HELP

ok this worked, but because i couldn't see that file gt save report thingy i copied what was there: ok will try that OTL thing next be back soon RkU Version: 3.8.388.590, Type LE (SR2) ============================================== OS Name: Windows 7 Version 6.1.7600 Number of processors #2 ============================================== >Drivers ============================================== 0x8FC13000 C:\windows\system32\DRIVERS\atipmdag.sys 5664768 bytes (ATI Technologies Inc., ATI Radeon Kernel Mode Driver) 0x82A16000 C:\windows\system32\ntkrnlpa.exe 4259840 bytes (Microsoft Corporation, NT Kernel & System) 0x82A16000 PnpManager 4259840 bytes 0x82A16000 RAW 4259840 bytes 0x82A16000 WMIxWDM 4259840 bytes 0x90635000 C:\windows\system32\DRIVERS\bcmwl6.sys 2723840 bytes (Broadcom Corporation, Broadcom 802.11 Network Adapter wireless driver) 0x8BA0E000 C:\windows\system32\DRIVERS\SMIEXP.SYS 2551808 bytes (Silicon Motion Corporation, SMI Export Device Driver) 0x971B0000 Win32k 2404352 bytes 0x971B0000 C:\windows\System32\win32k.sys 2404352 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0x8F076000 C:\windows\System32\drivers\tcpip.sys 1347584 bytes (Microsoft Corporation, TCP/IP Driver) 0x8A41B000 C:\windows\System32\Drivers\Ntfs.sys 1241088 bytes (Microsoft Corporation, NT File System Driver) 0x90235000 C:\windows\System32\drivers\dxgkrnl.sys 749568 bytes (Microsoft Corporation, DirectX Graphics Kernel) 0x8A61E000 C:\windows\system32\drivers\ndis.sys 749568 bytes (Microsoft Corporation, NDIS 6.20 driver) 0x8A088000 C:\windows\system32\CI.dll 700416 bytes (Microsoft Corporation, Code Integrity Module) 0x99023000 C:\windows\system32\drivers\peauth.sys 618496 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver) 0x8BD36000 C:\windows\system32\drivers\HTTP.sys 544768 bytes (Microsoft Corporation, HTTP Protocol Stack) 0x92435000 C:\windows\system32\drivers\CHDRT32.sys 528384 bytes (Conexant Systems Inc., High Definition Audio Function Driver) 0x8A133000 C:\windows\system32\drivers\Wdf01000.sys 462848 bytes (Microsoft Corporation, Kernel Mode Driver Framework Runtime) 0xA2E04000 C:\windows\system32\drivers\spsys.sys 434176 bytes (Microsoft Corporation, security processor) 0x8A588000 C:\windows\System32\Drivers\cng.sys 380928 bytes (Microsoft Corporation, Kernel Cryptography, Next Generation) 0x8F869000 C:\windows\system32\drivers\afd.sys 368640 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0x99141000 C:\windows\System32\DRIVERS\srv.sys 331776 bytes (Microsoft Corporation, Server driver) 0x990F2000 C:\windows\System32\DRIVERS\srv2.sys 323584 bytes (Microsoft Corporation, Smb 2.0 Server driver) 0x908F4000 C:\windows\system32\DRIVERS\USBPORT.SYS 307200 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0x8A288000 C:\windows\System32\drivers\volmgrx.sys 307200 bytes (Microsoft Corporation, Volume Manager Extension Driver) 0x8A1B2000 C:\windows\system32\DRIVERS\ACPI.sys 294912 bytes (Microsoft Corporation, ACPI Driver for NT) 0x8BCCD000 C:\windows\system32\DRIVERS\nwifi.sys 286720 bytes (Microsoft Corporation, NativeWiFi Miniport Driver) 0x9017A000 C:\windows\system32\DRIVERS\usbhub.sys 278528 bytes (Microsoft Corporation, Default Hub Driver for USB) 0x8A046000 C:\windows\system32\CLFS.SYS 270336 bytes (Microsoft Corporation, Common Log File System Driver) 0x8F92B000 C:\windows\system32\DRIVERS\rdbss.sys 266240 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0x8A738000 C:\windows\system32\DRIVERS\volsnap.sys 258048 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0x8A6D5000 C:\windows\system32\drivers\NETIO.SYS 253952 bytes (Microsoft Corporation, Network I/O Subsystem) 0x901BE000 C:\windows\system32\DRIVERS\mrxsmb10.sys 241664 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr) 0x90998000 C:\windows\system32\DRIVERS\Apfiltr.sys 233472 bytes (Alps Electric Co., Ltd., Alps Touch Pad Driver) 0x902EC000 C:\windows\System32\drivers\dxgmms1.sys 233472 bytes (Microsoft Corporation, DirectX Graphics MMS) 0x82E26000 ACPI_HAL 225280 bytes 0x82E26000 C:\windows\system32\halmacpi.dll 225280 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0x8A336000 C:\windows\system32\drivers\fltmgr.sys 212992 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0x90396000 C:\windows\system32\DRIVERS\ks.sys 212992 bytes (Microsoft Corporation, Kernel CSA Library) 0x8A7C4000 C:\windows\System32\DRIVERS\fvevol.sys 204800 bytes (Microsoft Corporation, BitLocker Drive Encryption Driver) 0x8F837000 C:\windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver) 0x8F1BF000 C:\windows\System32\drivers\fwpkclnt.sys 200704 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API) 0x924B6000 C:\windows\system32\drivers\portcls.sys 192512 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0x8A77F000 C:\windows\System32\drivers\rdyboost.sys 184320 bytes (Microsoft Corporation, ReadyBoost Driver) 0x8A54A000 