Menu
▾
▴
[Dev-C++] virus help!
|
From: <ten...@ne...> - 2003-08-11 19:56:18
|
I was searching through altavista for Annals of Mathematiks, and as I
have the bad habit of clicking on links without watching what it says I
clicked in a porn link (it seems that porn is a branch of mathematics, eh?)
The fact is that
When I noticed what kind of page I was going to, I went back page.
Then the dialog box saying svchost (at the end I past the text at
drwatson log) has generated errors and will be closed by windows.
I went on with my internet session.
I closed Netscape and I disconnected from the net through the icon in
the taskbar.
Two minutes later I noticed that the modem was still connected to the
net, and the light of "sending" was intermitent...
I switched off the modem.
I watched the task manager. There is a program which I didn't remember
seeing there and its not a usual win service.
I search for it in C:. It's in C:\WINNT\system32.
I see it. It was last modified today! (not like spoolsv and svchost).
So it is, it is a virus which installed it there.
I go back to task manager, select it and End process, but it says access
denied, it couldn't be closed. Shit!
I try to delete it in folder. As I feared, if it can't in task manager,
less while running cna I delete it.
Well. Change its name? It shouldn't work... But it does! I change its
name... Still Cannot delete.
I go to regedit (registry editor within windows), I save a backup, for
if it's not the problem.
I search for masblast and I delete all them.
I go back C:\WINNT\system32. I try to delete it (with changed name) and
it's deleted. [I close it with Task manager, it's closed].
I restart.
Back again. It's not in task manager task list! It's not in
C:\WINNT\system32!
I start Netscape and I connect to the net.... First seconds seem okay.
Both send and receive lights are off. I go to altavista, and mail. Seems
okay... OUCH! NOT! The send light is again intermitent. It doesn't
disconnet from taskbar! msblast is there again!
Someone there knows about it? How can I kill it?
The last I did, but I don't want to do anything is that I wrote a
program with an infinite loop for, with the same name, after restarting
and before connecting to the net I delete the virus msblast, I move it
to C:\WINNT\system32 and I run it, so I have the hope that if there's
yet a msblast in C:\WINNT\system32 running, the evil msblast won't come
to the scene.
Thanks.
-----The text produced by drwatson--------
Application exception occurred:
App: svchost.exe (pid=380)
When: 8/11/2003 @ 19:37:22.395
Exception number: c0000096 (privileged instruction)
*----> System Information <----*
Computer Name: CARLOS
User Name: SYSTEM
Number of Processors: 1
Processor Type: x86 Family 6 Model 6 Stepping 5
Windows 2000 Version: 5.0
Current Build: 2195
Service Pack: None
Current Type: Uniprocessor Free
Registered Organization: .
Registered Owner: Carlos García del Monte
*----> Task List <----*
0 Idle.exe
8 System.exe
136 smss.exe
164 csrss.exe
160 winlogon.exe
212 services.exe
224 lsass.exe
380 svchost.exe
408 spoolsv.exe
440 svchost.exe
480 regsvc.exe
496 MSTask.exe
532 WinMgmt.exe
704 Explorer.exe
712 RealPlay.exe
788 Winampa.exe
808 internat.exe
852 devcpp.exe
824 NETSCP.exe
716 MyE-tor.exe
740 drwtsn32.exe
0 _Total.exe
(01000000 - 01005000)
(77F80000 - 77FF9000)
(77DB0000 - 77E0A000)
(77E80000 - 77F36000)
(77D40000 - 77DAF000)
(77A50000 - 77B45000)
(77F40000 - 77F7C000)
(77E10000 - 77E75000)
(76190000 - 761CC000)
(78000000 - 78046000)
(77C10000 - 77C6D000)
(75030000 - 75044000)
(75020000 - 75028000)
(77BE0000 - 77BEF000)
(74FF0000 - 75002000)
(77980000 - 779A4000)
(75050000 - 75058000)
(74FD0000 - 74FE1000)
(75010000 - 75017000)
(77840000 - 7784C000)
(777E0000 - 777E8000)
(77950000 - 77979000)
(777F0000 - 777F5000)
(77830000 - 7783E000)
(77CC0000 - 77D40000)
(779B0000 - 77A45000)
(78140000 - 7815A000)
(75170000 - 751BF000)
(751C0000 - 751C6000)
(75150000 - 7515F000)
State Dump for Thread Id 0x178
eax=00000001 ebx=00000000 ecx=00076a78 edx=00000000 esi=00000000
edi=00000048
eip=77f8fb68 esp=0006fc38 ebp=0006fca8 iopl=0 nv up ei pl zr na
po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000
efl=00000246
function: ZwReadFile
77f8fb5d b8a1000000 mov eax,0xa1
77f8fb62 8d542404 lea edx,[esp+0x4]
ss:00b2d20f=????????
