Detection of virus, then automatic reboot, then "Startup Repair&q

Hi patndoris, Thank you for the prompt response. I am working off the computer in my local library this afternoon, and I just now picked up your response (which, unfortunately, had been captured by my junk-mail filter). After checking my emails last night from my smartphone and not realizing I had a response from Whatthetech, I used some other information I had found on the internet yesterday at the library (and last night on my smart phone) to try to troubleshoot the disabled home computer. Consequently, I may have gotten ahead of the instructions from your posting. I'm hoping that nothing I've done has caused any irreparable problems, but you will be the judge of that. Please forgive the rough quality of the recitation of facts below. I brought to the library some of my notes from last night's session, but a portion of my description below is based on less-than-perfect recall. Startup Repair was indeed able to run, and it said it was "unable to fix the problem automatically," or words to that effect. Set forth below is the explanation: Problem signature Problem Event Name: StartupRepairOffline Problem Signature 01: 6.1.7600.16385 Problem Signature 02: 6.1.7600.16385 Problem Signature 03: unknown Problem Signature 04: 21201015 Problem Signature 05: AutoFailover Problem Signature 06: 5 Problem Signature 07: Corrupt File OS Version: 6.1.7600.2.0.0.256.1 Locale ID: 1033 I believe I then clicked on another link in Startup Repair for further elaboration. I was taken to a page in Startup Repair that described various "tests" that had been performed, but the operative statement seemed to be the one that said "Root cause found: Boot critical file C:\CI.dll is corrupt." I googled "CI.dll file corrupt" and found some posts on www.sevenforums.com that suggested I might have a rootkit and that the "corrupt C:\CI.dll" message was in fact a red herring. One of the posters said he was able to get Windows 7 to boot up by rebooting in Safe Mode and selecting "Boot with driver sign verification disabled." I did that last night and, indeed, I was able to get what appeared to be my normal Windows 7 desktop (except that the date/time was wrong by several hours). While I had the opportunity, I copied some critical data files onto a thumb drive. My physical connection to the internet remained severed (from two days earlier), but I did run two scans. I ran a full scan of Microsoft Security Essentials, which found a few things: first, several Trojan Downloaders, which it removed, and, second, the following file, which MSE strangely allowed to remain on my computer: TrojanDropper:MSIL/Agent.E. I then ran STOPzilla, which failed to detect any infection at all other than a few old cookies. I was unable to get MSE to allow me to remove the Trojan Dropper. One other thing, which you are probably aware of, but I felt I should state anyway (and you can check out the posts if you want to see them). I found postings on two forums – sevenforums and Tech Support Forum – each with the same title: "Boot critical file c:\ci.dll is corrupt." (Both forums are where I learned, by the way, about booting up from Safe Mode by selecting "Boot with driver sign verification disabled.") The posters who said they had found a solution to problems that sounded just like mine said they were able to download TDSSKiller from the Kaspersky website and run it on the infected computer. A couple of the posters did this by removing the hard drive from the infected computer and attaching via a SATA/USB interface as a slave drive to a clean computer, and running TDSSKiller from the clean computer. They seemingly removed the infection this way. Another person said he was able to load TDSSKiller onto the infected computer and then remove the infection without having to remove the hard drive and connect it to a second computer. I was looking into this solution, but I certainly didn't want to connect to the internet on the infected computer. That is why I went to the library, to try to download TDSSKiller onto a thumb drive and connect it to the infected computer. But even if I do have a rootkit, I also have a Trojan Dropper. I'm not a virus/trojan whiz, but I would think these are two different infections. Anyway, now that I know you are on the case, I am in your hands. I am going to hold off on loading TDSSKiller for now. Also, if you suggest that I download some of the diagnostic files from the Whatthetech site, I can do that tomorrow afternoon when I return to the library, which is about to close. I hope the information above is helpful to you. Again, if I've done something you wouldn't have recommended, at least you know about it now. No sense in my trying to cover it up. mark_law_ok

I would not suggest running tools to fix things that we have not yet identified as a problem. TDSSKiller, when run as a scan only (choosing skip instead of cure) is fine, but using it to cure when you don't' know what you are dealing with has the potential to cause further complications

Windows 7 automatically creates system restore points after pre-determined amounts of use on the computer. When the startup repair box comes up, please choose System Restore and see if you can restore to a date a several days back, preferably a day or so before the problem occurred. You will not lose any documents or data you have created, only system files are restored. That should fix any registry corruptions.

It certainly sounds like we have some malware to deal with, but until we can run the necessary scans to determine what, I'm not prepared to just throw solutions at it. Only when we know what we are dealing with can we find the best solution for removing it. Bear with me, we'll do our very best to get this up and running for you.

If you are successful from the system restore, please reconnect to the internet immediately, and run the following scans. If it is not successful, just let me know and we'll try something else.




Please read carefully and follow these steps. There is a difference between what you see in one of the images below and what I need you to do.
We are only creating a log - I do NOT want you to "cure" or try to fix anything in this step. It is very important that you don't choose Cure when presented with that option.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If an infected file is detected, the default action will be Cure but I want you to choose SKIP instead , click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Download and Run DDS by sUBs

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done, DDS.txt will open.
• Save both reports to your desktop.

—————————————————

Please Please copy / paste the scan reults.

DDS.txt and Attach.txt




Download and Run GMER

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Right-click and choose Run as Administrator on GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  
  [external image: Posted Image]
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that may have been checked. Uncheck the following …
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one - make sure it is UNCHECKED)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Hi patndoris, Thanks for the prompt response. I won't be able to download the files you've suggested until tomorrow afternoon at the earliest, when I get access to a computer at the library. I certainly appreciate the advice about TDSSKiller, and I will follow your instructions carefully. Regarding System Restore, I tried it on Thursday with no luck. I had two possible restore points – October 9 and October 12 – and I chose the earlier date. I was then thrown back into the Startup Repair loop. Strangely last night, after I had managed to boot to my Desktop using the steps I described in my previous email, a dialog box popped up to tell me I had successfully restored my system to October 9. Then the computer spontaneously rebooted and went back into Startup Repair mode. I will nevertheless give System Restore another try tonight and will let you know what happens. As I mentioned in my previous email, I ran MSE last night (before I had access to your advice not to run any scans); so you know about the Trojan Dropper file that MSE allowed to remain on my computer. FWIW, here are the names of the three other infections that MSE said it found and removed: Exploit:Java/CVE-2010-0840.IX Exploit:Java/CVE-2010-0840.FJ TrojanDownloader:Java/OpenStream.AK If I am able to download the suggested files at the library tomorrow afternoon, I will try to run the diagnostics tomorrow night. Again, thank you very much for your kind assistance. mark_law_ok

