-9245-c9d4da436930} /*Microsoft Windows Mail Html Preview Handler*/%SystemRoot%\system32\inetcomm.dll = %SystemRoot%\system32\inetcomm.dll
@{f8b8412b-dea3-4130-b36c-5e8be73106ac} /*Microsoft Windows Mail Html Preview Handler*/%SystemRoot%\system32\inetcomm.dll = %SystemRoot%\system32\inetcomm.dll
@{5FA29220-36A1-40f9-89C6-F4B384B7642E} /*Shell Message Handler*/%SystemRoot%\system32\inetcomm.dll = %SystemRoot%\system32\inetcomm.dll
@{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} /*Shell DocObject Viewer*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{BC476F4C-D9D7-4100-8D4E-E043F6DEC409} /*Microsoft Browser Architecture*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{FBF23B40-E3F0-101B-8488-00AA003E56F8} /*InternetShortcut*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{3C374A40-BAE4-11CF-BF7D-00AA006946EE} /*Microsoft Url History Service*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{FF393560-C2A7-11CF-BFF4-444553540000} /*History*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{7BD29E00-76C1-11CF-9DD0-00A0C9034933} /*Temporary Internet Files*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{7BD29E01-76C1-11CF-9DD0-00A0C9034933} /*Temporary Internet Files*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{CFBFAE00-17A6-11D0-99CB-00C04FD64497} /*Microsoft Url Search Hook*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{3DC7A020-0ACD-11CF-A9BB-00AA004AE837} /*The Internet*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{73CFD649-CD48-4fd8-A272-2070EA56526B} /*IE BandProxy*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{07C45BB1-4A8C-4642-A1F5-237E7215FF66} /*IE Microsoft BrowserBand*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{43886CD5-6529-41c4-A707-7B3C92C05E68} /*IE Navigation Bar*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{30D02401-6A81-11d0-8274-00C04FD5AE38} /*IE Search Band*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{F83DAC1C-9BB9-4f2b-B619-09819DA81B0E} /*IE Registry Tree Options Utility*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{3028902F-6374-48b2-8DC6-9725E775B926} /*IE AutoComplete*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{98FF6D4B-6387-4b0a-8FBD-C5C4BB17B4F8} /*IE MRU AutoComplete List*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{FDE7673D-2E19-4145-8376-BBD58C4BC7BA} /*IE Custom MRU AutoCompleted List*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{6038EF75-ABFC-4e59-AB6F-12D397F6568D} /*IE Microsoft History AutoComplete List*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{9D958C62-3954-4b44-8FAB-C4670C1DB4C2} /*IE Microsoft Shell Folder AutoComplete List*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{B31C5FAE-961F-415b-BAF0-E697A5178B94} /*IE Microsoft Multiple AutoComplete List Container*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{E6EE9AAC-F76B-4947-8260-A9F136138E11} /*IE Shell Band Site Menu*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A} /*IE Shell Rebar BandSite*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} /*IE User Assist*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{4B78D326-D922-44f9-AF2A-07805C2A3560} /*IE Menu Band*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{6CF48EF8-44CD-45d2-8832-A16EA016311B} /*IE IShellFolderBand*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{F2CF5485-4E02-4f68-819C-B92DE9277049} /*&Links*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{1C1EDB47-CE22-4bbb-B608-77B48F83C823} /*IE Fade