[EP_X0FF]

Hello,

this could be problematic...
I will look on rku with jaws.

Regards.

[liangtong]

On Windows7 XP Mode,scanning stealth code failed.
Exception code : 0xC0000005
Instruction address : 0x0043D470
Attempt to read at address : 0x013A1007

[EP_X0FF]

Hello,

thanks for bugreport.

On Windows7 XP Mode,scanning stealth code failed.
Exception code : 0xC0000005
Instruction address : 0x0043D470
Attempt to read at address : 0x013A1007

When I will have appreciate software (Win7+XP mode) I will look :)

[wealllbe20]

Running On windows XP Sp3

Running Services:
Application Layer Gateway Service
Automatic Updates
Background Intelligent Transfer Service
COM+ Event System
Cryptographic Services
DCOM Server Process Launcher
DHCP Client
Distributed Link Tracking Client
DNS Client
Error Reporting Service
Event Log
HID Input Service
IPSEC Services
Java Quick Starter
Logical Disk Manager
Net Logon
Network Connections
Network Location Awareness (NLA)
Plug and Play
Print Spooler
Protected Storage
Remote Access Connection Manager
Remote Procedure Call (RPC)
Secondary Logon
Security Accounts Manager
Server
Shell Hardware Detection
SMS Agent Host
System Event Notification
System Restore Service
TCP/IP NetBIOS Helper
Telephony
Terminal Services
WebClient
Windows Firewall/Internet Connection Sharing (ICS)
Windows Management Instrumentation
Windows Time
Workstation

Drivers loaded:

