GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-19 15:00:48
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\Karel\LOCALS~1\Temp\ufpoyaoc.sys


---- System - GMER 1.0.15 ----

SSDT                                                                                                                                  86ADECB0                                                                                                                                                                            ZwConnectPort

Code                                                                                                                                  86F78580                                                                                                                                                                            pIofCallDriver

---- Kernel code sections - GMER 1.0.15 ----

.reloc                                                                                                                                C:\WINDOWS\system32\drivers\NDIS.sys                                                                                                                                                section is executable [0x86EEF280, 0x32C2A, 0xE0000060]
init                                                                                                                                  C:\WINDOWS\system32\drivers\senfilt.sys                                                                                                                                             entry point in "init" section [0xF6A33900]
.text                                                                                                                                 C:\WINDOWS\system32\drivers\hardlock.sys                                                                                                                                            section is writeable [0xEF5B5400, 0x87EE2, 0xE8000020]
.protecthardlockentry point in ".protecthardlockentry point in ".protecthardlockentry point in ".p" section [0xEF659620]  C:\WINDOWS\system32\drivers\hardlock.sys                                                                                                                                            entry point in ".protecthardlockentry point in ".protecthardlockentry point in ".p" section [0xEF659620]
.protecthardlockunknown last code section [0xEF659400, 0x5126, 0xE0000020]                                                        C:\WINDOWS\system32\drivers\hardlock.sys                                                                                                                                            unknown last code section [0xEF659400, 0x5126, 0xE0000020]
pnidata                                                                                                                               C:\WINDOWS\system32\DRIVERS\secdrv.sys                                                                                                                                              unknown last section [0xEF426F00, 0x24000, 0x48000000]

---- User code sections - GMER 1.0.15 ----

?                                                                                                                                     C:\WINDOWS\System32\svchost.exe[292]                                                                                                                                                image checksum mismatch; number of sections mismatch; time/date stamp mismatch; unknown module: gdiplus.dllunknown module: OLEAUT32.dllunknown module: urlmon.dll
.text                                                                                                                                 C:\WINDOWS\System32\svchost.exe[292] USER32.dll!SetForegroundWindow                                                                                                                 7E373D4D 8 Bytes  [B8, 01, 00, 00, 00, C2, 04, ...] {MOV EAX, 0x1; RET 0x4}
.text                                                                                                                                 C:\WINDOWS\Explorer.EXE[1420] ntdll.dll!NtQueryDirectoryFile + 6                                                                                                                    7C90DF64 4 Bytes  [90, 61, C2, 00]
?                                                                                                                                     C:\WINDOWS\System32\svchost.exe[1976]                                                                                                                                               image checksum mismatch; number of sections mismatch; time/date stamp mismatch; 