Task*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{6B4ECC4F-16D1-4474-94AB-5A763F2A54AE} /*IE Tracking Shell Menu*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{44C76ECD-F7FA-411c-9929-1B77BA77F524} /*IE Menu Site*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{205D7A97-F16D-4691-86EF-F3075DCCA57D} /*IE Menu Desk Bar*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{871C5380-42A0-1069-A2EA-08002B30309D} /*Internet Name Space*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{9A096BB5-9DC3-4D1C-8526-C3CBF991EA4E} /*IE RSS Feeder Folder*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{8856f961-340a-11d0-a96b-00c04fd705a2} /*Microsoft Web Browser*/C:\Windows\system32\ieframe.dll = C:\Windows\system32\ieframe.dll
@{00020d75-0000-0000-c000-000000000046} /*lnkfile*/(null) =
@{CC6EEFFB-43F6-46c5-9619-51D571967F7D} /*Web Publishing Wizard*/%SystemRoot%\System32\shwebsvc.dll = %SystemRoot%\System32\shwebsvc.dll
@{add36aa8-751a-4579-a266-d66f5202ccbb} /*Print Ordering via the Web*/%SystemRoot%\System32\shwebsvc.dll = %SystemRoot%\System32\shwebsvc.dll
@{6b33163c-76a5-4b6c-bf21-45de9cd503a1} /*Shell Publishing Wizard Object*/%SystemRoot%\System32\shwebsvc.dll = %SystemRoot%\System32\shwebsvc.dll
@{176d6597-26d3-11d1-b350-080036a75b03} /*ICM Scanner Management*/%SystemRoot%\System32\colorui.dll = %SystemRoot%\System32\colorui.dll
@{5DB2625A-54DF-11D0-B6C4-0800091AA605} /*ICM Monitor Management*/%SystemRoot%\System32\colorui.dll = %SystemRoot%\System32\colorui.dll
@{675F097E-4C4D-11D0-B6C1-0800091AA605} /*ICM Printer Management*/%SystemRoot%\system32\colorui.dll = %SystemRoot%\system32\colorui.dll
@{DBCE2480-C732-101B-BE72-BA78E9AD5B27} /*ICC Profile*/%SystemRoot%\system32\colorui.dll = %SystemRoot%\system32\colorui.dll
@{b2c761c6-29bc-4f19-9251-e6195265baf1} /*Color Control Panel Applet*/(null) =
@{74246bfc-4c96-11d0-abef-0020af6b0b7a} /*Device Manager*/%SystemRoot%\System32\devmgr.dll = %SystemRoot%\System32\devmgr.dll
@{7A979262-40CE-46ff-AEEE-7884AC3B6136} /*Add New Hardware*/(null) =
@{3e7efb4c-faf1-453d-89eb-56026875ef90} /*Get Programs Online*/(null) =
@{1b24a030-9b20-49bc-97ac-1be4426f9e59} /*ActiveDirectory Folder*/(null) =
@{34449847-FD14-4fc8-A75A-7432F5181EFB} /*ActiveDirectory Folder*/(null) =
@{C8494E42-ACDD-4739-B0FB-217361E4894F} /*Sam Account Folder*/(null) =
@{E29F9716-5C08-4FCD-955A-119FDB5A522D} /*Sam Account Folder*/(null) =
@{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0} /*Control Panel command object for Start menu*/(null) =
@{E44E5D18-0652-4508-A4E2-8A090067BCB0} /*Default Programs command object for Start menu*/(null) =
@{6dfd7c5c-2451-11d3-a299-00c04f8ef6af} /*Folder Options*/(null) =
@{97e467b4-98c6-4f19-9588-161b7773d6f6} /*Office Document Property Handler*/%SystemRoot%\system32\propsys.dll = %SystemRoot%\system32\propsys.dll
@{2C2577C2-63A7-40e3-9B7F-586602617ECB} /*Explorer Query Band*/(null) =
@{DC1C5A9C-E88A-4dde-A5A1-60F82A20AEF7} /*File Open Dialog*/%SystemRoot%\System32\comdlg32.dll = %SystemRoot%\System32\comdlg32.dll
@{C0B4E2F3-BA21-4773-8DBA-335EC946EB8B} /*File Save Dialog*/%SystemRoot%\System32\comdlg32.dll = %SystemRoot%\System32\comdlg32.dll
@{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} /*Shell Icon Handler for Application References*/C:\Windows\system32\dfshim.dll = C:\Windows\system32\dfshim.dll
@{e82a2d71-5b2f-43a0-97b8-81be15854de8} /*ShellLink for Application References*/C:\Windows\system32\dfshim.dll = C:\Windows\system32\dfshim.dll
