GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2014-04-02 22:31:07
Windows 6.1.7600  \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD2500BEVT-22A23T0 rev.01.01A01 232,89GB
Running: qomsl64y.exe; Driver: C:\Users\Kajtas\AppData\Local\Temp\kwrdapob.sys


---- Kernel code sections - GMER 2.1 ----

.text  ntkrnlpa.exe!ZwRollbackTransaction + 13F9                                                                                                   83882829 1 Byte  [06]
.text  ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                                      838A7132 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{6B683E0E-1505-488C-8053-3C1301924246}\Linkage@Bind    ?????????u???????t????????????????????????????????m?????????????????????text??????N?????????????????????????????????????????*6to4mp?76?????????????????????????a????Karta Microsoft 6to4?????????????????????????????????????????????????????????????????????????????????}???????????????l??????? ????????????????????????"?????l?7?????ro??? P?????????????????@nettun.inf,%msft%;Microsoft????{4d36e972-e325-11ce-bfc1-08002be10318}\0096?????{4d36e972-e325-11ce-bfc1-08002be10318}\0091??8???????p???????????????n???????e??????????????????*6to4mp??e??????????AB???????????????????????????????-?????e95????N?x???????????????HUAWEI Mobile Connect - USB Device (COM10)???????????????????????????????????????7????????mE0B???????????????????}??s3??TCPIP6TUNNEL?Tcpip6??????????????????????????n??? l??????i?????icr??text??????N??????}?????D??????N????????????D66??? ???????????????e???????????????????????????????????????????????s??????? ????????????????????????"?????l?4???????????*???????????d???????N??????c??????????input.inf???.NT?46?
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{6B683E0E-1505-488C-8053-3C1301924246}\Linkage@Route   ?????t??Karta Microsoft ISATAP #3?????:????????g???????????????????????? #219???????? ??????????????e???{4d36e972-e325-11ce-bfc1-08002be10318}??????????????????-9??@%systemroot%\system32\wkssvc.dll,-1002?1D??@%systemroot%\system32\wkssvc.dll,-1004?? ??? P??????D?????S\p??@%systemroot%\system32\wkssvc.dll,-1006?? ??Security Driver?????????????? ???????4???????????S??????????????????????????????\0??@nettun.inf,%msft%;Microsoft?????????????2???e??? p?????????????????????????????????????????????????????????????ne??????????????????@nettun.inf,%isatap.displayname%;Karta Microsoft ISATAP?????16??????????sE??????????????????3D???????????????????????????3??}???????????{00000000-0000-0000-FFFF-FFFFFFFFFFFF}????????N??????v??????????? ???????k????????????????????????!?????????????????????????????????????????????????????????{4d36e972-e325-11ce-bfc1-08002be10318}\0277?}???????????7????????????????????????????????????o??????????????????????????????????}???6t??????????Microsoft????f?f?f?g?g?g?g?h?g?h?h?k?k??@hal.inf,%acpia
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{6B683E0E-1505-488C-8053-3C1301924246}\Linkage@Export  ????????????? ?????????????????????1????????????????????WUDFCoinstaller.dll??E??????? ????????????????????????"?????X???]???????????????????????????????????????????????????? ??????????????????????????????>??????icl??Sterownik karty Microsoft 6to4??z???? ???????i?????ft???v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=17|LPort=3702|RA4=LocalSubnet|RA6=LocalSubnet|App=%systemroot%\system32\svchost.exe|Svc=PeerDistSvc|Name=@peerdistsh.dll,-10002|Desc=@peerdistsh.dll,-11002|EmbedCtxt=@peerdistsh.dll,-9001|????v2.10|Action=Allow|Active=FALSE|Dir=Out|Protocol=17|RPort=3702|RA4=LocalSubnet|RA6=LocalSubnet|App=%systemroot%\system32\svchost.exe|Svc=PeerDistSvc|Name=@peerdistsh.dll,-10003|Desc=@peerdistsh.dll,-11003|EmbedCtxt=@peerdistsh.dll,-9001|????&???????3???????????????????????&???????8???????????????????7??????????????????????system32\drivers\Wdf01000.sys????????????S??? ???????@????????????????????$?N???????????Packets Accumulation Timeout [usec]?????????????????????dword???? ??????????????????????????????F??
Reg    HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{3181D7EC-C157-40EF-9876-5A43BEA897F2}@InterfaceName                      isatap.{087ED305-0D74-4EEC-A414-925E6D825C4A}
Reg    HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{3181D7EC-C157-40EF-9876-5A43BEA897F2}@ReusableType                       0
Reg    HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Bind                                                                            ??????????N????????????????n?????????????????????????????????????????????????????@???????????@??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????1025&REV_C0\4&37F4157A&0&00E5???????????*?sw\{????????????????0000???????????v??????????????????????????t????????????????????????????1??????????? ???????c??????????6.1.7600.16385???????????????u?????????????????? ????????????????h????`?????????????????????????????????????nettun.inf???h??? P??????n?????ft%???????????????p???e???????????1??????????*6to4mp?6???????? ???????_??????????Sterownik karty Microsoft 6to4??????? "?????????????????????????????????Typ?????{8013F67A-5921-47C9-B371-BEAB578B27B9}???4??????????????????????? ??????????? ??????????????????????????????????????????? P???????????????????????????????????????$???????????????????>?????????????? ???????4?????84????????????u??????????????????? ?????????????
Reg    HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Route                                                                           ????????????????? ???????????????????A?,????????????????? ??? ???????????????????U?,??????????????#???????$??????f???????P??????????????????????Root\*6TO4MP\0038???????????#???? ???????T?????T?????B?,????????z???g????????????????????????????????????????????????????}??Root\*6TO4MP\0033?????$??????5??????????Root\*6TO4MP\0035???????????????????????????#???? ???????????????????T?,??????????????#385??Root\*6TO4MP\0034???Root\*6TO4MP\0036???Root\*6TO4MP\0037?????$??????5???????F??Root\*6TO4MP\0040?????????????????????$??????????e??????????????????? ???????T???????????T?,????????z???g????????????????????????????????????????????????????}???????????3??????FF????$???????????????????????????????????????$??????5???????9??????????? ???????????????????T?,????????????????????? ??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????#???? ???????T???????????T?,????????z???g????????????????????????????????????????????????????}??Root\*6TO4MP\0041??