77f8fb66 cd2e int 2e
77f8fb68 c22400 ret 0x24
77f8fb6b 55 push ebp
77f8fb6c 8bec mov ebp,esp
77f8fb6e 56 push esi
77f8fb6f 8b7508 mov esi,[ebp+0x8]
ss:00b2d27e=????????
77f8fb72 8b4608 mov eax,[esi+0x8]
ds:00abd5d6=????????
77f8fb75 25ffff0000 and eax,0xffff
77f8fb7a 0d0000efcd or eax,0xcdef0000
77f8fb7f 894608 mov [esi+0x8],eax
ds:00abd5d6=????????
77f8fb82 f60578e3fc7702
ds:77fce378=00
test byte ptr [NlsAnsiCodePage+0x6aa
(77fce378)],0x2
77f8fb89 0f85499c0100 jne RtlDeleteTimerQueueEx+0xa16
(77fa97d8)
77f8fb8f 8b4610 mov eax,[esi+0x10]
ds:00abd5d6=????????
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0006FCA8 77DC86D3 00000048 0006FD80 00000216 0006FCD0 ntdll!ZwReadFile
0006FCD4 77DC9431 00000048 0006FD80 00000216 0006FD0C
advapi32!SetSecurityDescriptorSacl
0006FD50 77DC9182 00000048 0006FD80 00000216 00074810
advapi32!StartServiceCtrlDispatcherW
0006FFB0 0100113D 00074810 00790070 00690064 77E87903
advapi32!StartServiceCtrlDispatcherW
0006FFF0 00000000 010010B8 00000000 000000C8 00000100 svchost!<nosymbols>
*----> Raw Stack Dump <----*
0006fc38 65 49 e8 77 48 00 00 00 - 00 00 00 00 00 00 00 00
eI.wH...........
0006fc48 00 00 00 00 80 fc 06 00 - 80 fd 06 00 16 02 00 00
................
0006fc58 00 00 00 00 00 00 00 00 - 0c fd 06 00 da 48 e8 77
.............H.w
0006fc68 80 fd 06 00 00 00 00 00 - 01 00 00 00 a0 56 07 00
.............V..
0006fc78 94 fd 06 00 00 00 00 00 - 70 00 00 00 28 48 07 00
........p...(H..
0006fc88 7c 01 00 00 00 00 00 00 - 60 fc 06 00 40 fd 06 00
|.......`...@...
0006fc98 40 fd 06 00 fd 13 ea 77 - 20 f3 e9 77 ff ff ff ff @......w
..w....
0006fca8 d4 fc 06 00 d3 86 dc 77 - 48 00 00 00 80 fd 06 00
.......wH.......
0006fcb8 16 02 00 00 d0 fc 06 00 - 00 00 00 00 a0 56 07 00
.............V..
0006fcc8 80 fd 06 00 00 00 00 00 - 00 00 00 00 50 fd 06 00
............P...
0006fcd8 31 94 dc 77 48 00 00 00 - 80 fd 06 00 16 02 00 00
1..wH...........
0006fce8 0c fd 06 00 10 48 07 00 - 00 00 00 00 00 f0 fd 7f
.....H..........