C:\windows\System32\Drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider) 0x8F800000 C:\windows\system32\DRIVERS\atikmpag.sys 172032 bytes (Advanced Micro Devices, Inc., AMD multi-vendor Miniport Driver) 0x8A21F000 C:\windows\system32\DRIVERS\pci.sys 172032 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0x92584000 C:\windows\system32\DRIVERS\SMIksdrv.sys 172032 bytes (SMI, SMI AVStream Camera Driver) 0x8A3D0000 C:\windows\system32\DRIVERS\MpFilter.sys 159744 bytes (Microsoft Corporation, Microsoft antimalware file system filter driver) 0x8A37B000 C:\windows\system32\DRIVERS\CLASSPNP.SYS 151552 bytes (Microsoft Corporation, SCSI Class System Dll) 0x8A713000 C:\windows\System32\Drivers\ksecpkg.sys 151552 bytes (Microsoft Corporation, Kernel Security Support Provider Interface Packages) 0x8A2F2000 C:\windows\system32\DRIVERS\ataport.SYS 143360 bytes (Microsoft Corporation, ATAPI Driver Extension) 0x925AE000 C:\windows\system32\DRIVERS\mrxsmb.sys 143360 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0x90325000 C:\windows\system32\DRIVERS\ndiswan.sys 139264 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0x990C4000 C:\windows\System32\DRIVERS\srvnet.sys 135168 bytes (Microsoft Corporation, Server Network driver) 0x8F9B2000 C:\windows\system32\DRIVERS\tunnel.sys 135168 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver) 0x8F017000 C:\windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver) 0x8A3B1000 C:\windows\system32\DRIVERS\cdrom.sys 126976 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0x90954000 C:\windows\system32\DRIVERS\HDAudBus.sys 126976 bytes (Microsoft Corporation, High Definition Audio Bus Driver) 0x8F8CA000 C:\windows\system32\DRIVERS\pacer.sys 126976 bytes (Microsoft Corporation, QoS Packet Scheduler) 0x97040000 C:\windows\System32\cdd.dll 122880 bytes (Microsoft Corporation, Canonical Display Driver) 0x8BC88000 C:\windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver) 0x925D1000 C:\windows\system32\DRIVERS\mrxsmb20.sys 110592 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector) 0x8BCA3000 C:\windows\system32\drivers\WudfPf.sys 106496 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver) 0x8BDBB000 C:\windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver) 0x924E5000 C:\windows\system32\drivers\drmk.sys 102400 bytes (Microsoft Corporation, Microsoft Trusted Audio Drivers) 0x8F98C000 C:\windows\System32\Drivers\dfsc.sys 98304 bytes (Microsoft Corporation, DFS Namespace Client Driver) 0x90973000 C:\windows\system32\DRIVERS\i8042prt.sys 98304 bytes (Microsoft Corporation, i8042 Port Driver) 0x90612000 C:\windows\system32\DRIVERS\rasl2tp.sys 98304 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0x90347000 C:\windows\system32\DRIVERS\raspppoe.sys 98304 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0x9035F000 C:\windows\system32\DRIVERS\raspptp.sys 94208 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0x90376000 C:\windows\system32\DRIVERS\rassstp.sys 94208 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager) 0x8F000000 C:\windows\system32\DRIVERS\tdx.sys 94208 bytes (Microsoft Corporation, TDI Translation Driver) 0x92563000 C:\windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver) 0x8A2D3000 C:\windows\System32\drivers\mountmgr.sys 90112 bytes (Microsoft Corporation, Mount Point Manager) 0x9253C000 C:\windows\system32\DRIVERS\HIDCLASS.SYS 77824 bytes (Microsoft Corporation, Hid Class Library) 0x8A575000 C:\windows\System32\Drivers\ksecdd.sys 77824 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0x8BD23000 C:\windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6) 0x8F908000 C:\windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0x90600000 C:\windows\system32\DRIVERS\AgileVpn.sys 73728 bytes (Microsoft Corporation, RAS Agile Vpn Miniport Call Manager) 0x908D8000 C:\windows\system32\DRIVERS\L1C62x86.sys 73728 bytes (Atheros Communications, Inc., Atheros L1c PCI-E Gigabit Ethernet Controller) 0x8BDD4000 C:\windows\System32\drivers\mpsdrv.sys 73728 bytes (Microsoft Corporation, Microsoft Protection Service Driver) 0x8F9D3000 C:\windows\system32\DRIVERS\amdppm.sys 69632 bytes (Microsoft Corporation, Processor Device Driver) 0x8A600000 C:\windows\system32\DRIVERS\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver) 0x92520000 C:\windows\System32\Drivers\dump_dumpfve.sys 69632 bytes 0x8A36A000 C:\windows\system32\drivers\fileinfo.sys 69632 bytes (Microsoft Corporation, FileInfo Filter Driver) 0x903D8000 C:\windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy) 0x8A254000 C:\windows\System32\drivers\partmgr.sys 69632 bytes (Microsoft Corporation, Partition Management Driver) 0x8A02D000 C:\windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver) 0x8F8E9000 C:\windows\system32\DRIVERS\vwififlt.sys 69632 bytes (Microsoft Corporation, Virtual WiFi Filter Driver) 0x909E2000 