Reg    HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Export                                                                          ????????????????????????? ????????????????????????????????N??????}???????~???????????_???????????????????u????????$??????n???????????????'???????????????h??????????COM8????? ??????????????????????????? ???{???F??????08???????B???????????? ???????????????????????????????????????$??????M???????t???????u??????????????????int?????? ???????3?????0?????????????8?????e-F??nettun.inf??????????????? ????????????????????????????(? ?????????????s?????? ??????????????d????????????0??__??????????????????????????????????????????????????????????????? ?????????????????????-??????$????????F????????????????????????????????????????????????????????????????????? ???????????????????????????????????????f??????????????? ?????????????????????1??L????????? ???????? ??????????????????????? ?????????????????????1????????????&???????????????????????? ?????????????????????1????????????????????? ?????????????????????1????????>?????????????>?????????????usbcdcacm_6&2c654e28&0&0002_00??????????????????????????????????????? ?????????????????
Reg    HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Bind                                                                       ????ic??int?????? ??????????????????????????????`????????e??????????????? P??????A?????08-??{5E3530D5-7CA6-4474-8DCD-5EC6ADB98FBD}??{4????????*??????1????d4-4??TCPIP6TUNNEL?Tcpip6??b????????????`??????E???0??\Device\{5E3530D5-7CA6-4474-8DCD-5EC6ADB98FBD}??DE??????????????????l???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????MSAFD NetBIOS [\Device\NetBT_Tcpip6_{932A074E-9166-4F4A-B370-5ADC7D0EAA90}] SEQPACKET 186???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????l???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????MSAFD NetBIOS [\Device\NetBT_Tcpip6_{932A074E-9166-4F4A-B370-5ADC7D0EAA90}] DATAGRAM 186???????????????????????????????????????
Reg    HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Route                                                                      ????????? ?????? ??????????????????????? ???????o????? ??a???????e??? ????????????????????N??????????????a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a?a????? ????????????????????????"???????????????????????N????????g????? ???????a???????????a?,?????? ?:???&?????????????????????????:?????????????????LocalSystemNetworkRestricted??????8??????8??????????%windir%\system32\DFDTS.dll?????? ???????a?????????????,??"?????????&????????????????????P??? ?????????????????????,??????????????????????s?????? ?????????????????????,????????N??????1????{5C85A128-86F7-41a4-B655-BEE3F2ADEF46}??????? ?????????????????????,??P???P??????????????n???(??????????????????????????????????????????????? ???????????????????a?,????????????(????????????????????????????????6??l-???????a??? ??????{fce3a9de-15fb-11e3-aa9e-60eb6935bab0}??????????????????????????????? ???????b?????????????.????????*???&????????????????????}?????????
Reg    HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Export                                                                     ????????Po??czenie lokalne* 26??????{00000000-0000-0000-FFFF-FFFFFFFFFFFF}?F&???? ???????1?????????????,????????$???<???????????????????????????????D2??? ?????????????????????,????????z?????#tap????$??????F???????5??Root\*6TO4MP\0016?????N??????3????DDEE??6to4mp.ndi???????????????????_??????????????? ???????@????????????????????$?N? ?????????? ?????????????????????1????????*???????????? ?????????????????????1????????????????????? ?????????????????????1????????????????????? ?????????????????????1??????????????????????????????????????z?????????????? ?????????????????????1?????????????????????????????f???????????????-??????? ?????????????????????1????????????????????? ?????????????????????1?????????????????????????????????f???????????t??????????????? ?????????????????????1????????????????????? ?????????????????????1?????????????????????????????f???f???????????f???f??????????? ?????????????????????1????????????????????????????????????????????????????????????3-E9D5??? ?????????????????????1???????????????????????
Reg    HKLM\SYSTEM\CurrentControlSet\services\NetBIOS\Linkage@Bind                                                                                 ?????????????????|???e??????????????????????????????????????????????????AT??? l?????? ????? Mi???????????????\?????e?\???????k????????????????????m???????????????N????????????D????nettun.inf?P?????????????????????f???????????1??????4m??????????????????????????4???\\?\Root#*6TO4MP#0067#{cac88484-7515-4c03-82e6-71a87abac361}?4??? ???????1?????????????,??N?????$?E?<???????????????????????????????????? ?????????????????????,????????????'????????????????????}??Root\*6TO4MP\0067????????????8??????C-??\\?\Root#*6TO4MP#0067#{ad498944-762f-11d0-8dcb-00c04fc3358c}\{F7593A92-D4E0-45A5-A01E-C6AFA39FCC51}?????? ???????:?????????????:????????????&???????????????????????? ?????????????????????????????????e????? ?????????????????????1????????????????????? ?????????????????????1????????????????????? ?????????????????????1????????????&????????????????????0??? ?????????????????????1????????????????????{00000000-0000-0000-FFFF-FFFFFFFFFFFF}??????? ???????1?????????????,????????$?D?<???????????????????????????????D ??? ?????????
Reg    HKLM\SYSTEM\CurrentControlSet\services\NetBIOS\Linkage@Route                                                                                ????13??6.1.7600.16778??????????????????????????????????????????????x????????????E???e??? "?????????????????d????????????????? ???????????????????????????????????????????????????????????????????*?????????????????? ?????????????????????1????????????????????? ?????????????????????1????????????????????????????????????????????????????? ??????????????????6.1.7600.16385??????Karta Microsoft 6to4??????`?????????????? ?????????????????????1?????????????????????????????e??ol??????????? ???????Z?????????????1????????????&????????????????????t??? ?????????????????????1?????????????????????????????F??9D??6.1.7600.16385????????:?????????????@nettun.inf,%msft%;Microsoft????? ???*??Ty??????????????????????????? ?????????????????????1????????????????????? ?????????????????????1????????????????????????????????????????????????????*6to4mp?????? ?????????????????????1????????????????????? ?????????????????????1????????????????????????????????????? ??????????????????????? ?????????????????????1????????????&??????????????????????