Hi patndoris, I tried System Restore again last night, as you suggested. This time I went with a restore point (October 12) that was closer in time to, but still before, the crash date (October 13). I got a message that the system had been successfully restored to October 12, but then the computer rebooted and once again went into Startup Repair mode, with the same eventual message about a corrupt ci.dll file. I rebooted in safe mode and selected "Boot with driver sign verification disabled," which allowed me to get to a login screen, as I had described in my previous emails. I successfully got to my Desktop when a box popped up to say my system had been restored to October 12. I clicked OK and then my screen flickered; a blue DOS-like screen with large white letters appeared and said some type of error had occurred. A second later, the computer rebooted into Startup Repair. I allowed it to run its course, after which it said it was unable to repair the problem, and it instructed me to hit Finish to shut down. I did that and repeated the previous startup process. This time, I saw no box about System Restore; instead, a box that said, "Windows has recovered from an unexpected shutdown." A few seconds later, I had the same result as before: blue screen with white letters, followed by a spontaneous reboot into Startup Repair. One more try, same result. Yet one more try, but this time I used an alternative login on the computer. That got me to the alternative-user Desktop without any further crashes, except that all the Desktop icons suddenly disappeared. I next saw a box over my System Tray that read, "You have been logged on with a temporary profile. You cannot access your files and files created on this profile will be deleted when you log off. To fix this, log off and try logging on later. Please see the event log for details or contact a system administrator." I wasn't about to log off and risk not being able to get back on again. Instead, I copied to the alternative-user Desktop the files I had downloaded at the library this afternoon from your Whatthetech posting from Saturday. One other thing: before I tried the System Restore last night, I checked to see whether I had a copy of Winzip on the computer. I did not, so I downloaded two unzip applications off the internet this afternoon. The first was a free copy of something called 7zip, which checked out on a CNET review and seemed to be legitimate. Next, after jumping through a bunch of hoops to get a trial copy of Winzip, I thought I had successfully downloaded it. This evening, I realized it wasn't on my thumb drive. In order to extract the TDSSKiller application, I first had to run the setup program for 7zip. As soon as I tried to do that, a STOPzilla window popped up to say, "STOPzilla has just deleted and blocked the following infection(s): Fake Antivirus.G. Would you like to scan and remove now?" Your earlier email advised against doing any scans without your go-ahead, so I will leave the screen as it is for now until I hear from you. That leaves me without an unzip application at the moment. I can go back to the library and try once more to get Winzip, but I recall that the download page said I would have to register it with an activation key. I suppose that is all right if I am permitted to do that from the internet connection on my smart phone, but I don't want to establish a physical connection to the internet from the infected computer until I get rid of all the malware. Do you have a bug-free copy of an unzip app that I can download from this site? I don't want you to run afoul of any licensing laws or contracts; so if you cannot permissibly transfer a copy to me, please suggest an alternative method for extracting TDSSKiller and GMER. I'm happy to try to give Winzip another shot. mark_law_ok

Doris, I have no problem making the logs available to you. Nor do I have any problem with your sharing the logs with your WhatTheTech colleagues for teaching/learning purposes. What I object to, as I said in my previous posting, is sharing that information with the world at large. Here is the operative analogy: A leading dermatologist drives into town in her state-of-the-art office on wheels and offers to give free full-body screenings to all comers. She is one of the country's foremost authorities on skin cancer. If you have melanoma under one of your toenails, she will find it. And the price is right! You go in for a screening, at which point she says, "Doris, just so you know, I will be taping a video of this screening, which I will share with younger dermatologists so that they can learn my technique." You're on board with that. After all, if more lives will be saved, who can complain? You might feel differently, however, if she adds, "To make the video available to the widest possible medical audience, I'm going to post it on YouTube." A few days later, everyone in your office is tittering, "Isn't that Doris from I.T. in the video? And look at that adorable tattoo on her tusch – Cupid and a heart and that romantic message: 'Doris and Brandon forever. True Love.' Isn't that sweet!" I find it quite ironic that a forum dedicated to eradicating malware – rogue applications like backdoors, keyloggers and adware – has apparently never even considered the issue I've raised. You don't like applications that surreptitiously steal people's private information, but you have no problem asking the same people to voluntarily cough up that information online, where it will become accessible to data-miners and the merely nosy. Perhaps I am more touchy about this issue than most other posters. To the Facebook generation, there doesn't seem to be a concept of private information. Everyone seems to be busy tweeting everybody else about what color underwear they have on today. Your reaction may very well be to roll your eyes and tell your friends, "Can you believe this? The guy doesn't want a list of his apps broadcast over the internet. What's the big deal? I don't get it." I want to reiterate that I am very grateful for your help and what you have done to assist me so far. I realize that the WTT work is probably a volunteer activity for you, and you are not getting rich doing it. I very much want this forum to prosper so that people like me, desperate to rescue files that are valuable to them, can get advice from experts like you. I hope you will be sensitive to my concerns as well. So, here is my proposal: you or one of the WTT administrators will suggest a donation from me to www.whatthetech.com/donate. You can inform me of the suggested amount via this site or by sending a message to the email address you have on file for me. Either way, I'm not sensitive about the public disclosure of that amount. (It might actually encourage other donations, which would be a good thing.) I will send the donation to www.whatthetech.com/donate via PayPal. After you have received my donation, you will notify me of an address to which I can email the logs for your review. You may share the logs with other WTT technicians via email if you believe they will learn from them. I am even OK with your posting my logs on WTT after they have been scrubbed to remove my name and my apps (and I would be happy to do that scrubbing myself to save you the time). I just don't want my private information to become public information. Yes, this will be more inconvenient for you than the usual method, but you will get some cred with your WTT colleagues for landing an actual donation, not a "gee-I-might-send-you-five-dollars-if-I-get-the-right-result" promise of a donation. I'm not asking for a guarantee of results, since I know you cannot give one. I am just trying to get advice that has a prayer of cleaning up my computer but allows me to keep my private information private. I know I need to share that information with you so that you can help me fix my problem; but otherwise, the information is nobody's business but mine. BTW, TDSSKiller did turn up a rootkit (Rootkit.win32.TDSS.tdl4), so this is not just a hardware problem, and I am really hoping I do not have to reformat my computer or reinstall Windows. I believe there has to be a way for you and WTT to work out an arrangement that ends up benefiting both the forum and me. Thank you again for your assistance and your patience. mark_law_ok

Doris, the information on the logs from my computer isn't "important." The fact that it isn't important doesn't mean that it is unreasonable for me not to want to disclose it to potential data-miners, the same kinds of folks who plant cookies and adware and information-stealing bugs that this forum is dedicated to eliminating.