---- User IAT/EAT - GMER 1.0.15 ----

IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegQueryValueExW]                                                                              83EC8B55
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorDacl]                                                                     75001C7D
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetEntriesInAclW]                                                                              0C7D831E
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorGroup]                                                                    6A1E7501
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorOwner]                                                                    03E86800
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!InitializeSecurityDescriptor]                                                                  016A0000
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!GetTokenInformation]                                                                           FF0471FF
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenProcessToken]                                                                              43B2BC15
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenThreadToken]                                                                               18458B00
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetServiceStatus]                                                                              33002083
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegisterServiceCtrlHandlerW]                                                                   18C25DC0
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegCloseKey]                                                                                   0C7D8100
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegOpenKeyExW]                                                                                 00000113
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!StartServiceCtrlDispatcherW]                                                                   498BF175
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte]                                                                           20831845
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrlenW]                                                                                      40C03300
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalFree]                                                                                     006ADBEB
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcess]                                                                             43805BB8
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThread]                                                                              69E4E800
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcAddress]                                                                                758B0002
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW]                                                                                2406C708
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LCMapStringW]                                                                                  088B0A74
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!FreeLibrary]                                                                                   0851FF50
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcpyW]                                                                                      00246683
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW]                                                                     FFFC4D83
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpiW]                                                                                     8514768B
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExitProcess]                                                                                   560674F6
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCommandLineW]                                                                               021C6CE8
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InitializeCriticalSection]                                                                     6A4FE800
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcessHeap]                                                                                04C20002
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetErrorMode]                                                                                  F18B5600
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter]                                                                   FFB4E856
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObject]                                                                   44F6FFFF
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange]                                                                    74010824
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryA]                                                                                  29E85607
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter]                                                                       59000220
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetTickCount]                                                                                  C25EC68B
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThreadId]                                                                            408B0004
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcessId]                                                                           74C08514
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime]                                                                       3AE85006
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!TerminateProcess]                                                                              C300021C
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter]                                                                      0824448B
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalAlloc]                                                                                    33002083
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpW]                                                                                      0008C2C0
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook]                                                                          [004005B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtQuerySecurityObject]                                                                            [004005B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlFreeHeap]                                                                                      0024C280
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtOpenKey]                                                                                        1024448B
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscat]                                                                                           B8002083
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscpy]                                                                                           80004001
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlAllocateHeap]                                                                                  8B0010C2
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCompareUnicodeString]                                                                          83082444
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitUnicodeString]                                                                             02B80020
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitializeSid]                                                                                 C2800040
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid]                                                                             01B80008
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid]                                                                               C2800040
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtClose]                                                                                          C0330004
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid]                                                                          0014C240
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetDaclSecurityDescriptor]                                                                     0824448B
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlQueryInformationAcl]                                                                           880440C7
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetAce]                                                                                        33088888
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlImageNtHeader]                                                                                 0008C2C0
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcslen]                                                                                           C240C033
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter]                                                                      C0330008
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCopySid]                                                                                       0010C240
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx]                                                                         B8002083
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen]                                                                         80004001
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize]                                                                       55000CC2
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf]                                                                           8351EC8B
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerListen]                                                                                 5600FC65
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW]                                                                          50FC458D
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf]                                                                             001183E8
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status]                                                                             FC758B00
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[292] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening]                                                                      0674F685
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegQueryValueExW]                                                                             9B8401C7
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorDacl]                                                                    46E90043
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetEntriesInAclW]                                                                             560001AA
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorGroup]                                                                   06C7F18B
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorOwner]                                                                   [00439B84] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!InitializeSecurityDescriptor]                                                                 01AA38E8
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!GetTokenInformation]                                                                          2444F600
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenProcessToken]                                                                             07740108
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenThreadToken]                                                                              AC0FE856
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetServiceStatus]                                                                             8B590001
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegisterServiceCtrlHandlerW]                                                                  04C25EC6
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegCloseKey]                                                                                  8B55C300
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegOpenKeyExW]                                                                                1475FFEC
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!StartServiceCtrlDispatcherW]                                                                  FF1075FF
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte]                                                                          10C48308
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrlenW]                                                                                     8B55C35D
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalFree]                                                                                    1475FFEC
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcess]                                                                            FF1075FF
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThread]                                                                             75FF0C75
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcAddress]                                                                               B108E808
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW]                                                                               458B0001
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LCMapStringW]                                                                                 F0A4E800
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!FreeLibrary]                                                                                  F18B0001
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcpyW]                                                                                     E8F07589
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW]                                                                    0001A906
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpiW]                                                                                    00FC6583
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExitProcess]                                                                                  8D0875FF
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCommandLineW]                                                                              06C70C4E
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InitializeCriticalSection]                                                                    [00439B90] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcessHeap]                                                                               001D67E8
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetErrorMode]                                                                                 E8C68B00
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter]                                                                  0001F156
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObject]                                                                  560004C2
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange]                                                                   006AF18B
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryA]                                                                                 4E8D016A
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter]                                                                      9006C70C
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetTickCount]                                                                                 E800439B
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThreadId]                                                                           000022DD
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcessId]                                                                          E95ECE8B
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime]                                                                      0001A999
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!TerminateProcess]                                                                             E8F18B56
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter]                                                                     FFFFFFDB
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalAlloc]                                                                                   082444F6
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpW]                                                                                     56077401
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook]                                                                         01AB68E8
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtQuerySecurityObject]                                                                           0004C25E
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlFreeHeap]                                                                                     9B9C01C7
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtOpenKey]                                                                                       BCE90043
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscat]                                                                                          56FFFFFF
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscpy]                                                                                          06C7F18B
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlAllocateHeap]                                                                                 [00439B9C] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCompareUnicodeString]                                                                         FFFFAEE8
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitUnicodeString]                                                                            2444F6FF
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitializeSid]                                                                                07740108
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid]                                                                            AB3BE856
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid]                                                                              8B590001
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtClose]                                                                                         04C25EC6
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid]                                                                         B8046A00
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetDaclSecurityDescriptor]                                                                    [00433E58] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlQueryInformationAcl]                                                                          01F009E8
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetAce]                                                                                       89F18B00
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlImageNtHeader]                                                                                7D8BF075
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcslen]                                                                                          DEE85708
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter]                                                                     830001A8
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCopySid]                                                                                      8300FC65
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx]                                                                        06C70C4E
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen]                                                                        [00439B90] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation)
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize]                                                                      001CC7E8
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf]                                                                          E8C68B00
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerListen]                                                                                0001F0B6
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW]                                                                         830004C2
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf]                                                                            60830020
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status]                                                                            0A8B0004
IAT                                                                                                                                   C:\WINDOWS\System32\svchost.exe[1976] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening]                                                                     04728B56