@{92337A8C-E11D-11D0-BE48-00C04FC30DF6} /*OlePrn.PrinterURL*/%SystemRoot%\system32\oleprn.dll = %SystemRoot%\system32\oleprn.dll
@{45670FA8-ED97-4F44-BC93-305082590BFB} /*Microsoft XPS Properties*/%SystemRoot%\system32\XPSSHHDR.DLL = %SystemRoot%\system32\XPSSHHDR.DLL
@{44121072-A222-48f2-A58A-6D9AD51EBBE9} /*Microsoft XPS Thumbnail*/%SystemRoot%\system32\XPSSHHDR.DLL = %SystemRoot%\system32\XPSSHHDR.DLL
@{38a98528-6cbf-4ca9-8dc0-b1e1d10f7b1b} /*View Available Networks*/(null) =
@{13D3C4B8-B179-4ebb-BF62-F704173E7448} /*Windows Contact Preview Handler*/%CommonProgramFiles%\System\wab32.dll = %CommonProgramFiles%\System\wab32.dll
@{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} /*Contacts folder*/(null) =
@{4F58F63F-244B-4c07-B29F-210BE59BE9B4} /*.group shell extension handler*/%CommonProgramFiles%\System\wab32.dll = %CommonProgramFiles%\System\wab32.dll
@{8082C5E6-4C27-48ec-A809-B8E1122E8F97} /*.contact shell extension handler*/%CommonProgramFiles%\System\wab32.dll = %CommonProgramFiles%\System\wab32.dll
@{16C2C29D-0E5F-45f3-A445-03E03F587B7D} /*group_wab_auto_file*/%CommonProgramFiles%\System\wab32.dll = %CommonProgramFiles%\System\wab32.dll
@{CF67796C-F57F-45F8-92FB-AD698826C602} /*contact_wab_auto_file*/%CommonProgramFiles%\System\wab32.dll = %CommonProgramFiles%\System\wab32.dll
@{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8} /*Compatibility Property Page*/%windir%\system32\acppage.dll = %windir%\system32\acppage.dll
@{4026492f-2f69-46b8-b9bf-5654fc07e423} /*Windows Firewall*/(null) =
@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager Folder*/C:\Windows\system32\extmgr.dll = C:\Windows\system32\extmgr.dll
@{fcfeecae-ee1b-4849-ae50-685dcf7717ec} /*Problem Reports and Solutions*/(null) =
@{a304259d-52b8-4526-8b1a-a1d6cecc8243} /*iSCSI Initiator*/(null) =
@{11dbb47c-a525-400b-9e80-a54615a090c0} /*Execute Folder*/ExplorerFrame.dll = ExplorerFrame.dll
@{90b9bce2-b6db-4fd3-8451-35917ea1081b} /*Search Execute Command*/ExplorerFrame.dll = ExplorerFrame.dll
@{911051fa-c21c-4246-b470-070cd8df6dc4} /*.cab or .zip files*/(null) =
@{da67b8ad-e81b-4c70-9b91b417b5e33527} /*Windows Search Shell Service*/(null) =
@{a38b883c-1682-497e-97b0-0a3a9e801682} /*IPropertyStore Handler for Images*/C:\Windows\system32\PhotoMetadataHandler.dll = C:\Windows\system32\PhotoMetadataHandler.dll
@{C7657C4A-9F68-40fa-A4DF-96BC08EB3551} /*Photo Thumbnail Provider*/C:\Windows\system32\PhotoMetadataHandler.dll = C:\Windows\system32\PhotoMetadataHandler.dll
@{3F30C968-480A-4C6C-862D-EFC0897BB84B} /*Photo Thumbnail Extractor*/C:\Windows\system32\PhotoMetadataHandler.dll = C:\Windows\system32\PhotoMetadataHandler.dll
@{BC65FB43-1958-4349-971A-210290480130} /*Network Explorer Property Sheet Handler*/%SystemRoot%\System32\NcdProp.dll = %SystemRoot%\System32\NcdProp.dll
@{d3e34b21-9d75-101a-8c3d-00aa001a1652} /*Bitmap Image*/(null) =
@{40C3D757-D6E4-4b49-BB41-0E5BBEA28817} /*Video Media Properties Handler*/%SystemRoot%\System32\mediametadatahandler.dll = %SystemRoot%\System32\mediametadatahandler.dll
@{E598560B-28D5-46aa-A14A-8A3BEA34B576} /*Windows Photo Gallery Viewer Video Verbs*/%ProgramFiles%\Windows Photo Gallery\PhotoViewer.dll /*file not found*/ = %ProgramFiles%\Windows Photo Gallery\PhotoViewer.dll /*file not found*/
@{00f2886f-cd64-4fc9-8ec5-30ef6cdbe8c3} /*Microsoft.ScannersAndCameras*/(null) =
@{0a4286ea-e355-44fb-8086-af3df7645bd9} /*Windows Media Player*/C:\PROGRA~1\WI4EB4~1\wmpband.dll = C:\PROGRA~1\WI4EB4~1\wmpband.dll
@{BB6B2374-3D79-41DB-87F4-896C91846510} /*EMDFileProperties*/emdmgmt.dll = emdmgmt.dll