Nevertheless, I appreciate your explanation of the rules of the game. I am willing to accede, so I have posted the text of the logs below (TDSS.txt, DDS.txt and Attach.txt), each of which you requested as a "copy/paste." In the case of GMER, as my post last night indicated, the file is 0kb in size, so I don't know whether I did something wrong. At the end of the scan, a box said something like "The scan found no system modifications." In any event, I tried to upload the gmer.txt file as an attachment to this post, but I was unable to do that (message said, "Attachment space used 0bytes of 500K. You did not select a file to upload"). Please let me know whether I need to re-run the scan.

TDSS.txt

17:49:22.0292 1084 TDSS rootkit removing tool 2.6.9.0 Oct 14 2011 11:33:24
17:49:22.0302 1084 ============================================================
17:49:22.0302 1084 Current date / time: 2011/10/18 17:49:22.0302
17:49:22.0302 1084 SystemInfo:
17:49:22.0302 1084
17:49:22.0302 1084 OS Version: 6.1.7601 ServicePack: 1.0
17:49:22.0302 1084 Product type: Workstation
17:49:22.0303 1084 ComputerName: MARKLAW-PC
17:49:22.0303 1084 UserName: Mark Law
17:49:22.0303 1084 Windows directory: C:\Windows
17:49:22.0303 1084 System windows directory: C:\Windows
17:49:22.0303 1084 Running under WOW64
17:49:22.0303 1084 Processor architecture: Intel x64
17:49:22.0303 1084 Number of processors: 2
17:49:22.0303 1084 Page size: 0x1000
17:49:22.0303 1084 Boot type: Normal boot
17:49:22.0303 1084 ============================================================
17:49:23.0337 1084 Initialize success
17:49:48.0551 6124 ============================================================
17:49:48.0551 6124 Scan started
17:49:48.0551 6124 Mode: Manual;
17:49:48.0551 6124 ============================================================
17:49:49.0165 6124 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
17:49:49.0169 6124 1394ohci - ok
17:49:49.0228 6124 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
17:49:49.0231 6124 ACPI - ok
17:49:49.0279 6124 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
17:49:49.0279 6124 AcpiPmi - ok
17:49:49.0325 6124 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
17:49:49.0329 6124 adp94xx - ok
17:49:49.0350 6124 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
17:49:49.0352 6124 adpahci - ok
17:49:49.0370 6124 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
17:49:49.0371 6124 adpu320 - ok
17:49:49.0444 6124 AFD (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys
17:49:49.0460 6124 AFD - ok
17:49:49.0473 6124 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
17:49:49.0474 6124 agp440 - ok
17:49:49.0488 6124 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
17:49:49.0489 6124 aliide - ok
17:49:49.0513 6124 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
17:49:49.0513 6124 amdide - ok
17:49:49.0531 6124 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
17:49:49.0531 6124 AmdK8 - ok
17:49:49.0545 6124 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
17:49:49.0545 6124 AmdPPM - ok
17:49:49.0563 6124 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
17:49:49.0563 6124 amdsata - ok
17:49:49.0578 6124 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
17:49:49.0580 6124 amdsbs - ok
17:49:49.0591 6124 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
17:49:49.0592 6124 amdxata - ok
17:49:49.0650 6124 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
17:49:49.0651 6124 AppID - ok
17:49:49.0706 6124 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
17:49:49.0707 6124 arc - ok
17:49:49.0725 6124 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
17:49:49.0726 6124 arcsas - ok
17:49:49.0764 6124 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
17:49:49.0764 6124 AsyncMac - ok
17:49:49.0808 6124 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
17:49:49.0809 6124 atapi - ok
17:49:49.0940 6124 atikmdag (80793852021864a9ed344843eeba5fdb) C:\Windows\system32\DRIVERS\atikmdag.sys
17:49:50.0049 6124 atikmdag - ok
17:49:50.0088 6124 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
17:49:50.0093 6124 b06bdrv - ok
17:49:50.0126 6124 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
17:49:50.0130 6124 b57nd60a - ok
17:49:50.0168 6124 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
17:49:50.0168 6124 Beep - ok
17:49:50.0205 6124 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
17:49:50.0205 6124 blbdrive - ok
17:49:50.0285 6124 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
17:49:50.0286 6124 bowser - ok
17:49:50.0301 6124 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
17:49:50.0302 6124 BrFiltLo - ok
17:49:50.0315 6124 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
17:49:50.0316 6124 BrFiltUp - ok
17:49:50.0342 6124 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
17:49:50.0345 6124 Brserid - ok
17:49:50.0359 6124 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
17:49:50.0359 6124 BrSerWdm - ok
17:49:50.0372 6124 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
17:49:50.0373 6124 BrUsbMdm - ok
17:49:50.0384 6124 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
17:49:50.0385 6124 BrUsbSer - ok
17:49:50.0400 6124 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
17:49:50.0401 6124 BTHMODEM - ok
17:49:50.0421 6124 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
17:49:50.0422 6124 cdfs - ok
17:49:50.0475 6124 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
17:49:50.0477 6124 cdrom - ok
17:49:50.0501 6124 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
17:49:50.0502 6124 circlass - ok
17:49:50.0530 6124 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
17:49:50.0534 6124 CLFS - ok
17:49:50.0575 6124 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
17:49:50.0575 6124 CmBatt - ok
17:49:50.0627 6124 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
17:49:50.0628 6124 cmdide - ok
17:49:50.0689 6124 CNG (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys
17:49:50.0694 6124 CNG - ok
17:49:50.0717 6124 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
17:49:50.0717 6124 Compbatt - ok
17:49:50.0775 6124 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
17:49:50.0776 6124 CompositeBus - ok
17:49:50.0790 6124 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
17:49:50.0791 6124 crcdisk - ok
17:49:50.0860 6124 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
17:49:50.0877 6124 CSC - ok
17:49:50.0943 6124 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
17:49:50.0945 6124 DfsC - ok
17:49:50.0966 6124 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
17:49:50.0966 6124 discache - ok
17:49:51.0018 6124 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
17:49:51.0019 6124 Disk - ok
17:49:51.0075 6124 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
17:49:51.0076 6124 drmkaud - ok
17:49:51.0142 6124 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
17:49:51.0151 6124 DXGKrnl - ok
17:49:51.0223 6124 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
17:49:51.0284 6124 ebdrv - ok
17:49:51.0310 6124 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
17:49:51.0312 6124 elxstor - ok
17:49:51.0357 6124 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
17:49:51.0358 6124 ErrDev - ok
17:49:51.0386 6124 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
17:49:51.0389 6124 exfat - ok
17:49:51.0440 6124 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