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 2)
Number of processors #2
==============================================
0xF738F000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0x806E2000 ACPI_HAL 134400 bytes
0xAAE02000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xF770E000 C:\WINDOWS\system32\DRIVERS\aksifdh.sys 65536 bytes (Aladdin Knowledge Systems, Ltd., PCSC IFD handler for eToken)
0xF6CD4000 C:\WINDOWS\System32\Drivers\AnyDVD.sys 98304 bytes (SlySoft, Inc., AnyDVD Filter Driver)
0xF7321000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xF7AF3000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xF7037000 C:\WINDOWS\system32\DRIVERS\b57xp32.sys 135168 bytes (Broadcom Corporation, Broadcom NetXtreme Gigabit Ethernet NDIS5.1 Driver.)
0xF79F6000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF78CE000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xF760E000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xF769E000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 53248 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xF74FE000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF74EE000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xF7339000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)
0xF79C2000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)
0xF767E000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xAACD8000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xF7A06000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xAADB2000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xBF9C4000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xF7B30000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xF7886000 C:\WINDOWS\System32\Drivers\ElbyCDIO.sys 20480 bytes (Elaborate Bytes AG, ElbyCD Windows NT/2000/XP I/O driver)
0xF781E000 C:\WINDOWS\system32\DRIVERS\eTSCFLT.sys 28672 bytes (Aladdin Knowledge Systems, Ltd., eToken Smart Card Filter Driver)
0xA9D5B000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 143360 bytes (Microsoft Corporation, Fast FAT File System Driver)
0xF77D6000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0xF75DE000 C:\WINDOWS\System32\Drivers\Fips.SYS 36864 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF783E000 C:\WINDOWS\system32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)
0xF7301000 fltMgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF79F4000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF735F000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0x806E2000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xF761E000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xF784E000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xAAFB4000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xF6FE0000 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 212992 bytes (Conexant Systems, Inc., HSF_HWB2 WDM driver)
0xF6E17000 C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 684032 bytes (Conexant Systems, Inc., HSF_CNXT driver)
0xF6EBE000 C:\WINDOWS\system32\DRIVERS\HSF_DP.sys 1044480 bytes (Conexant Systems, Inc., HSF_DP driver)
0xF79F0000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 8192 bytes (Microsoft Corporation, I2O Utility Filter)
0xBFA3B000 C:\WINDOWS\System32\ialmdd5.DLL 925696 bytes (Intel Corporation, DirectDraw(R) Driver for Intel(R) Graphics Technology)
0xBFA06000 C:\WINDOWS\System32\ialmdev5.DLL 217088 bytes (Intel Corporation, Component GHAL Driver)
0xBF9E4000 C:\WINDOWS\System32\ialmdnt5.dll 139264 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)
0xF706C000 C:\WINDOWS\system32\DRIVERS\ialmnt5.sys 1302528 bytes (Intel Corporation, Intel Graphics Miniport Driver)
0xBF9D6000 C:\WINDOWS\System32\ialmrnt5.dll 57344 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)
0xF76BE000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xF766E000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xAAE24000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 135168 bytes (Microsoft Corporation, IP Network Address Translator)
0xAAEC5000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xF74BE000 isapnp.sys 36864 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xA9349000 C:\WINDOWS\System32\Drivers\IsDrv122.sys 212992 bytes
0xAAD18000 C:\Program Files\UltraISO\drivers\ISODrive.sys 94208 bytes (EZB Systems, Inc., ISO DVD/CD-ROM Device Driver)
0xF780E000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xAAFAC000 C:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xF79BE000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF6FBD000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xF72D8000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xAA8F2000 C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 12288 bytes (Conexant, Diagnostic Interface DRIVER)
0xF79F8000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF77CE000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver)
0xF7816000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xAAFB0000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xF74CE000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xAA892000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 180224 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xAAD2F000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 454656 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xF785E000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF75BE000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xF798A000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xF7203000 Mup.sys 110592 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xF721E000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xF7966000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xF6CBD000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xF752E000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xF75CE000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xAAE45000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xA9C15000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xF7866000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF724B000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2142208 bytes (Microsoft Corporation, NT Kernel & System)
0xF7C0C000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF6BD7000 C:\WINDOWS\system32\DRIVERS\NWADIenum.sys 212992 bytes (Novatel Wireless Inc, NWADI Interface Bus Enumerator)
0xF6CEC000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
0xF7746000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF7A70000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)
0xF737E000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xF7A86000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
0xF773E000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF77F6000 C:\WINDOWS\system32\DRIVERS\pctnullport.sys 32768 bytes (PCTEL Inc., Null-modem emulator)
0x804D7000 PnpManager 2142208 bytes
0xF6DB3000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xAA176000 C:\WINDOWS\system32\CCM\prepdrv.sys 16384 bytes (Microsoft Corporation, SMS Software Metering Process Event Driver)
0xF77E6000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF774E000 PxHelp20.sys 20480 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xF71AE000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xF76CE000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF76DE000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xF76EE000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF77EE000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
0x804D7000 RAW 2142208 bytes
0xAADC6000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xF79FA000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF6C8C000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 200704 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
0xAA18E000 C:\WINDOWS\System32\Drivers\RDPWD.SYS 143360 bytes (Microsoft Corporation, RDP Terminal Stack Driver (US/Canada Only, Not for Export))
0xF76AE000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xF7806000 C:\WINDOWS\system32\DRIVERS\RimSerial.sys 28672 bytes (Research in Motion Ltd, RIM Virtual Serial Driver)
0xF79DA000 C:\WINDOWS\System32\Drivers\RootMdm.sys 8192 bytes (Microsoft Corporation, Legacy Non-Pnp Modem Device Driver)
0xF6D00000 C:\WINDOWS\system32\drivers\senfilt.sys 733184 bytes (Creative Technology Ltd., Creative WDM Audio Driver)
0xF795A000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xF768E000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xF6DD7000 C:\WINDOWS\system32\drivers\smwdm.sys 262144 bytes (Analog Devices, Inc., SoundMAX Integrated Digital Audio )
0xF72EF000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xAA701000 C:\WINDOWS\system32\DRIVERS\srv.sys 356352 bytes (Microsoft Corporation, Server driver)
0xF79E2000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xAAE6D000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 360448 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xF77DE000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xF7846000 C:\WINDOWS\System32\Drivers\TDTCP.SYS 24576 bytes (Microsoft Corporation, TCP Transport Driver)
0xF76FE000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xF75AE000 C:\Program Files\TrendMicro\OfficeScanClient\TmPreFlt.sys 53248 bytes (Trend Micro Inc., Pre-Filter For XP)
0xAADF1000 C:\WINDOWS\system32\DRIVERS\tmtdi.sys 69632 bytes (Trend Micro Inc., Trend Micro TDI Driver (i386-fre))
0xF6A20000 C:\WINDOWS\system32\DRIVERS\TM_CFW.sys 1798144 bytes (Trend Micro Inc., Trend Micro Common Firewall Module (IM i386-fre))
0xF6C0B000 C:\WINDOWS\system32\DRIVERS\update.sys 364544 bytes (Microsoft Corporation, Update Driver)
0xF7896000 C:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0xF79E6000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF77C6000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 28672 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xF754E000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xF7014000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 143360 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xF77BE000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 20480 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xF7856000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xF7058000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xF74DE000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF75EE000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xF777E000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xBF800000 Win32k 1851392 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1851392 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xF79C0000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0x804D7000 WMIxWDM 2142208 bytes



Tasklist:

Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
System Idle Process 0 Console 0 28 K
System 4 Console 0 236 K
smss.exe 636 Console 0 924 K
csrss.exe 692 Console 0 6,124 K
winlogon.exe 716 Console 0 18,412 K
services.exe 760 Console 0 53,432 K
lsass.exe 772 Console 0 3,832 K
svchost.exe 984 Console 0 16,560 K
svchost.exe 1048 Console 0 15,764 K
svchost.exe 1164 Console 0 51,592 K
svchost.exe 1204 Console 0 14,472 K
svchost.exe 1324 Console 0 13,924 K
spoolsv.exe 1360 Console 0 35,028 K
svchost.exe 1460 Console 0 15,852 K
jqs.exe 1604 Console 0 1,436 K
CcmExec.exe 1908 Console 0 31,444 K
alg.exe 472 Console 0 14,524 K
explorer.exe 2036 Console 0 18,472 K
wmiprvse.exe 152 Console 0 16,176 K
wmiprvse.exe 1680 Console 0 16,896 K
hkcmd.exe 408 Console 0 7,984 K
igfxpers.exe 1120 Console 0 7,928 K
OUTLOOK.EXE 2064 Console 0 29,664 K
WINWORD.EXE 628 Console 0 44,268 K
GoToAssistHelpAlert.exe 1676 Console 0 30,132 K
g2acomm.exe 2624 Console 0 23,540 K
g2alauncherexpert.exe 3748 Console 0 16,596 K
communicator.exe 3792 Console 0 30,232 K
userinit.exe 2532 Console 0 14,412 K
nlnotes.exe 3512 Console 0 17,060 K
ntaskldr.exe 1704 Console 0 2,148 K
opera.exe 900 Console 0 60,556 K
xpupg.exe 3060 Console 0 4,248 K
PccNTUpd.exe 2224 Console 0 4,416 K
WinRAR.exe 1808 Console 0 14,436 K
WinRAR.exe 2620 Console 0 6,576 K
cmd.exe 4024 Console 0 2,640 K
cmd.exe 2464 Console 0 2,652 K
wmiprvse.exe 3720 Console 0 6,964 K
msiexec.exe 3864 Console 0 3,372 K
tasklist.exe 256 Console 0 4,236 K

dll's loaded in RKU

RKUnhookerLE.EXE 2720 N/A

RKUnhooker Ran from: %userprofile%\Local Settings\Temp\Rar$EX00.015

Contents of: rku_error_log_517380546.txt
:
Exception code : 0xC0000005
Instruction address : 0x7C910A19
Attempt to read at address : 0x86BCE311
:eof
crashed while scanning for stealth code

[EP_X0FF]

Hi wealllbe20,

I've sent you private message with debug version link and instructions if you want to help me solve this problem.

Regards.

[Hampa]

This is freezing my whole system.

Shortly after opening it, it says something like
please wait, precaching data
the progressbar goes somewhere near middle then all hangs, mouse and everything freezes until i do a hard reset, there isnt any error or bsod

Im running win xp sp3

(edit: maybe not relevant to this topic but maybe worth telling,
when starting rootrepeal, after initializing when gui appears,
there is an error box saying Error - invalid PE image found!
alltho the program works fine after that error)

[EP_X0FF]

Hello,

you have some 3rd party software in your system causing incompatibility.

(edit: maybe not relevant to this topic but maybe worth telling,
when starting rootrepeal, after initializing when gui appears,
there is an error box saying Error - invalid PE image found!
alltho the program works fine after that error)

This is meaningful. This could explain why your system freezes.

Do you have any antiviruses, firewalls, HIPS, disk encryption software?

Regards.

[wealllbe20]

Hi wealllbe20,

I've sent you private message with debug version link and instructions if you want to help me solve this problem.

Regards.

I cannot reproduce the problem, I restarted my machine and all appears to be working fine.

I will keep trying.

[EP_X0FF]

Thank you for help.
Unfortunately I'm also unable to reproduce this behavior. It maybe caused also by some 3rd party software.

[Hampa]

Hello,

you have some 3rd party software in your system causing incompatibility.

Do you have any antiviruses, firewalls, HIPS, disk encryption software?

Regards.

Ahh, ye, i have nod32 running
Also rootrepeal found two hidden drivers which i have not seen before

Code: Select all

Name: Ptilink
Image Path: \Driver\Ptilink
Address: 0xF7966000	Size: 20608	File Visible: No	Signed: -
Status: Hidden from the Windows API!

Name: ࠂం扏楄
Image Path: ࠂం扏楄
Address: 0xF697F000	Size: 158720	File Visible: No	Signed: -
Status: Hidden from the Windows API!

http://www.virustotal.com/en/analisis/7 ... 1269611971
http://www.virustotal.com/en/analisis/5 ... 1269611988