C:\windows\system32\DRIVERS\AcpiVpc.sys 65536 bytes (Lenovo Corporation, ACPI Virtual Power Controller Driver) 0x8BCBD000 C:\windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver) 0x8A7AC000 C:\windows\System32\Drivers\mup.sys 65536 bytes (Microsoft Corporation, Multiple UNC Provider Driver) 0x8BD13000 C:\windows\system32\DRIVERS\ndisuio.sys 65536 bytes (Microsoft Corporation, NDIS User mode I/O driver) 0x8F91B000 C:\windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Remote Desktop Server Driver) 0x8A278000 C:\windows\system32\DRIVERS\volmgr.sys 65536 bytes (Microsoft Corporation, Volume Manager Driver) 0x90945000 C:\windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0x8F9A4000 C:\windows\system32\DRIVERS\blbdrive.sys 57344 bytes (Microsoft Corporation, BLB Drive Driver) 0x8F8FA000 C:\windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver) 0x8F068000 C:\windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver) 0x8A31F000 C:\windows\system32\DRIVERS\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0x8A5E5000 C:\windows\System32\drivers\pcw.sys 57344 bytes (Microsoft Corporation, Performance Counters for Windows Driver) 0x903CA000 C:\windows\system32\DRIVERS\umbus.sys 57344 bytes (Microsoft Corporation, User-Mode Bus Enumerator) 0x8A1A4000 C:\windows\system32\drivers\WDFLDR.SYS 57344 bytes (Microsoft Corporation, Kernel Mode Driver Framework Loader) 0x909F2000 C:\windows\system32\DRIVERS\CompositeBus.sys 53248 bytes (Microsoft Corporation, Multi-Transport Composite Bus Enumerator) 0x924FE000 C:\windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver) 0x9098B000 C:\windows\system32\DRIVERS\kbdclass.sys 53248 bytes (Microsoft Corporation, Keyboard Class Driver) 0x909D1000 C:\windows\system32\DRIVERS\mouclass.sys 53248 bytes (Microsoft Corporation, Mouse Class Driver) 0x990E5000 C:\windows\System32\drivers\tcpipreg.sys 53248 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver) 0x8F038000 C:\windows\System32\drivers\watchdog.sys 53248 bytes (Microsoft Corporation, Watchdog Driver) 0x8F980000 C:\windows\System32\drivers\discache.sys 49152 bytes (Microsoft Corporation, System Indexer/Cache Driver) 0x9919C000 C:\windows\system32\DRIVERS\NisDrvWFP.sys 49152 bytes (Microsoft Corporation, Microsoft Network Inspection System Driver) 0x8A207000 C:\windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0x8A26D000 C:\windows\system32\DRIVERS\BATTC.SYS 45056 bytes (Microsoft Corporation, Battery Class Driver) 0x9250B000 C:\windows\System32\Drivers\dump_dumpata.sys 45056 bytes 0x92531000 C:\windows\system32\DRIVERS\hidusb.sys 45056 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices) 0x8A022000 C:\windows\system32\mcupdate_AuthenticAMD.dll 45056 bytes (Microsoft Corporation, AMD Microcode Update Library) 0x8BC7D000 C:\windows\system32\DRIVERS\monitor.sys 45056 bytes (Microsoft Corporation, Monitor Driver) 0x92558000 C:\windows\system32\DRIVERS\mouhid.sys 45056 bytes (Microsoft Corporation, HID Mouse Filter Driver) 0x8F05D000 C:\windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver) 0x9062A000 C:\windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0x8F1F0000 C:\windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper) 0x8A249000 C:\windows\system32\DRIVERS\vdrvroot.sys 45056 bytes (Microsoft Corporation, Virtual Drive Root Enumerator) 0x92516000 C:\windows\System32\Drivers\dump_msahci.sys 40960 bytes 0x9257A000 C:\windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver) 0x99192000 C:\windows\system32\DRIVERS\MpNWMon.sys 40960 bytes (Microsoft Corporation, Network monitor driver) 0x8A315000 C:\windows\system32\DRIVERS\msahci.sys 40960 bytes (Microsoft Corporation, MS AHCI 1.0 Standard Driver) 0x8F976000 C:\windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver) 0x8F96C000 C:\windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy) 0x990BA000 C:\windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver) 0x908EA000 C:\windows\system32\DRIVERS\usbohci.sys 40960 bytes (Microsoft Corporation, OHCI USB Miniport Driver) 0x908CE000 C:\windows\system32\DRIVERS\vwifibus.sys 40960 bytes (Microsoft Corporation, Virtual WiFi Bus Driver) 0x8A32D000 C:\windows\system32\DRIVERS\amdxata.sys 36864 bytes (Advanced Micro Devices, Storage Filter Driver) 0x8A2E9000 C:\windows\system32\DRIVERS\atapi.sys 36864 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver) 0x8A5F3000 C:\windows\System32\Drivers\Fs_Rec.sys 36864 bytes (Microsoft Corporation, File System Recognizer Driver) 0xA2E6E000 C:\windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver) 0x97010000 C:\windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver) 0x8A000000 C:\windows\system32\DRIVERS\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0x8A611000 C:\windows\system32\DRIVERS\AtiPcie.sys 32768 bytes (Advanced Micro Devices Inc., AMD PCIE Filter Driver for ATI PCIE chipset) 0x8A03E000 