Reg    HKLM\SYSTEM\CurrentControlSet\services\NetBIOS\Linkage@Export                                                                               ??????????????????????????????????????????N??????}?????Dce??????????*6to4mp?el????>??????????????????????_??????????d?????$??????????????????????????????e??????????????5???\Device\{2F388B2C-98FB-4710-9376-9B42E6688ECC}??E9????????????????????$?????????????????Root\*6TO4MP\0238????????????y???e???e??????\n??Adres sieciowy??Tc??? ????????????????????????"?????l? ?????????Po??czenie lokalne* 18??55??11??????? ?????????????????????1????????????????????????????????????????? ?????????????????????1????????????????????????????????????????? ?????????????????????1????????????????????????????????????????????? ??tB??Microsoft????????????p???????4??????06????????????????????*?????????????????? ?????????????????????1????????????????????? ?????????????????????1????????????????????????????????????????????????????????????????????? ??????????????n???????????????????? ?????????????t?????p??????????>???????????? ?????????????o?????????????????????????R??? ???????????????????m???????????????????????8??? ???????????????????n?????
Reg    HKLM\SYSTEM\CurrentControlSet\services\NetBT\Linkage@Bind                                                                                   ????????????????????? ?????????????????????1????????????????????????????????????????????????????????????????????????? ?????????????????????1????????????????????????????????????13???7??? ???????z?????????????1????????????????????? ?????????????????????1????????????????????? ???????@????????????????????$?N????????????????????l?????????iec?????????????????? ?????$?????? ??????????ROOT\*6TO4MP\0140????????????????????????????????????????????????????????????????????????????????S??????????????????????????????nettun.inf?6B-??? ??????????????????6to4mp.ndi??????? ???????????????????????????????????????8??????C5??????????????????? ????????????N?????????????????????????{8DAB51BD-A288-43BA-A878-FE4FB39ADC4E}??????????????????????????????48??????os??t???? ???????????????????????????D??????????????????????WpdBusEnumRoot\UMB\2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GPLUS&PROD_GPLUS_MASS_STROA&REV_GE01#20110919&1#?????????????????????????\\?\WpdBusEnumRoot#UMB#2&37c186b&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GPLUS&PR
Reg    HKLM\SYSTEM\CurrentControlSet\services\NetBT\Linkage@Route                                                                                  ????????????????????? ?????????????????????1????????????????????????????? ?????????????????????1????????????????????????????????????????????????????????????? ?????????????????????1????????????&???????????????????????? ?????????????????????1????????????????????? ?????????????????????1?????????????????????????????????????B??6E???????????5??6F??? ???????? ????????????1????????????&????????????????????A?????????????????s????? ?????????????????????1????????????????????????????? ?????????????????????1?????????????????????????????????????B??0E???????????A??A3??? ?????????????????????1????????????&????????????????????{??? ?????????????????????1????????????????????????????? ?????????????????????1?????????????????????????????????????9??}"???????????-??A9??\\?\STORAGE#Volume#_??_USBSTOR#Disk&Ven_GPLUS&Prod_GPLUS_MASS_STROA&Rev_GE01#20110919&1#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}????????????5???5??????????3C???????????2??????STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GPLUS&PROD_GPLUS_MA
Reg    HKLM\SYSTEM\CurrentControlSet\services\NetBT\Linkage@Export                                                                                 ????????????????????????????int?el???n??tunnel??????????????????????Microsoft????????e????????????????????????N??????????????????????????u???????????t??? ???????????????????????????????????????5??? ?????????????????????1????????????????????????????????????????6.1.7600.16385?o4m??????????????????text????? ????????????????????????"?????l?X?????????? ????????????????????????"?????l?Y?????C0???????????1??????}????????????t?????e????????? ????????????????????????????????????????????s?????? ??V???????????x???? ???????????????????????????????????????f??? ?????????????????????1??L????????? ??????6F5????????????????u!??????*???????????d?????? ??????????????????usbstor.inf??????f?f?f?f?????g??????????????13??6.1.7600.16778??????????????????????????????????????????????x????????????E???e??? "?????????????????d????????????????? ???????????????????????????????????????????????????????????????????*?????????????????? ?????????????????????1????????????????????? ?????????????????????1???????????????????????????????????????????
Reg    HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch                                                                            4226
Reg    HKLM\SYSTEM\CurrentControlSet\services\Smb\Linkage@Bind                                                                                     ?????????????????????????????????????????????D??????{5????N??????4????D36?????N??????c???????????????????????????????????????????l??????????d???????????????????????????????????6to4mp.ndi??????.NT?????\Device\{0CF53DA9-67C7-4AD3-8BD3-005BCBDE11E3}???????????????????????\???????????????????s???????????????????????????????e??????????????s?????????????????????????????*??????2?????18}??oem17.inf???????????????????????????d????????????;???;??TCPIP6TUNNEL?Tcpip6?????????????????????? ?????????????????????1????????????????????tunnel??????? ???????@????????????????????$?N???????????6to4mp.ndi?unn???????????????????????????????????????????????????????????????????_??????????????????ROOT\*6TO4MP\0141?????`?????????????????:*??????????????? ???????????????????????????????????????????????????e???????????_??????????? *??????????????????????????????????????????1????????????>??????e??????????????? ???????1??????????????el???????????????????????????????????????????????????????f??????????????????????????? ????*??????2?????18}?