17:49:51.0442 6124 fastfat - ok
17:49:51.0465 6124 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
17:49:51.0466 6124 fdc - ok
17:49:51.0495 6124 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
17:49:51.0495 6124 FileInfo - ok
17:49:51.0512 6124 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
17:49:51.0513 6124 Filetrace - ok
17:49:51.0521 6124 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
17:49:51.0521 6124 flpydisk - ok
17:49:51.0575 6124 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
17:49:51.0578 6124 FltMgr - ok
17:49:51.0596 6124 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
17:49:51.0597 6124 FsDepends - ok
17:49:51.0622 6124 fssfltr (6c06701bf1db05405804d7eb610991ce) C:\Windows\system32\DRIVERS\fssfltr.sys
17:49:51.0623 6124 fssfltr - ok
17:49:51.0645 6124 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
17:49:51.0645 6124 Fs_Rec - ok
17:49:51.0696 6124 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
17:49:51.0699 6124 fvevol - ok
17:49:51.0718 6124 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
17:49:51.0719 6124 gagp30kx - ok
17:49:51.0775 6124 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
17:49:51.0776 6124 GEARAspiWDM - ok
17:49:51.0836 6124 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
17:49:51.0837 6124 hcw85cir - ok
17:49:51.0896 6124 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
17:49:51.0901 6124 HdAudAddService - ok
17:49:51.0957 6124 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
17:49:51.0958 6124 HDAudBus - ok
17:49:51.0975 6124 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
17:49:51.0976 6124 HidBatt - ok
17:49:51.0991 6124 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
17:49:51.0992 6124 HidBth - ok
17:49:52.0011 6124 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
17:49:52.0011 6124 HidIr - ok
17:49:52.0072 6124 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
17:49:52.0073 6124 HidUsb - ok
17:49:52.0128 6124 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
17:49:52.0129 6124 HpSAMD - ok
17:49:52.0198 6124 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
17:49:52.0216 6124 HTTP - ok
17:49:52.0260 6124 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
17:49:52.0260 6124 hwpolicy - ok
17:49:52.0315 6124 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
17:49:52.0316 6124 i8042prt - ok
17:49:52.0357 6124 iaStor (1d004cb1da6323b1f55caef7f94b61d9) C:\Windows\system32\DRIVERS\iaStor.sys
17:49:52.0362 6124 iaStor - ok
17:49:52.0389 6124 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
17:49:52.0392 6124 iaStorV - ok
17:49:52.0427 6124 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
17:49:52.0428 6124 iirsp - ok
17:49:52.0488 6124 IntcAzAudAddService (f2b52c7b1c8e6a4fc4c4564f4a421f23) C:\Windows\system32\drivers\RTKVHD64.sys
17:49:52.0496 6124 IntcAzAudAddService - ok
17:49:52.0515 6124 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
17:49:52.0516 6124 intelide - ok
17:49:52.0544 6124 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
17:49:52.0545 6124 intelppm - ok
17:49:52.0620 6124 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
17:49:52.0621 6124 IpFilterDriver - ok
17:49:52.0638 6124 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
17:49:52.0639 6124 IPMIDRV - ok
17:49:52.0655 6124 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
17:49:52.0657 6124 IPNAT - ok
17:49:52.0688 6124 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
17:49:52.0688 6124 IRENUM - ok
17:49:52.0701 6124 is3srv - ok
17:49:52.0750 6124 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
17:49:52.0751 6124 isapnp - ok
17:49:52.0768 6124 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
17:49:52.0771 6124 iScsiPrt - ok
17:49:52.0799 6124 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
17:49:52.0800 6124 kbdclass - ok
17:49:52.0814 6124 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
17:49:52.0815 6124 kbdhid - ok
17:49:52.0834 6124 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys
17:49:52.0835 6124 KSecDD - ok
17:49:52.0884 6124 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys
17:49:52.0886 6124 KSecPkg - ok
17:49:52.0905 6124 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
17:49:52.0906 6124 ksthunk - ok
17:49:52.0944 6124 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
17:49:52.0944 6124 lltdio - ok
17:49:52.0987 6124 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
17:49:52.0987 6124 LSI_FC - ok
17:49:53.0008 6124 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
17:49:53.0009 6124 LSI_SAS - ok
17:49:53.0034 6124 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
17:49:53.0034 6124 LSI_SAS2 - ok
17:49:53.0046 6124 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
17:49:53.0047 6124 LSI_SCSI - ok
17:49:53.0068 6124 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
17:49:53.0069 6124 luafv - ok
17:49:53.0100 6124 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
17:49:53.0100 6124 megasas - ok
17:49:53.0115 6124 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
17:49:53.0116 6124 MegaSR - ok
17:49:53.0131 6124 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
17:49:53.0131 6124 Modem - ok
17:49:53.0188 6124 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
17:49:53.0189 6124 monitor - ok
17:49:53.0248 6124 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
17:49:53.0249 6124 mouclass - ok
17:49:53.0270 6124 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
17:49:53.0271 6124 mouhid - ok
17:49:53.0332 6124 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
17:49:53.0333 6124 mountmgr - ok
17:49:53.0368 6124 MpFilter (c177a7ebf5e8a0b596f618870516cab8) C:\Windows\system32\DRIVERS\MpFilter.sys
17:49:53.0370 6124 MpFilter - ok
17:49:53.0428 6124 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
17:49:53.0430 6124 mpio - ok
17:49:53.0448 6124 MpNWMon (8fbf6b31fe8af1833d93c5913d5b4d55) C:\Windows\system32\DRIVERS\MpNWMon.sys
17:49:53.0449 6124 MpNWMon - ok
17:49:53.0466 6124 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
17:49:53.0467 6124 mpsdrv - ok
17:49:53.0522 6124 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
17:49:53.0524 6124 MRxDAV - ok
17:49:53.0575 6124 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
17:49:53.0577 6124 mrxsmb - ok
17:49:53.0608 6124 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
17:49:53.0613 6124 mrxsmb10 - ok
17:49:53.0627 6124 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
17:49:53.0628 6124 mrxsmb20 - ok
17:49:53.0694 6124 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
17:49:53.0694 6124 msahci - ok
17:49:53.0712 6124 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
17:49:53.0714 6124 msdsm - ok
17:49:53.0747 6124 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
17:49:53.0747 6124 Msfs - ok
17:49:53.0774 6124 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
17:49:53.0775 6124 mshidkmdf - ok
17:49:53.0824 6124 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
17:49:53.0825 6124 msisadrv - ok
17:49:53.0851 6124 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
17:49:53.0851 6124 MSKSSRV - ok
17:49:53.0881 6124 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
17:49:53.0881 6124 MSPCLOCK - ok
17:49:53.0892 6124 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
17:49:53.0892 6124 MSPQM - ok
