Updates Crashing

"Ben B. [US]" <> wrote in
news:OCge#:

> Are you running Windows Update on an administrator account? If you're
> not you should be.
Yes, I am,
> Check to see if the Automatic Updates service is still running:
> Click Start · Control Panel, then select Performance and Maintenance
> and click System. Select the Automatic Updates tab and make sure that
> Automatic is selected and then click OK.
I don't have that option as I am on Windows 2000 Professional, but I
opened the Automatic Updates .cpl applet and it is set to "Notify me but
don't automatically download or install them.".

I am in the UK as you can probably tell by the header, but I had been
waiting from 12 April to 14 April and no updates had appeared. But same
as what usually happens, when I went manually to the windows update site
the automatic updates try icon kicked in and showed the BITS update only
(despite the windows update site showing all 6 updates), which I accepted
and the icon then just disappeared. I then attempted to install the
updates and that is when the update.exe crashes first started. All
subsequent attempts have been from c:\WUTemp. I have also tried
downloading an update using a different computer but still the same
errors happened when running it on my system
>
>
> Now check to see if Automatic Updates is service is running:
> Click Start · Run and type "services.msc" without the quotes and press
> enter. The Services window should pop-up. Under the name column find
> Automatic Updates. If it does not appear there skip over the remainder
> of this paragraph, if it is double-click on it; the properties dialog
> should open up. Make sure it says "Automatic" in the Startup type box
> and the Service status says "Started".
Strange, automatic updates was set to manual and was not started. I have
just rectified that and started the update service and the automatic
updates icon appeared and again update.exe crashed
>
> If you've made any changes to this point restart your computer and see
> if Windows Update is working yet. If Windows Update continues to
> display errors continue on.
>
> Register the DLL files:
> Click Start · Run and type "cmd" without the quotes and press enter.
> Type in the following and press return after each line:
> REGSVR32 %windir%\system32\wuapi.dll
> REGSVR32 %windir%\system32\wuaueng.dll
> REGSVR32 %windir%\system32\atl.dll
> REGSVR32 %windir%\system32\wucltui.dll
> REGSVR32 %windir%\system32\wups.dll
> Enter "exit" and press enter.
>
>
>
> Check and see if Windows Update is working, if Windows Update
> continues not to work please attach your WindowsUpdate.log file. To
> gather your WindowsUpdate.log file select Start · Run, and then type
> "%windir%" and press enter. The WindowsUpdate.log file will be located
> in this folder.
I have done all this and it is still not working.

I noticed on another usenet posting found through googling suggestions
about uninstalling NetMeter to solve this problem and it turned out that
I did indeed have it installed. I have now uninstalled this but it
hasn't help. The only other things that I can remember installing were
the Intel Application accelerator and the Intel Processor ID utility and
the Intel Frequency ID utility, I have since uninstalled them all but it
has not helped. The only other thing I have installed recently is
Acrobat Reader 7.0, and the latest JAVA 1.5.0_02-b09

I will attach the WindowsUpdate.log in a followup as it is too large.

Here is the contents of my WindowsUpdate.log

2005-04-15 10:46:47+0100 2628 97c Service Main starts
2005-04-15 10:46:48+0100 2628 97c Using BatchFlushAge = 26366.
2005-04-15 10:46:48+0100 2628 97c Using SamplingValue = 924.
2005-04-15 10:46:48+0100 2628 97c Successfully loaded event namespace
dictionary.
2005-04-15 10:46:49+0100 2628 97c Successfully loaded client event
namespace descriptor.
2005-04-15 10:46:49+0100 2628 97c Successfully initialized local event
logger. Events will be logged at C:\WINNT\SoftwareDistribution
\ReportingEvents.log.
2005-04-15 10:46:49+0100 2628 97c Successfully initialized NT event
logger.
2005-04-15 10:46:49+0100 2628 97c Successfully initialized event
uploader 0.
2005-04-15 10:46:49+0100 2628 97c Reopened existing event cache file
at C:\WINNT\SoftwareDistribution\EventCache\{409BBD1E-8D25-4F93-96A2-
56337E107477}.bin for writing.
2005-04-15 10:46:49+0100 2628 97c Successfully initialized event
uploader 1.
2005-04-15 10:46:50+0100 2628 97c WU client with version 5.4.3790.2163
successfully initialized
2005-04-15 10:46:50+0100 2628 97c Service status is now
SERVICE_RUNNING
2005-04-15 10:46:50+0100 2628 8dc Successfully opened event cache file
at C:\WINNT\SoftwareDistribution\EventCache\{409BBD1E-8D25-4F93-96A2-
56337E107477}.bin for reading.
2005-04-15 10:46:52+0100 2628 8dc PT: Using serverID {9482F4B4-E343-
43B6-B170-9A65BC822C77}
2005-04-15 10:46:54+0100 2628 8dc PT: Using server URL
https://v5.windowsupdate.microsoft.c...ce/client.asmx
2005-04-15 10:46:54+0100 2628 8dc PT: Using serverID {9482F4B4-E343-
43B6-B170-9A65BC822C77}
2005-04-15 10:46:54+0100 2628 8dc PT: Using server URL
https://v5.windowsupdate.microsoft.c...ce/client.asmx
2005-04-15 10:46:54+0100 2628 8dc URL for server is
http://v5stats.windowsupdate.microso...ice/ReportingW
ebService.asmx
2005-04-15 10:46:54+0100 2628 8dc Trying to upload 1 events using
cached cookie.
2005-04-15 10:47:10+0100 2628 8dc DetectCompressionType returning type
0, hr=0x1
2005-04-15 10:47:10+0100 2628 8dc Successfully uploaded 1 events.
2005-04-15 10:47:10+0100 2628 8dc Deleted event cache file at C:\WINNT
\SoftwareDistribution\EventCache\{409BBD1E-8D25-4F93-96A2-
56337E107477}.bin.
2005-04-15 10:47:35+0100 2628 97c start delayed initialization of WU
client
2005-04-15 10:47:35+0100 2628 97c WU client successfully loaded
ongoing download call {51D76EFE-A798-4221-B41C-CA24976CE438} from
datastore
2005-04-15 10:47:35+0100 2628 97c WU client succeeded to load 1
persisted Download Calls
2005-04-15 10:47:35+0100 2628 97c Client Call Recorder finished
delayed initialization
2005-04-15 10:47:35+0100 2628 97c Setting next AU detection timeout to
2005-04-15 09:47:35
2005-04-15 10:47:36+0100 2628 97c AU finished delayed initialization
2005-04-15 10:47:36+0100 2628 97c AU received event of 1
2005-04-15 10:47:36+0100 2628 97c WU client succeeds
CClientCallRecorder::BeginFindUpdates from AutomaticUpdates with call id
{6B9A1174-4977-413C-AC59-A01C4EE127AD}
2005-04-15 10:47:36+0100 2628 8dc WU client calls back to download
call {51D76EFE-A798-4221-B41C-CA24976CE438} with code Call progress and
error 0
2005-04-15 10:47:36+0100 2628 8dc WU client executing call {6B9A1174-
4977-413C-AC59-A01C4EE127AD} of type Search Call
2005-04-15 10:47:48+0100 2628 8dc WU client add update {7E42BA28-C236-
4B44-B6BA-C00ADD8DE5A3}.100 to search result
2005-04-15 10:47:48+0100 2628 8dc WU client add update {0C0F4FFB-8D37-
417C-8F69-073A8B223A78}.100 to search result
2005-04-15 10:47:48+0100 2628 8dc WU client add update {D7B61865-7029-
4865-8A38-168399DBC68B}.100 to search result
2005-04-15 10:47:48+0100 2628 8dc WU client add update {DBE60056-72CC-
4B90-B497-AFB619618F67}.100 to search result
2005-04-15 10:47:48+0100 2628 8dc WU client add update {3CC799B2-35E1-
4AD7-962E-DBE9462FCDD6}.100 to search result
2005-04-15 10:47:48+0100 2628 8dc WU client add update {0519DD06-56DA-
4804-97BB-E60A8EC36495}.100 to search result
2005-04-15 10:47:48+0100 2628 8dc WU client found 6 updates and 10
categories in search
2005-04-15 10:47:48+0100 2628 8dc WU client finished Searching for
update
2005-04-15 10:47:48+0100 2628 518 AU Detection callback: 6 updates
detected
2005-04-15 10:47:48+0100 2628 518 AU detected 1 mandatory updates
2005-04-15 10:47:48+0100 2628 518 WU client calls back to search call
AutomaticUpdates with code Call complete and error 0
2005-04-15 10:47:48+0100 2628 518 WU client completed and deleted call
{6B9A1174-4977-413C-AC59-A01C4EE127AD}
2005-04-15 10:47:48+0100 2628 97c AU received event of 1
2005-04-15 10:47:48+0100 2628 97c WU client succeeds
CClientCallRecorder::BeginFindUpdates from AutomaticUpdates with call id
{8AB68C49-228E-410B-A0F5-CA43F774000E}
2005-04-15 10:47:50+0100 2628 97c AU received event of 1
2005-04-15 10:47:50+0100 2628 97c No pending client directive, bailing
out
2005-04-15 10:47:50+0100 2628 8dc CheckIfDirExists returned error
0x80070002.
2005-04-15 10:47:51+0100 2628 518 WU client calls back to download
call {51D76EFE-A798-4221-B41C-CA24976CE438} with code Call progress and
error 0
2005-04-15 10:47:51+0100 2628 8dc CheckIfDirExists returned error
0x80070002.
2005-04-15 10:47:51+0100 2628 8dc Downloading from
http://au.download.windowsupdate.com...oad/update/v3-
19990518/cabpool/windows2000-kb842773-x86-
enu_e676d47e065a314bbf1d15b096a67aede6b0539a.exe to C:\WINNT
\SoftwareDistribution\Download\S-1-5-18\932ed89017a1bad1845f7fa5b3e95b10
\Windows2000-KB842773-x86-enu.exe (full file).
2005-04-15 10:47:58+0100 2628 8dc WU client executing call {8AB68C49-
228E-410B-A0F5-CA43F774000E} of type Search Call
2005-04-15 10:47:58+0100 2628 8dc Checking for different Redirector
at:
http://download.windowsupdate.com/ms...ir/wuredir.cab
2005-04-15 10:47:58+0100 2628 8dc Successfully refreshed Redirector
cab.
2005-04-15 10:47:59+0100 2628 8dc Loading inf file C:\WINNT
\SoftwareDistribution\SelfUpdate\wusetup.inf
2005-04-15 10:47:59+0100 2628 8dc Warning: Setup callback
ReportProgress failed: 0x8007000d
2005-04-15 10:48:00+0100 2628 8dc PT: Using serverID {9482F4B4-E343-
43B6-B170-9A65BC822C77}
2005-04-15 10:48:00+0100 2628 8dc PT: Using server URL
https://v5.windowsupdate.microsoft.c...ce/client.asmx
2005-04-15 10:48:05+0100 2628 97c AU received event of 1
2005-04-15 10:48:09+0100 2628 8dc Add header for accept-encoding:
xpress succeeded
2005-04-15 10:48:10+0100 2628 97c Successfully launched client for
directive 3
2005-04-15 10:48:17+0100 2628 8dc DetectCompressionType returning type
1, hr=0x0
2005-04-15 10:48:18+0100 2628 8dc Add header for accept-encoding:
xpress succeeded
2005-04-15 10:48:18+0100 2628 8dc DetectCompressionType returning type
1, hr=0x0
2005-04-15 10:48:20+0100 2628 3a4 Download job for update {6E2CE922-
F9D8-43DE-92EE-6BAAC78729E2}, revision 100 completed successfully.
2005-04-15 10:48:22+0100 2628 3a4 Successfully downloaded file from
http://au.download.windowsupdate.com...oad/update/v3-
19990518/cabpool/windows2000-kb842773-x86-
enu_e676d47e065a314bbf1d15b096a67aede6b0539a.exe to C:\WINNT
\SoftwareDistribution\Download\S-1-5-18\932ed89017a1bad1845f7fa5b3e95b10
\Windows2000-KB842773-x86-enu.exe.
2005-04-15 10:48:22+0100 2628 518 WU client calls back to download
call {51D76EFE-A798-4221-B41C-CA24976CE438} with code Call progress and
error 0
2005-04-15 10:48:23+0100 2628 518 WU client calls back to download
call {51D76EFE-A798-4221-B41C-CA24976CE438} with code Call progress and
error 0
2005-04-15 10:48:25+0100 2628 97c AU received event of 0
2005-04-15 10:48:25+0100 2628 3a4 WU client persisted 1 download calls
2005-04-15 10:48:26+0100 2628 3a4 WU client persisted 1 download calls
2005-04-15 10:48:26+0100 2628 3a4 OS Version = 5.0.2195.4.0.65536
2005-04-15 10:48:26+0100 2628 3a4 Failed to load reporting information
from WMI with hr = 80041014.
2005-04-15 10:48:26+0100 2628 3a4 Locale ID = 1033
2005-04-15 10:48:26+0100 2628 3a4 ClientVersion: iuengine.dll =
5.4.3790.2163
2005-04-15 10:48:26+0100 2628 3a4 ClientVersion: wuapi.dll =
5.4.3790.2163
2005-04-15 10:48:27+0100 2628 3a4 ClientVersion: wuauclt.exe =
5.4.3790.2163
2005-04-15 10:48:27+0100 2628 3a4 ClientVersion: wuauclt1.exe =
5.4.3790.2163
2005-04-15 10:48:27+0100 2628 3a4 ClientVersion: wuaucpl.cpl =
5.4.3790.2163
2005-04-15 10:48:27+0100 2628 3a4 ClientVersion: wuaueng.dll =
5.4.3790.2163
2005-04-15 10:48:27+0100 2628 3a4 ClientVersion: wuaueng1.dll =
5.4.3790.2163
2005-04-15 10:48:27+0100 2628 3a4 ClientVersion: wuauserv.dll =
5.4.3630.2554
2005-04-15 10:48:27+0100 2628 3a4 ClientVersion: wucltui.dll =
5.4.3790.2163
2005-04-15 10:48:27+0100 2628 518 Download complete for all calls
2005-04-15 10:48:28+0100 2628 518 WU client calls back to download
call {51D76EFE-A798-4221-B41C-CA24976CE438} with code Call complete and
error 0
2005-04-15 10:48:28+0100 2628 518 WU client completed and deleted call
{51D76EFE-A798-4221-B41C-CA24976CE438}
2005-04-15 10:48:28+0100 2628 518 WU client persisted 0 download calls
2005-04-15 10:48:34+0100 2628 8dc WU client add update {7E42BA28-C236-
4B44-B6BA-C00ADD8DE5A3}.100 to search result
2005-04-15 10:48:34+0100 2628 8dc WU client add update {0C0F4FFB-8D37-
417C-8F69-073A8B223A78}.100 to search result
2005-04-15 10:48:34+0100 2628 8dc WU client add update {D7B61865-7029-
4865-8A38-168399DBC68B}.100 to search result
2005-04-15 10:48:34+0100 2628 8dc WU client add update {DBE60056-72CC-
4B90-B497-AFB619618F67}.100 to search result
2005-04-15 10:48:34+0100 2628 8dc WU client add update {3CC799B2-35E1-
4AD7-962E-DBE9462FCDD6}.100 to search result
2005-04-15 10:48:34+0100 2628 8dc WU client add update {0519DD06-56DA-
4804-97BB-E60A8EC36495}.100 to search result
2005-04-15 10:48:34+0100 2628 8dc WU client found 6 updates and 10
categories in search
2005-04-15 10:48:35+0100 2628 8dc WU client finished Searching for
update
2005-04-15 10:48:35+0100 2628 518 AU Detection callback: 6 updates
detected
2005-04-15 10:48:35+0100 2628 518 AU detected 1 mandatory updates
2005-04-15 10:48:35+0100 2628 518 Setting next AU detection timeout to
2005-04-16 07:44:06
2005-04-15 10:48:35+0100 2628 8dc REPORT EVENT: {9E4C2A5A-BA19-4848-
8B43-6553A5B9A913} 811 2005-04-15 10:48:26+0100 1 162 101
{7E42BA28-C236-4B44-B6BA-C00ADD8DE5A3} 100 0
AutomaticUpdates Success Content Download Download
succeeded.
2005-04-15 10:48:35+0100 2628 8dc REPORT EVENT: {0E6E9B99-3205-49BF-
A665-76188AADE1AD} 812 2005-04-15 10:48:27+0100 1 162 101
{6E2CE922-F9D8-43DE-92EE-6BAAC78729E2} 100 0
AutomaticUpdates Success Content Download Download
succeeded.
2005-04-15 10:48:35+0100 2628 8dc REPORT EVENT: {5C02C900-9138-447D-
8D41-B04942082735} 813 2005-04-15 10:48:28+0100 1 189 102
{00000000-0000-0000-0000-000000000000} 0 0
AutomaticUpdates Success Content Install Installation Ready:
The following updates are downloaded and ready for installation. To
install the updates, an administrator should log on to this computer and
Windows will prompt with further instructions: - Update for Background
Intelligent Transfer Service (BITS) 2.0 and WinHTTP 5.1 (KB842773)
2005-04-15 10:48:35+0100 2628 8dc Reopened existing event cache file
at C:\WINNT\SoftwareDistribution\EventCache\{6624CB58-E90D-40A0-97A6-
DDE15DF909C2}.bin for writing.
2005-04-15 10:48:35+0100 2628 8dc Reopened existing event cache file
at C:\WINNT\SoftwareDistribution\EventCache\{409BBD1E-8D25-4F93-96A2-
56337E107477}.bin for writing.
2005-04-15 10:48:35+0100 2628 518 WU client calls back to search call
AutomaticUpdates with code Call complete and error 0
2005-04-15 10:48:35+0100 2628 518 WU client completed and deleted call
{8AB68C49-228E-410B-A0F5-CA43F774000E}
2005-04-15 10:48:39+0100 2628 97c AU received event of 1
2005-04-15 10:48:40+0100 2628 97c Successfully launched client for
directive 5
2005-04-15 10:48:40+0100 2628 518 REPORT EVENT: {C3E1769D-6CD6-47FA-
93AD-3CA9DC423323} 814 2005-04-15 10:48:34+0100 1 147 101
{00000000-0000-0000-0000-000000000000} 0 0
AutomaticUpdates Success Software Synchronization Agent has
finished detecting items.
2005-04-15 10:49:09+0100 2628 7bc AU Client approved 1 updates for
install
2005-04-15 10:49:09+0100 2628 7bc WU client succeeds
CClientCallRecorder::BeginInstallUpdates from AutomaticUpdates with call
id {CDB85136-399E-4C2B-B68D-B24E9C357FD2}
2005-04-15 10:49:09+0100 2628 7bc Successfully initiated install for 1
updates
2005-04-15 10:49:09+0100 2628 518 WU client executing call {CDB85136-
399E-4C2B-B68D-B24E9C357FD2} of type Install call
2005-04-15 10:49:09+0100 2628 518 validate updates before Install
2005-04-15 10:49:14+0100 2628 518 prune update list before Install
2005-04-15 10:49:16+0100 2628 518 WU client starts install in user
context
2005-04-15 10:49:16+0100 2628 518 WU client is installing update
{6E2CE922-F9D8-43DE-92EE-6BAAC78729E2}.100
2005-04-15 10:49:20+0100 2628 130 Install failed: d0000005
2005-04-15 10:49:20+0100 2628 518 WU client finishes installing update
{6E2CE922-F9D8-43DE-92EE-6BAAC78729E2}.100 with result 0x8024200b
2005-04-15 10:49:20+0100 2628 518 WU client finished installing
updates
2005-04-15 10:49:20+0100 2628 518 Install call completed.
2005-04-15 10:49:20+0100 2628 518 Install complete for all calls,
reboot NOT needed
2005-04-15 10:49:20+0100 2628 518 WU client calls back to install call
{CDB85136-399E-4C2B-B68D-B24E9C357FD2} with code Call complete and error
0
2005-04-15 10:49:20+0100 2628 97c AU received event of 1
2005-04-15 10:49:20+0100 2628 97c WU client succeeds
CClientCallRecorder::BeginFindUpdates from AutomaticUpdates with call id
{76CBE5BA-3C24-4A81-B31A-6091D5E74D40}
2005-04-15 10:49:20+0100 2628 518 WU client completed and deleted call
{CDB85136-399E-4C2B-B68D-B24E9C357FD2}
2005-04-15 10:49:20+0100 2628 518 WU client executing call {76CBE5BA-
3C24-4A81-B31A-6091D5E74D40} of type Search Call
2005-04-15 10:49:23+0100 2628 518 WU client add update {7E42BA28-C236-
4B44-B6BA-C00ADD8DE5A3}.100 to search result
2005-04-15 10:49:23+0100 2628 518 WU client add update {0C0F4FFB-8D37-
417C-8F69-073A8B223A78}.100 to search result
2005-04-15 10:49:23+0100 2628 518 WU client add update {D7B61865-7029-
4865-8A38-168399DBC68B}.100 to search result
2005-04-15 10:49:23+0100 2628 518 WU client add update {DBE60056-72CC-
4B90-B497-AFB619618F67}.100 to search result
2005-04-15 10:49:23+0100 2628 518 WU client add update {3CC799B2-35E1-
4AD7-962E-DBE9462FCDD6}.100 to search result
2005-04-15 10:49:23+0100 2628 518 WU client add update {0519DD06-56DA-
4804-97BB-E60A8EC36495}.100 to search result
2005-04-15 10:49:23+0100 2628 518 WU client found 6 updates and 10
categories in search
2005-04-15 10:49:23+0100 2628 518 WU client finished Searching for
update
2005-04-15 10:49:23+0100 2628 518 AU Detection callback: 6 updates
detected
2005-04-15 10:49:23+0100 2628 518 AU detected 1 mandatory updates
2005-04-15 10:49:23+0100 2628 518 WU client calls back to search call
AutomaticUpdates with code Call complete and error 0
2005-04-15 10:49:23+0100 2628 518 WU client completed and deleted call
{76CBE5BA-3C24-4A81-B31A-6091D5E74D40}
2005-04-15 10:49:24+0100 2628 368 Resetting cached installation status
2005-04-15 10:49:25+0100 2628 97c AU received event of 0
2005-04-15 10:49:25+0100 2628 518 REPORT EVENT: {73D4D79C-5906-4EA8-
AA07-2CAE04411EB1} 815 2005-04-15 10:49:20+0100 1 182 101
{7E42BA28-C236-4B44-B6BA-C00ADD8DE5A3} 100 d0000005
AutomaticUpdates Failure Content Install Installation
Failure: Windows failed to install the following update with error
0xd0000005: Update for Background Intelligent Transfer Service (BITS) 2.0
and WinHTTP 5.1 (KB842773).
2005-04-15 10:49:25+0100 2628 518 REPORT EVENT: {0D55E142-B1EB-4091-
A37B-2E70C63132BA} 816 2005-04-15 10:49:20+0100 1 182 101
{6E2CE922-F9D8-43DE-92EE-6BAAC78729E2} 100 d0000005
AutomaticUpdates Failure Content Install Installation
Failure: Windows failed to install the following update with error
0xd0000005: Update for Background Intelligent Transfer Service (BITS) 2.0
and WinHTTP 5.1 (KB842773).