@{875CB1A1-0F29-45de-A1AE-CFB4950D0B78} /*Audio Media Properties Handler*/%SystemRoot%\System32\mediametadatahandler.dll = %SystemRoot%\System32\mediametadatahandler.dll
@{89D83576-6BD1-4c86-9454-BEB04E94C819} /*MAPI Search Namespace Extension*/%systemroot%\system32\mssvp.dll = %systemroot%\system32\mssvp.dll
@{7A0F6AB7-ED84-46B6-B47E-02AA159A152B} /*Sync Center Simple Conflict Presenter*/%SystemRoot%\System32\SyncCenter.dll = %SystemRoot%\System32\SyncCenter.dll
@{9D687A4C-1404-41ef-A089-883B6FBECDE6} /*Windows Photo Gallery Viewer Autoplay Handler*/(null) =
@{37efd44d-ef8d-41b1-940d-96973a50e9e0} /*Windows Sidebar Properties*/(null) =
@{00f20eb5-8fd6-4d9d-b75e-36801766c8f1} /*PhotoAcqDropTarget*/%ProgramFiles%\Windows Photo Gallery\PhotoAcq.dll /*file not found*/ = %ProgramFiles%\Windows Photo Gallery\PhotoAcq.dll /*file not found*/
@{BC48B32F-5910-47F5-8570-5074A8A5636A} /*Sync Results Delegate Folder*/%SystemRoot%\System32\SyncCenter.dll = %SystemRoot%\System32\SyncCenter.dll
@{ED228FDF-9EA8-4870-83B1-96B02CFE0D52} /*Games Folder*/C:\Windows\System32\gameux.dll = C:\Windows\System32\gameux.dll
@{E413D040-6788-4C22-957E-175D1C513A34} /*Sync Center Conflict Delegate Folder*/%SystemRoot%\System32\SyncCenter.dll = %SystemRoot%\System32\SyncCenter.dll
@{67718415-c450-4f3c-bf8a-b487642dc39b} /*Windows Features*/(null) =
@{91ADC906-6722-4B05-A12B-471ADDCCE132} /*Touch Band*/%SystemRoot%\System32\TouchX.dll = %SystemRoot%\System32\TouchX.dll
@{2781761E-28E0-4109-99FE-B9D127C57AFE} /*Windows Defender IOfficeAntiVirus implementation*/%ProgramFiles%\Windows Defender\MpOav.dll /*file not found*/ = %ProgramFiles%\Windows Defender\MpOav.dll /*file not found*/
@{FFE2A43C-56B9-4bf5-9A79-CC6D4285608A} /*Windows Photo Gallery Viewer Image Verbs*/%ProgramFiles%\Windows Photo Gallery\PhotoViewer.dll /*file not found*/ = %ProgramFiles%\Windows Photo Gallery\PhotoViewer.dll /*file not found*/
@{4B534112-3AF6-4697-A77C-D62CE9B9E7CF} /*Sync Center Event Properties Extension*/%SystemRoot%\System32\SyncCenter.dll = %SystemRoot%\System32\SyncCenter.dll
@{F1390A9A-A3F4-4E5D-9C5F-98F3BD8D935C} /*Sync Setup Delegate Folder*/%SystemRoot%\System32\SyncCenter.dll = %SystemRoot%\System32\SyncCenter.dll
@{4E5BFBF8-F59A-4e87-9805-1F9B42CC254A} /*GameUX.RichGameMediaThumbnail*/C:\Windows\System32\gameux.dll = C:\Windows\System32\gameux.dll
@{d8559eb9-20c0-410e-beda-7ed416aecc2a} /*Windows Defender*/(null) =
@{576C9E85-1300-4EF5-BF6B-D00509F4EDCD} /*Sync Center Handler Properties Extension*/%SystemRoot%\System32\SyncCenter.dll = %SystemRoot%\System32\SyncCenter.dll
@{5ea4f148-308c-46d7-98a9-49041b1dd468} /*Mobility Center Control Panel*/(null) =
@{289978AC-A101-4341-A817-21EBA7FD046D} /*Sync Center Conflict Folder*/%SystemRoot%\System32\SyncCenter.dll = %SystemRoot%\System32\SyncCenter.dll
@{877ca5ac-cb41-4842-9c69-9136e42d47e2} /*File Backup Index*/%systemroot%\system32\sdshext.dll = %systemroot%\system32\sdshext.dll
@{71D99464-3B6B-475C-B241-E15883207529} /*Sync Results Folder*/%SystemRoot%\System32\SyncCenter.dll = %SystemRoot%\System32\SyncCenter.dll
@{B32D3949-ED98-4DBB-B347-17A144969BBA} /*Sync Center Item Properties Extension*/%SystemRoot%\System32\SyncCenter.dll = %SystemRoot%\System32\SyncCenter.dll
@{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8} /*Portable Devices Menu*/%SystemRoot%\system32\wpdshext.dll = %SystemRoot%\system32\wpdshext.dll
@{2E9E59C0-B437-4981-A647-9C34B9B90891} /*Sync Setup Folder*/%SystemRoot%\System32\SyncCenter.dll = %SystemRoot%\System32\SyncCenter.dll