Reg    HKLM\SYSTEM\CurrentControlSet\services\Smb\Linkage@Route                                                                                    ????????? ??????? ??????tD??nettun.inf???d??? ???????n???????????????????????????????????????????????c??????????????????Microsoft???????-2????????????4?????????????????????????????Typ?????? "??????f??????????? ??????????????????? ???????_??????? ????????????`?????????????????????? j?????????????????USB??????????????p???e??? ???????l??????????USB\VID_04E8&PID_681D\5700f09176da??????????????????? ???????8?????10A??????cp????????:?????????????????????????????????*isatap?????? P?????????????MS???????????}??????? ??????????????????ip??11??????????????????????????????l???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????MSAFD NetBIOS [\Device\NetBT_Tcpip6_{0A127593-716B-4A73-A82B-4298FD121A08}] SEQPACKET 72????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????MSAFD NetBIOS [\Device\
Reg    HKLM\SYSTEM\CurrentControlSet\services\Smb\Linkage@Export                                                                                   ?????????????????????????????????F??nettun.inf???????????????1??????? ??y????}??????????Microsoft???????????????j????a??????????ndis5_ip6_tunnel??????????????$??????k???????????????????f?g?????????????????????????????????e??????3-??????????*6to4mp?1C??oem19.inf????i?i???v??????????????????????????????????*??????o???????????????????N??????????????????????????9.??f????????????2???????????????????????e???????????????????????????B??????????????????? ???????1?????????????,????????$?R?<???????????????????????????????????? ?????????????????????,????????z?????????????z?????????????????\\?\Root#*6TO4MP#0080#{cac88484-7515-4c03-82e6-71a87abac361}????? ???????1?????????????,??N?????$?R?<???????????????????????????????????? ?????????????????????,????????????'?????????????????????????$?????????????????Root\*6TO4MP\0080???????????????????????\\?\Root#*6TO4MP#0080#{ad498944-762f-11d0-8dcb-00c04fc3358c}\{EA086DDC-8058-4951-9418-4C668B5B0533}?????? ???????:?????????????:????????????&???????????????????????? ?????????????????
Reg    HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Linkage@Bind                                                                                  ?????-???? ??????????????????????4??????????????????????????????????????????????????text????nettun.inf??????? ???????|???????????l?:??????????{?&???????????????????????????????????????????????????????????????MSAFD NetBIOS [\Device\NetBT_Tcpip6_{E53CB97B-536F-4CA9-A69A-9635AE9263D7}] SEQPACKET 136?????????????????????????????????????????m??????????????? ?????????????????????6-21-2006????????????m??5???? ?????????????????????1????????????????????? ?????????????????????1????????????????????????????????????? ?????????????????????1????????????&???????????????????????????????????? ?????????????????????1????????????????????????????? ?????????????????????1????????z?????????????????????????????????????z?????????????nettun.inf:Microsoft.NTx86:6to4mp.ndi:6.1.7600.16385:*6to4mp?*??????????????????tunnel??tu??? *?????? ??????????????????????????????????????????netfxperf.dll???????-E???????????s??t???????????????????????E5??????????????????????????????? ???????Z???????????l?9?????? ?N?????????????8?????????????????????ndi
Reg    HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Linkage@Route                                                                                 ?????????????????????????????e???????????n??????????????????????????6to4mp.ndi????????:??????}?g????????????????????????@nettun.inf,%6to4mp.displayname%;Karta Microsoft 6to4???{00000000-0000-0000-FFFF-FFFFFFFFFFFF}??????? l?????????????????? l??????f?????oso??@nettun.inf,%6to4mp.displayname%;Karta Microsoft 6to4???{4d36e972-e325-11ce-bfc1-08002be10318}\0246?ED??@nettun.inf,%6to4mp.displayname%;Karta Microsoft 6to4???{00000000-0000-0000-FFFF-FFFFFFFFFFFF}??17??{4d36e972-e325-11ce-bfc1-08002be10318}?tBT??Karta Microsoft 6to4 #215????????????????h????N???????????????????h???????????????N????????????D????Microsoft????g?j????????????????????????????????$???4????? ??????? ??????????????????????????????????????????????????????? ??????????? ??????????? ??????????????????????????????????????????????????????????????????*?*???????????????????????*???? ???????H??????????????????????????? ???????????????????0????*??????????3???0??*????{00000000-0000-0000-FFFF-FFFFFFFFFFFF}????????????????????????????????????????N????????
Reg    HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Linkage@Export                                                                                ?????6??*6to4mp??????????????????????????????????????????????t????????N??????8?????D-8??????????????????????????? ???????????????????????????????????&???????E???????????????????F???????????????????????????????????m???l???$???????l??????????????????????HidUsb???????????????????????6??s???*6to4mp?????????????????????????????????????????@volume.inf,%msft%;Microsoft????????6to4mp.ndi??13???????????t????????????$???????????????????v?????????????? ??????????????????????????USBAAPL.Dev??m????N????????????D???????????????????s????????????????????? ??????????????s???????????Typ?????? ???????4?????f-1??????????Net?????????text????ew_usbenumfilter????????????USB?????tunnel??????? x??????"??????????@usbport.inf,%usb\root_hub.devicedesc%;G??wny koncentrator USB????????N????????????D???????????????????????????e?????????????????????????????????????????l??tunnel?01????????????f??????@volsnap.inf,%storage\volumesnapshot.devicedesc%;Rodzajowa kopia w tle wolumin?w????@volsnap.inf,%storage\volumesnapshot.devicedesc%;Rodzajowa 
Reg    HKLM\SYSTEM\ControlSet002\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{6B683E0E-1505-488C-8053-3C1301924246}\Linkage@Bind        ???;?y??11??6-?????????????????????????????????????????????S??????*??z???????????????f?g?f????"??7??????????????????????GenCdRom???????????????????????????????????????????????? ????}??????? ???????????????;???f?f?f???U?~?U????????????????????????????????????????????????????e??????B?B?B??????????????????Microsoft????????????D?????s81???????????????????????????? ??<??????s???????????????????????????????????????????? ????????????????????????$????????? ???????e???????????????mnmsrvc????????A????? ????????????????????????????L?????????????????%ProgramData%\Microsoft\Windows\WER\* /s??????h?????????????????%systemroot%\Minidump\* /s?%systemroot%\memory.dmp??????????????????????????\hiberfil.sys????????&J?????????????????????????????C:\Windows\System32\MSDTC\MSDTC.Log???????L????????A????%windir%\softwaredistribution\*.* /s??????6?????????????%SystemRoot%\netlogon.chg???????%TEMP%\* /s?????? x?????????????r???\System Volume Information\MountPointManagerRemoteDatabase??????????????????????????\Pagefile.sys??????????