C:\windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver) 0x8A265000 C:\windows\system32\DRIVERS\compbatt.sys 32768 bytes (Microsoft Corporation, Composite Battery Driver) 0x8A7BC000 C:\windows\System32\drivers\hwpolicy.sys 32768 bytes (Microsoft Corporation, Hardware Policy Driver) 0x80BD5000 C:\windows\system32\kdcom.dll 32768 bytes (Microsoft Corporation, Serial Kernel Debugger) 0x8A009000 C:\windows\system32\DRIVERS\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver) 0x8F045000 C:\windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport) 0x8F04D000 C:\windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Encoder Miniport) 0x8F055000 C:\windows\system32\drivers\rdprefmp.sys 32768 bytes (Microsoft Corporation, RDP Reflector Driver Miniport) 0x8A777000 C:\windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor) 0x8A200000 C:\windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver) 0x9254F000 C:\windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library) 0x8A3F7000 C:\windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver) 0x9038D000 C:\windows\system32\DRIVERS\WDMirror.sys 28672 bytes (Windows ® Codename Longhorn DDK provider, WDMirror Miniport Driver) 0x8F8C3000 C:\windows\system32\DRIVERS\wfplwf.sys 28672 bytes (Microsoft Corporation, WFP NDIS 6.20 Lightweight Filter Driver) 0x991AC000 c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B9B3FBE3-889E-496D-81D9-3957D1C09384}\MpKslf6b823d6.sys 24576 bytes (Microsoft Corporation, KSLDriver) 0x9093F000 C:\windows\system32\DRIVERS\usbfilter.sys 24576 bytes (Advanced Micro Devices, AMD USB Filter Driver) 0x909DE000 C:\windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver) 0x90394000 C:\windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0x92556000 C:\windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) ============================================== >Stealth ============================================== 0x06350000 Hidden Image–>CLI.Aspect.MMVideo.Graphics.Runtime.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 102400 bytes 0x06BF0000 Hidden Image–>CLI.Aspect.Radeon3D.Graphics.Wizard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 102400 bytes 0x06F90000 Hidden Image–>CLI.Aspect.DisplaysOptions.Graphics.Dashboard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 102400 bytes 0x00610000 Hidden Image–>CLI.Foundation.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 110592 bytes 0x00400000 Hidden Image–>MOM.Implementation.DLL [ EPROCESS 0x86A6BD40 ] PID: 2940, 118784 bytes 0x014B0000 Hidden Image–>MOM.Implementation.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 118784 bytes 0x07F20000 Hidden Image–>CLI.Component.Dashboard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 1232896 bytes 0x06800000 Hidden Image–>CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 126976 bytes 0x08340000 Hidden Image–>CLI.Aspect.DisplaysManager2.Graphics.Dashboard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 1306624 bytes 0x04DD0000 Hidden Image–>CLI.Caste.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 159744 bytes 0x07A00000 Hidden Image–>CLI.Aspect.DisplaysManager2.Graphics.Wizard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 1716224 bytes 0x06F40000 Hidden Image–>CLI.Aspect.InfoCentre.Graphics.Dashboard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 208896 bytes 0x07DB0000 Hidden Image–>CLI.Aspect.InfoCentre.Graphics.Wizard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 217088 bytes 0x08150000 Hidden Image–>CLI.Aspect.CrossDisplay.Graphics.Dashboard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 282624 bytes 0x004F0000 Hidden Image–>MOM.Foundation.DLL [ EPROCESS 0x86A6BD40 ] PID: 2940, 28672 bytes 0x00580000 Hidden Image–>LOG.Foundation.Implementation.Private.DLL [ EPROCESS 0x86A6BD40 ] PID: 2940, 28672 bytes 0x00600000 Hidden Image–>MOM.Foundation.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x00630000 Hidden Image–>LOG.Foundation.Implementation.Private.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x01650000 Hidden Image–>CLI.Component.Runtime.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x03EB0000 Hidden Image–>AEM.Server.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x03F00000 Hidden Image–>AEM.Plugin.DPPE.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x04110000 Hidden Image–>AEM.Plugin.Hotkeys.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x042A0000 Hidden Image–>AEM.Plugin.WinMessages.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x04310000 Hidden Image–>DEM.Graphics.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x04300000 Hidden Image–>DEM.Foundation.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x044B0000 Hidden Image–>DEM.Graphics.I0709.dll [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x04BC0000 Hidden Image–>AEM.Plugin.GD.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x04E10000 Hidden Image–>AEM.Actions.CCAA.