0006fcf8 62 97 d4 77 68 48 07 00 - 94 fd 06 00 00 00 00 00
b..whH..........
0006fd08 3c fd 06 00 00 00 00 00 - 00 00 00 00 00 00 00 00
<...............
0006fd18 50 50 07 00 28 48 07 00 - 88 01 00 00 70 00 65 00
PP..(H......p.e.
0006fd28 32 00 00 00 01 00 00 00 - c5 95 dc 77 00 00 00 00
2..........w....
0006fd38 ec fc 06 00 68 48 07 00 - a0 ff 06 00 8b 19 db 77
....hH.........w
0006fd48 e8 99 dc 77 ff ff ff ff - b0 ff 06 00 82 91 dc 77
...w...........w
0006fd58 48 00 00 00 80 fd 06 00 - 16 02 00 00 10 48 07 00
H............H..
0006fd68 78 47 07 00 00 f0 fd 7f - 03 00 00 00 00 00 00 00
xG..............
State Dump for Thread Id 0x188
eax=00000001 ebx=00000000 ecx=004a1edc edx=00000000 esi=77f90328
edi=0042fe84
eip=77f90333 esp=0042fe70 ebp=0042fe8c iopl=0 nv up ei pl nz na
po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000
efl=00000206
function: ZwDelayExecution
77f90328 b832000000 mov eax,0x32
77f9032d 8d542404 lea edx,[esp+0x4]
ss:00eed447=????????
77f90331 cd2e int 2e
77f90333 c20800 ret 0x8
77f90336 33c0 xor eax,eax
77f90338 e99ac6ffff jmp RtlCopySid+0x64 (77f8c9d7)
77f9033d 23d1 and edx,ecx
77f9033f 8a06 mov al,[esi]
ds:77f90328=b8
77f90341 8807 mov [edi],al
ds:0042fe84=90
77f90343 8a4601 mov al,[esi+0x1]
ds:78a4d8fe=??
77f90346 884701 mov [edi+0x1],al
ds:00eed45a=??
77f90349 8a4602 mov al,[esi+0x2]
ds:78a4d8fe=??
77f9034c c1e902 shr ecx,0x2
77f9034f 884702 mov [edi+0x2],al
ds:00eed45a=??
77f90352 83c603 add esi,0x3
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0042FE8C 761939B9 00014B27 00000000 000006B3 00000002
ntdll!ZwDelayExecution
0042FEB8 76191B02 00000000 0007505C 00000000 01003000 rpcss!<nosymbols>
0042FF84 0100157B 00000001 00075058 00000000 00075050 rpcss!<nosymbols>
76191954 0000B4EC 33565300 5D8957DB 019DE8FC 358B0000 svchost!<nosymbols>
*----> Raw Stack Dump <----*
0042fe70 ab 4b e8 77 00 00 00 00 - 84 fe 42 00 00 00 00 00
.K.w......B.....
0042fe80 27 4b 01 00 90 5c 78 cd - ff ff ff ff b8 fe 42 00
'K...\x.......B.
0042fe90 b9 39 19 76 27 4b 01 00 - 00 00 00 00 b3 06 00 00
.9.v'K..........
0042fea0 02 00 00 00 00 00 00 00 - 54 02 00 00 b1 1a 6f 00
........T.....o.
0042feb0 b1 1a 6f 00 d0 13 70 00 - 84 ff 42 00 02 1b 19 76
..o...p...B....v
0042fec0 00 00 00 00 5c 50 07 00 - 00 00 00 00 00 30 00 01
....\P.......0..
0042fed0 4c 4c ed 77 a0 03 ee 77 - 5c 50 07 00 01 00 00 00
LL.w...w\P......
0042fee0 0a 0c 00 00 0a 0c 00 00 - 00 00 00 00 00 73 07 00
.............s..
0042fef0 60 ff 42 00 02 00 00 00 - 5c 50 07 00 00 00 00 00
`.B.....\P......