Reg    HKLM\SYSTEM\ControlSet002\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{6B683E0E-1505-488C-8053-3C1301924246}\Linkage@Route       ???U?????????P???????P??????????? ??????????????????????????atapi????U???????????????????????????????????U??????????? ??????? ??????????????g???????????????????????????????????????????????????????????????????g???????????????????????e????????????????????????;??????????????????????????????????hdc??????????????????????????U???????????U???????U???????????t???????U???????????????U??System??????? ?????????????U??????????&??????????????????s?????U?????U???????????????????U???????????????????U????????????????"??U??????????????Root\SYSTEM\0000?????U??? ???????U?????U???????????????????????????????2????? ???????U?????U???????????????????? ???????s??????U????? ???????U???????????U????????????????*???????????????????e??????U?????U*???? ?????????????U???????????????????????????s????? ???????U?????U?????;?,??(???0?n??????????e??????n??U??????????????d???C:\Windows\System32\WDI\LogFiles\WdiContextLog.etl.001?t%\??AUO22EC0_01_07D9_C0??????U?????U????? ???????U???????????U?,??????@?`??????????????????????????????????????????
Reg    HKLM\SYSTEM\ControlSet002\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{6B683E0E-1505-488C-8053-3C1301924246}\Linkage@Export      ???@?y????????????????????????<??@???????????????????????1??????????ROOT\MS_AGILEVPNMINIPORT\0000????????????????????????1??????Ndi-Mp-AgileVpn??????????@??????????????6.1.7600.16385????????(??????????????????????@??????????????2800????? ????????????????????N??@???1??????????NdisWan?????{E28D896F-9EA8-433A-9C10-66C97C19A921}????????????$??1??NdisWan?????????????????????????????????????????????????? P??@??????????????? ???@??????????n???? (??@??????????????WAN Miniport (SSTP)?????Microsoft???6.1.7600.16385???????? ?????????????????6-21-2006???? ???????@???????????@??????????`????????e??{E28D896F-9EA8-433A-9C10-66C97C19A921}???????????@????????d??????@?@?@????`??@???1???1??\Device\{E28D896F-9EA8-433A-9C10-66C97C19A921}???????@?@????? ???????@?????@?????@?????????????????i?????????@???????e??RasSstp????????@???@????? ???????@???????????@?????????????? ???????????? ???@??????????????ndiscowan???? ???@??????????????nolower????????@????? ???????@?????@??????????????0?N????????????? ??@???1?????d?1???@?????????????
Reg    HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Bind                                                                                ???l?s???????k??????s????????????????????????????d??????s???USB??????k???????????????}???????????D?????s\a????<??l?????g?????????i???????e???????????o??????al??? ???k???????????????????s???l?t?~???????????????????k???????{?????k?&???????k??????????storage\volume??????????????????????LegacyDriver?????i?k?k?k?k?k?k???????????????????????????k???????????????????????-?????l?????????????????t???????k???D??sE??? $??????????????????????n?????k?&??????????????????????????????LegacyDriver?????k??????????????{8ECC055D-047F-11D1-A537-0000F8753ED1}??????NDProxy?NO???i?k?k?k??????????P??t?????????e?????k?k?k????????????????????????X??????????l????X???????????????N??k???o????Dntr?????????????m???m???m???k?k????X??????4???3???k???????8??{533c5b84-ec70-11d2-9505-00c04f79deaf}?ci\???k??COM6?????k???????????????8???????????4???????T????X???????????????<??t????????h??????l?l?k??text????????????? ???????????????????????????????????????f???k???????m???a??in???m?m?8??? ???????k?????k?????k???????????????????????O?????????????????
Reg    HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Route                                                                               ???s?s?????h????@system32\DRIVERS\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,28,0)?;(0,28,0)???????????????&??????????*6to4mp?????Net?????? ???????h?????h??????????(??????????????????????????h?h????? ???????h?????h???????-??4????????????????????????????h????? ???????h?????????????-?????????????????????y?????h????? ???????h???????????h????????"??????????????????h ??????????????f????????????????????????@???????????????????????????????D??????????????????????????????????????????????????????????????????????????????????h?h?????h??? ???????h?????h???????1??L????????? ??????ft-?????h???h???h????????? ???????h?????h???????1????????????&????????????????????b??? ???????h?????????????1????????????????????? ???????h?????????????1?????????????????????????????h??? ???????h?????????????1???????????????????????h???h???h???h????? ???????h?????????????1??????????????????????????????????????d??h???????????h???h???????????????????????v?????sme????N???????????D?????????or??? ??????????????x???? ???????i???????.???????d?
Reg    HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Export                                                                              ????????????????????????????%SystemRoot%\system32\srvsvc.dll?????????????????????t??????5???tunnel???????u?u?u??? ???????s???????????s????????,????? ???????????????????????????????????????d???????????????e????????s??????????????????KeyboardClass??????????????????????????????????????????????????????s????? ???????o?????s????????????????T???????????????????????t?????????????????????????????????????????P??s????????h?????\SystemRoot\system32\DRIVERS\kbdhid.sys??????? t?????t????(??s?????????e????Keyboard HID Driver??????????s??????p???Keyboard Port???LocalSystem??????????h????????????T??s???????????d??hidirkbd.inf_x86_neutral_b7b6ffb126da2654??????????????g?????t??? ?????????????????????? ????????????t??????????????? ???????s???????????s?????????????? ???????????? ???????o?????t?????t??????????@?????????????"??t?????????e????@keyiso.dll,-100??????@??t????????h?????%SystemRoot%\system32\lsass.exe???????"??t?????????n????@keyiso.dll,-101????? ???s??????????????????????????????????????????????t????????t?????????????
