Má veľa znakov tak pošlem viac príspevkov
GMER 1.0.15.15281 -
http://www.gmer.net
Rootkit scan 2010-05-03 00:37:06
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\straka\LOCALS~1\Temp\uwkiifog.sys
---- System - GMER 1.0.15 ----
SSDT 88DB1580 ZwAssignProcessToJobObject
SSDT spfv.sys ZwCreateKey [0xB9EA70E0]
SSDT 88DB2100 ZwDebugActiveProcess
SSDT 88DB1B30 ZwDuplicateObject
SSDT spfv.sys ZwEnumerateKey [0xB9EC5CA4]
SSDT spfv.sys ZwEnumerateValueKey [0xB9EC6032]
SSDT spfv.sys ZwOpenKey [0xB9EA70C0]
SSDT 88DB0CC0 ZwOpenProcess
SSDT 88DB0FC0 ZwOpenThread
SSDT 88DB19C0 ZwProtectVirtualMemory
SSDT spfv.sys ZwQueryKey [0xB9EC610A]
SSDT spfv.sys ZwQueryValueKey [0xB9EC5F8A]
SSDT 88DB1860 ZwSetContextThread
SSDT 88DB16E0 ZwSetInformationThread
SSDT 88DAE700 ZwSetSecurityObject
SSDT spfv.sys ZwSetValueKey [0xB9EC619C]
SSDT 88DB1420 ZwSuspendProcess
SSDT 88DB12C0 ZwSuspendThread
SSDT 88DB0E50 ZwTerminateProcess
SSDT 88DB1150 ZwTerminateThread
SSDT 88DB1F50 ZwWriteVirtualMemory
INT 0x63 ? 8A984BF8
INT 0x63 ? 8A984BF8
INT 0x63 ? 8A984BF8
INT 0x63 ? 8A984BF8
INT 0x63 ? 89AA9DC0
INT 0x83 ? 8A987BF8
INT 0x83 ? 89AA9DC0
INT 0x83 ? 8A987BF8
INT 0x84 ? 89AA9DC0
INT 0xA4 ? 89AA9DC0
INT 0xA4 ? 89AA9DC0
INT 0xA4 ? 89AA9DC0
INT 0xA4 ? 89AA9DC0
INT 0xB4 ? 89AA9DC0
---- Kernel code sections - GMER 1.0.15 ----
? spfv.sys Systém nemůže nalézt uvedený soubor. !
.text C:\WINDOWS.0\system32\DRIVERS\nv4_mini.sys section is writeable [0xB7F30380, 0x34E2EF, 0xE8000020]
.text USBPORT.SYS!DllUnload B7F108AC 5 Bytes JMP 89AA93A0
init C:\WINDOWS.0\system32\drivers\Senfilt.sys entry point in "init" section [0xAFFC5A00]
? C:\DOCUME~1\straka\LOCALS~1\Temp\mbr.sys Systém nemůže nalézt uvedený soubor. !
---- User code sections - GMER 1.0.15 ----
.text C:\Program Files\ESET\ESET Smart Security\ekrn.exe[276] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 00]
.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2524] USER32.dll!DefWindowProcA + 11A 7E37C298 7 Bytes JMP 10031D10 C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)
.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2524] USER32.dll!SetWindowRgn + 2BD 7E37E7E5 7 Bytes JMP 10031C80 C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)
.text C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe[2524] USER32.dll!SetClipboardData + 19D 7E38113B 7 Bytes JMP 10031CF0 C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\NewUI.dll (New UI/Avanquest Software)
.text C:\Program Files\Mozilla Firefox\firefox.exe[3428] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [B9EA8042] spfv.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [B9EA813E] spfv.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [B9EA80C0] spfv.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [B9EA8800] spfv.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [B9EA86D6] spfv.sys
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\Explorer.EXE [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINDOWS.0\Explorer.EXE[792] @ C:\WINDOWS.0\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [5D067774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!InitializeSecurityDescriptor] [77DC79C6] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!GetSecurityDescriptorLength] [77DC74BB] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!GetSecurityDescriptorControl] [77DD4BB9] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!IsValidSecurityDescriptor] [77DD4C11] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!ImpersonateNamedPipeClient] [77DC7426] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!RegOpenKeyW] [77DC7946] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!RegisterEventSourceW] [77DE803C] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!ReportEventW] [77DE3681] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!DeregisterEventSource] [77DE79D3] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!RegDeleteKeyA] [77DD42A0] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!RegCreateKeyExA] [77DCE9F4] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!RegSetValueExA] [77DCEAE7] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!OpenSCManagerW] [77DD6F55] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!OpenServiceW] [77DD6FFD] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!QueryServiceStatus] [77DD6D50] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!StartServiceW] [77DE3E94] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!CloseServiceHandle] [77DD6CE5] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!IsValidSid] [77DCF219] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!EqualSid] [77DCF07A] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!GetLengthSid] [77DC7D5C] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!CopySid] [77DCF0E7] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!SystemFunction040] [77DE7014] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!SystemFunction041] [77DDE4D2] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!GetSecurityDescriptorDacl] [77DC73E7] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!MakeSelfRelativeSD] [77DC745E] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!InitializeAcl] [77DC7D09] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!AddAccessAllowedAce] [77DC7D31] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!SetSecurityDescriptorDacl] [77DC79EB] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