I have also run an update through Dependancy Walker. The last meaningful
log entry says "Second chance exception 0xC0000005 (Access Violation)
occurred in "c:\winnt\system32\WINTRUST.DLL" at address 0x769503B2."

This DLL is identical to a collegues so the DLL is not corrupt.

Warning: At least one delay-load dependency module was not found.
Warning: At least one module has an unresolved import due to a missing
export function in a delay-load dependent module.

-------------------------------------------------------------------------
-------
Starting profile on 15/04/2005 at 11:33:10

Operating System: Microsoft Windows 2000 Professional (32-bit), version
5.00.2195 Service Pack 4
Program Executable: c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE
Program Arguments:
Starting Directory: c:\9c3b6d437d78ea73d12fe1d495\update\
Search Path: C:\WINNT\system32;C:\WINNT;C:\PROGRA~1\ULTRAE~1;C: \TVPCDEV
\COMMANDS;C:\Program Files\WinZip;C:\UTILS;C:\WINNT\Microsoft.NET
\Framework\v1.0.3705;C:\Program Files\Common Files\GTK\2.0\lib;C:\Program
Files\Common Files\GTK\2.0\lib\gtk-2.0\2.2.0\engines;C:\Program Files
\Common Files\GTK\2.0\lib\gtk-2.0\2.2.0\immodules;C:\Program Files\Common
Files\GTK\2.0\lib\gtk-2.0\2.2.0\loaders;C:\Program Files\Common Files\GTK
\2.0\lib\pango\1.0.0\modules;C:\Program Files\MS Debugging Tools for
Windows;C:\Program Files\Common Files\OpSession\Viewer Shared;C:\Program
Files\Microsoft SQL Server\80\Tools\BINN;C:\Program Files\rksupport;C:
\Program Files\Programming Tools\doxygen\bin;C:\Program Files\Programming
Tools\doxygen\EXTERN~1\Graphviz\bin;C:\Program Files\Programming Tools
\doxygen\EXTERN~1\Graphviz\bin\tools;C:\Program Files\HTML Help
Workshop;c:\Program Files\Support Tools\;C:\perl-5.8.0;C:\perl-5.8.0
\UTILS;C:\Program Files\Microsoft Visual Studio .NET 2003\Common7\Tools
\;C:\WINNT\system32\WBEM;

Options Selected:
Log DllMain calls for process attach and process detach messages.
Hook the process to gather more detailed dependency information.
Log LoadLibrary function calls.
Log GetProcAddress function calls.
Log debug output messages.
Use full paths when logging file names.
Automatically open and profile child processes.
-------------------------------------------------------------------------
-------