@{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF} /*Sync Center Folder*/%SystemRoot%\System32\SyncCenter.dll = %SystemRoot%\System32\SyncCenter.dll
@{CB1B7F8C-C50A-4176-B604-9E24DEE8D4D1} /*Welcome Center*/oobefldr.dll = oobefldr.dll
@{15D633E2-AD00-465b-9EC7-F56B7CDF8E27} /*Tablet PC Input Panel*/%CommonProgramFiles%\microsoft shared\ink\TipBand.dll /*file not found*/ = %CommonProgramFiles%\microsoft shared\ink\TipBand.dll /*file not found*/
@{F04CC277-03A2-4277-96A9-77967471BDFF} /*Sync Center Conflict Properties Extension*/%SystemRoot%\System32\SyncCenter.dll = %SystemRoot%\System32\SyncCenter.dll
@{53BEDF0B-4E5B-4183-8DC9-B844344FA104} /*Microsoft Windows MAPI Preview Handler*/%SystemRoot%\system32\mssvp.dll = %SystemRoot%\system32\mssvp.dll
@{6b9228da-9c15-419e-856c-19e768a13bdc} /*Windows gadget DropTarget*/%ProgramFiles%\Windows Sidebar\sbdrop.dll /*file not found*/ = %ProgramFiles%\Windows Sidebar\sbdrop.dll /*file not found*/
@{8E25992B-373E-486E-80E5-BD23AE417E66} /*Sync Center Device Notification Sink*/%SystemRoot%\System32\SyncCenter.dll = %SystemRoot%\System32\SyncCenter.dll
@{35786D3C-B075-49b9-88DD-029876E11C01} /*Portable Devices*/%SystemRoot%\system32\wpdshext.dll = %SystemRoot%\system32\wpdshext.dll
@{031EE060-67BC-460d-8847-E4A7C5E45A27} /*Windows Media Player Rich Preview Handler*/(null) =
@{1FA9085F-25A2-489B-85D4-86326EEDCD87} /*Manage Wireless Networks*/%SystemRoot%\system32\wlanpref.dll = %SystemRoot%\system32\wlanpref.dll
@{ECDD6472-2B9B-4b4b-AE36-F316DF3C8D60} /*RichGameMediaPropertyStore Class*/C:\Windows\System32\gameux.dll = C:\Windows\System32\gameux.dll
@{BD7A2E7B-21CB-41b2-A086-B309680C6B7E} /*Client Side Cache Namespace Extension*/%systemroot%\system32\mssvp.dll = %systemroot%\system32\mssvp.dll
@{c5a40261-cd64-4ccf-84cb-c394da41d590} /*Video Thumbnail Extractor*/%SystemRoot%\System32\mediametadatahandler.dll = %SystemRoot%\System32\mediametadatahandler.dll
@{2F603045-309F-11CF-9774-0020AFD0CFF6} /*Synaptics Control Panel*/C:\Program Files\Synaptics\SynTP\SynTPCpl.dll = C:\Program Files\Synaptics\SynTP\SynTPCpl.dll
@{7F67036B-66F1-411A-AD85-759FB9C5B0DB} /*ShellViewRTF*/C:\Windows\System32\ShellvRTF.dll = C:\Windows\System32\ShellvRTF.dll
@{A70C977A-BF00-412C-90B7-034C51DA2439} /*NvCpl DesktopContext Class*/C:\Windows\system32\nvcpl.dll = C:\Windows\system32\nvcpl.dll
@{B41DB860-8EE4-11D2-9906-E49FADC173CA} /*WinRAR shell extension*/C:\Program Files\WinRAR\rarext.dll = C:\Program Files\WinRAR\rarext.dll
@{327669A0-59A7-4be9-B99E-1C9F3A57611A} /*Haali Matroska Thumbnail Exctractor*/(null) =
@{5574006C-28F5-4a65-A28C-74DE6BFBE0BB} /*Haali Matroska Shell Property Page*/(null) =
@{0561EC90-CE54-4f0c-9C55-E226110A740C} /*Haali Column Provider*/(null) =
@{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} /*OpenOffice.org Column Handler*/(null) =
@{087B3AE3-E237-4467-B8DB-5A38AB959AC9} /*OpenOffice.org Infotip Handler*/(null) =
@{63542C48-9552-494A-84F7-73AA6A7C99C1} /*OpenOffice.org Property Sheet Handler*/(null) =
@{3B092F0C-7696-40E3-A80F-68D74DA84210} /*OpenOffice.org Thumbnail Viewer*/(null) =
@{2B3453E4-49DF-11D3-8229-0080BE509050} /*GMail Drive*/C:\Windows\system32\ShellExt\GMailFS.dll = C:\Windows\system32\ShellExt\GMailFS.dll
@{2B3453E4-49DF-11D3-8229-0080BE509052} /*GMailFS Property Sheet*/C:\Windows\system32\ShellExt\GMailFS.dll = C:\Windows\system32\ShellExt\GMailFS.dll
@{2B3453E4-49DF-11D3-8229-0080BE509054} /*GMailFS Drop Handler*/C:\Windows\system32\ShellExt\GMailFS.dll = C:\Windows\system32\ShellExt\GMailFS.dll