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x04E20000 Hidden Image–>ResourceManagement.Foundation.Private.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x04E50000 Hidden Image–>DEM.Graphics.I0804.dll [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x05230000 Hidden Image–>CLI.Caste.Graphics.Runtime.Shared.Private.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x05290000 Hidden Image–>CLI.Aspect.HotkeysHandling.Graphics.Runtime.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x052D0000 Hidden Image–>DEM.Graphics.I0805.dll [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x052B0000 Hidden Image–>CLI.Aspect.HotkeysHandling.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x05D60000 Hidden Image–>DEM.Graphics.I0912.dll [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x05DA0000 Hidden Image–>DEM.Graphics.I0706.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x06820000 Hidden Image–>AEM.Plugin.REG.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x06420000 Hidden Image–>DEM.Graphics.I0712.dll [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x063B0000 Hidden Image–>DEM.Graphics.I0906.dll [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x06410000 Hidden Image–>CLI.Aspect.Welcome.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x06470000 Hidden Image–>DEM.Graphics.I0812.dll [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x064D0000 Hidden Image–>APM.Foundation.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x06940000 Hidden Image–>AEM.Plugin.EEU.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x06930000 Hidden Image–>CLI.Component.Runtime.Extension.EEU.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x06A90000 Hidden Image–>CLI.Component.Wizard.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x06A80000 Hidden Image–>CLI.Component.Client.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x06C10000 Hidden Image–>atixclib.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x06BD0000 Hidden Image–>CLI.Caste.Graphics.Wizard.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x06EE0000 Hidden Image–>CLI.Component.Dashboard.Shared.Private.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x06F10000 Hidden Image–>CLI.Caste.Graphics.Dashboard.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 28672 bytes 0x073D0000 Hidden Image–>CLI.Aspect.DeviceLCD.Graphics.Wizard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 315392 bytes 0x06720000 Hidden Image–>CLI.Aspect.DeviceLCD.Graphics.Dashboard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 331776 bytes 0x06780000 Hidden Image–>CLI.Aspect.Radeon3D.Graphics.Dashboard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 364544 bytes 0x03A10000 Hidden Image–>NEWAEM.Foundation.DLL [ EPROCESS 0x86A6BD40 ] PID: 2940, 36864 bytes 0x015F0000 Hidden Image–>CLI.Foundation.XManifest.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 36864 bytes 0x03BA0000 Hidden Image–>NEWAEM.Foundation.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 36864 bytes 0x052A0000 Hidden Image–>CLI.Aspect.CustomFormats.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 36864 bytes 0x052F0000 Hidden Image–>CLI.Aspect.DisplaysColour2.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 36864 bytes 0x063E0000 Hidden Image–>CLI.Aspect.PowerPlayDPPE.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 36864 bytes 0x063D0000 Hidden Image–>CLI.Aspect.Welcome.Graphics.Runtime.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 36864 bytes 0x063F0000 Hidden Image–>CLI.Aspect.DisplaysOptions.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 36864 bytes 0x06AA0000 Hidden Image–>CLI.Component.Wizard.Shared.Private.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 36864 bytes 0x06ED0000 Hidden Image–>CLI.Component.Dashboard.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 36864 bytes 0x04B60000 Hidden Image–>CLI.Caste.Graphics.Runtime.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 389120 bytes 0x081A0000 Hidden Image–>CLI.Aspect.DeviceCRT.Graphics.Dashboard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 405504 bytes 0x06A10000 Hidden Image–>CLI.Component.Wizard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 413696 bytes 0x08A20000 Hidden Image–>CLI.Aspect.MMVideo.Graphics.Wizard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 421888 bytes 0x00470000 Hidden Image–>LOG.Foundation.DLL [ EPROCESS 0x86A6BD40 ] PID: 2940, 45056 bytes 0x004E0000 Hidden Image–>LOG.Foundation.Private.DLL [ EPROCESS 0x86A6BD40 ] PID: 2940, 45056 bytes 0x01630000 Hidden Image–>CCC.Implementation.DLL [ EPROCESS 0x86A6BD40 ] PID: 2940, 45056 bytes 0x005D0000 Hidden Image–>CCC.Implementation.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 45056 bytes 0x005F0000 Hidden Image–>LOG.Foundation.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 45056 bytes 0x007D0000 Hidden Image–>LOG.Foundation.Private.