Started "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" (process 0x83C)
at address 0x01000000. Successfully hooked module.
Loaded "c:\winnt\system32\NTDLL.DLL" at address 0x77F80000. Successfully
hooked module.
Loaded "c:\winnt\system32\KERNEL32.DLL" at address 0x7C570000.
Successfully hooked module.
Loaded "c:\winnt\system32\SHELL32.DLL" at address 0x782F0000.
Successfully hooked module.
Loaded "c:\winnt\system32\GDI32.DLL" at address 0x77F40000. Successfully
hooked module.
Loaded "c:\winnt\system32\USER32.DLL" at address 0x77E10000.
Successfully hooked module.
Loaded "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2D0000.
Successfully hooked module.
Loaded "c:\winnt\system32\RPCRT4.DLL" at address 0x77D30000.
Successfully hooked module.
Loaded "c:\winnt\system32\SHLWAPI.DLL" at address 0x70A70000.
Successfully hooked module.
Loaded "c:\winnt\system32\MSVCRT.DLL" at address 0x78000000.
Successfully hooked module.
Loaded "c:\winnt\system32\COMCTL32.DLL" at address 0x71710000.
Successfully hooked module.
Loaded "c:\winnt\system32\IMAGEHLP.DLL" at address 0x77920000.
Successfully hooked module.
Loaded "c:\winnt\system32\MPR.DLL" at address 0x76620000. Successfully
hooked module.
Loaded "c:\winnt\system32\VERSION.DLL" at address 0x77820000.
Successfully hooked module.
Loaded "c:\winnt\system32\LZ32.DLL" at address 0x759B0000. Successfully
hooked module.
Loaded "c:\winnt\system32\PSAPI.DLL" at address 0x690A0000. Successfully
hooked module.
Loaded "c:\winnt\system32\OLE32.DLL" at address 0x77A50000. Successfully
hooked module.
Loaded "c:\winnt\system32\OLEAUT32.DLL" at address 0x779B0000.
Successfully hooked module.
Loaded "c:\winnt\system32\WINSPOOL.DRV" at address 0x77800000.
Successfully hooked module.
Loaded "c:\winnt\system32\CRYPT32.DLL" at address 0x7C740000.
Successfully hooked module.
Loaded "c:\winnt\system32\MSASN1.DLL" at address 0x77430000.
Successfully hooked module.
Loaded "c:\winnt\system32\USERENV.DLL" at address 0x7C0F0000.
Successfully hooked module.
Entrypoint reached. All implicit modules have been loaded.
DllMain(0x7C570000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\KERNEL32.DLL" called.
DllMain(0x7C570000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\KERNEL32.DLL" returned 1 (0x1).
Injected "c:\progra~1\micros~1.ne~\common7\tools\bin\DEPEND S.DLL" at
address 0x08370000.
DllMain(0x08370000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\progra~1
\micros~1.ne~\common7\tools\bin\DEPENDS.DLL" called.
DllMain(0x08370000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\progra~1
\micros~1.ne~\common7\tools\bin\DEPENDS.DLL" returned 1 (0x1).
DllMain(0x77E10000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\USER32.DLL" called.
LoadLibraryW("shim.dll") called from "c:\winnt\system32\USER32.DLL" at
address 0x77E3E133.
Loaded "c:\winnt\system32\SHIM.DLL" at address 0x732E0000. Successfully
hooked module.
DllMain(0x732E0000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\SHIM.DLL" called.
DllMain(0x732E0000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\SHIM.DLL" returned 1 (0x1).
LoadLibraryW("shim.dll") returned 0x732E0000.
GetProcAddress(0x732E0000 [c:\winnt\system32\SHIM.DLL], "LoadPatchDll")
called from "c:\winnt\system32\USER32.DLL" at address 0x77E3E145 and
returned 0x732E8B41.
LoadLibraryExW("c:\9c3b6d437d78ea73d12fe1d495\upda te\update.exe",
0x00000000, LOAD_LIBRARY_AS_DATAFILE) called from "c:\winnt\system32
\VERSION.DLL" at address 0x778213F1.
Mapped "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" as a data file
into memory at address 0x01000000.
LoadLibraryExW("c:\9c3b6d437d78ea73d12fe1d495\upda te\update.exe",
0x00000000, LOAD_LIBRARY_AS_DATAFILE) returned 0x01000000.
LoadLibraryExW("c:\9c3b6d437d78ea73d12fe1d495\upda te\update.exe",
0x00000000, LOAD_LIBRARY_AS_DATAFILE) called from "c:\winnt\system32
\VERSION.DLL" at address 0x778215C5.
Mapped "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" as a data file
into memory at address 0x01000000.
LoadLibraryExW("c:\9c3b6d437d78ea73d12fe1d495\upda te\update.exe",
0x00000000, LOAD_LIBRARY_AS_DATAFILE) returned 0x01000000.
DllMain(0x77E10000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\USER32.DLL" returned 28311553 (0x1B00001).
DllMain(0x77D30000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\RPCRT4.DLL" called.
LoadLibraryA("kernel32.dll") called from "c:\winnt\system32\RPCRT4.DLL"
at address 0x77D3E850.
LoadLibraryA("kernel32.dll") returned 0x7C570000.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"InterlockedCompareExchange") called from "c:\winnt\system32\RPCRT4.DLL"
at address 0x77D3E860 and returned 0x7C57B5BC.
DllMain(0x77D30000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\RPCRT4.DLL" returned 1 (0x1).
DllMain(0x7C2D0000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\ADVAPI32.DLL" called.
DllMain(0x7C2D0000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\ADVAPI32.DLL" returned 1 (0x1).
DllMain(0x78000000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\MSVCRT.DLL" called.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"IsProcessorFeaturePresent") called from "c:\winnt\system32\MSVCRT.DLL"
at address 0x78001EAA and returned 0x7C597AAD.
DllMain(0x78000000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\MSVCRT.DLL" returned 1 (0x1).
DllMain(0x70A70000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\SHLWAPI.DLL" called.
DllMain(0x70A70000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\SHLWAPI.DLL" returned 1 (0x1).
DllMain(0x71710000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\COMCTL32.DLL" called.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"ProcessIdToSessionId") called from "c:\winnt\system32\COMCTL32.DLL" at
address 0x71722F54 and returned 0x7C5987C0.
GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
"GetSystemMetrics") called from "c:\winnt\system32\COMCTL32.DLL" at
address 0x717297A6 and returned 0x77E16D11.
GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
"MonitorFromWindow") called from "c:\winnt\system32\COMCTL32.DLL" at
address 0x717297B7 and returned 0x77E4F33D.
GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
"MonitorFromRect") called from "c:\winnt\system32\COMCTL32.DLL" at
address 0x717297C8 and returned 0x77E4F2C2.
GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
"MonitorFromPoint") called from "c:\winnt\system32\COMCTL32.DLL" at
address 0x717297D9 and returned 0x77E4F244.
GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
"EnumDisplayMonitors") called from "c:\winnt\system32\COMCTL32.DLL" at
address 0x717297EA and returned 0x77E58246.
GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
"EnumDisplayDevicesW") called from "c:\winnt\system32\COMCTL32.DLL" at
address 0x717297FB and returned 0x77E41D11.
GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
"GetMonitorInfoW") called from "c:\winnt\system32\COMCTL32.DLL" at
address 0x7172981B and returned 0x77E3DC5A.
DllMain(0x71710000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\COMCTL32.DLL" returned 1 (0x1).
DllMain(0x782F0000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\SHELL32.DLL" called.
DllMain(0x782F0000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\SHELL32.DLL" returned 1 (0x1).
DllMain(0x77920000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\IMAGEHLP.DLL" called.
DllMain(0x77920000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\IMAGEHLP.DLL" returned 1 (0x1).
DllMain(0x76620000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\MPR.DLL" called.
DllMain(0x76620000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\MPR.DLL" returned 1 (0x1).
DllMain(0x759B0000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\LZ32.DLL" called.
DllMain(0x759B0000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\LZ32.DLL" returned 1 (0x1).
DllMain(0x77820000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\VERSION.DLL" called.
DllMain(0x77820000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\VERSION.DLL" returned 1 (0x1).
DllMain(0x690A0000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\PSAPI.DLL" called.
DllMain(0x690A0000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\PSAPI.DLL" returned 131073 (0x20001).
DllMain(0x77A50000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\OLE32.DLL" called.
GetProcAddress(0x77D30000 [c:\winnt\system32\RPCRT4.DLL],
"I_RpcForcePickleCleanup") called from "c:\winnt\system32\OLE32.DLL" at
address 0x77B12A68 and returned 0x77D4CD2E.
GetProcAddress(0x77F80000 [c:\winnt\system32\NTDLL.DLL],
"NtQuerySystemInformation") called from "c:\winnt\system32\RPCRT4.DLL" at
address 0x77D488A6 and returned 0x77F83227.
GetProcAddress(0x77F80000 [c:\winnt\system32\NTDLL.DLL], "NtOpenFile")
called from "c:\winnt\system32\RPCRT4.DLL" at address 0x77D488C1 and
returned 0x77F85AFB.
GetProcAddress(0x77F80000 [c:\winnt\system32\NTDLL.DLL],
"RtlInitUnicodeString") called from "c:\winnt\system32\RPCRT4.DLL" at
address 0x77D488CE and returned 0x77F8335D.
DllMain(0x77A50000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\OLE32.DLL" returned 1 (0x1).
DllMain(0x779B0000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\OLEAUT32.DLL" called.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL], "IsTNT")
called from "c:\winnt\system32\OLEAUT32.DLL" at address 0x77A23F12 and
returned NULL. Error: The specified procedure could not be found (127).
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"IsProcessorFeaturePresent") called from "c:\winnt\system32
\OLEAUT32.DLL" at address 0x77A272EB and returned 0x7C597AAD.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"SetCriticalSectionSpinCount") called from "c:\winnt\system32
\OLEAUT32.DLL" at address 0x779C83EB and returned 0x77F8E85F.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"SetCriticalSectionSpinCount") called from "c:\winnt\system32
\OLEAUT32.DLL" at address 0x779C83EB and returned 0x77F8E85F.
LoadLibraryA("C:\WINNT\system32\ole32.dll") called from "c:\winnt
\system32\OLEAUT32.DLL" at address 0x77A0FA9E.
LoadLibraryA("C:\WINNT\system32\ole32.dll") returned 0x77A50000.
GetProcAddress(0x77A50000 [c:\winnt\system32\OLE32.DLL],
"DcomChannelSetHResult") called from "c:\winnt\system32\OLEAUT32.DLL" at
address 0x77A0FAB3 and returned 0x77A9C757.
DllMain(0x779B0000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\OLEAUT32.DLL" returned 1 (0x1).
DllMain(0x77800000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\WINSPOOL.DRV" called.
DllMain(0x77800000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\WINSPOOL.DRV" returned 1 (0x1).
DllMain(0x77430000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\MSASN1.DLL" called.
DllMain(0x77430000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\MSASN1.DLL" returned 1 (0x1).
DllMain(0x7C740000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\CRYPT32.DLL" called.
LoadLibraryA("advapi32.dll") called from "c:\winnt\system32\CRYPT32.DLL"
at address 0x7C741B77.
LoadLibraryA("advapi32.dll") returned 0x7C2D0000.
GetProcAddress(0x7C2D0000 [c:\winnt\system32\ADVAPI32.DLL],
"CryptAcquireContextW") called from "c:\winnt\system32\CRYPT32.DLL" at
address 0x7C741B8A and returned 0x7C2EA433.
GetProcAddress(0x7C2D0000 [c:\winnt\system32\ADVAPI32.DLL],
"CryptSignHashW") called from "c:\winnt\system32\CRYPT32.DLL" at address
0x7C741B9C and returned 0x7C2F7BA1.
GetProcAddress(0x7C2D0000 [c:\winnt\system32\ADVAPI32.DLL],
"CryptVerifySignatureW") called from "c:\winnt\system32\CRYPT32.DLL" at
address 0x7C741BAE and returned 0x7C2F7C8C.
GetProcAddress(0x7C2D0000 [c:\winnt\system32\ADVAPI32.DLL],
"CryptSetProviderW") called from "c:\winnt\system32\CRYPT32.DLL" at
address 0x7C741BC0 and returned 0x7C2F7EF5.
LoadLibraryA("kernel32.dll") called from "c:\winnt\system32\CRYPT32.DLL"
at address 0x7C75E1F5.
LoadLibraryA("kernel32.dll") returned 0x7C570000.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"RegisterWaitForSingleObject") called from "c:\winnt\system32
\CRYPT32.DLL" at address 0x7C75E210 and returned 0x7C59C578.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"UnregisterWaitEx") called from "c:\winnt\system32\CRYPT32.DLL" at
address 0x7C75E22A and returned 0x7C59C6B1.
LoadLibraryA("advapi32.dll") called from "c:\winnt\system32\MSASN1.DLL"
at address 0x77437AB0.
LoadLibraryA("advapi32.dll") returned 0x7C2D0000.
GetProcAddress(0x7C2D0000 [c:\winnt\system32\ADVAPI32.DLL],
"RegOpenKeyExA") called from "c:\winnt\system32\MSASN1.DLL" at address
0x77437AC6 and returned 0x7C2D24B9.
DllMain(0x7C740000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\CRYPT32.DLL" returned 1 (0x1).
DllMain(0x7C0F0000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\USERENV.DLL" called.
DllMain(0x7C0F0000, DLL_PROCESS_ATTACH, 0x0006FD30) in "c:\winnt\system32
\USERENV.DLL" returned 1 (0x1).
Loaded "c:\winnt\system32\ENTAPI.DLL" at address 0x37000000.
Successfully hooked module.
Loaded "c:\winnt\system32\NETAPI32.DLL" at address 0x75170000.
Successfully hooked module.
Loaded "c:\winnt\system32\SECUR32.DLL" at address 0x7C340000.
Successfully hooked module.
Loaded "c:\winnt\system32\NTDSAPI.DLL" at address 0x77BF0000.
Successfully hooked module.
Loaded "c:\winnt\system32\DNSAPI.DLL" at address 0x77980000.
Successfully hooked module.
Loaded "c:\winnt\system32\WSOCK32.DLL" at address 0x75050000.
Successfully hooked module.
Loaded "c:\winnt\system32\WS2_32.DLL" at address 0x75030000.
Successfully hooked module.
Loaded "c:\winnt\system32\WS2HELP.DLL" at address 0x75020000.
Successfully hooked module.
Loaded "c:\winnt\system32\WLDAP32.DLL" at address 0x77950000.
Successfully hooked module.
Loaded "c:\winnt\system32\NETRAP.DLL" at address 0x751C0000.
Successfully hooked module.
Loaded "c:\winnt\system32\SAMLIB.DLL" at address 0x75150000.
Successfully hooked module.
DllMain(0x7C340000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\SECUR32.DLL" called.
DllMain(0x7C340000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\SECUR32.DLL" returned 1 (0x1).
DllMain(0x75020000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\WS2HELP.DLL" called.
DllMain(0x75020000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\WS2HELP.DLL" returned 1 (0x1).
DllMain(0x75030000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\WS2_32.DLL" called.
DllMain(0x75030000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\WS2_32.DLL" returned 1 (0x1).
DllMain(0x77980000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\DNSAPI.DLL" called.
DllMain(0x77980000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\DNSAPI.DLL" returned 1 (0x1).
DllMain(0x77950000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\WLDAP32.DLL" called.
DllMain(0x77950000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\WLDAP32.DLL" returned 1 (0x1).
DllMain(0x77BF0000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\NTDSAPI.DLL" called.
DllMain(0x77BF0000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\NTDSAPI.DLL" returned 1 (0x1).
DllMain(0x75150000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\SAMLIB.DLL" called.
DllMain(0x75150000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\SAMLIB.DLL" returned 1 (0x1).
DllMain(0x75170000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\NETAPI32.DLL" called.
DllMain(0x75170000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\NETAPI32.DLL" returned 1 (0x1).
DllMain(0x37000000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\ENTAPI.DLL" called.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetLongPathNameW") called from "c:\winnt\system32\ENTAPI.DLL" at address
0x370031AB and returned 0x7C5A2292.
DllMain(0x37000000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\ENTAPI.DLL" returned 0 (0x0).
DllMain(0x37000000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\ENTAPI.DLL" called.
DllMain(0x37000000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\ENTAPI.DLL" returned 0 (0x0).
DllMain(0x75170000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\NETAPI32.DLL" called.
DllMain(0x75170000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\NETAPI32.DLL" returned 1 (0x1).
DllMain(0x75150000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\SAMLIB.DLL" called.
DllMain(0x75150000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\SAMLIB.DLL" returned 1 (0x1).
DllMain(0x77BF0000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\NTDSAPI.DLL" called.
DllMain(0x77BF0000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\NTDSAPI.DLL" returned 1 (0x1).
DllMain(0x77950000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\WLDAP32.DLL" called.
DllMain(0x77950000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\WLDAP32.DLL" returned 1 (0x1).
DllMain(0x77980000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\DNSAPI.DLL" called.
DllMain(0x77980000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\DNSAPI.DLL" returned 1 (0x1).
DllMain(0x7C340000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\SECUR32.DLL" called.
DllMain(0x7C340000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\SECUR32.DLL" returned 1 (0x1).
Unloaded "c:\winnt\system32\ENTAPI.DLL" at address 0x37000000.
Unloaded "c:\winnt\system32\NETAPI32.DLL" at address 0x75170000.
Unloaded "c:\winnt\system32\SAMLIB.DLL" at address 0x75150000.
Unloaded "c:\winnt\system32\NETRAP.DLL" at address 0x751C0000.
Unloaded "c:\winnt\system32\NTDSAPI.DLL" at address 0x77BF0000.
Unloaded "c:\winnt\system32\WLDAP32.DLL" at address 0x77950000.
Unloaded "c:\winnt\system32\DNSAPI.DLL" at address 0x77980000.
Unloaded "c:\winnt\system32\WSOCK32.DLL" at address 0x75050000.
Unloaded "c:\winnt\system32\SECUR32.DLL" at address 0x7C340000.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"UnhandledExceptionFilter") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x01066971 and returned 0x7C59BCDC.
LoadLibraryA("setupapi.dll") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x0106BA3B.
Loaded "c:\winnt\system32\SETUPAPI.DLL" at address 0x77880000.
Successfully hooked module.
DllMain(0x77880000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\SETUPAPI.DLL" called.
LoadLibraryA("COMCTL32.dll") called from "c:\winnt\system32
\SETUPAPI.DLL" at address 0x7788A156.
LoadLibraryA("COMCTL32.dll") returned 0x71710000.
GetProcAddress(0x71710000 [c:\winnt\system32\COMCTL32.DLL], 0x00000011)
called from "c:\winnt\system32\SETUPAPI.DLL" at address 0x7788A1AC and
returned 0x717240A6.
LoadLibraryA("kernel32.dll") called from "c:\winnt\system32
\SETUPAPI.DLL" at address 0x7788A316.
LoadLibraryA("kernel32.dll") returned 0x7C570000.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetFileAttributesExA") called from "c:\winnt\system32\SETUPAPI.DLL" at
address 0x7788A2F5 and returned 0x7C587482.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetFileAttributesExW") called from "c:\winnt\system32\SETUPAPI.DLL" at
address 0x7788A2F5 and returned 0x7C5874A2.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetSystemWindowsDirectoryA") called from "c:\winnt\system32
\SETUPAPI.DLL" at address 0x7788A2F5 and returned 0x7C592C13.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetSystemWindowsDirectoryW") called from "c:\winnt\system32
\SETUPAPI.DLL" at address 0x7788A2F5 and returned 0x7C592C6E.
DllMain(0x77880000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\SETUPAPI.DLL" returned 1 (0x1).
LoadLibraryA("setupapi.dll") returned 0x77880000.
GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
"pSetupIsUserAdmin") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x0106BA4D and returned NULL. Error: The
specified procedure could not be found (127).
DllMain(0x77880000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\SETUPAPI.DLL" called.
DllMain(0x77880000, DLL_PROCESS_DETACH, 0x00000000) in "c:\winnt\system32
\SETUPAPI.DLL" returned 1 (0x1).
Unloaded "c:\winnt\system32\SETUPAPI.DLL" at address 0x77880000.
LoadLibraryW("rpcrt4.dll") called from "c:\winnt\system32\RPCRT4.DLL" at
address 0x77D400DA.
LoadLibraryW("rpcrt4.dll") returned 0x77D30000.
LoadLibraryA("SetupApi.DLL") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x01073365.
Loaded "c:\winnt\system32\SETUPAPI.DLL" at address 0x77880000.
Successfully hooked module.
DllMain(0x77880000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\SETUPAPI.DLL" called.
LoadLibraryA("COMCTL32.dll") called from "c:\winnt\system32
\SETUPAPI.DLL" at address 0x7788A156.
LoadLibraryA("COMCTL32.dll") returned 0x71710000.
GetProcAddress(0x71710000 [c:\winnt\system32\COMCTL32.DLL], 0x00000011)
called from "c:\winnt\system32\SETUPAPI.DLL" at address 0x7788A1AC and
returned 0x717240A6.
LoadLibraryA("kernel32.dll") called from "c:\winnt\system32
\SETUPAPI.DLL" at address 0x7788A316.
LoadLibraryA("kernel32.dll") returned 0x7C570000.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetFileAttributesExA") called from "c:\winnt\system32\SETUPAPI.DLL" at
address 0x7788A2F5 and returned 0x7C587482.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetFileAttributesExW") called from "c:\winnt\system32\SETUPAPI.DLL" at
address 0x7788A2F5 and returned 0x7C5874A2.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetSystemWindowsDirectoryA") called from "c:\winnt\system32
\SETUPAPI.DLL" at address 0x7788A2F5 and returned 0x7C592C13.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetSystemWindowsDirectoryW") called from "c:\winnt\system32
\SETUPAPI.DLL" at address 0x7788A2F5 and returned 0x7C592C6E.
DllMain(0x77880000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\SETUPAPI.DLL" returned 1 (0x1).
LoadLibraryA("SetupApi.DLL") returned 0x77880000.
GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
"VerifyCatalogFile") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x0107347C and returned 0x778BDF7C.
GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
"InstallCatalog") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x0107348E and returned 0x778BDE7A.
GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
"StringTableEnum") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x010734A0 and returned 0x778D1755.
GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
"StringTableInitializeEx") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x010734B2 and returned 0x778831EC.
GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
"StringTableAddStringEx") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x010734C4 and returned 0x77885FAC.
GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
"StringTableLookUpStringEx") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x010734D6 and returned 0x77885F0C.
GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
"MyGetFileTitle") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x010734E8 and returned 0x778815F6.
GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
"SetupCopyOEMInfA") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x010734FA and returned 0x778A5AA0.
GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
"pSetupSetGlobalFlags") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x0107350C and returned 0x778B662E.
GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
"pSetupGetGlobalFlags") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x0107351E and returned 0x778B663A.
LoadLibraryA("Cabinet.dll") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x01073534.
Loaded "c:\winnt\system32\CABINET.DLL" at address 0x75A00000.
Successfully hooked module.
LoadLibraryA("Cabinet.dll") returned 0x75A00000.
GetProcAddress(0x75A00000 [c:\winnt\system32\CABINET.DLL], "FCIDestroy")
called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address
0x01073545 and returned 0x75A06A0A.
GetProcAddress(0x75A00000 [c:\winnt\system32\CABINET.DLL],
"FCIFlushCabinet") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x01073557 and returned 0x75A06999.
GetProcAddress(0x75A00000 [c:\winnt\system32\CABINET.DLL], "FCIAddFile")
called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address
0x01073569 and returned 0x75A068D8.
GetProcAddress(0x75A00000 [c:\winnt\system32\CABINET.DLL], "FCICreate")
called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address
0x0107357B and returned 0x75A0679B.
GetProcAddress(0x75A00000 [c:\winnt\system32\CABINET.DLL], "FDIDestroy")
called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address
0x0107358D and returned 0x75A01CD8.
GetProcAddress(0x75A00000 [c:\winnt\system32\CABINET.DLL], "FDICopy")
called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address
0x0107359F and returned 0x75A01DBF.
GetProcAddress(0x75A00000 [c:\winnt\system32\CABINET.DLL], "FDICreate")
called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address
0x010735B1 and returned 0x75A01C48.
LoadLibraryA("psapi.dll") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x010735BD.
LoadLibraryA("psapi.dll") returned 0x690A0000.
GetProcAddress(0x690A0000 [c:\winnt\system32\PSAPI.DLL],
"GetModuleBaseNameA") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x010735CE and returned 0x690A1BD4.
GetProcAddress(0x690A0000 [c:\winnt\system32\PSAPI.DLL],
"EnumProcessModules") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x010735E0 and returned 0x690A1981.
GetProcAddress(0x690A0000 [c:\winnt\system32\PSAPI.DLL], "EnumProcesses")
called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address
0x010735F2 and returned 0x690A3106.
LoadLibraryA("wintrust.dll") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x010735FE.
Loaded "c:\winnt\system32\WINTRUST.DLL" at address 0x76930000.
Successfully hooked module.
DllMain(0x76930000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\WINTRUST.DLL" called.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000, 0x00000000)
returned 0x76930000.
DllMain(0x76930000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\WINTRUST.DLL" returned 1 (0x1).
