All pastes #631477 Raw Edit

lol

public text v1 · immutable
#631477 ·published 2007-07-24 00:19 UTC
rendered paste body
RkUnhooker report generator v0.7
==============================================
Rootkit Unhooker kernel version: 3.7.300.502
==============================================
Windows Major Version: 5
Windows Minor Version: 1
Windows Build Number: 2600
==============================================
NtClose
Actual Address 0xB51B1AA0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtCreateKey
Actual Address 0xB51A4330
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtCreateProcess
Actual Address 0xB51B17D0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtCreateProcessEx
Actual Address 0xB51B1940
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtCreateSection
Actual Address 0xB51B23E0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtCreateSymbolicLinkObject
Actual Address 0xB51B2030
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtCreateThread
Actual Address 0xB51B2D00
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtDeleteKey
Actual Address 0xB51A4430
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtDeleteValueKey
Actual Address 0xB51A44B0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtDuplicateObject
Actual Address 0xB51B1C00
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtEnumerateKey
Actual Address 0xB51A4560
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtEnumerateValueKey
Actual Address 0xB51A4610
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtFlushKey
Actual Address 0xB51A46C0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtInitializeRegistry
Actual Address 0xB51A4740
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtLoadDriver
Actual Address 0xB51B0030
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtLoadKey
Actual Address 0xB51A5160
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtLoadKey2
Actual Address 0xB51A4760
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtNotifyChangeKey
Actual Address 0xB51A4840
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtOpenFile
Actual Address 0xBA4D9000
Hooked by: kl1.sys

NtOpenKey
Actual Address 0xB51A4920
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtOpenProcess
Actual Address 0xB51B15C0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtOpenSection
Actual Address 0xB51B2210
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtQueryKey
Actual Address 0xB51A4A00
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtQueryMultipleValueKey
Actual Address 0xB51A4AB0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtQuerySystemInformation
Actual Address 0xB51B29B0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtQueryValueKey
Actual Address 0xB51A4B60
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtReplaceKey
Actual Address 0xB51A4C40
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtRestoreKey
Actual Address 0xB51A4CD0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtResumeThread
Actual Address 0xB51B2CB0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtSaveKey
Actual Address 0xB51A4ED0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtSetContextThread
Actual Address 0xB51B3030
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtSetInformationFile
Actual Address 0xB51B3650
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtSetInformationKey
Actual Address 0xB51A4F60
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtSetSecurityObject
Actual Address 0xB51AEC50
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtSetValueKey
Actual Address 0xB51A5000
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtSuspendThread
Actual Address 0xB51B2C60
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtSystemDebugControl
Actual Address 0xB51B0390
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtTerminateProcess
Actual Address 0xB51B2800
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtUnloadKey
Actual Address 0xB51A5120
Hooked by: C:\WINDOWS\system32\drivers\klif.sys

NtWriteVirtualMemory
Actual Address 0xB51B1AC0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys


Actual Address 0xB51ADD60
Hooked by: C:\WINDOWS\system32\drivers\klif.sys


Actual Address 0xB51ADD70
Hooked by: C:\WINDOWS\system32\drivers\klif.sys


Actual Address 0xB51ADD80
Hooked by: C:\WINDOWS\system32\drivers\klif.sys


Actual Address 0xB51ADDA0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys


Actual Address 0xB51ADDC0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys


Actual Address 0xB51ADDF0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys


Actual Address 0xB51ADE00
Hooked by: C:\WINDOWS\system32\drivers\klif.sys


Actual Address 0xB51ADE20
Hooked by: C:\WINDOWS\system32\drivers\klif.sys


Actual Address 0xB51ADE30
Hooked by: C:\WINDOWS\system32\drivers\klif.sys


Actual Address 0xB51ADEF0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys


Actual Address 0xB51ADFC0
Hooked by: C:\WINDOWS\system32\drivers\klif.sys


Actual Address 0xB51AE000
Hooked by: C:\WINDOWS\system32\drivers\klif.sys


Actual Address 0xB51AE040
Hooked by: C:\WINDOWS\system32\drivers\klif.sys