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 45056 bytes 0x01670000 Hidden Image–>ATICCCom.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 45056 bytes 0x05D50000 Hidden Image–>CLI.Aspect.DeviceLCD.Graphics.Runtime.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 45056 bytes 0x05DB0000 Hidden Image–>CLI.Aspect.DeviceLCD.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 45056 bytes 0x06E40000 Hidden Image–>CLI.Aspect.TransCode.Graphics.Wizard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 503808 bytes 0x01640000 Hidden Image–>CLI.Foundation.Private.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 53248 bytes 0x03B50000 Hidden Image–>AEM.Server.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 53248 bytes 0x03EE0000 Hidden Image–>AEM.Plugin.Source.Kit.Server.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 53248 bytes 0x042F0000 Hidden Image–>DEM.Graphics.I0601.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 53248 bytes 0x05280000 Hidden Image–>CLI.Aspect.DeviceCV.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 53248 bytes 0x052C0000 Hidden Image–>CLI.Aspect.DisplaysColour2.Graphics.Runtime.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 53248 bytes 0x052E0000 Hidden Image–>CLI.Aspect.DisplaysOptions.Graphics.Runtime.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 53248 bytes 0x05D40000 Hidden Image–>CLI.Aspect.DeviceCRT.Graphics.Runtime.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 53248 bytes 0x06370000 Hidden Image–>CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 53248 bytes 0x06950000 Hidden Image–>CLI.Component.Client.Shared.Private.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 53248 bytes 0x06AB0000 Hidden Image–>CLI.Caste.Graphics.Wizard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 53248 bytes 0x06BE0000 Hidden Image–>CLI.Aspect.TransCode.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 53248 bytes 0x06830000 Hidden Image–>CLI.Aspect.DisplaysColour2.Graphics.Dashboard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 585728 bytes 0x06970000 Hidden Image–>CLI.Component.Systemtray.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 585728 bytes 0x01600000 Hidden Image–>CLI.Component.Runtime.Shared.Private.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 61440 bytes 0x05D90000 Hidden Image–>CLI.Aspect.DeviceDFP.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 61440 bytes 0x05DC0000 Hidden Image–>CLI.Aspect.DeviceProperty.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 61440 bytes 0x06400000 Hidden Image–>CLI.Aspect.DeviceCRT.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 61440 bytes 0x06440000 Hidden Image–>CLI.Aspect.DeviceProperty.Graphics.Runtime.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 61440 bytes 0x015D0000 Hidden Image–>CLI.Component.SkinFactory.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 69632 bytes 0x01620000 Hidden Image–>CLI.Component.Runtime.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 69632 bytes 0x06130000 Hidden Image–>CLI.Aspect.Radeon3D.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 69632 bytes 0x06380000 Hidden Image–>CLI.Aspect.MMVideo.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 69632 bytes 0x06600000 Hidden Image–>APM.Server.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 69632 bytes 0x07420000 Hidden Image–>ResourceManagement.Foundation.Implementation.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 749568 bytes 0x00540000 Hidden Image–>LOG.Foundation.Implementation.DLL [ EPROCESS 0x86A6BD40 ] PID: 2940, 77824 bytes 0x007B0000 Hidden Image–>LOG.Foundation.Implementation.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 77824 bytes 0x05000000 Hidden Image–>CLI.Aspect.DeviceCV.Graphics.Runtime.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 77824 bytes 0x05D70000 Hidden Image–>CLI.Aspect.DeviceDFP.Graphics.Runtime.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 77824 bytes 0x05DD0000 Hidden Image–>CLI.Aspect.Radeon3D.Graphics.Runtime.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 77824 bytes 0x05F00000 Hidden Image–>CLI.Aspect.DeviceTV.Graphics.Shared.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 77824 bytes 0x06F20000 Hidden Image–>CLI.Aspect.Welcome.Graphics.Dashboard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 77824 bytes 0x08550000 Hidden Image–>CLI.Aspect.MMVideo.Graphics.Dashboard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 839680 bytes 0x03B30000 Hidden Image–>ADL.Foundation.dll [ EPROCESS 0x86C6ED40 ] PID: 3356, 86016 bytes 0x05250000 Hidden Image–>CLI.Aspect.DeviceTV.Graphics.Runtime.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 86016 bytes 0x06EF0000 Hidden Image–>CLI.Caste.Graphics.Dashboard.DLL [ EPROCESS 0x86C6ED40 ] PID: 3356, 86016 bytes !!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)