LoadLibraryA("wintrust.dll") returned 0x76930000.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATOpen") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x01073613 and returned 0x769479AB.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATClose") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x01073625 and returned 0x76947A70.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATGetCatAttrInfo") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x01073637 and returned 0x76947BC7.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATEnumerateMember") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x01073649 and returned 0x769482A7.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATEnumerateAttr") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x0107365B and returned 0x7694832E.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATAdminRemoveCatalog") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x0107366D and returned NULL. Error: The
specified procedure could not be found (127).
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATAdminAcquireContext") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x0107367F and returned 0x76949058.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATAdminReleaseContext") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x01073691 and returned 0x76949271.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATAdminCalcHashFromFileHandle") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010736A3 and
returned 0x7694933D.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATAdminEnumCatalogFromHash") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010736B5 and
returned 0x76949593.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATCatalogInfoFromContext") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010736C7 and
returned 0x769497C5.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATAdminReleaseCatalogContext") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010736D9 and
returned 0x76949559.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"WTHelperProvDataFromStateData") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010736EB and
returned 0x76947B92.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"WTHelperGetProvSignerFromChain") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010736FD and
returned 0x7693BD1E.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"WTHelperGetProvCertFromChain") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x0107370F and
returned 0x7693BD5C.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"WinVerifyTrust") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x01073721 and returned 0x7693B401.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATGetMemberInfo") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x01073733 and returned 0x76947DDD.
LoadLibraryA("crypt32.dll") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x010737A3.
LoadLibraryA("crypt32.dll") returned 0x7C740000.
GetProcAddress(0x7C740000 [c:\winnt\system32\CRYPT32.DLL],
"CryptHashPublicKeyInfo") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x010737B4 and returned 0x7C76A5E2.
LoadLibraryA("newdev.dll") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x010737DC.
Loaded "c:\winnt\system32\NEWDEV.DLL" at address 0x6A3A0000.
Successfully hooked module.
DllMain(0x6A3A0000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\NEWDEV.DLL" called.
DllMain(0x6A3A0000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\NEWDEV.DLL" returned 1 (0x1).
LoadLibraryA("newdev.dll") returned 0x6A3A0000.
GetProcAddress(0x6A3A0000 [c:\winnt\system32\NEWDEV.DLL],
"UpdateDriverForPlugAndPlayDevicesA") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010737ED and
returned 0x6A3A1FB4.
LoadLibraryA("kernel32.DLL") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x010737F9.
LoadLibraryA("kernel32.DLL") returned 0x7C570000.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetSystemDefaultUILanguage") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x0107380A and returned 0x7C5B0FFB.
LoadLibraryA("SXS.DLL") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x01073816.
LoadLibraryA("SXS.DLL") returned NULL. Error: The specified module could
not be found (126).
LoadLibraryA("Advapi32.DLL") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x01073845.
LoadLibraryA("Advapi32.DLL") returned 0x7C2D0000.
GetProcAddress(0x7C2D0000 [c:\winnt\system32\ADVAPI32.DLL],
"SetSecurityDescriptorControl") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x01073856 and
returned 0x7C2E6C7E.
GetProcAddress(0x7C2D0000 [c:\winnt\system32\ADVAPI32.DLL],
"InitiateSystemShutdownExA") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x0107386E and returned 0x7C3094D3.
LoadLibraryA("Clusapi.DLL") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x0107387A.
Loaded "c:\winnt\system32\CLUSAPI.DLL" at address 0x73930000.
Successfully hooked module.
LoadLibraryA("Clusapi.DLL") returned 0x73930000.
GetProcAddress(0x73930000 [c:\winnt\system32\CLUSAPI.DLL],
"GetNodeClusterState") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x0107388B and returned 0x739335E8.
LoadLibraryA("gdi32.DLL") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x01073897.
LoadLibraryA("gdi32.DLL") returned 0x77F40000.
GetProcAddress(0x77F40000 [c:\winnt\system32\GDI32.DLL], "SetLayout")
called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address
0x010738AA and returned 0x77F530D6.
LoadLibraryA("UPDSPAPI.dll") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x01066878.
Loaded "c:\9c3b6d437d78ea73d12fe1d495\update\UPDSPAPI.DLL " at address
0x00C20000. Successfully hooked module.
DllMain(0x00C20000, DLL_PROCESS_ATTACH, 0x00000000) in "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDSPAPI.DLL" called.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"UnhandledExceptionFilter") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDSPAPI.DLL" at address 0x00C383CF and returned 0x7C59BCDC.
LoadLibraryA("C:\WINNT\system32\kernel32.dll") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDSPAPI.DLL" at address 0x00C37FDB.
LoadLibraryA("C:\WINNT\system32\kernel32.dll") returned 0x7C570000.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetSystemWindowsDirectoryW") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDSPAPI.DLL" at address 0x00C38073 and returned 0x7C592C6E.
LoadLibraryA("C:\WINNT\system32\shlwapi.dll") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDSPAPI.DLL" at address 0x00C37FDB.
LoadLibraryA("C:\WINNT\system32\shlwapi.dll") returned 0x70A70000.
GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL],
"SHAutoComplete") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDSPAPI.DLL" at address 0x00C38073 and returned 0x70AA9E0B.
DllMain(0x00C20000, DLL_PROCESS_ATTACH, 0x00000000) in "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDSPAPI.DLL" returned 1 (0x1).
LoadLibraryA("UPDSPAPI.dll") returned 0x00C20000.
GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
\UPDSPAPI.DLL], "UpdSpOpenInfFileA") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9 and
returned 0x00C327EE.
GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
\UPDSPAPI.DLL], "UpdSpGetLineTextA") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9 and
returned 0x00C33312.
GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
\UPDSPAPI.DLL], "UpdSpFindFirstLineA") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9 and
returned 0x00C2F8A9.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetSystemWow64DirectoryW") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x0106E0BD and returned NULL. Error: The
specified procedure could not be found (127).
GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
\UPDSPAPI.DLL], "UpdSpGetSourceInfoA") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9 and
returned 0x00C32E22.
GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
\UPDSPAPI.DLL], "UpdSpGetLineCountA") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9 and
returned 0x00C2F9E0.
GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
\UPDSPAPI.DLL], "UpdSpGetStringFieldA") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9 and
returned 0x00C3317C.
GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
\UPDSPAPI.DLL], "UpdSpGetStringFieldA") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9 and
returned 0x00C3317C.
GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
\UPDSPAPI.DLL], "UpdSpGetStringFieldA") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9 and
returned 0x00C3317C.
GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
\UPDSPAPI.DLL], "UpdSpFindNextLine") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9 and
returned 0x00C2F925.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetUserDefaultUILanguage") called from "c:\winnt\system32\COMCTL32.DLL"
at address 0x7174A9F7 and returned 0x7C5B1028.
GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL],
"DllGetVersion") called from "c:\winnt\system32\COMCTL32.DLL" at address
0x7176AF10 and returned 0x70AC2A56.
GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL], 0x00000189)
called from "c:\winnt\system32\COMCTL32.DLL" at address 0x7176AFCA and
returned 0x70A9AEB5.
GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL],
"DllGetVersion") called from "c:\winnt\system32\COMCTL32.DLL" at address
0x7176AF10 and returned 0x70AC2A56.
GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL], 0x000001AE)
called from "c:\winnt\system32\COMCTL32.DLL" at address 0x7176AF6D and
returned 0x70AAE6DA.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetSystemDefaultUILanguage") called from "c:\winnt\system32
\SHLWAPI.DLL" at address 0x70AAE140 and returned 0x7C5B0FFB.
LoadLibraryA("COMCTL32.dll") called from "c:\winnt\system32\SHLWAPI.DLL"
at address 0x70AC5CD9.
LoadLibraryA("COMCTL32.dll") returned 0x71710000.
GetProcAddress(0x71710000 [c:\winnt\system32\COMCTL32.DLL], 0x00000148)
called from "c:\winnt\system32\SHLWAPI.DLL" at address 0x70AC5DD6 and
returned 0x71724171.
GetProcAddress(0x71710000 [c:\winnt\system32\COMCTL32.DLL], 0x0000014E)
called from "c:\winnt\system32\SHLWAPI.DLL" at address 0x70AC5DD6 and
returned 0x7171E831.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetUserDefaultUILanguage") called from "c:\winnt\system32\SHLWAPI.DLL"
at address 0x70AAE1F3 and returned 0x7C5B1028.
GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
"NotifyWinEvent") called from "c:\winnt\system32\COMCTL32.DLL" at address
0x7172A4A8 and returned 0x77E5077C.
LoadLibraryExW("C:\Program Files\Iomega\DriveIcons\IMGHOOK.DLL",
0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) called from "c:\winnt\system32
\USER32.DLL" at address 0x77E1E47E.
Loaded "c:\program files\iomega\driveicons\IMGHOOK.DLL" at address
0x30000000. Successfully hooked module.
DllMain(0x30000000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\program files
\iomega\driveicons\IMGHOOK.DLL" called.
GetProcAddress(0x782F0000 [c:\winnt\system32\SHELL32.DLL],
"SHFileOperationA") called from "c:\program files\iomega\driveicons
\IMGHOOK.DLL" at address 0x3000114D and returned 0x783402E6.
GetProcAddress(0x782F0000 [c:\winnt\system32\SHELL32.DLL],
"SHFileOperationW") called from "c:\program files\iomega\driveicons
\IMGHOOK.DLL" at address 0x3000114D and returned 0x7833FF7A.
DllMain(0x30000000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\program files
\iomega\driveicons\IMGHOOK.DLL" returned 1 (0x1).
LoadLibraryExW("C:\Program Files\Iomega\DriveIcons\IMGHOOK.DLL",
0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x30000000.
GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL],
"DllGetVersion") called from "c:\winnt\system32\COMCTL32.DLL" at address
0x7176AF10 and returned 0x70AC2A56.
GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL], 0x00000189)
called from "c:\winnt\system32\COMCTL32.DLL" at address 0x7176AFCA and
returned 0x70A9AEB5.
GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL],
"DllGetVersion") called from "c:\winnt\system32\COMCTL32.DLL" at address
0x7176AF10 and returned 0x70AC2A56.
GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL], 0x000001AF)
called from "c:\winnt\system32\COMCTL32.DLL" at address 0x7176AF9A and
returned 0x70AAE752.
GetProcAddress(0x71710000 [c:\winnt\system32\COMCTL32.DLL], 0x00000150)
called from "c:\winnt\system32\SHLWAPI.DLL" at address 0x70AC5DD6 and
returned 0x717235AE.
GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
\UPDSPAPI.DLL], "UpdSpFindFirstLineW") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9 and
returned 0x00C2F449.
LoadLibraryA("setupapi.dll") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x0106BA3B.
LoadLibraryA("setupapi.dll") returned 0x77880000.
GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
"pSetupIsUserAdmin") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x0106BA4D and returned NULL. Error: The
specified procedure could not be found (127).
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"GetSystemWow64DirectoryW") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x0106E0BD and returned NULL. Error: The
specified procedure could not be found (127).
GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
\UPDSPAPI.DLL], "UpdSpCloseInfFile") called from "c:
\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9 and
returned 0x00C32A37.
LoadLibraryA("SETUPAPI.dll") called from "c:\9c3b6d437d78ea73d12fe1d495
\update\UPDATE.EXE" at address 0x01066878.
LoadLibraryA("SETUPAPI.dll") returned 0x77880000.
GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
"SetupCloseInfFile") called from "c:\9c3b6d437d78ea73d12fe1d495\update
\UPDATE.EXE" at address 0x010668D9 and returned 0x77882D8A.
LoadLibraryA("WINTRUST.dll") called from "c:\winnt\system32
\SETUPAPI.DLL" at address 0x7788A156.
LoadLibraryA("WINTRUST.dll") returned 0x76930000.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATAdminAcquireContext") called from "c:\winnt\system32
\SETUPAPI.DLL" at address 0x7788A1AC and returned 0x76949058.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATAdminCalcHashFromFileHandle") called from "c:\winnt\system32
\SETUPAPI.DLL" at address 0x7788A1AC and returned 0x7694933D.
LoadLibraryExW("C:\WINNT\System32\asfsipc.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
Loaded "c:\winnt\system32\ASFSIPC.DLL" at address 0x74A50000.
Successfully hooked module.
DllMain(0x74A50000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\ASFSIPC.DLL" called.
DllMain(0x74A50000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\ASFSIPC.DLL" returned 1 (0x1).
LoadLibraryExW("C:\WINNT\System32\asfsipc.dll", 0x00000000, 0x00000000)
returned 0x74A50000.
GetProcAddress(0x74A50000 [c:\winnt\system32\ASFSIPC.DLL],
"DllCanUnloadNow") called from "c:\winnt\system32\CRYPT32.DLL" at address
0x7C74EDC3 and returned NULL. Error: The specified procedure could not be
found (127).
GetProcAddress(0x74A50000 [c:\winnt\system32\ASFSIPC.DLL],
"IsMyTypeOfFile") called from "c:\winnt\system32\CRYPT32.DLL" at address
0x7C74ED39 and returned 0x74A515AF.
LoadLibraryExW("C:\WINNT\system32\CRYPT32.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("C:\WINNT\system32\CRYPT32.dll", 0x00000000, 0x00000000)
returned 0x7C740000.
LoadLibraryExW("MSISIP.DLL", 0x00000000, 0x00000000) called from "c:
\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
Loaded "c:\winnt\system32\MSISIP.DLL" at address 0x00E10000.
Successfully hooked module.
DllMain(0x00E10000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\MSISIP.DLL" called.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"InitializeCriticalSectionAndSpinCount") called from "c:\winnt\system32
\MSISIP.DLL" at address 0x00E169F2 and returned 0x7C59987C.
DllMain(0x00E10000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\MSISIP.DLL" returned 1 (0x1).
LoadLibraryExW("MSISIP.DLL", 0x00000000, 0x00000000) returned 0x00E10000.
GetProcAddress(0x00E10000 [c:\winnt\system32\MSISIP.DLL],
"DllCanUnloadNow") called from "c:\winnt\system32\CRYPT32.DLL" at address
0x7C74EDC3 and returned NULL. Error: The specified procedure could not be
found (127).
GetProcAddress(0x00E10000 [c:\winnt\system32\MSISIP.DLL],
"MsiSIPIsMyTypeOfFile") called from "c:\winnt\system32\CRYPT32.DLL" at
address 0x7C74ED39 and returned 0x00E12868.
LoadLibraryW("ole32.dll") called from "c:\winnt\system32\MSISIP.DLL" at
address 0x00E12895.
LoadLibraryW("ole32.dll") returned 0x77A50000.
GetProcAddress(0x77A50000 [c:\winnt\system32\OLE32.DLL], "CoInitialize")
called from "c:\winnt\system32\MSISIP.DLL" at address 0x00E1266F and
returned 0x77A90E04.
GetProcAddress(0x77A50000 [c:\winnt\system32\OLE32.DLL],
"StgOpenStorage") called from "c:\winnt\system32\MSISIP.DLL" at address
0x00E128E3 and returned 0x77A73B4C.
GetProcAddress(0x77A50000 [c:\winnt\system32\OLE32.DLL],
"CoUninitialize") called from "c:\winnt\system32\MSISIP.DLL" at address
0x00E126B0 and returned 0x77A7EB3E.
LoadLibraryExW("C:\WINNT\System32\wshext.dll", 0x00000000, 0x00000000)
called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
Loaded "c:\winnt\system32\WSHEXT.DLL" at address 0x10000000.
Successfully hooked module.
Loaded "c:\winnt\system32\COMDLG32.DLL" at address 0x76B30000.
Successfully hooked module.
DllMain(0x76B30000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\COMDLG32.DLL" called.
DllMain(0x76B30000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\COMDLG32.DLL" returned 1 (0x1).
DllMain(0x10000000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\WSHEXT.DLL" called.
LoadLibraryA("C:\WINNT\System32\wshENG.DLL") called from "c:\winnt
\system32\WSHEXT.DLL" at address 0x10008F55.
LoadLibraryA("C:\WINNT\System32\wshENG.DLL") returned NULL. Error: The
specified module could not be found (126).
LoadLibraryA("wshENG.DLL") called from "c:\winnt\system32\WSHEXT.DLL" at
address 0x10008F64.
LoadLibraryA("wshENG.DLL") returned NULL. Error: The specified module
could not be found (126).
LoadLibraryA("C:\WINNT\System32\wshEN.DLL") called from "c:\winnt
\system32\WSHEXT.DLL" at address 0x10008FC1.
LoadLibraryA("C:\WINNT\System32\wshEN.DLL") returned NULL. Error: The
specified module could not be found (126).
LoadLibraryA("wshEN.DLL") called from "c:\winnt\system32\WSHEXT.DLL" at
address 0x10008FD0.
LoadLibraryA("wshEN.DLL") returned NULL. Error: The specified module
could not be found (126).
LoadLibraryA("C:\WINNT\System32\wshENU.DLL") called from "c:\winnt
\system32\WSHEXT.DLL" at address 0x1000904D.
LoadLibraryA("C:\WINNT\System32\wshENU.DLL") returned NULL. Error: The
specified module could not be found (126).
LoadLibraryA("wshENU.DLL") called from "c:\winnt\system32\WSHEXT.DLL" at
address 0x10009058.
LoadLibraryA("wshENU.DLL") returned NULL. Error: The specified module
could not be found (126).
DllMain(0x10000000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\WSHEXT.DLL" returned 1 (0x1).
LoadLibraryExW("C:\WINNT\System32\wshext.dll", 0x00000000, 0x00000000)
returned 0x10000000.
GetProcAddress(0x10000000 [c:\winnt\system32\WSHEXT.DLL],
"DllCanUnloadNow") called from "c:\winnt\system32\CRYPT32.DLL" at address
0x7C74EDC3 and returned 0x10002130.
GetProcAddress(0x10000000 [c:\winnt\system32\WSHEXT.DLL],
"IsFileSupportedName") called from "c:\winnt\system32\CRYPT32.DLL" at
address 0x7C74ED39 and returned 0x10005060.
GetProcAddress(0x10000000 [c:\winnt\system32\WSHEXT.DLL],
"IsFileSupportedName") called from "c:\winnt\system32\CRYPT32.DLL" at
address 0x7C74ED39 and returned 0x10005060.
GetProcAddress(0x10000000 [c:\winnt\system32\WSHEXT.DLL],
"IsFileSupportedName") called from "c:\winnt\system32\CRYPT32.DLL" at
address 0x7C74ED39 and returned 0x10005060.
LoadLibraryExW("WINTRUST.DLL", 0x00000000, 0x00000000) called from "c:
\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
LoadLibraryExW("WINTRUST.DLL", 0x00000000, 0x00000000) returned
0x76930000.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"DllCanUnloadNow") called from "c:\winnt\system32\CRYPT32.DLL" at address
0x7C74EDC3 and returned NULL. Error: The specified procedure could not be
found (127).
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptSIPPutSignedDataMsg") called from "c:\winnt\system32\CRYPT32.DLL"
at address 0x7C74ED39 and returned 0x7694415C.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called
from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
returned 0x01530001.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptSIPCreateIndirectData") called from "c:\winnt\system32
\CRYPT32.DLL" at address 0x7C74ED39 and returned 0x7694421B.
LoadLibraryA("rsaenh.dll") called from "c:\winnt\system32\ADVAPI32.DLL"
at address 0x7C2E4355.
Loaded "c:\winnt\system32\RSAENH.DLL" at address 0x7CA00000.
Successfully hooked module.
DllMain(0x7CA00000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\RSAENH.DLL" called.
LoadLibraryA("crypt32.dll") called from "c:\winnt\system32\RSAENH.DLL" at
address 0x7CA1BF53.
LoadLibraryA("crypt32.dll") returned 0x7C740000.
LoadLibraryA("ole32.dll") called from "c:\winnt\system32\RSAENH.DLL" at
address 0x7CA0D3F3.
LoadLibraryA("ole32.dll") returned 0x77A50000.
DllMain(0x7CA00000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
\RSAENH.DLL" returned 1 (0x1).
LoadLibraryA("rsaenh.dll") returned 0x7CA00000.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
"CPAcquireContext") called from "c:\winnt\system32\ADVAPI32.DLL" at
address 0x7C2E4495 and returned 0x7CA0BF89.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
"CPReleaseContext") called from "c:\winnt\system32\ADVAPI32.DLL" at
address 0x7C2E4495 and returned 0x7CA0BFD9.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL], "CPGenKey")
called from "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4495 and
returned 0x7CA065F0.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL], "CPDeriveKey")
called from "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4495 and
returned 0x7CA0680B.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL], "CPDestroyKey")
called from "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4495 and
returned 0x7CA081C8.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
"CPSetKeyParam") called from "c:\winnt\system32\ADVAPI32.DLL" at address
0x7C2E4495 and returned 0x7CA083A0.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
"CPGetKeyParam") called from "c:\winnt\system32\ADVAPI32.DLL" at address
0x7C2E4495 and returned 0x7CA086EF.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL], "CPExportKey")
called from "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4495 and
returned 0x7CA0734D.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL], "CPImportKey")
called from "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4495 and
returned 0x7CA078F3.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL], "CPEncrypt")
called from "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4495 and
returned 0x7CA04AA5.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL], "CPDecrypt")
called from "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4495 and
returned 0x7CA04DB2.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL], "CPCreateHash")
called from "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4495 and
returned 0x7CA04F2B.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL], "CPHashData")
called from "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4495 and
returned 0x7CA055F0.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
"CPHashSessionKey") called from "c:\winnt\system32\ADVAPI32.DLL" at
address 0x7C2E4495 and returned 0x7CA05736.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
"CPDestroyHash") called from "c:\winnt\system32\ADVAPI32.DLL" at address
0x7C2E4495 and returned 0x7CA059E9.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL], "CPSignHash")
called from "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4495 and
returned 0x7CA0A1DF.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
"CPVerifySignature") called from "c:\winnt\system32\ADVAPI32.DLL" at
address 0x7C2E4495 and returned 0x7CA0A639.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL], "CPGenRandom")
called from "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4495 and
returned 0x7CA0A00E.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL], "CPGetUserKey")
called from "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4495 and
returned 0x7CA082D4.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
"CPSetProvParam") called from "c:\winnt\system32\ADVAPI32.DLL" at address
0x7C2E4495 and returned 0x7CA08AA8.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
"CPGetProvParam") called from "c:\winnt\system32\ADVAPI32.DLL" at address
0x7C2E4495 and returned 0x7CA08BE5.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
"CPSetHashParam") called from "c:\winnt\system32\ADVAPI32.DLL" at address
0x7C2E4495 and returned 0x7CA091A2.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
"CPGetHashParam") called from "c:\winnt\system32\ADVAPI32.DLL" at address
0x7C2E4495 and returned 0x7CA095B2.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
"CPDuplicateKey") called from "c:\winnt\system32\ADVAPI32.DLL" at address
0x7C2E44B2 and returned 0x7CA09A84.
GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
"CPDuplicateHash") called from "c:\winnt\system32\ADVAPI32.DLL" at
address 0x7C2E44B2 and returned 0x7CA05B1B.
LoadLibraryA("kernel32.dll") called from "c:\winnt\system32\RSAENH.DLL"
at address 0x7CA17B11.
LoadLibraryA("kernel32.dll") returned 0x7C570000.
GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
"InterlockedCompareExchange") called from "c:\winnt\system32\RSAENH.DLL"
at address 0x7CA17B21 and returned 0x7C57B5BC.
GetProcAddress(0x77F80000 [c:\winnt\system32\NTDLL.DLL],
"NtQuerySystemInformation") called from "c:\winnt\system32\RSAENH.DLL" at
address 0x7CA1770F and returned 0x77F83227.
GetProcAddress(0x77F80000 [c:\winnt\system32\NTDLL.DLL], "NtOpenFile")
called from "c:\winnt\system32\RSAENH.DLL" at address 0x7CA1772A and
returned 0x77F85AFB.
GetProcAddress(0x77F80000 [c:\winnt\system32\NTDLL.DLL],
"RtlInitUnicodeString") called from "c:\winnt\system32\RSAENH.DLL" at
address 0x7CA17737 and returned 0x77F8335D.
GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
"CryptCATAdminEnumCatalogFromHash") called from "c:\winnt\system32
\SETUPAPI.DLL" at address 0x7788A1AC and returned 0x76949593.
Second chance exception 0xC0000005 (Access Violation) occurred in "c:
\winnt\system32\WINTRUST.DLL" at address 0x769503B2.
Exited "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" (process 0x83C)
with code 128 (0x80).