17:49:53.0943 6124 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
17:49:53.0947 6124 MsRPC - ok
17:49:53.0969 6124 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
17:49:53.0970 6124 mssmbios - ok
17:49:53.0987 6124 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
17:49:53.0987 6124 MSTEE - ok
17:49:54.0008 6124 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
17:49:54.0009 6124 MTConfig - ok
17:49:54.0026 6124 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
17:49:54.0027 6124 Mup - ok
17:49:54.0061 6124 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
17:49:54.0064 6124 NativeWifiP - ok
17:49:54.0138 6124 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
17:49:54.0147 6124 NDIS - ok
17:49:54.0169 6124 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
17:49:54.0170 6124 NdisCap - ok
17:49:54.0192 6124 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
17:49:54.0193 6124 NdisTapi - ok
17:49:54.0235 6124 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
17:49:54.0237 6124 Ndisuio - ok
17:49:54.0298 6124 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
17:49:54.0300 6124 NdisWan - ok
17:49:54.0349 6124 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
17:49:54.0350 6124 NDProxy - ok
17:49:54.0369 6124 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
17:49:54.0370 6124 NetBIOS - ok
17:49:54.0427 6124 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
17:49:54.0430 6124 NetBT - ok
17:49:54.0471 6124 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
17:49:54.0472 6124 nfrd960 - ok
17:49:54.0497 6124 NisDrv (5f7d72cbcdd025af1f38fdeee5646968) C:\Windows\system32\DRIVERS\NisDrvWFP.sys
17:49:54.0498 6124 NisDrv - ok
17:49:54.0519 6124 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
17:49:54.0520 6124 Npfs - ok
17:49:54.0533 6124 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
17:49:54.0533 6124 nsiproxy - ok
17:49:54.0613 6124 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
17:49:54.0628 6124 Ntfs - ok
17:49:54.0649 6124 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
17:49:54.0649 6124 Null - ok
17:49:54.0701 6124 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
17:49:54.0702 6124 nvraid - ok
17:49:54.0752 6124 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
17:49:54.0754 6124 nvstor - ok
17:49:54.0774 6124 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
17:49:54.0775 6124 nv_agp - ok
17:49:54.0832 6124 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
17:49:54.0833 6124 ohci1394 - ok
17:49:54.0869 6124 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
17:49:54.0870 6124 Parport - ok
17:49:54.0916 6124 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
17:49:54.0917 6124 partmgr - ok
17:49:54.0983 6124 PCDSRVC{1E208CE0-FB7451FF-06020101}_0 (7317a0b550f7ac0223b7070897670476) c:\program files\dell support center\pcdsrvc_x64.pkms
17:49:54.0985 6124 PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - ok
17:49:55.0000 6124 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
17:49:55.0002 6124 pci - ok
17:49:55.0019 6124 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
17:49:55.0020 6124 pciide - ok
17:49:55.0050 6124 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
17:49:55.0051 6124 pcmcia - ok
17:49:55.0067 6124 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
17:49:55.0068 6124 pcw - ok
17:49:55.0095 6124 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
17:49:55.0111 6124 PEAUTH - ok
17:49:55.0197 6124 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
17:49:55.0199 6124 PptpMiniport - ok
17:49:55.0218 6124 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
17:49:55.0219 6124 Processor - ok
17:49:55.0293 6124 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
17:49:55.0337 6124 Psched - ok
17:49:55.0468 6124 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys
17:49:55.0469 6124 PxHlpa64 - ok
17:49:55.0505 6124 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
17:49:55.0514 6124 ql2300 - ok
17:49:55.0533 6124 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
17:49:55.0534 6124 ql40xx - ok
17:49:55.0553 6124 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
17:49:55.0554 6124 QWAVEdrv - ok
17:49:55.0575 6124 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
17:49:55.0575 6124 RasAcd - ok
17:49:55.0598 6124 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
17:49:55.0599 6124 RasAgileVpn - ok
17:49:55.0665 6124 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
17:49:55.0667 6124 Rasl2tp - ok
17:49:55.0727 6124 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
17:49:55.0728 6124 RasPppoe - ok
17:49:55.0741 6124 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
17:49:55.0743 6124 RasSstp - ok
17:49:55.0798 6124 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
17:49:55.0802 6124 rdbss - ok
17:49:55.0814 6124 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
17:49:55.0815 6124 rdpbus - ok
17:49:55.0835 6124 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
17:49:55.0836 6124 RDPCDD - ok
17:49:55.0895 6124 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
17:49:55.0897 6124 RDPDR - ok
17:49:55.0929 6124 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
17:49:55.0930 6124 RDPENCDD - ok
17:49:55.0946 6124 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
17:49:55.0947 6124 RDPREFMP - ok
17:49:56.0006 6124 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
17:49:56.0010 6124 RDPWD - ok
17:49:56.0081 6124 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
17:49:56.0083 6124 rdyboost - ok
17:49:56.0137 6124 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
17:49:56.0138 6124 rspndr - ok
17:49:56.0176 6124 RTL8167 (4b42bc58294e83a6a92ec8b88c14c4a3) C:\Windows\system32\DRIVERS\Rt64win7.sys
17:49:56.0179 6124 RTL8167 - ok
17:49:56.0230 6124 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
17:49:56.0230 6124 s3cap - ok
17:49:56.0315 6124 SASDIFSV - ok
17:49:56.0323 6124 SASKUTIL - ok
17:49:56.0370 6124 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
17:49:56.0372 6124 sbp2port - ok
17:49:56.0438 6124 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
17:49:56.0439 6124 scfilter - ok
17:49:56.0467 6124 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
17:49:56.0468 6124 secdrv - ok
17:49:56.0490 6124 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
17:49:56.0490 6124 Serenum - ok
17:49:56.0525 6124 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
17:49:56.0526 6124 Serial - ok
17:49:56.0576 6124 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
17:49:56.0577 6124 sermouse - ok
17:49:56.0635 6124 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
17:49:56.0636 6124 sffdisk - ok
17:49:56.0647 6124 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
17:49:56.0648 6124 sffp_mmc - ok
17:49:56.0658 6124 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
17:49:56.0658 6124 sffp_sd - ok
17:49:56.0671 6124 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
17:49:56.0671 6124 sfloppy - ok
17:49:56.0698 6124 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
17:49:56.0699 6124 SiSRaid2 - ok
17:49:56.0708 6124 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
17:49:56.0708 6124 SiSRaid4 - ok
17:49:56.0729 6124 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
17:49:56.0729 6124 Smb - ok
17:49:56.0762 6124 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
17:49:56.0763 6124 spldr - ok
