RkUnhooker report generator v0.7 ============================================== Rootkit Unhooker kernel version: 3.7.300.502 ============================================== Windows Major Version: 5 Windows Minor Version: 1 Windows Build Number: 2600 ============================================== NtClose Actual Address 0xB51B1AA0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtCreateKey Actual Address 0xB51A4330 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtCreateProcess Actual Address 0xB51B17D0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtCreateProcessEx Actual Address 0xB51B1940 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtCreateSection Actual Address 0xB51B23E0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtCreateSymbolicLinkObject Actual Address 0xB51B2030 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtCreateThread Actual Address 0xB51B2D00 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtDeleteKey Actual Address 0xB51A4430 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtDeleteValueKey Actual Address 0xB51A44B0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtDuplicateObject Actual Address 0xB51B1C00 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtEnumerateKey Actual Address 0xB51A4560 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtEnumerateValueKey Actual Address 0xB51A4610 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtFlushKey Actual Address 0xB51A46C0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtInitializeRegistry Actual Address 0xB51A4740 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtLoadDriver Actual Address 0xB51B0030 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtLoadKey Actual Address 0xB51A5160 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtLoadKey2 Actual Address 0xB51A4760 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtNotifyChangeKey Actual Address 0xB51A4840 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtOpenFile Actual Address 0xBA4D9000 Hooked by: kl1.sys NtOpenKey Actual Address 0xB51A4920 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtOpenProcess Actual Address 0xB51B15C0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtOpenSection Actual Address 0xB51B2210 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtQueryKey Actual Address 0xB51A4A00 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtQueryMultipleValueKey Actual Address 0xB51A4AB0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtQuerySystemInformation Actual Address 0xB51B29B0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtQueryValueKey Actual Address 0xB51A4B60 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtReplaceKey Actual Address 0xB51A4C40 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtRestoreKey Actual Address 0xB51A4CD0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtResumeThread Actual Address 0xB51B2CB0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtSaveKey Actual Address 0xB51A4ED0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtSetContextThread Actual Address 0xB51B3030 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtSetInformationFile Actual Address 0xB51B3650 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtSetInformationKey Actual Address 0xB51A4F60 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtSetSecurityObject Actual Address 0xB51AEC50 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtSetValueKey Actual Address 0xB51A5000 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtSuspendThread Actual Address 0xB51B2C60 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtSystemDebugControl Actual Address 0xB51B0390 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtTerminateProcess Actual Address 0xB51B2800 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtUnloadKey Actual Address 0xB51A5120 Hooked by: C:\WINDOWS\system32\drivers\klif.sys NtWriteVirtualMemory Actual Address 0xB51B1AC0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys Actual Address 0xB51ADD60 Hooked by: C:\WINDOWS\system32\drivers\klif.sys Actual Address 0xB51ADD70 Hooked by: C:\WINDOWS\system32\drivers\klif.sys Actual Address 0xB51ADD80 Hooked by: C:\WINDOWS\system32\drivers\klif.sys Actual Address 0xB51ADDA0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys Actual Address 0xB51ADDC0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys Actual Address 0xB51ADDF0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys Actual Address 0xB51ADE00 Hooked by: C:\WINDOWS\system32\drivers\klif.sys Actual Address 0xB51ADE20 Hooked by: C:\WINDOWS\system32\drivers\klif.sys Actual Address 0xB51ADE30 Hooked by: C:\WINDOWS\system32\drivers\klif.sys Actual Address 0xB51ADEF0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys Actual Address 0xB51ADFC0 Hooked by: C:\WINDOWS\system32\drivers\klif.sys Actual Address 0xB51AE000 Hooked by: C:\WINDOWS\system32\drivers\klif.sys Actual Address 0xB51AE040 Hooked by: C:\WINDOWS\system32\drivers\klif.sys