Peter Nimmo <Peter.Nimmo@nospamtnsofresdotcom> wrote in
news:Xns963C6C55797ECPeterNnospamtnsofres@207.46.2 48.16:

> I have also run an update through Dependancy Walker. The last
> meaningful log entry says "Second chance exception 0xC0000005 (Access
> Violation) occurred in "c:\winnt\system32\WINTRUST.DLL" at address
> 0x769503B2."
>
> This DLL is identical to a collegues so the DLL is not corrupt.
>
> Warning: At least one delay-load dependency module was not found.
> Warning: At least one module has an unresolved import due to a missing
> export function in a delay-load dependent module.
>
> -----------------------------------------------------------------------
> -- -------
> Starting profile on 15/04/2005 at 11:33:10
>
> Operating System: Microsoft Windows 2000 Professional (32-bit),
> version 5.00.2195 Service Pack 4
> Program Executable: c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE
> Program Arguments:
> Starting Directory: c:\9c3b6d437d78ea73d12fe1d495\update\
> Search Path:
> C:\WINNT\system32;C:\WINNT;C:\PROGRA~1\ULTRAE~1;C: \TVPCDEV
> \COMMANDS;C:\Program Files\WinZip;C:\UTILS;C:\WINNT\Microsoft.NET
> \Framework\v1.0.3705;C:\Program Files\Common
> Files\GTK\2.0\lib;C:\Program Files\Common
> Files\GTK\2.0\lib\gtk-2.0\2.2.0\engines;C:\Program Files \Common
> Files\GTK\2.0\lib\gtk-2.0\2.2.0\immodules;C:\Program Files\Common
> Files\GTK\2.0\lib\gtk-2.0\2.2.0\loaders;C:\Program Files\Common
> Files\GTK \2.0\lib\pango\1.0.0\modules;C:\Program Files\MS Debugging
> Tools for Windows;C:\Program Files\Common Files\OpSession\Viewer
> Shared;C:\Program Files\Microsoft SQL Server\80\Tools\BINN;C:\Program
> Files\rksupport;C: \Program Files\Programming
> Tools\doxygen\bin;C:\Program Files\Programming
> Tools\doxygen\EXTERN~1\Graphviz\bin;C:\Program Files\Programming Tools
> \doxygen\EXTERN~1\Graphviz\bin\tools;C:\Program Files\HTML Help
> Workshop;c:\Program Files\Support Tools\;C:\perl-5.8.0;C:\perl-5.8.0
> \UTILS;C:\Program Files\Microsoft Visual Studio .NET
> 2003\Common7\Tools \;C:\WINNT\system32\WBEM;
>
> Options Selected:
> Log DllMain calls for process attach and process detach messages.
> Hook the process to gather more detailed dependency information.
> Log LoadLibrary function calls.
> Log GetProcAddress function calls.
> Log debug output messages.
> Use full paths when logging file names.
> Automatically open and profile child processes.
> -----------------------------------------------------------------------
> -- -------
>
> Started "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" (process
> 0x83C) at address 0x01000000. Successfully hooked module.
> Loaded "c:\winnt\system32\NTDLL.DLL" at address 0x77F80000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\KERNEL32.DLL" at address 0x7C570000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\SHELL32.DLL" at address 0x782F0000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\GDI32.DLL" at address 0x77F40000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\USER32.DLL" at address 0x77E10000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2D0000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\RPCRT4.DLL" at address 0x77D30000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\SHLWAPI.DLL" at address 0x70A70000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\MSVCRT.DLL" at address 0x78000000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\COMCTL32.DLL" at address 0x71710000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\IMAGEHLP.DLL" at address 0x77920000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\MPR.DLL" at address 0x76620000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\VERSION.DLL" at address 0x77820000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\LZ32.DLL" at address 0x759B0000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\PSAPI.DLL" at address 0x690A0000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\OLE32.DLL" at address 0x77A50000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\OLEAUT32.DLL" at address 0x779B0000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\WINSPOOL.DRV" at address 0x77800000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\CRYPT32.DLL" at address 0x7C740000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\MSASN1.DLL" at address 0x77430000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\USERENV.DLL" at address 0x7C0F0000.
> Successfully hooked module.
> Entrypoint reached. All implicit modules have been loaded.
> DllMain(0x7C570000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \KERNEL32.DLL" called.
> DllMain(0x7C570000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \KERNEL32.DLL" returned 1 (0x1).
> Injected "c:\progra~1\micros~1.ne~\common7\tools\bin\DEPEND S.DLL" at
> address 0x08370000.
> DllMain(0x08370000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\progra~1
> \micros~1.ne~\common7\tools\bin\DEPENDS.DLL" called.
> DllMain(0x08370000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\progra~1
> \micros~1.ne~\common7\tools\bin\DEPENDS.DLL" returned 1 (0x1).
> DllMain(0x77E10000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \USER32.DLL" called.
> LoadLibraryW("shim.dll") called from "c:\winnt\system32\USER32.DLL" at
> address 0x77E3E133.
> Loaded "c:\winnt\system32\SHIM.DLL" at address 0x732E0000.
> Successfully hooked module.
> DllMain(0x732E0000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \SHIM.DLL" called.
> DllMain(0x732E0000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \SHIM.DLL" returned 1 (0x1).
> LoadLibraryW("shim.dll") returned 0x732E0000.
> GetProcAddress(0x732E0000 [c:\winnt\system32\SHIM.DLL],
> "LoadPatchDll") called from "c:\winnt\system32\USER32.DLL" at address
> 0x77E3E145 and returned 0x732E8B41.
> LoadLibraryExW("c:\9c3b6d437d78ea73d12fe1d495\upda te\update.exe",
> 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called from "c:\winnt\system32
> \VERSION.DLL" at address 0x778213F1.
> Mapped "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" as a data
> file into memory at address 0x01000000.
> LoadLibraryExW("c:\9c3b6d437d78ea73d12fe1d495\upda te\update.exe",
> 0x00000000, LOAD_LIBRARY_AS_DATAFILE) returned 0x01000000.
> LoadLibraryExW("c:\9c3b6d437d78ea73d12fe1d495\upda te\update.exe",
> 0x00000000, LOAD_LIBRARY_AS_DATAFILE) called from "c:\winnt\system32
> \VERSION.DLL" at address 0x778215C5.
> Mapped "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" as a data
> file into memory at address 0x01000000.
> LoadLibraryExW("c:\9c3b6d437d78ea73d12fe1d495\upda te\update.exe",
> 0x00000000, LOAD_LIBRARY_AS_DATAFILE) returned 0x01000000.
> DllMain(0x77E10000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \USER32.DLL" returned 28311553 (0x1B00001).
> DllMain(0x77D30000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \RPCRT4.DLL" called.
> LoadLibraryA("kernel32.dll") called from
> "c:\winnt\system32\RPCRT4.DLL" at address 0x77D3E850.
> LoadLibraryA("kernel32.dll") returned 0x7C570000.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "InterlockedCompareExchange") called from
> "c:\winnt\system32\RPCRT4.DLL" at address 0x77D3E860 and returned
> 0x7C57B5BC. DllMain(0x77D30000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \RPCRT4.DLL" returned 1 (0x1).
> DllMain(0x7C2D0000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \ADVAPI32.DLL" called.
> DllMain(0x7C2D0000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \ADVAPI32.DLL" returned 1 (0x1).
> DllMain(0x78000000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \MSVCRT.DLL" called.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "IsProcessorFeaturePresent") called from
> "c:\winnt\system32\MSVCRT.DLL" at address 0x78001EAA and returned
> 0x7C597AAD. DllMain(0x78000000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \MSVCRT.DLL" returned 1 (0x1).
> DllMain(0x70A70000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \SHLWAPI.DLL" called.
> DllMain(0x70A70000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \SHLWAPI.DLL" returned 1 (0x1).
> DllMain(0x71710000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \COMCTL32.DLL" called.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "ProcessIdToSessionId") called from "c:\winnt\system32\COMCTL32.DLL"
> at address 0x71722F54 and returned 0x7C5987C0.
> GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
> "GetSystemMetrics") called from "c:\winnt\system32\COMCTL32.DLL" at
> address 0x717297A6 and returned 0x77E16D11.
> GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
> "MonitorFromWindow") called from "c:\winnt\system32\COMCTL32.DLL" at
> address 0x717297B7 and returned 0x77E4F33D.
> GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
> "MonitorFromRect") called from "c:\winnt\system32\COMCTL32.DLL" at
> address 0x717297C8 and returned 0x77E4F2C2.
> GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
> "MonitorFromPoint") called from "c:\winnt\system32\COMCTL32.DLL" at
> address 0x717297D9 and returned 0x77E4F244.
> GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
> "EnumDisplayMonitors") called from "c:\winnt\system32\COMCTL32.DLL" at
> address 0x717297EA and returned 0x77E58246.
> GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
> "EnumDisplayDevicesW") called from "c:\winnt\system32\COMCTL32.DLL" at
> address 0x717297FB and returned 0x77E41D11.
> GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
> "GetMonitorInfoW") called from "c:\winnt\system32\COMCTL32.DLL" at
> address 0x7172981B and returned 0x77E3DC5A.
> DllMain(0x71710000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \COMCTL32.DLL" returned 1 (0x1).
> DllMain(0x782F0000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \SHELL32.DLL" called.
> DllMain(0x782F0000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \SHELL32.DLL" returned 1 (0x1).
> DllMain(0x77920000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \IMAGEHLP.DLL" called.
> DllMain(0x77920000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \IMAGEHLP.DLL" returned 1 (0x1).
> DllMain(0x76620000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \MPR.DLL" called.
> DllMain(0x76620000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \MPR.DLL" returned 1 (0x1).
> DllMain(0x759B0000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \LZ32.DLL" called.
> DllMain(0x759B0000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \LZ32.DLL" returned 1 (0x1).
> DllMain(0x77820000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \VERSION.DLL" called.
> DllMain(0x77820000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \VERSION.DLL" returned 1 (0x1).
> DllMain(0x690A0000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \PSAPI.DLL" called.
> DllMain(0x690A0000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \PSAPI.DLL" returned 131073 (0x20001).
> DllMain(0x77A50000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \OLE32.DLL" called.
> GetProcAddress(0x77D30000 [c:\winnt\system32\RPCRT4.DLL],
> "I_RpcForcePickleCleanup") called from "c:\winnt\system32\OLE32.DLL"
> at address 0x77B12A68 and returned 0x77D4CD2E.
> GetProcAddress(0x77F80000 [c:\winnt\system32\NTDLL.DLL],
> "NtQuerySystemInformation") called from "c:\winnt\system32\RPCRT4.DLL"
> at address 0x77D488A6 and returned 0x77F83227.
> GetProcAddress(0x77F80000 [c:\winnt\system32\NTDLL.DLL], "NtOpenFile")
> called from "c:\winnt\system32\RPCRT4.DLL" at address 0x77D488C1 and
> returned 0x77F85AFB.
> GetProcAddress(0x77F80000 [c:\winnt\system32\NTDLL.DLL],
> "RtlInitUnicodeString") called from "c:\winnt\system32\RPCRT4.DLL" at
> address 0x77D488CE and returned 0x77F8335D.
> DllMain(0x77A50000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \OLE32.DLL" returned 1 (0x1).
> DllMain(0x779B0000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \OLEAUT32.DLL" called.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL], "IsTNT")
> called from "c:\winnt\system32\OLEAUT32.DLL" at address 0x77A23F12 and
> returned NULL. Error: The specified procedure could not be found
> (127). GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "IsProcessorFeaturePresent") called from "c:\winnt\system32
> \OLEAUT32.DLL" at address 0x77A272EB and returned 0x7C597AAD.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "SetCriticalSectionSpinCount") called from "c:\winnt\system32
> \OLEAUT32.DLL" at address 0x779C83EB and returned 0x77F8E85F.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "SetCriticalSectionSpinCount") called from "c:\winnt\system32
> \OLEAUT32.DLL" at address 0x779C83EB and returned 0x77F8E85F.
> LoadLibraryA("C:\WINNT\system32\ole32.dll") called from "c:\winnt
> \system32\OLEAUT32.DLL" at address 0x77A0FA9E.
> LoadLibraryA("C:\WINNT\system32\ole32.dll") returned 0x77A50000.
> GetProcAddress(0x77A50000 [c:\winnt\system32\OLE32.DLL],
> "DcomChannelSetHResult") called from "c:\winnt\system32\OLEAUT32.DLL"
> at address 0x77A0FAB3 and returned 0x77A9C757.
> DllMain(0x779B0000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \OLEAUT32.DLL" returned 1 (0x1).
> DllMain(0x77800000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \WINSPOOL.DRV" called.
> DllMain(0x77800000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \WINSPOOL.DRV" returned 1 (0x1).
> DllMain(0x77430000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \MSASN1.DLL" called.
> DllMain(0x77430000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \MSASN1.DLL" returned 1 (0x1).
> DllMain(0x7C740000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \CRYPT32.DLL" called.
> LoadLibraryA("advapi32.dll") called from
> "c:\winnt\system32\CRYPT32.DLL" at address 0x7C741B77.
> LoadLibraryA("advapi32.dll") returned 0x7C2D0000.
> GetProcAddress(0x7C2D0000 [c:\winnt\system32\ADVAPI32.DLL],
> "CryptAcquireContextW") called from "c:\winnt\system32\CRYPT32.DLL" at
> address 0x7C741B8A and returned 0x7C2EA433.
> GetProcAddress(0x7C2D0000 [c:\winnt\system32\ADVAPI32.DLL],
> "CryptSignHashW") called from "c:\winnt\system32\CRYPT32.DLL" at
> address 0x7C741B9C and returned 0x7C2F7BA1.
> GetProcAddress(0x7C2D0000 [c:\winnt\system32\ADVAPI32.DLL],
> "CryptVerifySignatureW") called from "c:\winnt\system32\CRYPT32.DLL"
> at address 0x7C741BAE and returned 0x7C2F7C8C.
> GetProcAddress(0x7C2D0000 [c:\winnt\system32\ADVAPI32.DLL],
> "CryptSetProviderW") called from "c:\winnt\system32\CRYPT32.DLL" at
> address 0x7C741BC0 and returned 0x7C2F7EF5.
> LoadLibraryA("kernel32.dll") called from
> "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75E1F5.
> LoadLibraryA("kernel32.dll") returned 0x7C570000.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "RegisterWaitForSingleObject") called from "c:\winnt\system32
> \CRYPT32.DLL" at address 0x7C75E210 and returned 0x7C59C578.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "UnregisterWaitEx") called from "c:\winnt\system32\CRYPT32.DLL" at
> address 0x7C75E22A and returned 0x7C59C6B1.
> LoadLibraryA("advapi32.dll") called from
> "c:\winnt\system32\MSASN1.DLL" at address 0x77437AB0.
> LoadLibraryA("advapi32.dll") returned 0x7C2D0000.
> GetProcAddress(0x7C2D0000 [c:\winnt\system32\ADVAPI32.DLL],
> "RegOpenKeyExA") called from "c:\winnt\system32\MSASN1.DLL" at address
> 0x77437AC6 and returned 0x7C2D24B9.
> DllMain(0x7C740000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \CRYPT32.DLL" returned 1 (0x1).
> DllMain(0x7C0F0000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \USERENV.DLL" called.
> DllMain(0x7C0F0000, DLL_PROCESS_ATTACH, 0x0006FD30) in
> "c:\winnt\system32 \USERENV.DLL" returned 1 (0x1).
> Loaded "c:\winnt\system32\ENTAPI.DLL" at address 0x37000000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\NETAPI32.DLL" at address 0x75170000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\SECUR32.DLL" at address 0x7C340000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\NTDSAPI.DLL" at address 0x77BF0000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\DNSAPI.DLL" at address 0x77980000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\WSOCK32.DLL" at address 0x75050000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\WS2_32.DLL" at address 0x75030000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\WS2HELP.DLL" at address 0x75020000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\WLDAP32.DLL" at address 0x77950000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\NETRAP.DLL" at address 0x751C0000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\SAMLIB.DLL" at address 0x75150000.
> Successfully hooked module.
> DllMain(0x7C340000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \SECUR32.DLL" called.
> DllMain(0x7C340000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \SECUR32.DLL" returned 1 (0x1).
> DllMain(0x75020000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \WS2HELP.DLL" called.
> DllMain(0x75020000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \WS2HELP.DLL" returned 1 (0x1).
> DllMain(0x75030000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \WS2_32.DLL" called.
> DllMain(0x75030000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \WS2_32.DLL" returned 1 (0x1).
> DllMain(0x77980000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \DNSAPI.DLL" called.
> DllMain(0x77980000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \DNSAPI.DLL" returned 1 (0x1).
> DllMain(0x77950000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \WLDAP32.DLL" called.
> DllMain(0x77950000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \WLDAP32.DLL" returned 1 (0x1).
> DllMain(0x77BF0000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \NTDSAPI.DLL" called.
> DllMain(0x77BF0000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \NTDSAPI.DLL" returned 1 (0x1).
> DllMain(0x75150000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \SAMLIB.DLL" called.
> DllMain(0x75150000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \SAMLIB.DLL" returned 1 (0x1).
> DllMain(0x75170000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \NETAPI32.DLL" called.
> DllMain(0x75170000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \NETAPI32.DLL" returned 1 (0x1).
> DllMain(0x37000000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \ENTAPI.DLL" called.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "GetLongPathNameW") called from "c:\winnt\system32\ENTAPI.DLL" at
> address 0x370031AB and returned 0x7C5A2292.
> DllMain(0x37000000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \ENTAPI.DLL" returned 0 (0x0).
> DllMain(0x37000000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \ENTAPI.DLL" called.
> DllMain(0x37000000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \ENTAPI.DLL" returned 0 (0x0).
> DllMain(0x75170000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \NETAPI32.DLL" called.
> DllMain(0x75170000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \NETAPI32.DLL" returned 1 (0x1).
> DllMain(0x75150000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \SAMLIB.DLL" called.
> DllMain(0x75150000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \SAMLIB.DLL" returned 1 (0x1).
> DllMain(0x77BF0000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \NTDSAPI.DLL" called.