Reg    HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Bind                                                                           ???s????Extended base??????????????????????????????????????????e???????????????????????????????g?????????????????????????????B???????z??Pointer Class???????????tunnel?T_T??????s???????????? ???????o?????t?????t????????@?????????m?????$??t?????????e????@comres.dll,-2946????????t????????h?????%SystemRoot%\System32\svchost.exe -k NetworkServiceAndNoImpersonation?????$??t?????????n????@comres.dll,-2947???? 8??t??????????????NT AUTHORITY\NetworkService??????????????????????????????????????????????t?????????????? ????????????????t???????????e??RPCSS?SamSS???????,??t????????????????????????????????????2??t??????????????????SeChangeNotifyPrivilege?????? F??t???????????????t??? ???????????????????????????????????????????????????t?t?t?t?t?t?t?t?t?t?t?t????? ???????t???????????t????????,?F??? ???????????%systemroot%\system32\msdtckrm.dll????????"??t?????????n????KtmRmServiceMain????????????????????????????? ???????t???????????t??????????????????????????????0??????????????????????????????????????????????? ??????????????
Reg    HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Route                                                                          ???s?t???????u?????? ????????????????t???????????e??SamSS?Srv?????????,??t???????????????????????????????????????t??????????????????SeChangeNotifyPrivilege?SeImpersonatePrivilege?SeAuditPrivilege?SeLoadDriverPrivilege????????t?t?t?t?t?t?t?t?t?t?t??????????????????????????? ???????u???????????t?????????????? ?????????????????????????y?????? ???????o?????t?????t??????????R???????????????????????t??????????????????????t??????????????????????????P??t????????h?????\SystemRoot\system32\DRIVERS\parvdm.sys?????RpcSs????????????t??????p???Extended Base????????t???????????e??Parport??&???????????,???,??? *??t??????????p???Parallel arbitrator???????R??t???????????d??msports.inf_x86_neutral_c1a802e06677f73f?????t?t?t?t?t?t?t?t????? ???????t?????????????????????????? ???????????? ???????o?????u?????u????????$???????????????J??t?????????e????@%SystemRoot%\system32\pcasvc.dll,-1?????????????????????????????t????????h?????%systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted????u?u?u???t?????? ?????????????J??t?
Reg    HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Export                                                                         ???t????????????????????????????????????t?????\??t?????????n????Net??????????????????????d?????????V2A??Net??????????f??????????????????????????Net??????????????????????v????(??t??????p????????????????????????t???????t???????t??????????????t???@%systemroot%\system32\drivers\luafv.sys,-100?????6??t????????h??????????????????????e??System Bus Extender?????Typ???????????????????????????????????<??t??????????????\SystemRoot\system32\drivers\luafv.sys??????@%systemroot%\system32\drivers\luafv.sys,-101???system32\drivers\modem.sys??????????????????t????????????t????,????????????e????y????????????z?z????????????????????????????????t????????31??????????????}??tunnel???}????\??t?????????n?????t?t?t?t?t?t?t????????????b??t?????????e?????????????????????????????????????t??system32\DRIVERS\mouclass.sys?ouclass.sys???@%SystemRoot%\system32\drivers\mountmgr.sys,-100????????????????t??????????????????????????????g??????????????????????m??????}??????????????????????System32\drivers\mountmgr.sys????????????p???u?????????????
Reg    HKLM\SYSTEM\ControlSet002\services\NetBIOS\Linkage@Bind                                                                                     ???n?n??????ee??ee??11??10???m???????????j???????????????j??????????????????????????????????????????????????? ???????n???????????????????????????????f??? ???????n?????n???????1??L????????? ??????? ???? ???????n?????n???????1????????????&???????????????????????? ???????n?????n???????1????????????????????? ???????n???????????n?1?????????????????????????n???????5???n??????????????volsnap.inf:MSFT.NTx86:volume_snapshot_install:6.1.7600.16385:storage\volumesnapshot?????n?n?f?????n????? ???????n?????n???????1?????????????????????n?n????????? ???????n???????????n?1?????????????????????????????5???????????n???5???????n?n???????n????? ???????n?????n???????1???????????????????????n???n???n?????n??? ???????n???????????n?1?????????????????????????????H??.D???????n???.??38?????????????n????? ???????n?????n???????1????????????&???????????????????? ?????n???n????? ???????n?????n???????1????????????????????? ???????n???????????n?1?????????????????????????????????????????n???????????????????n?n???????n????? ???????n?????n???
Reg    HKLM\SYSTEM\ControlSet002\services\NetBIOS\Linkage@Route                                                                                    ????????USB?????MSTEE???HIDClass??????N???????????D?????{4d36e96c-e325-11ce-bfc1-08002be10318}????????X?????????????{4d36e96c-e325-11ce-bfc1-08002be10318}\0004??????????l???????e???????k??????s?????>????????g????vwifimp?06??????????????????OM?2B9??B9????????????????????????????????????r?????????????????????????????????????????????ksfilter.inf????????????????????? V?????????????????SW\{ddf4358e-bb2c-11d0-a42f-00a0c9223196}?????????N????????????D??????X?????????????????????????????????? ???????????????????????????????????????f??? ?????????????????????1??L????????? ???????????????????????? ?????????????????????1????????????&???????????????????????? ?????????????????????1????????????????????????????? ?????????????????????1????????????????????ksfilter.inf:Microsoft.NTx86:MSTEE:6.1.7600.16385:sw\{cfd669f1-9bc2-11d0-8299-0000f822fe8a}?????????????????????????????????????????????????????? ?????????????????????1????????????????????????????????? ?????????????????????1???????????????????????????????????????????????????