0042ff00 e0 47 07 00 00 00 00 00 - 00 00 00 00 00 00 00 00
.G..............
0042ff10 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00
................
0042ff20 00 00 00 00 00 00 00 00 - 00 00 00 00 20 d0 32 81
............ .2.
0042ff30 20 b9 32 81 00 00 00 00 - b0 ba 32 81 00 73 07 00
.2.......2..s..
0042ff40 46 02 00 00 86 d6 42 80 - 00 2f 06 80 80 ba 32 81
F.....B../....2.
0042ff50 20 b9 32 81 00 00 00 00 - 00 00 00 00 00 00 00 00
.2.............
0042ff60 00 00 00 00 d5 aa e8 77 - 66 50 07 00 01 00 00 00
.......wfP......
0042ff70 80 00 00 00 ff ff ff ff - e0 47 07 00 ea 47 07 00
.........G...G..
0042ff80 00 00 00 00 54 19 19 76 - 7b 15 00 01 01 00 00 00
....T..v{.......
0042ff90 58 50 07 00 00 00 00 00 - 50 50 07 00 ec ff 42 00
XP......PP....B.
0042ffa0 50 50 07 00 00 00 00 00 - d3 95 dc 77 01 00 00 00
PP.........w....
State Dump for Thread Id 0x18c
eax=778321fe ebx=00000003 ecx=7ffdd000 edx=00000000 esi=77f87e6c
edi=00000003
eip=77f87e77 esp=0053fd24 ebp=0053fd70 iopl=0 nv up ei pl zr na
po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000
efl=00000246
function: ZwWaitForMultipleObjects
77f87e6c b8e9000000 mov eax,0xe9
77f87e71 8d542404 lea edx,[esp+0x4]
ss:00ffd2fb=????????
77f87e75 cd2e int 2e
77f87e77 c21400 ret 0x14
77f87e7a 668b08 mov cx,[eax]
ds:778321fe=8b55
77f87e7d 40 inc eax
77f87e7e 40 inc eax
77f87e7f 8945a4 mov [ebp+0xa4],eax
ss:00ffd346=????????
77f87e82 6685c9 test cx,cx
77f87e85 75f3 jnz
RtlExpandEnvironmentStrings_U+0x26 (77f8e57a)
77f87e87 663930 cmp [eax],si
ds:778321fe=8b55
77f87e8a 75ee jnz ZwFsControlFile+0x54 (77f8bf7a)
77f87e8c 40 inc eax
77f87e8d 40 inc eax
77f87e8e 8945a4 mov [ebp+0xa4],eax
ss:00ffd346=????????
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0053FD70 77E9E68A 0053FD48 00000001 00000000 00000000
ntdll!ZwWaitForMultipleObjects
0053FFB4 77E92CA8 00000004 0008092C 7FFDD000 00081510
kernel32!WaitForMultipleObjects
0053FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!CreateFileA
State Dump for Thread Id 0x190
eax=0009bf58 ebx=0009bf5a ecx=0057fd00 edx=0009bf58 esi=000747e0
edi=0057f860
eip=0057f863 esp=0057f768 ebp=00580046 iopl=0 nv up ei pl nz ac
pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000
efl=00000212
function: <nosymbols>
0057f84a 7ce1 jl 0058b72d
0057f84c be329409f9 mov esi,0xf9099432
0057f851 3a6bb6 cmp ch,[ebx+0xb6]
ds:00b59530=??
0057f854 d7 xlat
0057f855 9f lahf
0057f856 4d dec ebp
0057f857 8571da test [ecx+0xda],esi
ds:0103d2d6=????????
0057f85a c681bf321dc6b3 mov byte ptr [ecx+0xc61d32bf],0xb3
ds:c6752fbf=??