---- Devices - GMER 1.0.15 ----

AttachedDevice                                                                                                                        \FileSystem\Ntfs \Ntfs                                                                                                                                                              SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

Device                                                                                                                                \Driver\NDIS \Device\Ndis                                                                                                                                                           [86EF6982] NDIS.sys[.reloc] 

AttachedDevice                                                                                                                        \Driver\Tcpip \Device\Ip                                                                                                                                                            SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device                                                                                                                                \Driver\prodrv04 \Device\ProDrv04                                                                                                                                                   86E8BA90
Device                                                                                                                                                                                                                                                                                                                    pci.sys (NT Plug and Play PCI Enumerator/Microsoft Corporation)

AttachedDevice                                                                                                                        \Driver\Tcpip \Device\Tcp                                                                                                                                                           SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice                                                                                                                        \FileSystem\Fastfat \Fat                                                                                                                                                            SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice                                                                                                                        \FileSystem\Fastfat \Fat                                                                                                                                                            InCDrec.SYS (InCD File System Recognizer/Nero AG)

---- Registry - GMER 1.0.15 ----

Reg                                                                                                                                   HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)                                                                                
Reg                                                                                                                                   HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                                                                                     0
Reg                                                                                                                                   HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                                                                                  0xEB 0x8E 0x3E 0x92 ...
Reg                                                                                                                                   HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                
Reg                                                                                                                                   HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                     1
Reg                                                                                                                                   HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                  0x3D 0x50 0xB0 0x31 ...
Reg                                                                                                                                   HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                                                     0xD4 0xC3 0x97 0x02 ...
Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                                                                                                    
Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                                                                                 0
Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                                                                              0xEB 0x8E 0x3E 0x92 ...
Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                                                                    
Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                 1
Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                              0x3D 0x50 0xB0 0x31 ...
Reg                                                                                                                                   HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                                                 0xD4 0xC3 0x97 0x02 ...
Reg                                                                                                                                   HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)                                                                                
Reg                                                                                                                                   HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                                                                                     0
Reg                                                                                                                                   HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                                                                                  0xEB 0x8E 0x3E 0x92 ...
Reg                                                                                                                                   HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                
Reg                                                                                                                                   HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                     1
Reg                                                                                                                                   HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                  0x3D 0x50 0xB0 0x31 ...
Reg                                                                                                                                   HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                                                     0xD4 0xC3 0x97 0x02 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\.package@                                                                                                                                                     package_auto_file
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\ASP.HostEncode\CLSID                                                                                                                                          
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\ASP.HostEncode\CLSID@                                                                                                                                         {0CF774D1-F077-11D1-B1BC-00C04F86C324}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\AVIEBHO.IEFW@                                                                                                                                                 IEFW Object
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\AVIEBHO.IEFW\CLSID                                                                                                                                            
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\AVIEBHO.IEFW\CLSID@                                                                                                                                           {FAAD2038-C371-473d-86F1-5B11D39C3775}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\AVIEBHO.IEFW\CurVer                                                                                                                                           
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\AVIEBHO.IEFW\CurVer@                                                                                                                                          AVIEBHO.IEFW.2
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\AVIEBHO.IEFW.2@                                                                                                                                               IEFW Object
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\AVIEBHO.IEFW.2\CLSID                                                                                                                                          
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\AVIEBHO.IEFW.2\CLSID@                                                                                                                                         {FAAD2038-C371-473d-86F1-5B11D39C3775}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32                                                                                                   
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel                                                                                    Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@                                                                                                  C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b                                                                  0xC8 0x28 0x51 0xAF ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32                                                                                                   
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel                                                                                    Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@                                                                                                  C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b                                                                  0x71 0x3B 0x04 0x66 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32                                                                                                   
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel                                                                                    Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@                                                                                                  C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016                                                                  0xFF 0x7C 0x85 0xE0 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32                                                                                                   