Reg    HKLM\SYSTEM\ControlSet002\services\NetBIOS\Linkage@Export                                                                                   ????ll??????????????????06??????ll???????????????????????????????????l???\??sO??????????????????ll????????????????????????????????????????????????????????????????????????????????????z?????????????????? ????????????????????????"?????l???????????{00000000-0000-0000-FFFF-FFFFFFFFFFFF}??????? l??????-??????????*6to4mp??e??*6to4mp?????*6to4mp?????????????????????????????????????????????????????????????????????tunnel?455??*6to4mp??????????????6??4m??????????????????????????????????????????\Device\NetBIOS_NetBT_Tcpip_{087ED305-0D74-4EEC-A414-925E6D825C4A}?\Device\NetBIOS_NetBT_Tcpip_{2676B820-5F12-42CE-AB19-EDCA35572F13}?\Device\NetBIOS_NetBT_Tcpip_{D1A19B67-31A4-452A-851C-2E00A4EA132E}?\Device\NetBIOS_NetBT_Tcpip_{68EB6D5C-A0D6-466F-BC39-C3D8D2C52990}?\Device\NetBIOS_NetBT_Tcpip_{E92EE340-FE77-451D-84E1-AAB3D90810AA}?\Device\NetBIOS_NetBT_Tcpip_{18E61A03-F008-4FFB-8A7E-F0CE2D9B31C8}?\Device\NetBIOS_NetBT_Tcpip_{4881D4F7-FD3F-4515-8D24-4B890FDA76AC}?\Device\NetBIOS_NetBT_Tcpip_{82DF742C-C5E5-40A6-9740-C0BD974AF484}
Reg    HKLM\SYSTEM\ControlSet002\services\NetBT\Linkage@Bind                                                                                       ???i?u??@system32\DRIVERS\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,28,3)?;(0,28,3)??????? ??????????????????*6to4mp??????????i???e???e??tunnel???????????l??????p???{4d36e97d-e325-11ce-bfc1-08002be10318}??????? B??i?????????4????*6to4mp???????N??????????????????????h???i??s???Modem????????????????`??????s???Base????*6to4mp???????N??????e???????e????????????????????P??u?????????e???????h????{4d36e97d-e325-11ce-bfc1-08002be10318}??????Wdf01000????NDIS?:??? ??????????????????KSecDD???????????j?????????????????????????h???????h????{00000000-0000-0000-ffff-ffffffffffff}?-A5??Net??????????????_??BB???????????4??t-??t-??? ???????h?????h??????????(???????????????????s??/??? ???????h?????h???????-??4?????????????????????????? ???????h?????????????-?????????????????????y??? ???????h???????????h????????"??????????f???????h ???????????r???????????|???????????????@???????????????????????????????D?????????????????????????????????????????????????????????????????????????????-0???i?i????????? ???????h?????h???????
Reg    HKLM\SYSTEM\ControlSet002\services\NetBT\Linkage@Route                                                                                      ????f5??? ?????????????????????1?????????????????????????i???r??ri??????????????????? ?????????????????????1????????????????????? ???????????????????k?1????????????????????????????????????QportInstall00??????????????? ?????????????????????1????????????????????? ???????????????????l?1????????????????????????????????0B???????l??????????????????? ?????????????????????1????????????????????? ???????????????????l?1????????,?????????????????????????????,?????????????usb\vid_12d1&pid_14fe???????????? ?????????????????????1??????????????????????(?????????????????????????????oem8.inf:QcomSerialPort:QportInstall00:1.0.1.4:usb\vid_12d1&pid_14fe?c??? ?????????????????????1????????????????????? ???????????????????i?1??????????????????????????????????sft%???????????????????????????e??? ?????????????????????1????????????????????? ???????????????????i?1????????????????????? ???????? ????????????1????????????&????????????????????S??????????????? ?????????????????????????????????? ???????????????????? ?????????????????????????
Reg    HKLM\SYSTEM\ControlSet002\services\NetBT\Linkage@Export                                                                                     ?????u??????????Net?eE????????????N??????E????D}?\????????????N????????????? ???????????????????????????Net?????? "??????c?????l??????X??????p???t???????????B????0??????????t??6.1.7600.16385?TO4??@%systemroot%\system32\DRIVERS\RDPCDD.sys,-100???????????????0???????????B???&???????u???????????????????d??tunnel??????????????????????????????vi??????????????????????????????????sK????.Po??czenie lokalne* 123??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????2Karta Microsoft 6to4 #113?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
Reg    HKLM\SYSTEM\ControlSet002\services\Smb\Linkage@Bind                                                                                         ???j???????????????????????i????? ???????i?????i???????1???????????????????????i???i???i???i???i???i???i???i???i????????????? ???????i???????????h?1????????????????????srv2???????i????? ???????i?????i???????1????????????????????? ???????i???????????h?1????????????????????tunnel??????Modem????????k???,???????????????????????/?????i????? ???????h?????i???????1????????????&??????????????????????????h???h???i???i???i????????????? ???????i?????????????1???????????????????????i????? ???????h?????i????????????????????(???????????????????????? ???????i?????i?? ???????"???&?????????????????@machine.inf,%pci\ven_8086&dev_2448.devicedesc%;Mostek (bridge) Intel(R) 82801 PCI - 2448???@system32\DRIVERS\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,30,0)?;(0,30,0)??????*6to4mp??D??tunnel?d0-???i??????????????PCI\VEN_8086&DEV_2448&SUBSYS_049B1025&REV_93?PCI\VEN_8086&DEV_2448&SUBSYS_049B1025?PCI\VEN_8086&DEV_2448&CC_060401?PCI\VEN_8086&DEV_2448&CC_0604????PCI\VEN_8086&DEV_2448&REV_93?PCI\VEN_8086&DEV_2448?PCI\VEN_8086
Reg    HKLM\SYSTEM\ControlSet002\services\Smb\Linkage@Route                                                                                        ???t?t???????t???t???s?s?s?s?s??????????????????????????????%SystemRoot%\system32\srvsvc.dll?????????????????????t??????5???tunnel???????u?u?u??? ???????s???????????s????????,????? ???????????????????????????????????????d???????????????e????????s??????????????????KeyboardClass??????????????????????????????????????????????????????s????? ???????o?????s????????????????T???????????????????????t?????????????????????????????????????????P??s????????h?????\SystemRoot\system32\DRIVERS\kbdhid.sys??????? t?????t????(??s?????????e????Keyboard HID Driver??????????s??????p???Keyboard Port???LocalSystem??????????h????????????T??s???????????d??hidirkbd.inf_x86_neutral_b7b6ffb126da2654??????????????g?????t??? ?????????????????????? ????????????t??????????????? ???????s???????????s?????????????? ???????????? ???????o?????t?????t??????????@?????????????"??t?????????e????@keyiso.dll,-100??????@??t????????h?????%SystemRoot%\system32\lsass.exe???????"??t?????????n????@keyiso.dll,-101????? ???s?????????????????????????????????????