0057f861 5a pop edx
0057f862 f8 clc
FAULT ->0057f863 ec in al,dx
0057f864 bf32fcb38d mov edi,0x8db3fc32
0057f869 1cf0 sbb al,0xf0
0057f86b e8c841a6df call dffe3a38
0057f870 ebcd jmp 0058bb3f
0057f872 c28836 ret 0x3688
0057f875 7490 jz 00587807
0057f877 7f89 jg 00585302
0057f879 5a pop edx
0057f87a e67e out 7e,al
0057f87c 0c24 or al,0x24
0057f87e 7cad jl 0058b72d
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
00580046 00000000 00000000 00000000 00000000 00000000 <nosymbols>
*----> Raw Stack Dump <----*
0057f768 c0 13 00 01 e0 47 07 00 - 90 90 90 90 90 90 90 90
.....G..........
0057f778 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 90
................
0057f788 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 90
................
0057f798 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 90
................
0057f7a8 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 90
................
0057f7b8 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 90
................
0057f7c8 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 90
................
0057f7d8 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 90
................
0057f7e8 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 90
................
0057f7f8 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 90
................
0057f808 90 90 90 90 90 90 90 90 - 90 90 90 90 90 90 90 eb
................
0057f818 19 5e 31 c9 81 e9 89 ff - ff ff 81 36 80 bf 32 94
.^1........6..2.
0057f828 81 ee fc ff ff ff e2 f2 - eb 05 e8 e2 ff ff ff 03
................
0057f838 53 06 1f 74 57 75 95 80 - bf bb 92 7f 89 5a 1a ce
S..tWu.......Z..
0057f848 b1 de 7c e1 be 32 94 09 - f9 3a 6b b6 d7 9f 4d 85
..|..2...:k...M.
0057f858 71 da c6 81 bf 32 1d c6 - b3 5a f8 ec bf 32 fc b3
q....2...Z...2..
0057f868 8d 1c f0 e8 c8 41 a6 df - eb cd c2 88 36 74 90 7f
.....A......6t..
0057f878 89 5a e6 7e 0c 24 7c ad - be 32 94 09 f9 22 6b b6
.Z.~.$|..2..."k.
0057f888 d7 4c 4c 62 cc da 8a 81 - bf 32 1d c6 ab cd e2 84
.LLb.....2......
0057f898 d7 f9 79 7c 84 da 9a 81 - bf 32 1d c6 a7 cd e2 84
..y|.....2......
State Dump for Thread Id 0x254
eax=00aeffa4 ebx=00aeff6c ecx=7ffdc000 edx=00000000 esi=77f90328
edi=00aefe6c
eip=77f90333 esp=00aefe58 ebp=00aefe74 iopl=0 nv up ei pl nz na
po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000
efl=00000206
function: ZwDelayExecution
77f90328 b832000000 mov eax,0x32
77f9032d 8d542404 lea edx,[esp+0x4]
ss:015ad42f=????????
77f90331 cd2e int 2e
77f90333 c20800 ret 0x8
77f90336 33c0 xor eax,eax
77f90338 e99ac6ffff jmp RtlCopySid+0x64 (77f8c9d7)
77f9033d 23d1 and edx,ecx
77f9033f 8a06 mov al,[esi]
ds:77f90328=b8
77f90341 8807 mov [edi],al
ds:00aefe6c=90
77f90343 8a4601 mov al,[esi+0x1]
ds:78a4d8fe=??
77f90346 884701 mov [edi+0x1],al
ds:015ad442=??
77f90349 8a4602 mov al,[esi+0x2]
ds:78a4d8fe=??
77f9034c c1e902 shr ecx,0x2
77f9034f 884702 mov [edi+0x2],al
ds:015ad442=??