> DllMain(0x77BF0000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \NTDSAPI.DLL" returned 1 (0x1).
> DllMain(0x77950000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \WLDAP32.DLL" called.
> DllMain(0x77950000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \WLDAP32.DLL" returned 1 (0x1).
> DllMain(0x77980000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \DNSAPI.DLL" called.
> DllMain(0x77980000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \DNSAPI.DLL" returned 1 (0x1).
> DllMain(0x7C340000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \SECUR32.DLL" called.
> DllMain(0x7C340000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \SECUR32.DLL" returned 1 (0x1).
> Unloaded "c:\winnt\system32\ENTAPI.DLL" at address 0x37000000.
> Unloaded "c:\winnt\system32\NETAPI32.DLL" at address 0x75170000.
> Unloaded "c:\winnt\system32\SAMLIB.DLL" at address 0x75150000.
> Unloaded "c:\winnt\system32\NETRAP.DLL" at address 0x751C0000.
> Unloaded "c:\winnt\system32\NTDSAPI.DLL" at address 0x77BF0000.
> Unloaded "c:\winnt\system32\WLDAP32.DLL" at address 0x77950000.
> Unloaded "c:\winnt\system32\DNSAPI.DLL" at address 0x77980000.
> Unloaded "c:\winnt\system32\WSOCK32.DLL" at address 0x75050000.
> Unloaded "c:\winnt\system32\SECUR32.DLL" at address 0x7C340000.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "UnhandledExceptionFilter") called from "c:\9c3b6d437d78ea73d12fe1d495
> \update\UPDATE.EXE" at address 0x01066971 and returned 0x7C59BCDC.
> LoadLibraryA("setupapi.dll") called from
> "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at address
> 0x0106BA3B. Loaded "c:\winnt\system32\SETUPAPI.DLL" at address
> 0x77880000. Successfully hooked module.
> DllMain(0x77880000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \SETUPAPI.DLL" called.
> LoadLibraryA("COMCTL32.dll") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A156.
> LoadLibraryA("COMCTL32.dll") returned 0x71710000.
> GetProcAddress(0x71710000 [c:\winnt\system32\COMCTL32.DLL],
> 0x00000011) called from "c:\winnt\system32\SETUPAPI.DLL" at address
> 0x7788A1AC and returned 0x717240A6.
> LoadLibraryA("kernel32.dll") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A316.
> LoadLibraryA("kernel32.dll") returned 0x7C570000.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "GetFileAttributesExA") called from "c:\winnt\system32\SETUPAPI.DLL"
> at address 0x7788A2F5 and returned 0x7C587482.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "GetFileAttributesExW") called from "c:\winnt\system32\SETUPAPI.DLL"
> at address 0x7788A2F5 and returned 0x7C5874A2.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "GetSystemWindowsDirectoryA") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A2F5 and returned 0x7C592C13.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "GetSystemWindowsDirectoryW") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A2F5 and returned 0x7C592C6E.
> DllMain(0x77880000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \SETUPAPI.DLL" returned 1 (0x1).
> LoadLibraryA("setupapi.dll") returned 0x77880000.
> GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
> "pSetupIsUserAdmin") called from "c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDATE.EXE" at address 0x0106BA4D and returned NULL. Error: The
> specified procedure could not be found (127).
> DllMain(0x77880000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \SETUPAPI.DLL" called.
> DllMain(0x77880000, DLL_PROCESS_DETACH, 0x00000000) in
> "c:\winnt\system32 \SETUPAPI.DLL" returned 1 (0x1).
> Unloaded "c:\winnt\system32\SETUPAPI.DLL" at address 0x77880000.
> LoadLibraryW("rpcrt4.dll") called from "c:\winnt\system32\RPCRT4.DLL"
> at address 0x77D400DA.
> LoadLibraryW("rpcrt4.dll") returned 0x77D30000.
> LoadLibraryA("SetupApi.DLL") called from
> "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at address
> 0x01073365. Loaded "c:\winnt\system32\SETUPAPI.DLL" at address
> 0x77880000. Successfully hooked module.
> DllMain(0x77880000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \SETUPAPI.DLL" called.
> LoadLibraryA("COMCTL32.dll") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A156.
> LoadLibraryA("COMCTL32.dll") returned 0x71710000.
> GetProcAddress(0x71710000 [c:\winnt\system32\COMCTL32.DLL],
> 0x00000011) called from "c:\winnt\system32\SETUPAPI.DLL" at address
> 0x7788A1AC and returned 0x717240A6.
> LoadLibraryA("kernel32.dll") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A316.
> LoadLibraryA("kernel32.dll") returned 0x7C570000.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "GetFileAttributesExA") called from "c:\winnt\system32\SETUPAPI.DLL"
> at address 0x7788A2F5 and returned 0x7C587482.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "GetFileAttributesExW") called from "c:\winnt\system32\SETUPAPI.DLL"
> at address 0x7788A2F5 and returned 0x7C5874A2.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "GetSystemWindowsDirectoryA") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A2F5 and returned 0x7C592C13.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "GetSystemWindowsDirectoryW") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A2F5 and returned 0x7C592C6E.
> DllMain(0x77880000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \SETUPAPI.DLL" returned 1 (0x1).
> LoadLibraryA("SetupApi.DLL") returned 0x77880000.
> GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
> "VerifyCatalogFile") called from "c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDATE.EXE" at address 0x0107347C and returned 0x778BDF7C.
> GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
> "InstallCatalog") called from "c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDATE.EXE" at address 0x0107348E and returned 0x778BDE7A.
> GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
> "StringTableEnum") called from "c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDATE.EXE" at address 0x010734A0 and returned 0x778D1755.
> GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
> "StringTableInitializeEx") called from "c:\9c3b6d437d78ea73d12fe1d495
> \update\UPDATE.EXE" at address 0x010734B2 and returned 0x778831EC.
> GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
> "StringTableAddStringEx") called from "c:\9c3b6d437d78ea73d12fe1d495
> \update\UPDATE.EXE" at address 0x010734C4 and returned 0x77885FAC.
> GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
> "StringTableLookUpStringEx") called from
> "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at address
> 0x010734D6 and returned 0x77885F0C. GetProcAddress(0x77880000
> [c:\winnt\system32\SETUPAPI.DLL], "MyGetFileTitle") called from
> "c:\9c3b6d437d78ea73d12fe1d495\update \UPDATE.EXE" at address
> 0x010734E8 and returned 0x778815F6. GetProcAddress(0x77880000
> [c:\winnt\system32\SETUPAPI.DLL], "SetupCopyOEMInfA") called from
> "c:\9c3b6d437d78ea73d12fe1d495\update \UPDATE.EXE" at address
> 0x010734FA and returned 0x778A5AA0. GetProcAddress(0x77880000
> [c:\winnt\system32\SETUPAPI.DLL], "pSetupSetGlobalFlags") called from
> "c:\9c3b6d437d78ea73d12fe1d495\update \UPDATE.EXE" at address
> 0x0107350C and returned 0x778B662E. GetProcAddress(0x77880000
> [c:\winnt\system32\SETUPAPI.DLL], "pSetupGetGlobalFlags") called from
> "c:\9c3b6d437d78ea73d12fe1d495\update \UPDATE.EXE" at address
> 0x0107351E and returned 0x778B663A. LoadLibraryA("Cabinet.dll") called
> from "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at address
> 0x01073534. Loaded "c:\winnt\system32\CABINET.DLL" at address
> 0x75A00000. Successfully hooked module.
> LoadLibraryA("Cabinet.dll") returned 0x75A00000.
> GetProcAddress(0x75A00000 [c:\winnt\system32\CABINET.DLL],
> "FCIDestroy") called from
> "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address
> 0x01073545 and returned 0x75A06A0A. GetProcAddress(0x75A00000
> [c:\winnt\system32\CABINET.DLL], "FCIFlushCabinet") called from
> "c:\9c3b6d437d78ea73d12fe1d495\update \UPDATE.EXE" at address
> 0x01073557 and returned 0x75A06999. GetProcAddress(0x75A00000
> [c:\winnt\system32\CABINET.DLL], "FCIAddFile") called from
> "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address
> 0x01073569 and returned 0x75A068D8. GetProcAddress(0x75A00000
> [c:\winnt\system32\CABINET.DLL], "FCICreate") called from
> "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address
> 0x0107357B and returned 0x75A0679B. GetProcAddress(0x75A00000
> [c:\winnt\system32\CABINET.DLL], "FDIDestroy") called from
> "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address
> 0x0107358D and returned 0x75A01CD8. GetProcAddress(0x75A00000
> [c:\winnt\system32\CABINET.DLL], "FDICopy") called from
> "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address
> 0x0107359F and returned 0x75A01DBF. GetProcAddress(0x75A00000
> [c:\winnt\system32\CABINET.DLL], "FDICreate") called from
> "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address
> 0x010735B1 and returned 0x75A01C48. LoadLibraryA("psapi.dll") called
> from "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at address
> 0x010735BD. LoadLibraryA("psapi.dll") returned 0x690A0000.
> GetProcAddress(0x690A0000 [c:\winnt\system32\PSAPI.DLL],
> "GetModuleBaseNameA") called from
> "c:\9c3b6d437d78ea73d12fe1d495\update \UPDATE.EXE" at address
> 0x010735CE and returned 0x690A1BD4. GetProcAddress(0x690A0000
> [c:\winnt\system32\PSAPI.DLL], "EnumProcessModules") called from
> "c:\9c3b6d437d78ea73d12fe1d495\update \UPDATE.EXE" at address
> 0x010735E0 and returned 0x690A1981. GetProcAddress(0x690A0000
> [c:\winnt\system32\PSAPI.DLL], "EnumProcesses") called from
> "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address
> 0x010735F2 and returned 0x690A3106. LoadLibraryA("wintrust.dll")
> called from "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at
> address 0x010735FE. Loaded "c:\winnt\system32\WINTRUST.DLL" at address
> 0x76930000. Successfully hooked module.
> DllMain(0x76930000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \WINTRUST.DLL" called.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> LoadLibraryExW("C:\WINNT\system32\wintrust.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\wintrust.dll",
> 0x00000000, 0x00000000) returned 0x76930000.
> DllMain(0x76930000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \WINTRUST.DLL" returned 1 (0x1).
> LoadLibraryA("wintrust.dll") returned 0x76930000.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATOpen") called from "c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDATE.EXE" at address 0x01073613 and returned 0x769479AB.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATClose") called from "c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDATE.EXE" at address 0x01073625 and returned 0x76947A70.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATGetCatAttrInfo") called from "c:\9c3b6d437d78ea73d12fe1d495
> \update\UPDATE.EXE" at address 0x01073637 and returned 0x76947BC7.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATEnumerateMember") called from "c:\9c3b6d437d78ea73d12fe1d495
> \update\UPDATE.EXE" at address 0x01073649 and returned 0x769482A7.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATEnumerateAttr") called from "c:\9c3b6d437d78ea73d12fe1d495
> \update\UPDATE.EXE" at address 0x0107365B and returned 0x7694832E.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATAdminRemoveCatalog") called from
> "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at address
> 0x0107366D and returned NULL. Error: The specified procedure could not
> be found (127). GetProcAddress(0x76930000
> [c:\winnt\system32\WINTRUST.DLL], "CryptCATAdminAcquireContext")
> called from "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at
> address 0x0107367F and returned 0x76949058. GetProcAddress(0x76930000
> [c:\winnt\system32\WINTRUST.DLL], "CryptCATAdminReleaseContext")
> called from "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at
> address 0x01073691 and returned 0x76949271. GetProcAddress(0x76930000
> [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATAdminCalcHashFromFileHandle") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010736A3
> and returned 0x7694933D.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATAdminEnumCatalogFromHash") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010736B5
> and returned 0x76949593.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATCatalogInfoFromContext") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010736C7
> and returned 0x769497C5.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATAdminReleaseCatalogContext") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010736D9
> and returned 0x76949559.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "WTHelperProvDataFromStateData") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010736EB
> and returned 0x76947B92.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "WTHelperGetProvSignerFromChain") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010736FD
> and returned 0x7693BD1E.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "WTHelperGetProvCertFromChain") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x0107370F
> and returned 0x7693BD5C.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "WinVerifyTrust") called from "c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDATE.EXE" at address 0x01073721 and returned 0x7693B401.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATGetMemberInfo") called from "c:\9c3b6d437d78ea73d12fe1d495
> \update\UPDATE.EXE" at address 0x01073733 and returned 0x76947DDD.
> LoadLibraryA("crypt32.dll") called from "c:\9c3b6d437d78ea73d12fe1d495
> \update\UPDATE.EXE" at address 0x010737A3.
> LoadLibraryA("crypt32.dll") returned 0x7C740000.
> GetProcAddress(0x7C740000 [c:\winnt\system32\CRYPT32.DLL],
> "CryptHashPublicKeyInfo") called from "c:\9c3b6d437d78ea73d12fe1d495
> \update\UPDATE.EXE" at address 0x010737B4 and returned 0x7C76A5E2.
> LoadLibraryA("newdev.dll") called from "c:\9c3b6d437d78ea73d12fe1d495
> \update\UPDATE.EXE" at address 0x010737DC.
> Loaded "c:\winnt\system32\NEWDEV.DLL" at address 0x6A3A0000.
> Successfully hooked module.
> DllMain(0x6A3A0000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \NEWDEV.DLL" called.
> DllMain(0x6A3A0000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \NEWDEV.DLL" returned 1 (0x1).
> LoadLibraryA("newdev.dll") returned 0x6A3A0000.
> GetProcAddress(0x6A3A0000 [c:\winnt\system32\NEWDEV.DLL],
> "UpdateDriverForPlugAndPlayDevicesA") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010737ED
> and returned 0x6A3A1FB4.
> LoadLibraryA("kernel32.DLL") called from
> "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at address
> 0x010737F9. LoadLibraryA("kernel32.DLL") returned 0x7C570000.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "GetSystemDefaultUILanguage") called from
> "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at address
> 0x0107380A and returned 0x7C5B0FFB. LoadLibraryA("SXS.DLL") called
> from "c:\9c3b6d437d78ea73d12fe1d495\update \UPDATE.EXE" at address
> 0x01073816. LoadLibraryA("SXS.DLL") returned NULL. Error: The
> specified module could not be found (126).
> LoadLibraryA("Advapi32.DLL") called from
> "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at address
> 0x01073845. LoadLibraryA("Advapi32.DLL") returned 0x7C2D0000.
> GetProcAddress(0x7C2D0000 [c:\winnt\system32\ADVAPI32.DLL],
> "SetSecurityDescriptorControl") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x01073856
> and returned 0x7C2E6C7E.
> GetProcAddress(0x7C2D0000 [c:\winnt\system32\ADVAPI32.DLL],
> "InitiateSystemShutdownExA") called from
> "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at address
> 0x0107386E and returned 0x7C3094D3. LoadLibraryA("Clusapi.DLL") called
> from "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at address
> 0x0107387A. Loaded "c:\winnt\system32\CLUSAPI.DLL" at address
> 0x73930000. Successfully hooked module.
> LoadLibraryA("Clusapi.DLL") returned 0x73930000.
> GetProcAddress(0x73930000 [c:\winnt\system32\CLUSAPI.DLL],
> "GetNodeClusterState") called from
> "c:\9c3b6d437d78ea73d12fe1d495\update \UPDATE.EXE" at address
> 0x0107388B and returned 0x739335E8. LoadLibraryA("gdi32.DLL") called
> from "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at address
> 0x01073897. LoadLibraryA("gdi32.DLL") returned 0x77F40000.
> GetProcAddress(0x77F40000 [c:\winnt\system32\GDI32.DLL], "SetLayout")
> called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at
> address 0x010738AA and returned 0x77F530D6.
> LoadLibraryA("UPDSPAPI.dll") called from
> "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at address
> 0x01066878. Loaded "c:\9c3b6d437d78ea73d12fe1d495\update\UPDSPAPI.DLL "
> at address 0x00C20000. Successfully hooked module.
> DllMain(0x00C20000, DLL_PROCESS_ATTACH, 0x00000000) in "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDSPAPI.DLL" called.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "UnhandledExceptionFilter") called from "c:\9c3b6d437d78ea73d12fe1d495
> \update\UPDSPAPI.DLL" at address 0x00C383CF and returned 0x7C59BCDC.
> LoadLibraryA("C:\WINNT\system32\kernel32.dll") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDSPAPI.DLL" at address
> 0x00C37FDB. LoadLibraryA("C:\WINNT\system32\kernel32.dll") returned
> 0x7C570000. GetProcAddress(0x7C570000
> [c:\winnt\system32\KERNEL32.DLL], "GetSystemWindowsDirectoryW") called
> from "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDSPAPI.DLL" at address
> 0x00C38073 and returned 0x7C592C6E.
> LoadLibraryA("C:\WINNT\system32\shlwapi.dll") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDSPAPI.DLL" at address
> 0x00C37FDB. LoadLibraryA("C:\WINNT\system32\shlwapi.dll") returned
> 0x70A70000. GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL],
> "SHAutoComplete") called from "c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDSPAPI.DLL" at address 0x00C38073 and returned 0x70AA9E0B.
> DllMain(0x00C20000, DLL_PROCESS_ATTACH, 0x00000000) in "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDSPAPI.DLL" returned 1 (0x1).
> LoadLibraryA("UPDSPAPI.dll") returned 0x00C20000.
> GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDSPAPI.DLL], "UpdSpOpenInfFileA") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9
> and returned 0x00C327EE.
> GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDSPAPI.DLL], "UpdSpGetLineTextA") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9
> and returned 0x00C33312.
> GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDSPAPI.DLL], "UpdSpFindFirstLineA") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9
> and returned 0x00C2F8A9.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "GetSystemWow64DirectoryW") called from "c:\9c3b6d437d78ea73d12fe1d495
> \update\UPDATE.EXE" at address 0x0106E0BD and returned NULL. Error:
> The specified procedure could not be found (127).
> GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDSPAPI.DLL], "UpdSpGetSourceInfoA") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9
> and returned 0x00C32E22.
> GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDSPAPI.DLL], "UpdSpGetLineCountA") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9
> and returned 0x00C2F9E0.
> GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDSPAPI.DLL], "UpdSpGetStringFieldA") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9
> and returned 0x00C3317C.
> GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDSPAPI.DLL], "UpdSpGetStringFieldA") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9
> and returned 0x00C3317C.
> GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDSPAPI.DLL], "UpdSpGetStringFieldA") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9
> and returned 0x00C3317C.
> GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDSPAPI.DLL], "UpdSpFindNextLine") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9
> and returned 0x00C2F925.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "GetUserDefaultUILanguage") called from
> "c:\winnt\system32\COMCTL32.DLL" at address 0x7174A9F7 and returned
> 0x7C5B1028. GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL],
> "DllGetVersion") called from "c:\winnt\system32\COMCTL32.DLL" at
> address 0x7176AF10 and returned 0x70AC2A56.
> GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL], 0x00000189)
> called from "c:\winnt\system32\COMCTL32.DLL" at address 0x7176AFCA and
> returned 0x70A9AEB5.
> GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL],
> "DllGetVersion") called from "c:\winnt\system32\COMCTL32.DLL" at
> address 0x7176AF10 and returned 0x70AC2A56.
> GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL], 0x000001AE)
> called from "c:\winnt\system32\COMCTL32.DLL" at address 0x7176AF6D and
> returned 0x70AAE6DA.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "GetSystemDefaultUILanguage") called from "c:\winnt\system32
> \SHLWAPI.DLL" at address 0x70AAE140 and returned 0x7C5B0FFB.
> LoadLibraryA("COMCTL32.dll") called from
> "c:\winnt\system32\SHLWAPI.DLL" at address 0x70AC5CD9.
> LoadLibraryA("COMCTL32.dll") returned 0x71710000.
> GetProcAddress(0x71710000 [c:\winnt\system32\COMCTL32.DLL],
> 0x00000148) called from "c:\winnt\system32\SHLWAPI.DLL" at address
> 0x70AC5DD6 and returned 0x71724171.
> GetProcAddress(0x71710000 [c:\winnt\system32\COMCTL32.DLL],
> 0x0000014E) called from "c:\winnt\system32\SHLWAPI.DLL" at address
> 0x70AC5DD6 and returned 0x7171E831.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "GetUserDefaultUILanguage") called from
> "c:\winnt\system32\SHLWAPI.DLL" at address 0x70AAE1F3 and returned
> 0x7C5B1028. GetProcAddress(0x77E10000 [c:\winnt\system32\USER32.DLL],
> "NotifyWinEvent") called from "c:\winnt\system32\COMCTL32.DLL" at
> address 0x7172A4A8 and returned 0x77E5077C.
> LoadLibraryExW("C:\Program Files\Iomega\DriveIcons\IMGHOOK.DLL",
> 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) called from
> "c:\winnt\system32 \USER32.DLL" at address 0x77E1E47E.
> Loaded "c:\program files\iomega\driveicons\IMGHOOK.DLL" at address
> 0x30000000. Successfully hooked module.
> DllMain(0x30000000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\program
> files \iomega\driveicons\IMGHOOK.DLL" called.
> GetProcAddress(0x782F0000 [c:\winnt\system32\SHELL32.DLL],
> "SHFileOperationA") called from "c:\program files\iomega\driveicons
> \IMGHOOK.DLL" at address 0x3000114D and returned 0x783402E6.
> GetProcAddress(0x782F0000 [c:\winnt\system32\SHELL32.DLL],
> "SHFileOperationW") called from "c:\program files\iomega\driveicons
> \IMGHOOK.DLL" at address 0x3000114D and returned 0x7833FF7A.
> DllMain(0x30000000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\program
> files \iomega\driveicons\IMGHOOK.DLL" returned 1 (0x1).
> LoadLibraryExW("C:\Program Files\Iomega\DriveIcons\IMGHOOK.DLL",
> 0x00000000, LOAD_WITH_ALTERED_SEARCH_PATH) returned 0x30000000.
> GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL],
> "DllGetVersion") called from "c:\winnt\system32\COMCTL32.DLL" at
> address 0x7176AF10 and returned 0x70AC2A56.
> GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL], 0x00000189)
> called from "c:\winnt\system32\COMCTL32.DLL" at address 0x7176AFCA and
> returned 0x70A9AEB5.
> GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL],
> "DllGetVersion") called from "c:\winnt\system32\COMCTL32.DLL" at
> address 0x7176AF10 and returned 0x70AC2A56.
> GetProcAddress(0x70A70000 [c:\winnt\system32\SHLWAPI.DLL], 0x000001AF)
> called from "c:\winnt\system32\COMCTL32.DLL" at address 0x7176AF9A and
> returned 0x70AAE752.
> GetProcAddress(0x71710000 [c:\winnt\system32\COMCTL32.DLL],
> 0x00000150) called from "c:\winnt\system32\SHLWAPI.DLL" at address
> 0x70AC5DD6 and returned 0x717235AE.
> GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDSPAPI.DLL], "UpdSpFindFirstLineW") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9
> and returned 0x00C2F449.
> LoadLibraryA("setupapi.dll") called from
> "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at address
> 0x0106BA3B. LoadLibraryA("setupapi.dll") returned 0x77880000.
> GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
> "pSetupIsUserAdmin") called from "c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDATE.EXE" at address 0x0106BA4D and returned NULL. Error: The
> specified procedure could not be found (127).
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "GetSystemWow64DirectoryW") called from "c:\9c3b6d437d78ea73d12fe1d495
> \update\UPDATE.EXE" at address 0x0106E0BD and returned NULL. Error:
> The specified procedure could not be found (127).
> GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDSPAPI.DLL], "UpdSpCloseInfFile") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9
> and returned 0x00C32A37.
> LoadLibraryA("SETUPAPI.dll") called from
> "c:\9c3b6d437d78ea73d12fe1d495 \update\UPDATE.EXE" at address
> 0x01066878. LoadLibraryA("SETUPAPI.dll") returned 0x77880000.
> GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
> "SetupCloseInfFile") called from "c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDATE.EXE" at address 0x010668D9 and returned 0x77882D8A.
> LoadLibraryA("WINTRUST.dll") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A156.
> LoadLibraryA("WINTRUST.dll") returned 0x76930000.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATAdminAcquireContext") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A1AC and returned 0x76949058.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATAdminCalcHashFromFileHandle") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A1AC and returned 0x7694933D.
> LoadLibraryExW("C:\WINNT\System32\asfsipc.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. Loaded "c:\winnt\system32\ASFSIPC.DLL" at address
> 0x74A50000. Successfully hooked module.
> DllMain(0x74A50000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \ASFSIPC.DLL" called.
> DllMain(0x74A50000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \ASFSIPC.DLL" returned 1 (0x1).
> LoadLibraryExW("C:\WINNT\System32\asfsipc.dll", 0x00000000,
> 0x00000000) returned 0x74A50000.
> GetProcAddress(0x74A50000 [c:\winnt\system32\ASFSIPC.DLL],
> "DllCanUnloadNow") called from "c:\winnt\system32\CRYPT32.DLL" at
> address 0x7C74EDC3 and returned NULL. Error: The specified procedure
> could not be found (127).
> GetProcAddress(0x74A50000 [c:\winnt\system32\ASFSIPC.DLL],
> "IsMyTypeOfFile") called from "c:\winnt\system32\CRYPT32.DLL" at
> address 0x7C74ED39 and returned 0x74A515AF.
> LoadLibraryExW("C:\WINNT\system32\CRYPT32.dll", 0x00000000,
> 0x00000000) called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C75F4C0. LoadLibraryExW("C:\WINNT\system32\CRYPT32.dll",
> 0x00000000, 0x00000000) returned 0x7C740000.
> LoadLibraryExW("MSISIP.DLL", 0x00000000, 0x00000000) called from "c:
> \winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
> Loaded "c:\winnt\system32\MSISIP.DLL" at address 0x00E10000.
> Successfully hooked module.
> DllMain(0x00E10000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \MSISIP.DLL" called.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "InitializeCriticalSectionAndSpinCount") called from
> "c:\winnt\system32 \MSISIP.DLL" at address 0x00E169F2 and returned
> 0x7C59987C. DllMain(0x00E10000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \MSISIP.DLL" returned 1 (0x1).
> LoadLibraryExW("MSISIP.DLL", 0x00000000, 0x00000000) returned
> 0x00E10000. GetProcAddress(0x00E10000 [c:\winnt\system32\MSISIP.DLL],
> "DllCanUnloadNow") called from "c:\winnt\system32\CRYPT32.DLL" at
> address 0x7C74EDC3 and returned NULL. Error: The specified procedure
> could not be found (127).
> GetProcAddress(0x00E10000 [c:\winnt\system32\MSISIP.DLL],
> "MsiSIPIsMyTypeOfFile") called from "c:\winnt\system32\CRYPT32.DLL" at
> address 0x7C74ED39 and returned 0x00E12868.
> LoadLibraryW("ole32.dll") called from "c:\winnt\system32\MSISIP.DLL"
> at address 0x00E12895.
> LoadLibraryW("ole32.dll") returned 0x77A50000.
> GetProcAddress(0x77A50000 [c:\winnt\system32\OLE32.DLL],
> "CoInitialize") called from "c:\winnt\system32\MSISIP.DLL" at address
> 0x00E1266F and returned 0x77A90E04.
> GetProcAddress(0x77A50000 [c:\winnt\system32\OLE32.DLL],
> "StgOpenStorage") called from "c:\winnt\system32\MSISIP.DLL" at
> address 0x00E128E3 and returned 0x77A73B4C.
> GetProcAddress(0x77A50000 [c:\winnt\system32\OLE32.DLL],
> "CoUninitialize") called from "c:\winnt\system32\MSISIP.DLL" at
> address 0x00E126B0 and returned 0x77A7EB3E.
> LoadLibraryExW("C:\WINNT\System32\wshext.dll", 0x00000000, 0x00000000)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
> Loaded "c:\winnt\system32\WSHEXT.DLL" at address 0x10000000.
> Successfully hooked module.
> Loaded "c:\winnt\system32\COMDLG32.DLL" at address 0x76B30000.
> Successfully hooked module.
> DllMain(0x76B30000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \COMDLG32.DLL" called.
> DllMain(0x76B30000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \COMDLG32.DLL" returned 1 (0x1).
> DllMain(0x10000000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \WSHEXT.DLL" called.
> LoadLibraryA("C:\WINNT\System32\wshENG.DLL") called from "c:\winnt
> \system32\WSHEXT.DLL" at address 0x10008F55.
> LoadLibraryA("C:\WINNT\System32\wshENG.DLL") returned NULL. Error: The
> specified module could not be found (126).
> LoadLibraryA("wshENG.DLL") called from "c:\winnt\system32\WSHEXT.DLL"
> at address 0x10008F64.
> LoadLibraryA("wshENG.DLL") returned NULL. Error: The specified module
> could not be found (126).
> LoadLibraryA("C:\WINNT\System32\wshEN.DLL") called from "c:\winnt
> \system32\WSHEXT.DLL" at address 0x10008FC1.
> LoadLibraryA("C:\WINNT\System32\wshEN.DLL") returned NULL. Error: The
> specified module could not be found (126).
> LoadLibraryA("wshEN.DLL") called from "c:\winnt\system32\WSHEXT.DLL"
> at address 0x10008FD0.
> LoadLibraryA("wshEN.DLL") returned NULL. Error: The specified module
> could not be found (126).
> LoadLibraryA("C:\WINNT\System32\wshENU.DLL") called from "c:\winnt
> \system32\WSHEXT.DLL" at address 0x1000904D.
> LoadLibraryA("C:\WINNT\System32\wshENU.DLL") returned NULL. Error: The
> specified module could not be found (126).
> LoadLibraryA("wshENU.DLL") called from "c:\winnt\system32\WSHEXT.DLL"
> at address 0x10009058.
> LoadLibraryA("wshENU.DLL") returned NULL. Error: The specified module
> could not be found (126).
> DllMain(0x10000000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \WSHEXT.DLL" returned 1 (0x1).
> LoadLibraryExW("C:\WINNT\System32\wshext.dll", 0x00000000, 0x00000000)
> returned 0x10000000.
> GetProcAddress(0x10000000 [c:\winnt\system32\WSHEXT.DLL],
> "DllCanUnloadNow") called from "c:\winnt\system32\CRYPT32.DLL" at
> address 0x7C74EDC3 and returned 0x10002130.
> GetProcAddress(0x10000000 [c:\winnt\system32\WSHEXT.DLL],
> "IsFileSupportedName") called from "c:\winnt\system32\CRYPT32.DLL" at
> address 0x7C74ED39 and returned 0x10005060.
> GetProcAddress(0x10000000 [c:\winnt\system32\WSHEXT.DLL],
> "IsFileSupportedName") called from "c:\winnt\system32\CRYPT32.DLL" at
> address 0x7C74ED39 and returned 0x10005060.
> GetProcAddress(0x10000000 [c:\winnt\system32\WSHEXT.DLL],
> "IsFileSupportedName") called from "c:\winnt\system32\CRYPT32.DLL" at
> address 0x7C74ED39 and returned 0x10005060.
> LoadLibraryExW("WINTRUST.DLL", 0x00000000, 0x00000000) called from "c:
> \winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
> LoadLibraryExW("WINTRUST.DLL", 0x00000000, 0x00000000) returned
> 0x76930000.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "DllCanUnloadNow") called from "c:\winnt\system32\CRYPT32.DLL" at
> address 0x7C74EDC3 and returned NULL. Error: The specified procedure
> could not be found (127).
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptSIPPutSignedDataMsg") called from
> "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74ED39 and returned
> 0x7694415C. LoadLibraryExA("sp3res.dll", 0x00000000,
> LOAD_LIBRARY_AS_DATAFILE) called from "c:\winnt\system32\CRYPT32.DLL"
> at address 0x7C74C4E1. Mapped "SP3RES.DLL" as a data file into memory
> at address 0x01530001. LoadLibraryExA("sp3res.dll", 0x00000000,
> LOAD_LIBRARY_AS_DATAFILE) returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C74C4E1.
> Mapped "SP3RES.DLL" as a data file into memory at address 0x01530001.
> LoadLibraryExA("sp3res.dll", 0x00000000, LOAD_LIBRARY_AS_DATAFILE)
> returned 0x01530001.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptSIPCreateIndirectData") called from "c:\winnt\system32
> \CRYPT32.DLL" at address 0x7C74ED39 and returned 0x7694421B.
> LoadLibraryA("rsaenh.dll") called from
> "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4355.
> Loaded "c:\winnt\system32\RSAENH.DLL" at address 0x7CA00000.
> Successfully hooked module.
> DllMain(0x7CA00000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \RSAENH.DLL" called.
> LoadLibraryA("crypt32.dll") called from "c:\winnt\system32\RSAENH.DLL"
> at address 0x7CA1BF53.
> LoadLibraryA("crypt32.dll") returned 0x7C740000.
> LoadLibraryA("ole32.dll") called from "c:\winnt\system32\RSAENH.DLL"
> at address 0x7CA0D3F3.
> LoadLibraryA("ole32.dll") returned 0x77A50000.
> DllMain(0x7CA00000, DLL_PROCESS_ATTACH, 0x00000000) in
> "c:\winnt\system32 \RSAENH.DLL" returned 1 (0x1).
> LoadLibraryA("rsaenh.dll") returned 0x7CA00000.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPAcquireContext") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E4495 and returned 0x7CA0BF89.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPReleaseContext") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E4495 and returned 0x7CA0BFD9.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL], "CPGenKey")
> called from "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4495 and
> returned 0x7CA065F0.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPDeriveKey") called from "c:\winnt\system32\ADVAPI32.DLL" at address
> 0x7C2E4495 and returned 0x7CA0680B.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPDestroyKey") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E4495 and returned 0x7CA081C8.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPSetKeyParam") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E4495 and returned 0x7CA083A0.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPGetKeyParam") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E4495 and returned 0x7CA086EF.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPExportKey") called from "c:\winnt\system32\ADVAPI32.DLL" at address
> 0x7C2E4495 and returned 0x7CA0734D.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPImportKey") called from "c:\winnt\system32\ADVAPI32.DLL" at address
> 0x7C2E4495 and returned 0x7CA078F3.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL], "CPEncrypt")
> called from "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4495 and
> returned 0x7CA04AA5.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL], "CPDecrypt")
> called from "c:\winnt\system32\ADVAPI32.DLL" at address 0x7C2E4495 and
> returned 0x7CA04DB2.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPCreateHash") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E4495 and returned 0x7CA04F2B.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPHashData") called from "c:\winnt\system32\ADVAPI32.DLL" at address
> 0x7C2E4495 and returned 0x7CA055F0.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPHashSessionKey") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E4495 and returned 0x7CA05736.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPDestroyHash") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E4495 and returned 0x7CA059E9.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPSignHash") called from "c:\winnt\system32\ADVAPI32.DLL" at address
> 0x7C2E4495 and returned 0x7CA0A1DF.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPVerifySignature") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E4495 and returned 0x7CA0A639.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPGenRandom") called from "c:\winnt\system32\ADVAPI32.DLL" at address
> 0x7C2E4495 and returned 0x7CA0A00E.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPGetUserKey") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E4495 and returned 0x7CA082D4.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPSetProvParam") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E4495 and returned 0x7CA08AA8.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPGetProvParam") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E4495 and returned 0x7CA08BE5.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPSetHashParam") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E4495 and returned 0x7CA091A2.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPGetHashParam") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E4495 and returned 0x7CA095B2.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPDuplicateKey") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E44B2 and returned 0x7CA09A84.
> GetProcAddress(0x7CA00000 [c:\winnt\system32\RSAENH.DLL],
> "CPDuplicateHash") called from "c:\winnt\system32\ADVAPI32.DLL" at
> address 0x7C2E44B2 and returned 0x7CA05B1B.
> LoadLibraryA("kernel32.dll") called from
> "c:\winnt\system32\RSAENH.DLL" at address 0x7CA17B11.
> LoadLibraryA("kernel32.dll") returned 0x7C570000.
> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL],
> "InterlockedCompareExchange") called from
> "c:\winnt\system32\RSAENH.DLL" at address 0x7CA17B21 and returned
> 0x7C57B5BC. GetProcAddress(0x77F80000 [c:\winnt\system32\NTDLL.DLL],
> "NtQuerySystemInformation") called from "c:\winnt\system32\RSAENH.DLL"
> at address 0x7CA1770F and returned 0x77F83227.
> GetProcAddress(0x77F80000 [c:\winnt\system32\NTDLL.DLL], "NtOpenFile")
> called from "c:\winnt\system32\RSAENH.DLL" at address 0x7CA1772A and
> returned 0x77F85AFB.
> GetProcAddress(0x77F80000 [c:\winnt\system32\NTDLL.DLL],
> "RtlInitUnicodeString") called from "c:\winnt\system32\RSAENH.DLL" at
> address 0x7CA17737 and returned 0x77F8335D.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATAdminEnumCatalogFromHash") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A1AC and returned 0x76949593.
> Second chance exception 0xC0000005 (Access Violation) occurred in "c:
> \winnt\system32\WINTRUST.DLL" at address 0x769503B2.
> Exited "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" (process
> 0x83C) with code 128 (0x80).
Any Ideas?