Reg    HKLM\SYSTEM\ControlSet002\services\Smb\Linkage@Export                                                                                       ???u?u???????:??????????????el???????u??????????????*6to4mp??????????????B??????????????????Microsoft???@%SystemRoot%\system32\drivers\partmgr.sys,-101??????u??text????@%SystemRoot%\system32\drivers\partmgr.sys,-100??????????????????e??????????????????*6to4mp?e???????????????6-21-2006????????????0??????????????????????????????? ???????u?????u?????n?????????????? ???????????????????????t??????u???u????? ???????u???????????u????????"?F????????k??? F??u??????????e???%SystemRoot%\System32\wshnetbs.dll????????????????????????h???????????????????????h??????? ??u???????g???????????????????????u?u?u?u????? ???????o?????u???????9????????X???????T???C:\ProgramData\Microsoft\MF?????IntcHdmi.sys??????????????????????????R??????????????d?????????????u????????????System32\DRIVERS\netbt.sys???????????????????????????{??????????????????????????t????????????????????:???????????????????????????????????????????????????????????????????????B???????????????????7??????????????????????????????????????????????????????? ???????u?????
Reg    HKLM\SYSTEM\ControlSet002\services\TCPIP6\Linkage@Bind                                                                                      ???k?n????N??l???????????????????????????????p???????????????????o??rdbss???????????????disk????????????? ???????????????????4??? ??ms_ndiswanip?????????k???????????f?k?k?k?k???k???????}?????????????????s????????????????????????????????????????????????????????????????????????????????volume.inf:MSFT.NTx86:volume_install:6.1.7600.17122:storage\volume???????????k??????s????l???l?????????????????s?4???????????8?????sag???????????????s??????p????????????????k???-??25???k???????t???????s??LegacyDriver?????????????????|??????????Volume???????????????????????????????????????????????????????????l??????sa??????????????????????????????????????????volsnap??????????????????????????????????????k??????????????????????????System?B-D??????????? Z??????n?????ora???f?j?k?k?k`??k???????k??????????LegacyDriver?????????????????????????????????????0??00??Typ??????????????????????????????k??????????????? ???????k?????k?????k????????????&? ???????O???????????????????????? ???????k???????????k??????????`???????????? ???????k?????k???
Reg    HKLM\SYSTEM\ControlSet002\services\TCPIP6\Linkage@Route                                                                                     ???v?????????????????????i?i?o?u?u?u?u?v?u????<??v????????h??????????v??????e????v??????????????t????????{???????v???v??????????????????????????PlugPlay???????v????? ???????o?????????????,????????P????????p??@%systemroot%\system32\drivers\RDPENCDD.sys,-100????@%systemroot%\system32\drivers\RdpRefMp.sys,-101?????????????????????????????{??WmiCollectPerfData??????text?????????????v??????????????????????p????}???v???????????v???????????????e??????????????? ???????o???????????v??????????P???????s??????????????g??????X??????}???t??tunnel??????????????????????????t?????`??????f??????*6to4mp??????????????????????????????????????????????????#???#??Extended Base????????????????????????????????????????????????????`??????s???tunnel??????system32\DRIVERS\rspndr.sys??????????????????d???????????B???????????????????????v??? ???????o??????????????????????X???????????@%systemroot%\system32\srvsvc.dll,-102??????????????????????WmiClosePerfData?????"??????????????????????????????????P?????????????N??v?????????n????system32\DR
Reg    HKLM\SYSTEM\ControlSet002\services\TCPIP6\Linkage@Export                                                                                    ???v?????????????????????|???????????????}????R??w?????????e??????Z??w????????h??????????????????5???|???5????X??????????t???????????????v?????????????????????????????????????????????v????? ???????o?????v?????v?0????????J???????s?????J??v?????????e????@%SystemRoot%\system32\samsrv.dll,-1??????4??v??????p???MS_WindowsLocalValidation??????v??????@??v????????h?????%SystemRoot%\system32\lsass.exe???????J??v?????????n????@%SystemRoot%\system32\samsrv.dll,-2????RPCSS???????? ???v??????????????LocalSystem??????????????????????????????v??????????????????????t??????? ????????????v?v?v?v?v?v?v?v?v???????v???????????e??? ???????v???????????v?0????????????????????????????0????????????????`???????????????????? ????????????????????? ???????????????????? ???????o???????????u??????????T????????????v??????????????????????????t????????????????????v?v?v????????????????????????T??v????????h???????L??v???????????d??oem8.inf????PlugPlay????\SystemRoot\system32\DRIVERS\sbp2port.sys???sbp2.inf_x86_neutral_bb4d4cfbd699b95f?????\??v?

---- EOF - GMER 2.1 ----