@{2B3453E4-49DF-11D3-8229-0080BE509056} /*GMailFS Context Menu*/C:\Windows\system32\ShellExt\GMailFS.dll = C:\Windows\system32\ShellExt\GMailFS.dll
@{FFB699E0-306A-11d3-8BD1-00104B6F7516} /*Play on my TV helper*/C:\Windows\system32\nvcpl.dll = C:\Windows\system32\nvcpl.dll
@{0563DB41-F538-4B37-A92D-4659049B7766} /*WLMD Message Handler*/C:\Program Files\Windows Live\Mail\mailcomm.dll = C:\Program Files\Windows Live\Mail\mailcomm.dll
@{06A2568A-CED6-4187-BB20-400B8C02BE5A} /**/(null) =
@{00F33137-EE26-412F-8D71-F84E4C2C6625} /**/C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll = C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
@{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} /*Windows Live Photo Gallery Autoplay Drop Target*/(null) =
@{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} /*Windows Live Photo Gallery Viewer Drop Target*/(null) =
@{00F374B7-B390-4884-B372-2FC349F2172B} /*Windows Live Photo Gallery Editor Drop Target*/(null) =
@{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} /*Windows Live Photo Gallery Viewer Drop Target Shim*/C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll = C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
@{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} /*Windows Live Photo Gallery Editor Drop Target Shim*/C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll = C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
@{00F30F90-3E96-453B-AFCD-D71989ECC2C7} /*Windows Live Photo Gallery Autoplay Drop Target Shim*/C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll = C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>
McCtxMenu@{01576F39-90DE-4D6E-A068-5B20C22BAAEE} = c:\PROGRA~1\mcafee\VIRUSS~1\mcctxmnu.dll
Notepad++@{120B94B5-2E6A-4F13-94D0-414BCB64FA0F} = C:\Program Files\Notepad++\nppcm.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ >>>
MBAMShlExt@{57CE581A-0CB6-4266-9CA0-19364C90A0B3} = C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
McCtxMenu@{01576F39-90DE-4D6E-A068-5B20C22BAAEE} = c:\PROGRA~1\mcafee\VIRUSS~1\mcctxmnu.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>
@{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll = C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
@{27B4851A-3207-45A2-B947-BE8AFE6163AB}c:\PROGRA~1\mcafee\msk\mskapbho.dll = c:\PROGRA~1\mcafee\msk\mskapbho.dll
@{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll = C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
@{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll = C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
@{7DB2D5A0-7241-4E79-B68D-6309F01C5231}c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll = c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
@{9030D464-4C02-4ABF-8ECC-5164760863C6}C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll = C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
@{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll = C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
@{B164E929-A1B6-4A06-B104-2CD0E90A88FF}c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll = c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
@{DF21F1DB-80C6-11D3-9483-B03D0EC10000}c:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll = c:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll
@{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}C:\Program Files\Windows Live\Toolbar\wltcore.dll = C:\Program Files\Windows Live\Toolbar\wltcore.dll