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel                                                                                    Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@                                                                                                  C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48                                                                  0x86 0x8C 0x21 0x01 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32                                                                                                   
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel                                                                                    Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@                                                                                                  C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472                                                                  0xF5 0x1D 0x4D 0x73 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32                                                                                                   
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel                                                                                    Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@                                                                                                  C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d                                                                  0xDF 0x20 0x58 0x62 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32                                                                                                   
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel                                                                                    Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@                                                                                                  C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b                                                                  0xFB 0xA7 0x78 0xE6 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32                                                                                                   
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel                                                                                    Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@                                                                                                  C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d                                                                  0xAA 0x52 0xC6 0x00 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32                                                                                                   
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel                                                                                    Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@                                                                                                  C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3                                                                  0xB2 0x46 0x9A 0xE2 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32                                                                                                   
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel                                                                                    Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@                                                                                                  C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b                                                                  0x3D 0xCE 0xEA 0x26 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32                                                                                                   
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel                                                                                    Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@                                                                                                  C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6                                                                  0xE3 0x0E 0x66 0xD5 ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32                                                                                                   
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel                                                                                    Apartment
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@                                                                                                  C:\WINDOWS\system32\OLE32.DLL
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2                                                                  0xFA 0xEA 0x66 0x7F ...
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\ECMAScript@                                                                                                                                                   JScript Language
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\ECMAScript\CLSID                                                                                                                                              
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\ECMAScript\CLSID@                                                                                                                                             {f414c260-6ac0-11cf-b6d1-00aa00bbbb58}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\ECMAScript\OLEScript                                                                                                                                          
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\HTML.HostEncode\CLSID                                                                                                                                         
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\HTML.HostEncode\CLSID@                                                                                                                                        {0CF774D0-F077-11D1-B1BC-00C04F86C324}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript@                                                                                                                                                   JScript Language
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript\CLSID                                                                                                                                              
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript\CLSID@                                                                                                                                             {f414c260-6ac0-11cf-b6d1-00aa00bbbb58}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript\OLEScript                                                                                                                                          
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript Author@                                                                                                                                            JScript Language Authoring
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript Author\CLSID                                                                                                                                       
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript Author\CLSID@                                                                                                                                      {f414c261-6ac0-11cf-b6d1-00aa00bbbb58}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript Author\OLEScript                                                                                                                                   
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.1@                                                                                                                                                JScript Language
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.1\CLSID                                                                                                                                           
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.1\CLSID@                                                                                                                                          {f414c260-6ac0-11cf-b6d1-00aa00bbbb58}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.1\OLEScript                                                                                                                                       
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.1 Author@                                                                                                                                         JScript Language Authoring
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.1 Author\CLSID                                                                                                                                    
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.1 Author\CLSID@                                                                                                                                   {f414c261-6ac0-11cf-b6d1-00aa00bbbb58}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.1 Author\OLEScript                                                                                                                                
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.2@                                                                                                                                                JScript Language
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.2\CLSID                                                                                                                                           
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.2\CLSID@                                                                                                                                          {f414c260-6ac0-11cf-b6d1-00aa00bbbb58}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.2\OLEScript                                                                                                                                       
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.2 Author@                                                                                                                                         JScript Language Authoring
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.2 Author\CLSID                                                                                                                                    
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.2 Author\CLSID@                                                                                                                                   {f414c261-6ac0-11cf-b6d1-00aa00bbbb58}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.2 Author\OLEScript                                                                                                                                