ok, not happy it says it can't do it to a temporary folder????? ok, so it wont work when i hit run, which is what i do every other time, but it won't work, so instead i went to SAVE, thinking ok, it wont' run from HERE, but if i save it, then it will run from there…. but here is where the TRUE BLUE HONEST DIED IN THE Wool NO YOU JUST DONT GET HOW STUPID I AM AND THUS WHY MY SCREEN NAME HERE IS SO DARN ON SPOT PITCH PERFECT TOTAL COMPUTER IDIOT i am: i NEVER know where to save it to…. there are folders, to click on have to choose one says cici system folder one says library system folder one says computer file folder one says network file folder and every program i have on the computer also is shown… problem is… when in the past I have had to do this for some reason or another, can't remember when where how why i got to that point, but the POINT IS: when in the past i did that, chose a folder to put something in to save it…. I NEVER COULD FIND IT AGAIN. please read and then delete how utterly stupid i am…i can't do computers. i can't download pictures into my computer from a digital camera, i can't do a USB stick, I can't do anything…once for 5 minutes I had a cell phone, that was impossible for me too, i remember i couldn't use the ear phone blue tooth thingy, the verizon people had to program everything, i couldnt ever figure out how to get a better ring tone, hated those ringtones, figured there must be someplace online where you can get a free cooler ring tone, no go….who could figure it out???? i'm STUPID STUPID STUPID STUPID STUPID