HKCU\Control Panel\Desktop@SCRNSAVE.EXE = C:\Windows\system32\logon.scr

HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=IT_IT&c=71&bd=Pavilion&pf=laptop = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
@Start Pagehttp://ie.redirect.hp.com/svs/rdr?T ... &pf=laptop = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
@Local Page%SystemRoot%\system32\blank.htm = %SystemRoot%\system32\blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start Pagewww.google.it/ = www.google.it/
@Local PageC:\Windows\system32\blank.htm = C:\Windows\system32\blank.htm

HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
dvd@CLSID = C:\Windows\System32\msvidctl.dll
its@CLSID = %SystemRoot%\System32\itss.dll
livecall@CLSID = C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
mhtml@CLSID = %SystemRoot%\system32\inetcomm.dll
ms-help@CLSID = C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
ms-its@CLSID = %SystemRoot%\System32\itss.dll
ms-itss@CLSID = C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
msnim@CLSID = C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
sacore@CLSID = c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
tv@CLSID = C:\Windows\System32\msvidctl.dll
wlmailhtml@CLSID = C:\Program Files\Windows Live\Mail\mailcomm.dll

HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ >>>
000000000001@LibraryPath = %SystemRoot%\system32\NLAapi.dll
000000000002@LibraryPath = %SystemRoot%\system32\napinsp.dll
000000000003@LibraryPath = %SystemRoot%\system32\pnrpnsp.dll
000000000004@LibraryPath = %SystemRoot%\system32\pnrpnsp.dll

HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000007@LibraryPath = %SystemRoot%\system32\wshbth.dll

---- EOF - GMER 1.0.13 ----

[ivan92]

[claudio] sulla mia schermata di jave non c'è la scheda cache ....ci sono solo le schede generale,aggiornamento, java,protezione,avanzate....ho guardato ma non trova cache

[[Claudio]]

Start
Pannello di controllo
clicca sull'icona Java e verrà aperto il Pannello di controllo di Java
seleziona la scheda Generale
nella terza sezione (File temporanei Internet) clicca su Impostazioni
nella finestra successiva clicca su Elimina file
spunta le voci Applicazioni e applet e File traccia registro
clicca su OK per confermare e poi nuovamente OK e infine APPLICA

[stevens]

riavvia gmer - se vedi delle voci in rosso clicca su ognuna di esse con il tasto destro del mouse. Scegli l’opzione apposita per l’eliminazione


appena finito, continuiamo

[ivan92]

non ha trovato niente

[[Claudio]]

non ha trovato niente

Ivan scusa ti avevo suggerito di eseguire una scansione completa con Kaspersky Virus Removal tool e di allegare il report ..... ti avevo chiesto di allegare un log di Hijackthis ma anche per quello nulla ....... cosi non andiamo da nessuna parte
Gmer non ha trovato nulla perché non ci sono rootkit da cercare.

[ivan92]

si scusa claudio ma non so chi seguire...comunque tu hai scritto di cancellare quello che c'è nella cartella prefetch ...ma il prefetch non è il sistema che usano i processori per attuare il parallelismo dei calcoli? cancellando i dati non combino un malanno?

[[Claudio]]

si scusa claudio ma non so chi seguire...