77f90352 83c603 add esi,0x3
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
00AEFE74 761A2ED7 000036A7 00000000 0042FB50 77D4E7D7
ntdll!ZwDelayExecution
00AEFFB4 77E92CA8 00000000 0042FB50 77D4E7D7 00000000 rpcss!<nosymbols>
00AEFFEC 00000000 00000000 00000000 00000000 00000000 kernel32!CreateFileA
State Dump for Thread Id 0x174
eax=00000000 ebx=80120006 ecx=00093d48 edx=00000000 esi=000797e0
edi=00094e88
eip=77f82eec esp=00c2fe28 ebp=00c2ff74 iopl=0 nv up ei pl nz na
pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000
efl=00000202
function: ZwReplyWaitReceivePortEx
77f82ee1 b8ac000000 mov eax,0xac
77f82ee6 8d542404 lea edx,[esp+0x4]
ss:016ed3ff=????????
77f82eea cd2e int 2e
77f82eec c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
00C2FF74 77D4B407 77D4B853 000797E0 00000000 00000000
ntdll!ZwReplyWaitReceivePortEx
00C2FFA8 77D4B771 00074E08 00C2FFEC 77E92CA8 00095CA0
rpcrt4!RpcBindingSetOption
00C2FFB4 77E92CA8 00095CA0 00000000 00000000 00095CA0
rpcrt4!RpcBindingSetOption
00C2FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!CreateFileA
State Dump for Thread Id 0xc4
eax=00c6f86c ebx=80120006 ecx=00003c80 edx=00000000 esi=000797e0
edi=00094e88
eip=77f82eec esp=00c6fe28 ebp=00c6ff74 iopl=0 nv up ei pl nz na
po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000
efl=00000206
function: ZwReplyWaitReceivePortEx
77f82ee1 b8ac000000 mov eax,0xac
77f82ee6 8d542404 lea edx,[esp+0x4]
ss:0172d3ff=????????
77f82eea cd2e int 2e
77f82eec c21400 ret 0x14
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
00C6FF74 77D4B407 77D4B7BF 000797E0 00000000 00000000
ntdll!ZwReplyWaitReceivePortEx
00C6FFA8 77D4B771 00097250 00C6FFEC 77E92CA8 00095BD8
rpcrt4!RpcBindingSetOption
00C6FFB4 77E92CA8 00095BD8 00000000 00000000 00095BD8
rpcrt4!RpcBindingSetOption
00C6FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!CreateFileA
State Dump for Thread Id 0x248
eax=00000000 ebx=00007530 ecx=7ffd7000 edx=00000000 esi=000751a0
edi=00007530
eip=77f8b520 esp=00cafebc ebp=00cafee4 iopl=0 nv up ei ng nz ac
po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000
efl=00000297
function: ZwRemoveIoCompletion
77f8b515 b8a8000000 mov eax,0xa8
77f8b51a 8d542404 lea edx,[esp+0x4]
ss:0176d493=????????
77f8b51e cd2e int 2e
77f8b520 c21400 ret 0x14
77f8b523 8b4124 mov eax,[ecx+0x24]
ds:80a945d6=????????
77f8b526 39420c cmp [edx+0xc],eax
ds:00abd5d6=????????
77f8b529 0f85bc370000 jne RtlAddAccessAllowedAce+0x1c
(77f8eceb)
77f8b52f ff4208 inc dword ptr [edx+0x8]
ds:00abd5d6=????????
77f8b532 33c0 xor eax,eax
77f8b534 c20400 ret 0x4
*----> Stack Back Trace <----*
FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
00CAFEE4 77D5C3A7 0000005C 00CAFF1C 00CAFF0C 00CAFF14
ntdll!ZwRemoveIoCompletion
00CAFF20 77D5BB26 00007530 00CAFF60 00CAFF5C 00CAFF70
rpcrt4!NdrServerMarshall
00CAFF74 77D5BA15 77D4B7BF 000751A0 00070778 0007A3E0
rpcrt4!I_RpcBCacheAllocate
00CAFFA8 77D4B771 0009BF98 00CAFFEC 77E92CA8 00088128
rpcrt4!I_RpcBCacheAllocate
00CAFFB4 77E92CA8 00088128 00070778 0007A3E0 00088128
rpcrt4!RpcBindingSetOption
00CAFFEC 00000000 00000000 00000000 00000000 00000000 kernel32!CreateFileA
|