"Peter Nimmo" <> wrote in message
news:Xns963CB62DFB54EPeterNnospamtnsofres@127.0.0. 1...
> Peter Nimmo <Peter.Nimmo@nospamtnsofresdotcom> wrote in
> news:Xns963C6C55797ECPeterNnospamtnsofres@207.46.2 48.16:
>
>> I have also run an update through Dependancy Walker. The last
>> meaningful log entry says "Second chance exception 0xC0000005 (Access
>> Violation) occurred in "c:\winnt\system32\WINTRUST.DLL" at address
>> 0x769503B2."
>>
>> This DLL is identical to a collegues so the DLL is not corrupt.


Have you tried re-registering the .dlls associated with encryption
such as the one you are crashing in?

<title>KB822798 - You cannot install some updates or programs</title>

(TechNet KB search for
wintrust "Windows Update"
)


---

"Robert Aldwinckle" <> wrote in news:eOt5d0cSFHA.2964
@TK2MSFTNGP15.phx.gbl:
>
> Have you tried re-registering the .dlls associated with encryption
> such as the one you are crashing in?
>
><title>KB822798 - You cannot install some updates or programs</title>
>
> (TechNet KB search for
> wintrust "Windows Update"
> )
Yes, I have done that and compared each of the dlls with a collegues and
each one is identical.

"Peter Nimmo" <Peter.Nimmo@nospamtnsofresdotcom> wrote in message news:Xns963C6C55797ECPeterNnospamtnsofres@207.46.2 48.16...
>I have also run an update through Dependancy Walker. The last meaningful
> log entry says "Second chance exception 0xC0000005 (Access Violation)
> occurred in "c:\winnt\system32\WINTRUST.DLL" at address 0x769503B2."
>
> This DLL is identical to a collegues so the DLL is not corrupt.

What about the other recoverable error conditions indicated by
your excellent trace? Do they yield any clues?

Can you create the same sort of trace on the machine which works?
Perhaps you would spot a significant difference that way.
You probably wouldn't be able to compare the traces in any automated
way e.g. using windiff, unless you took the trouble to remove or
"commonalize" all transitory details such as addresses and GUIDs,
etc. but it might at least help to scroll two side by side windows
with such traces in them.

E.g. I don't have your OS (I have XPsp2) but FWIW some of those
"returned NULL" cases in your log would not have occurred on my
system.


FWIW let's highlight those now:

> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL], "IsTNT")
> called from "c:\winnt\system32\OLEAUT32.DLL" at address 0x77A23F12 and
> returned NULL. Error: The specified procedure could not be found (127).

My kernel32 does not have IsTNT either.


> GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL], "pSetupIsUserAdmin")
> called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address 0x0106BA4D
> and returned NULL. Error: The specified procedure could not be found (127).

My setupapi.dll does have pSetupIsUserAdmin.


> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL], "CryptCATAdminRemoveCatalog")
> called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address 0x0107366D
> and returned NULL. Error: The specified procedure could not be found (127).

My wintrust.dll has CryptCATAdminRemoveCatalog


> LoadLibraryA("SXS.DLL") called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE"
> at address 0x01073816.
> LoadLibraryA("SXS.DLL") returned NULL. Error: The specified module could
> not be found (126).

I do have such a module, in %windir%\System32
<filever>
--a-- W32i DLL ENU 5.1.2600.2180 shp 713,216 08-04-2004 sxs.dll
</filever>


> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL], "GetSystemWow64DirectoryW")
> called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address 0x0106E0BD
> and returned NULL. Error: The specified procedure could not be found (127).

My kernel32.dll has GetSystemWow64DirectoryW


> GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL], "pSetupIsUserAdmin")
> called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address 0x0106BA4D
> and returned NULL. Error: The specified procedure could not be found (127).

> GetProcAddress(0x7C570000 [c:\winnt\system32\KERNEL32.DLL], "GetSystemWow64DirectoryW")
> called from "c:\9c3b6d437d78ea73d12fe1d495\update\UPDATE.E XE" at address 0x0106E0BD
> and returned NULL. Error: The specified procedure could not be found (127).

(Two more already seen.)

New plan. I have just spotted something interesting in the next "returned NULL".
Something between here and then appears to have caused a cleanup to be
initiated. (Note that this is a guess which should be tested by looking at the
same trace being done for a case which doesn't fail.)


> GetProcAddress(0x00C20000 [c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDSPAPI.DLL], "UpdSpCloseInfFile") called from "c:
> \9c3b6d437d78ea73d12fe1d495\update\UPDATE.EXE" at address 0x010668D9 and
> returned 0x00C32A37.
> LoadLibraryA("SETUPAPI.dll") called from "c:\9c3b6d437d78ea73d12fe1d495
> \update\UPDATE.EXE" at address 0x01066878.
> LoadLibraryA("SETUPAPI.dll") returned 0x77880000.
> GetProcAddress(0x77880000 [c:\winnt\system32\SETUPAPI.DLL],
> "SetupCloseInfFile") called from "c:\9c3b6d437d78ea73d12fe1d495\update
> \UPDATE.EXE" at address 0x010668D9 and returned 0x77882D8A.

Hmm... maybe I have a red herring. This looks like it could be
some normal termination of some kind.

> LoadLibraryA("WINTRUST.dll") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A156.
> LoadLibraryA("WINTRUST.dll") returned 0x76930000.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATAdminAcquireContext") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A1AC and returned 0x76949058.
> GetProcAddress(0x76930000 [c:\winnt\system32\WINTRUST.DLL],
> "CryptCATAdminCalcHashFromFileHandle") called from "c:\winnt\system32
> \SETUPAPI.DLL" at address 0x7788A1AC and returned 0x7694933D.
> LoadLibraryExW("C:\WINNT\System32\asfsipc.dll", 0x00000000, 0x00000000)
> called from "c:\winnt\system32\CRYPT32.DLL" at address 0x7C75F4C0.
> Loaded "c:\winnt\system32\ASFSIPC.DLL" at address 0x74A50000.
> Successfully hooked module.
> DllMain(0x74A50000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
> \ASFSIPC.DLL" called.
> DllMain(0x74A50000, DLL_PROCESS_ATTACH, 0x00000000) in "c:\winnt\system32
> \ASFSIPC.DLL" returned 1 (0x1).
> LoadLibraryExW("C:\WINNT\System32\asfsipc.dll", 0x00000000, 0x00000000)
> returned 0x74A50000.
> GetProcAddress(0x74A50000 [c:\winnt\system32\ASFSIPC.DLL],
> "DllCanUnloadNow") called from "c:\winnt\system32\CRYPT32.DLL" at address
> 0x7C74EDC3 and returned NULL. Error: The specified procedure could not be
> found (127).

Well, FWIW, my asfsiipc.dll doesn't have a DllCanUnloadNow either.
I hope you can find out whether your normal trace has this and more importantly
what follows in it.

I'm going to stop here in case what follows is just documenting failed
error recovery and diagnosis. FWIW all the rest of the "returned NULL"
would occur on my system too.


HTH

Robert
---