Lo vedo.

comunque tu hai scritto di cancellare quello che c'è nella cartella prefetch ...ma il prefetch non è il sistema che usano i processori per attuare il parallelismo dei calcoli? cancellando i dati non combino un malanno?

Nella cartella Prefetch vengono catalogati tutti i file e programmi utilizzati con maggiore frequenza.
Nel tempo si accumulano anche vecchie voci ma non solo, sempre più spesso, anche file malevoli.
Questa è una delle ragioni per le quali ogni tanto la cartella Prefetch deve essere svuotata.

C'è chi come me preferisce disabilitare totalmente la funzione del Prefetch eseguendo una modifica al Registro di Sistema [la descrivo giusto perché se ne sta parlando]:
Start
Esegui
nella casella di dialogo digitare regedit
confermare con OK
dal menu a cascata a a sinistra seguire questo percorso:

HKEY_LOCAL_MACHINE
SYSTEM
CurrentControlSet
Control
Session Manager
Memory Management
PrefetchParameters

nella finestra di destra doppio click sulla voce Enable Prefetch
in quella successiva nel campo denominato Dati valore sostituire il valore presente [di default é 3] con 0 e corfermare con OK
concluso il passaggio, chiudere il Regedit e riavviare il Computer [dopo il riavvio la funzione Prefetch non verrà più avviata].

Sempre sulla questione gestione Prefetch segnalo questo tool: Windows XP Prefetch Clean and Control scaricabile da qui
Una breve spiegazione sulle funzioni di WXP si trova in questo articolo

Detto questo vediamo se si riesce a passare oltre e vedere il report di Kaspersky Virus Removal tool e un log di Hijackthis?

[ivan92]

siccome il log di kaspersky è molto lungo...(circa 9 mb) devi dirmi un altro metodo per pubblicarlo...comunque intento posto il log di hijack this

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14.51.23, on 27/02/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\RtHDVCpl.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Hp\Digital Imaging\bin\HpqSRmon.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Utente\Documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE= ... &pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: VeriSoft Access Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - Startup: is-B21JG.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{035A7A39-03E6-4522-9147-59CAF8CF44C6}: NameServer = 85.37.17.6 85.38.28.89
O17 - HKLM\System\CS1\Services\Tcpip\..\{035A7A39-03E6-4522-9147-59CAF8CF44C6}: NameServer = 85.37.17.6 85.38.28.89
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: APSHook.dll
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Utilità di pianificazione di LiveUpdate automatico - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

--
End of file - 11520 bytes

[crazy.cat]

siccome il log di kaspersky è molto lungo...(circa 9 mb) devi dirmi un altro metodo per pubblicarlo

9 mb?????
E quanti virus ti ha trovato in grazia?
Caricalo su questo sito http://www.wikifortio.com/ e posta il link per poterlo scaricare

[ivan92]

a no sono 146 mb...un po tanti...quindi non posso caricarli su wikifortio...comunque ha trovato 2 virus:
----->:not foundTrojan program Trojan-Spy.HTML.Fraud.gen (modification) Email message body: Local Folders\Inbox\McAfee Anti efc\[From:"assistenza@paypal.it" <asisstenza@paypal.i>][Subject:[PHISH]Attenzione! Il vostro conto PayPal è stato limitato!?][Time:2009/02/07 14:08:21]/text/html
(che al momento dell'eliminazione non è stato trovato)
----->quarantined: Trojan program Trojan-Spy.HTML.Fraud.gen (modification) Email message attachment: Local Folders\Inbox\McAfee Anti efc\[From:"assistenza@paypal.it" <asisstenza@paypal.i>][Subject:Message has a suspicious part : [PHISH]Attenzione! Il vostro conto PayPal è stato limitato!?][Time:2009/02/07 14:08:21]/Message has a suspicious part _ [PHISH]Attenzione! Il vostro conto PayPal è stato limitato!_.htm
(e questo è stato messo in quarantena)

[crazy.cat]

Ma il log non si può salvare in formato Html?
Come fa a crearti un file Html del genere?

[ivan92]

comunque è un file .txt...e non ho idea del perché so solo che ieri sera ha scansionato circa un milione di oggetti che di solito gli altri antivirus ne esaminano 200.000 circa....