17:49:56.0827 6124 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
17:49:56.0832 6124 srv - ok
17:49:56.0857 6124 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
17:49:56.0862 6124 srv2 - ok
17:49:56.0876 6124 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
17:49:56.0877 6124 srvnet - ok
17:49:56.0949 6124 stdriver (353ad29837f1a9a4685edb65af57f87d) C:\Windows\system32\DRIVERS\stdriver64.sys
17:49:56.0951 6124 stdriver - ok
17:49:56.0971 6124 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
17:49:56.0972 6124 stexstor - ok
17:49:57.0034 6124 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
17:49:57.0036 6124 storflt - ok
17:49:57.0066 6124 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
17:49:57.0067 6124 storvsc - ok
17:49:57.0090 6124 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
17:49:57.0090 6124 swenum - ok
17:49:57.0118 6124 szkg5 - ok
17:49:57.0189 6124 Tcpip (f0e98c00a09fdf791525829a1d14240f) C:\Windows\system32\drivers\tcpip.sys
17:49:57.0206 6124 Tcpip - ok
17:49:57.0271 6124 TCPIP6 (f0e98c00a09fdf791525829a1d14240f) C:\Windows\system32\DRIVERS\tcpip.sys
17:49:57.0285 6124 TCPIP6 - ok
17:49:57.0332 6124 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
17:49:57.0333 6124 tcpipreg - ok
17:49:57.0350 6124 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
17:49:57.0351 6124 TDPIPE - ok
17:49:57.0365 6124 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
17:49:57.0366 6124 TDTCP - ok
17:49:57.0417 6124 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
17:49:57.0418 6124 tdx - ok
17:49:57.0437 6124 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
17:49:57.0438 6124 TermDD - ok
17:49:57.0512 6124 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
17:49:57.0513 6124 tssecsrv - ok
17:49:57.0590 6124 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
17:49:57.0591 6124 TsUsbFlt - ok
17:49:57.0649 6124 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
17:49:57.0650 6124 tunnel - ok
17:49:57.0666 6124 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
17:49:57.0667 6124 uagp35 - ok
17:49:57.0762 6124 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
17:49:57.0765 6124 udfs - ok
17:49:57.0845 6124 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
17:49:57.0847 6124 uliagpkx - ok
17:49:57.0888 6124 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
17:49:57.0889 6124 umbus - ok
17:49:57.0919 6124 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
17:49:57.0919 6124 UmPass - ok
17:49:57.0982 6124 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
17:49:57.0984 6124 usbaudio - ok
17:49:58.0034 6124 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
17:49:58.0042 6124 usbccgp - ok
17:49:58.0100 6124 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
17:49:58.0102 6124 usbcir - ok
17:49:58.0123 6124 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
17:49:58.0124 6124 usbehci - ok
17:49:58.0151 6124 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
17:49:58.0156 6124 usbhub - ok
17:49:58.0172 6124 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
17:49:58.0173 6124 usbohci - ok
17:49:58.0200 6124 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
17:49:58.0201 6124 usbprint - ok
17:49:58.0249 6124 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
17:49:58.0250 6124 usbscan - ok
17:49:58.0269 6124 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
17:49:58.0270 6124 USBSTOR - ok
17:49:58.0287 6124 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys
17:49:58.0288 6124 usbuhci - ok
17:49:58.0311 6124 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
17:49:58.0311 6124 vdrvroot - ok
17:49:58.0322 6124 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
17:49:58.0323 6124 vga - ok
17:49:58.0342 6124 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
17:49:58.0343 6124 VgaSave - ok
17:49:58.0361 6124 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
17:49:58.0364 6124 vhdmp - ok
17:49:58.0419 6124 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
17:49:58.0420 6124 viaide - ok
17:49:58.0442 6124 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
17:49:58.0445 6124 vmbus - ok
17:49:58.0463 6124 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
17:49:58.0463 6124 VMBusHID - ok
17:49:58.0475 6124 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
17:49:58.0475 6124 volmgr - ok
17:49:58.0524 6124 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
17:49:58.0528 6124 volmgrx - ok
17:49:58.0545 6124 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
17:49:58.0548 6124 volsnap - ok
17:49:58.0574 6124 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
17:49:58.0575 6124 vsmraid - ok
17:49:58.0590 6124 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
17:49:58.0590 6124 vwifibus - ok
17:49:58.0609 6124 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
17:49:58.0610 6124 WacomPen - ok
17:49:58.0637 6124 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
17:49:58.0638 6124 WANARP - ok
17:49:58.0643 6124 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
17:49:58.0644 6124 Wanarpv6 - ok
17:49:58.0671 6124 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
17:49:58.0672 6124 Wd - ok
17:49:58.0697 6124 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
17:49:58.0700 6124 Wdf01000 - ok
17:49:58.0741 6124 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
17:49:58.0741 6124 WfpLwf - ok
17:49:58.0785 6124 WimFltr (b14ef15bd757fa488f9c970eee9c0d35) C:\Windows\system32\DRIVERS\wimfltr.sys
17:49:58.0787 6124 WimFltr - ok
17:49:58.0803 6124 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
17:49:58.0804 6124 WIMMount - ok
17:49:58.0888 6124 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
17:49:58.0889 6124 WmiAcpi - ok
17:49:58.0916 6124 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
17:49:58.0917 6124 ws2ifsl - ok
17:49:58.0972 6124 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
17:49:58.0973 6124 WudfPf - ok
17:49:58.0991 6124 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
17:49:58.0994 6124 WUDFRd - ok
17:49:59.0024 6124 MBR (0x1B8) (de1996b5390bac8242e23168f828c750) \Device\Harddisk0\DR0
17:49:59.0025 6124 \Device\Harddisk0\DR0 ( Rootkit.Win32.TDSS.tdl4 ) - infected
17:49:59.0025 6124 \Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0)
17:49:59.0031 6124 MBR (0x1B8) (e5fa06aca0d60ba9c870d0ef3d9898c9) \Device\Harddisk5\DR5
17:49:59.0579 6124 \Device\Harddisk5\DR5 - ok
17:49:59.0585 6124 Boot (0x1200) (1dd6de8dd57ead416f8a089267ea0655) \Device\Harddisk0\DR0\Partition0
17:49:59.0586 6124 \Device\Harddisk0\DR0\Partition0 - ok
17:49:59.0599 6124 Boot (0x1200) (c5e6c8a2e58d94ce1928a4919bce7b9a) \Device\Harddisk0\DR0\Partition1
17:49:59.0600 6124 \Device\Harddisk0\DR0\Partition1 - ok
17:49:59.0604 6124 Boot (0x1200) (4ff22de58e389eba94509cd983307a1a) \Device\Harddisk5\DR5\Partition0
17:49:59.0605 6124 \Device\Harddisk5\DR5\Partition0 - ok
17:49:59.0606 6124 ============================================================
17:49:59.0606 6124 Scan finished
17:49:59.0606 6124 ============================================================
17:49:59.0616 1164 Detected object count: 1
17:49:59.0616 1164 Actual detected object count: 1
17:52:34.0892 1164 \Device\Harddisk0\DR0 ( Rootkit.Win32.TDSS.tdl4 ) - skipped by user
17:52:34.0892 1164 \Device\Harddisk0\DR0 ( Rootkit.Win32.TDSS.tdl4 ) - User select action: Skip