!LookupAccountNameW] [77DD5B59] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!SystemFunction036] [77DC82A2] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!RegEnumValueW] [77DC7EED] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!RegEnumValueA] [77DE9BBF] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!RegQueryInfoKeyA] [77DD4332] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!RegQueryValueExW] [77DC6FFF] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!RegOpenKeyExA] [77DC7852] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!RegQueryValueExA] [77DC7ABB] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!RegCloseKey] [77DC6C27] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!RegOpenKeyExW] [77DC6AAF] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!TraceMessage] [77E1B355] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!LookupAccountSidW] [77DD5707] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!RevertToSelf] [77DC7338] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!OpenProcessToken] [77DC798B] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!SetThreadToken] [77DCF193] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!GetTokenInformation] [77DC7305] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\RPCRT4.dll [ADVAPI32.dll!OpenThreadToken] [77DC72CC] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\Secur32.dll [ADVAPI32.dll!RegSetValueExW] [77DCD767] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\Secur32.dll [ADVAPI32.dll!LsaOpenPolicy] [77DD1E27] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\Secur32.dll [ADVAPI32.dll!LsaQueryInformationPolicy] [77DD2E07] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\Secur32.dll [ADVAPI32.dll!LsaFreeMemory] [77DD2DDE] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\Secur32.dll [ADVAPI32.dll!LsaClose] [77DD1EF4] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\Secur32.dll [ADVAPI32.dll!RegCreateKeyExW] [77DC776C] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\Secur32.dll [ADVAPI32.dll!RegCloseKey] [77DC6C27] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\Secur32.dll [ADVAPI32.dll!SystemFunction035] [77DD8185] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\Secur32.dll [ADVAPI32.dll!RegDeleteKeyW] [77DD559B] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\Secur32.dll [ADVAPI32.dll!RegEnumValueW] [77DC7EED] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\Secur32.dll [ADVAPI32.dll!RegQueryInfoKeyW] [77DD49CE] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\Secur32.dll [ADVAPI32.dll!RegQueryValueExW] [77DC6FFF] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\Secur32.dll [ADVAPI32.dll!RegOpenKeyExW] [77DC6AAF] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegQueryValueExA] [77DC7ABB] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegQueryValueA] [77DEBB8D] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!AccessCheck] [77DC73A0] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!LookupAccountNameW] [77DD5B59] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegOpenKeyExA] [77DC7852] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegCreateKeyExW] [77DC776C] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegEnumValueW] [77DC7EED] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegEnumKeyA] [77DD53B8] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegDeleteKeyA] [77DD42A0] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!DuplicateEncryptionInfoFile] [77E035EA] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!AllocateLocallyUniqueId] [77DC748C] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegSetValueExW] [77DCD767] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegDeleteKeyW] [77DD559B] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegSetValueW] [77E26116] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegQueryValueExW] [77DC6FFF] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegQueryValueW] [77DCD87A] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegCloseKey] [77DC6C27] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegOpenKeyExW] [77DC6AAF] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!InstallApplication] [77E0D7B7] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegOpenKeyA] [77DCEFC8] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RegOpenKeyW] [77DC7946] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!SetThreadToken] [77DCF193] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!OpenThreadToken] [77DC72CC] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!AccessCheckByType] [77DCF1C9] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!GetSecurityDescriptorDacl] [77DC73E7] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!EqualSid] [77DCF07A] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!GetTokenInformation] [77DC7305] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!RevertToSelf] [77DC7338] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!ImpersonateAnonymousToken] [77DD4C5B] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!GetSecurityDescriptorLength] [77DC74BB] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!DuplicateToken] [77DC8211] C:\WINDOWS.0\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation)
IAT C:\Program Files\Windows Sidebar\sidebar.exe[2320] @ C:\WINDOWS.0\system32\ole32.dll [ADVAPI32.dll!OpenProcessToken]