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.3@                                                                                                                                                JScript Language
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.3\CLSID                                                                                                                                           
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.3\CLSID@                                                                                                                                          {f414c260-6ac0-11cf-b6d1-00aa00bbbb58}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JavaScript1.3\OLEScript                                                                                                                                       
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JScript@                                                                                                                                                      JScript Language
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JScript\CLSID                                                                                                                                                 
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JScript\CLSID@                                                                                                                                                {f414c260-6ac0-11cf-b6d1-00aa00bbbb58}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JScript\OLEScript                                                                                                                                             
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JScript Author@                                                                                                                                               JScript Language Authoring
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JScript Author\CLSID                                                                                                                                          
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JScript Author\CLSID@                                                                                                                                         {f414c261-6ac0-11cf-b6d1-00aa00bbbb58}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JScript Author\OLEScript                                                                                                                                      
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JScript.Encode@                                                                                                                                               JScript Language Encoding
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JScript.Encode\CLSID                                                                                                                                          
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JScript.Encode\CLSID@                                                                                                                                         {f414c262-6ac0-11cf-b6d1-00aa00bbbb58}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JScript.Encode\OLEScript                                                                                                                                      
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JSFile.HostEncode\CLSID                                                                                                                                       
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\JSFile.HostEncode\CLSID@                                                                                                                                      {85131630-480C-11D2-B1F9-00C04F86C324}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\LiveScript@                                                                                                                                                   JScript Language
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\LiveScript\CLSID                                                                                                                                              
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\LiveScript\CLSID@                                                                                                                                             {f414c260-6ac0-11cf-b6d1-00aa00bbbb58}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\LiveScript\OLEScript                                                                                                                                          
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\LiveScript Author@                                                                                                                                            JScript Language Authoring
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\LiveScript Author\CLSID                                                                                                                                       
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\LiveScript Author\CLSID@                                                                                                                                      {f414c261-6ac0-11cf-b6d1-00aa00bbbb58}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\LiveScript Author\OLEScript                                                                                                                                   
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\MSIDXS@                                                                                                                                                       Microsoft OLE DB Provider for Indexing Service
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\MSIDXS\Clsid                                                                                                                                                  
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\MSIDXS\Clsid@                                                                                                                                                 {F9AE8980-7E52-11d0-8964-00C04FD611D7}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\MSIDXS ErrorLookup@                                                                                                                                           Microsoft OLE DB Error Lookup for Indexing Service
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\MSIDXS ErrorLookup\Clsid                                                                                                                                      
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\MSIDXS ErrorLookup\Clsid@                                                                                                                                     {F9AE8981-7E52-11d0-8964-00C04FD611D7}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\MSScriptControl.ScriptControl@                                                                                                                                ScriptControl Object
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\MSScriptControl.ScriptControl\CLSID                                                                                                                           
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\MSScriptControl.ScriptControl\CLSID@                                                                                                                          {0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\MSScriptControl.ScriptControl\CurVer                                                                                                                          
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\MSScriptControl.ScriptControl\CurVer@                                                                                                                         MSScriptControl.ScriptControl.1
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\MSScriptControl.ScriptControl.1@                                                                                                                              ScriptControl Object
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\MSScriptControl.ScriptControl.1\CLSID                                                                                                                         
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\MSScriptControl.ScriptControl.1\CLSID@                                                                                                                        {0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\package_auto_file@                                                                                                                                            
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\package_auto_file\shell                                                                                                                                       
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\package_auto_file\shell@                                                                                                                                      open
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\package_auto_file\shell\open                                                                                                                                  
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\package_auto_file\shell\open@                                                                                                                                 &Otev??t
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\package_auto_file\shell\open\command                                                                                                                          
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\package_auto_file\shell\open\command@                                                                                                                         C:\Program Files\Windows Media Player\wmplayer.exe /Open "%L"
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\package_auto_file\shell\play                                                                                                                                  
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\package_auto_file\shell\play@                                                                                                                                 &P?ehr?t
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\package_auto_file\shell\play\command                                                                                                                          
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\package_auto_file\shell\play\command@                                                                                                                         C:\Program Files\Windows Media Player\wmplayer.exe /Play "%L"