When you run OTL please right click and choose Run as administrator, instead of double clicking it to run it.. See if it runs ok when you do that.

NO, PLEASE GO READ ABOVE EDITED MENU i am beyond stupid. not working i hit OTL, i get a window. file download security warning do you want to run or save this file? i click on run with the right clicker, not the left clicker….NOTHING HAPPENS

I'll tell you what….let's try an online scan and see what happens. This should be a bit easier since. Be sure to follow the instructions carefully and it should go ok.


http://www.eset.eu/online-scanner
Go here to run an online scannner from ESET.
Click the green ESET Online Scanner button.
Read the End User License Agreement and check the box: YES, I accept the Terms of Use.
Click on the Start button next to it.
You may receive an alert on the address bar that "This site might require the following ActiveX control…Click here to install…". Click on that alert and then click Insall ActiveX component.
A new window will appear asking "Do you want to install this software?"".
Answer Yes to download and install the ActiveX controls that allows the scan to run.
Click Start.
Check Remove found threats and Scan potentially unwanted applications.
Click Scan to begin.
If offered the option to get information or buy software. Just close the window.
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic.


Depending on what this shows, we may still need to try for some other logs - but let's see what it comes back with. I want to make this as painless for you as possible, and get your computer working again for you.

ok, it is slowly downloading…not there yet. not scanning yet, still downloading the virus signature data base…….. ok…. scan in progress i'll be back with result, this too is slow slow slowly happening, will edit and come back p.s….doris you are a peach…. truly, thanks for biding with me uh oh……… scan stopped at 25 % and it's been 4 minutes, absolutely stopped dead

This scan can take a bit. Be patient and just let the scan run. Post the results when you're done. But I need to ask a favor. Please DO NOT EDIT your posts. I don't get an email notification when you do that and it causes me to be slower in answering and may cause me to miss something important. Please just add a reply and I'll be able to get back to you more quickly. I'll be keeping an eye out for your next reply

okay 2 minutes later it has started scanning again, now up to 26 percent done . will come back and edit this post with results o0ps, no I won't edit…sorry, didn't know about editing screwing you up…ok, i will just reply next time

Yes, just let it scan. You can go off and do something on the desktop while it scans. I've found a watched scan doesn't scan any faster. In fact, I'm convinced that when you watch a scan it deliberately goes slower! LOL. Please just add reply when you get the results. Please don't edit the post or I won't get the notifications.

Ok, it said no threats found and i saw no place to click to give you a file….yup, i went and ate dinner, only took 38 minutes to scan lol

It's fine that there is no log if there were no threats found. Can you let me know if the computer is behaving ok now in normal mode?

i guess so. haven't gone anywhere but here, but second time i restarted it everything popped up just fine, no white boxes can you tell me where its the easiest place to put something to find it? what folder? next tim this happens and i hit run and it won't run, then to save it so I can then go there and try to open it???

Can you please go ahead and do the normal things you do online for about a half hour or so and then post back and let me know if you have any further issues with it?

ok, but i'm kinda upset about reading that root thing, it listed a ton of hidden objects? whatever, i don't know what any of it means….i'll go surf around, check emails, write to friends

Don't worry about the RootkitUnhooker log.. I'll let you know if I think we need to run any more scans. First thing is to make sure the symptoms and problems you were having have been taken care of.