[dyn!o]

LaDidi: with all respect my friend... don't say things you ain't sure.

DEC ECX in your opinion can't crash or cause a special operation? How much would you bet on it? I hope not much since it can. It can perform many other wild things. I suggest you to read about viruses with advanced metamorph engines. Anyway, that's not important in *this* case but think again:

it's Hardlock, so it uses hardlock.sys (and maybe haspnt.sys) drivers. You still don't see the possibility of flags (decrement result) controlling?

Mahmut: make sure you completely removed hardlock.sys/haspnt.sys communication (you can run the software and check active drivers, or just remove the drivers).

Regards.