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\ScriptControl@                                                                                                                                                ScriptControl Object
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\ScriptControl\CLSID                                                                                                                                           
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\ScriptControl\CLSID@                                                                                                                                          {0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\ScriptControl\CurVer                                                                                                                                          
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\ScriptControl\CurVer@                                                                                                                                         MSScriptControl.ScriptControl.1
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\Scripting.Dictionary@                                                                                                                                         Scripting.Dictionary
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\Scripting.Dictionary\CLSID                                                                                                                                    
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\Scripting.Dictionary\CLSID@                                                                                                                                   {EE09B103-97E0-11CF-978F-00A02463E06F}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\Scripting.Encoder@                                                                                                                                            Script Encoder Object
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\Scripting.Encoder\CLSID                                                                                                                                       
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\Scripting.Encoder\CLSID@                                                                                                                                      {32DA2B15-CFED-11D1-B747-00C04FC2B085}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\Scripting.FileSystemObject@                                                                                                                                   FileSystem Object
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\Scripting.FileSystemObject\CLSID                                                                                                                              
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\Scripting.FileSystemObject\CLSID@                                                                                                                             {0D43FE01-F093-11CF-8940-00A0C9054228}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBS@                                                                                                                                                          VB Script Language
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBS\CLSID                                                                                                                                                     
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBS\CLSID@                                                                                                                                                    {B54F3741-5B07-11cf-A4B0-00AA004A55E8}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBS\OLEScript                                                                                                                                                 
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBS Author@                                                                                                                                                   VB Script Language Authoring
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBS Author\CLSID                                                                                                                                              
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBS Author\CLSID@                                                                                                                                             {B54F3742-5B07-11cf-A4B0-00AA004A55E8}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBS Author\OLEScript                                                                                                                                          
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript@                                                                                                                                                     VB Script Language
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript\CLSID                                                                                                                                                
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript\CLSID@                                                                                                                                               {B54F3741-5B07-11cf-A4B0-00AA004A55E8}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript\OLEScript                                                                                                                                            
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript Author@                                                                                                                                              VB Script Language Authoring
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript Author\CLSID                                                                                                                                         
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript Author\CLSID@                                                                                                                                        {B54F3742-5B07-11cf-A4B0-00AA004A55E8}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript Author\OLEScript                                                                                                                                     
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript.Encode@                                                                                                                                              VBScript Language Encoding
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript.Encode\CLSID                                                                                                                                         
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript.Encode\CLSID@                                                                                                                                        {B54F3743-5B07-11cf-A4B0-00AA004A55E8}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript.Encode\OLEScript                                                                                                                                     
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript.RegExp@                                                                                                                                              VBScript Regular Expression
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript.RegExp\CLSID                                                                                                                                         
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript.RegExp\CLSID@                                                                                                                                        {3F4DACA4-160D-11D2-A8E9-00104B365C9F}
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBScript.RegExp\OLEScript                                                                                                                                     
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBSFile.HostEncode\CLSID                                                                                                                                      
Reg                                                                                                                                   HKLM\SOFTWARE\Classes\VBSFile.HostEncode\CLSID@                                                                                                                                     {85131631-480C-11D2-B1F9-00C04F86C324}
Reg                                                                                                                                   HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac\OpenWithProgids@ \0\x2d9\x2d9\x2d9\x2d9xS\23\x2d9\x2d9\x2d9\x2d9=>\0=>\0004\0hlp\0E\0=>\0lkT\23\3   
Reg                                                                                                                                   HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\OpenWithProgids@ \0\x2d9\x2d9\x2d9\x2d9xS\23\x2d9\x2d9\x2d9\x2d9=>\0=>\0004\0hlp\0E\0=>\0lkT\23\3  
Reg                                                                                                                                   HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithProgids@ \0\x2d9\x2d9\x2d9\x2d9xS\23\x2d9\x2d9\x2d9\x2d9=>\0=>\0004\0hlp\0E\0=>\0lkT\23\3   

---- Files - GMER 1.0.15 ----

File                                                                                                                                  C:\ACERNB\NAV2006\Support\SymNet\SymNet\System32\Drivers\symndis.sys                                                                                                                (size mismatch) 27792/182912 bytes executable
File                                                                                                                                  C:\Documents and Settings\Karel\Local Settings\temp\plugtmp                                                                                                                         0 bytes
File                                                                                                                                  C:\WINDOWS\system32\dllcache\ndis.sys                                                                                                                                               (size mismatch) 212736/182912 bytes executable
File                                                                                                                                  C:\WINDOWS\system32\drivers\ndis.sys                                                                                                                                                (size mismatch) 212736/182912 bytes executable
File                                                                                                                                  C:\WINDOWS\system32\drivers\symndis.sys                                                                                                                                             (size mismatch) 46208/182912 bytes executable

---- EOF - GMER 1.0.15 ----