DDS.txt:
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_17
Run by [removed] at 17:59:08 on 2011-10-18
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8191.6245 [GMT -4:00]
.
AV: Microsoft Security Essentials *Disabled/Outdated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Outdated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: STOPzilla Anti-Spyware *Disabled/Updated* {B2E69928-50DC-94CA-6A80-AAB054008761}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Program Files (x86)\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Sony\Drive Letter Recognition Software\RIconMan.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.exe
c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\system32\spool\DRIVERS\x64\3\HP1006MC.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\SysWOW64\ping.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Verizon\FiOS\ihs\IHANotify.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\NCH Software\HourGuard\hourguard.exe
C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
C:\Program Files (x86)\Ask.com\Updater\Updater.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\STOPzilla!\STOPzilla.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files (x86)\WinZip\WINZIP32.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: H - No File
uURLSearchHooks: NCH Toolbar: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\prxtbNCH.dll
mURLSearchHooks: NCH Toolbar: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\prxtbNCH.dll
mWinlogon: Userinit=c:\windows\syswow64\userinit.exe,
BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitBHO.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
BHO: Somoto Toolbar: {652853ad-5592-4231-88c6-706613a52e61} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: TwcToolbarBhoApp Class: {aa1f9ddb-e605-4ba6-81d4-e427dee012ad} - C:\Windows\SysWow64\TwcToolbarBho.dll
BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No File
BHO: NCH Toolbar: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\prxtbNCH.dll
BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: {e3215f20-3212-11d6-9f8b-00d0b743919d} - c:\program files (x86)\stopzilla!\sziebho.dll
TB: The Weather Channel Toolbar: {2e5e800e-6ac0-411e-940a-369530a35e43} - C:\Windows\SysWow64\TwcToolbarIe7.dll
TB: Snagit: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitIEAddin.dll
TB: NCH Toolbar: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\prxtbNCH.dll
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
TB: Somoto Toolbar: {652853ad-5592-4231-88c6-706613a52e61} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll
TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
uRun: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [ihanotify] C:\Program Files (x86)\Verizon\FiOS\ihs\IHANotify.exe 44 fios
uRun: [Spyware Doctor] C:\Users\Mark Law\Desktop\sdsetup_revwire207[1].exe -min
mRun: [SSBkgdUpdate] "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
mRun: [DNS7reminder] "C:\Program Files (x86)\Nuance\NaturallySpeaking10\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking10\Ereg.ini
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [HourGuard] "C:\Program Files (x86)\NCH Software\HourGuard\hourguard.exe" -logon
mRun: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
mRun: []
mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
mRunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"
mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Users\Mark Law\Desktop\Fiddler2\Fiddler.exe"
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://attewc.webex.com/client/T26L10NSP49EP10-attewc/event/ieatgpc.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{E6F2E9DA-D010-4D5D-BA58-ADB59DE88FB3} : DhcpNameServer = 192.168.1.1
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: SnagIt Toolbar Loader: {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitBHO.dll
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No File
BHO-X64: McAfee Phishing Filter - No File
BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO-X64: Conduit Engine: {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
BHO-X64: Conduit Engine - No File
BHO-X64: Somoto Toolbar: {652853ad-5592-4231-88c6-706613a52e61} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll
BHO-X64: Somoto Toolbar - No File
BHO-X64: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
BHO-X64: Search Helper - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO-X64: TwcToolbarBhoApp Class: {AA1F9DDB-E605-4ba6-81D4-E427DEE012AD} - C:\Windows\SysWow64\TwcToolbarBho.dll
BHO-X64: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No File
BHO-X64: NCH Toolbar: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\prxtbNCH.dll
BHO-X64: NCH - No File
BHO-X64: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
BHO-X64: Ask Toolbar BHO - No File
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
c:\program files (x86)\stopzilla!\sziebho.dll
TB-X64: The Weather Channel Toolbar: {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\Windows\SysWow64\TwcToolbarIe7.dll
TB-X64: Snagit: {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitIEAddin.dll
TB-X64: NCH Toolbar: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - C:\Program Files (x86)\NCH\prxtbNCH.dll
TB-X64: Conduit Engine: {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
TB-X64: Somoto Toolbar: {652853ad-5592-4231-88c6-706613a52e61} - C:\Program Files (x86)\somototoolbar\vmntemplateX.dll
TB-X64: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
TB-X64: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
mRun-x64: [SSBkgdUpdate] "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
mRun-x64: [DNS7reminder] "C:\Program Files (x86)\Nuance\NaturallySpeaking10\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking10\Ereg.ini
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [HourGuard] "C:\Program Files (x86)\NCH Software\HourGuard\hourguard.exe" -logon
mRun-x64: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
mRun-x64: [(Default)]
mRun-x64: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
mRunOnce-x64: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"
mRunOnce-x64: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe
IE-X64: {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Users\Mark Law\Desktop\Fiddler2\Fiddler.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Mark Law\AppData\Roaming\Mozilla\Firefox\Profiles\vig57khw.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll
FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordlegacyext.dll
FF - component: C:\Users\Mark Law\AppData\Roaming\Mozilla\Firefox\Profiles\vig57khw.default\extensions\{652853ad-5592-4231-88c6-706613a52e61}\components\dtTransparency.dll
FF - component: C:\Users\Mark Law\AppData\Roaming\Mozilla\Firefox\Profiles\vig57khw.default\extensions\{c2db4fe6-8409-45ce-8010-189a7b5cce86}\components\RadioWMPCoreGecko19.dll
FF - component: C:\Users\Mark Law\AppData\Roaming\Mozilla\Firefox\Profiles\vig57khw.default\extensions\{c2db4fe6-8409-45ce-8010-189a7b5cce86}\components\RadioWMPCoreGecko5.dll
FF - component: C:\Users\Mark Law\AppData\Roaming\Mozilla\Firefox\Profiles\vig57khw.default\extensions\{c2db4fe6-8409-45ce-8010-189a7b5cce86}\components\RadioWMPCoreGecko6.dll
FF - component: C:\Users\Mark Law\AppData\Roaming\Mozilla\Firefox\Profiles\vig57khw.default\extensions\{c2db4fe6-8409-45ce-8010-189a7b5cce86}\components\RadioWMPCoreGecko7.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll
FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll
FF - plugin: C:\Users\Mark Law\AppData\Roaming\Mozilla\plugins\npatgpc.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Amazon Toolbar: [removed] - %profile%\extensions\[removed]
FF - Ext: NCH Community Toolbar: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - %profile%\extensions\{c2db4fe6-8409-45ce-8010-189a7b5cce86}
FF - Ext: SomotoToolbar: {652853ad-5592-4231-88c6-706613a52e61} - %profile%\extensions\{652853ad-5592-4231-88c6-706613a52e61}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys –> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys –> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-2 92160]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe –> C:\Windows\system32\atiesrxx.exe [?]
R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Sony\Drive Letter Recognition Software\RIconMan.exe [2011-5-16 1750016]
R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2009-11-2 1692480]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys –> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 stdriver;Sound tap driver Upper Class Filter Driver v2.0.0.0;C:\Windows\system32\DRIVERS\stdriver64.sys –> C:\Windows\system32\DRIVERS\stdriver64.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-4-29 136176]
S2 LMIRescue_e901ddf2-7619-4e15-b875-cef118c099b5;LogMeIn Rescue (e901ddf2-7619-4e15-b875-cef118c099b5);"C:\Users\Admin\AppData\Local\Temp\LMIA535.tmp\LMI_Rescue_srv.exe" -service -sid e901ddf2-7619-4e15-b875-cef118c099b5 –> C:\Users\Admin\AppData\Local\Temp\LMIA535.tmp\LMI_Rescue_srv.exe [?]
S2 RoxWatch10;Roxio Hard Drive Watcher 10;C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [2009-6-10 166384]
S3 ExpressAccountsService;Express Accounts;C:\Program Files (x86)\NCH Software\ExpressAccounts\expressaccounts.exe [2011-8-1 2640900]
S3 ExpressInvoiceService;Express Invoice;C:\Program Files (x86)\NCH Software\ExpressInvoice\expressinvoice.exe [2011-8-1 1765380]
S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys –> C:\Windows\system32\DRIVERS\fssfltr.sys [?]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-4-29 136176]
S3 InventoriaService;Inventoria Stock Manager;C:\Program Files (x86)\NCH Software\Inventoria\inventoria.exe [2011-8-1 1363460]
S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys –> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys –> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]
S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\Dell Support Center\pcdsrvc_x64.pkms [2011-7-21 25072]
S3 RoxMediaDB10;RoxMediaDB10;C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-6-10 1124848]
S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S4 RoxLiveShare10;LiveShare P2P Server 10;C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [2009-6-10 309744]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2011-10-18 19:53:08 ——– d—–w- C:\Users\Mark Law\AppData\Local\{A3E7AF84-49E9-4682-8282-287B3688DA28}
2011-10-18 19:51:06 601424 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{00C94F51-944C-90C3-B08B-F79D38E694C3}\GapaEngine.dll
2011-10-18 19:48:30 ——– d—–w- C:\Users\Mark Law\AppData\Local\{747BB3E1-E152-44FA-B54A-B063920CCF06}
2011-10-18 19:45:40 69000 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E7557BBE-81A1-4AE4-A50B-FBBB5796E377}\offreg.dll
2011-10-18 19:45:36 9049936 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E7557BBE-81A1-4AE4-A50B-FBBB5796E377}\mpengine.dll
2011-10-18 18:24:38 ——– d—–w- C:\Users\Mark Law\AppData\Local\{AF8BE08F-CFBC-4D37-B63A-B698A6C54501}
2011-10-18 09:52:36 ——– d—–w- C:\Users\Mark Law\AppData\Local\{7602836C-73B6-4F7C-9098-7F473AC68A79}
2011-10-18 07:15:33 ——– d—–w- C:\Users\Mark Law\AppData\Local\{820DCCA7-88A4-421A-AF4C-9A7B1A5F7309}
2011-10-12 14:01:45 ——– d—–w- C:\Users\Mark Law\AppData\Local\{C7706BF0-6991-4BF7-99A1-F3AA811D80A0}
2011-10-12 02:01:11 ——– d—–w- C:\Users\Mark Law\AppData\Local\{EDDAFFC2-D1B7-4556-80BF-544A581B3708}
2011-10-11 14:00:37 ——– d—–w- C:\Users\Mark Law\AppData\Local\{A7A2AA6E-0874-42CA-B983-C5C38B11AA65}
2011-10-11 14:00:26 ——– d—–w- C:\Users\Mark Law\AppData\Local\{248250AB-AA13-4EC6-BBA4-BF7A2CCEB225}
2011-10-11 13:45:35 917840 —-a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{FAC2DBFD-5ADD-4D30-85BB-8CA65D967277}\gapaengine.dll
2011-10-07 17:56:02 ——– d—–w- C:\Users\Mark Law\AppData\Local\{43D887A1-7B6F-4876-A888-00B297B19E5A}
2011-10-07 17:55:51 ——– d—–w- C:\Users\Mark Law\AppData\Local\{E6053590-5187-49CB-B554-619F92189729}
2011-10-04 18:25:34 ——– d—–w- C:\Users\Mark Law\AppData\Local\{1462CB87-BFE2-4A9D-9152-134CCFD12035}
2011-10-04 18:25:24 ——– d—–w- C:\Users\Mark Law\AppData\Local\{D5E30BDE-0CD3-4F89-9A38-10F3DD12EA48}
2011-10-03 18:01:22 ——– d—–w- C:\Users\Mark Law\AppData\Local\{331C4FDE-F41C-4610-A134-34DA3911B816}
2011-10-03 18:01:12 ——– d—–w- C:\Users\Mark Law\AppData\Local\{F07016BF-7436-4DD8-90C6-A481CA24CC5C}
2011-10-01 00:50:29 ——– d—–w- C:\Program Files (x86)\Ask.com
2011-09-26 14:34:55 ——– d—–w- C:\Users\Mark Law\AppData\Local\{4710BF3E-1ABE-44F2-A6C5-D87ED2ADE2F4}
2011-09-26 14:34:38 ——– d—–w- C:\Users\Mark Law\AppData\Local\{2F83871A-6AFF-464C-916B-54F0522797CE}
2011-09-26 14:25:22 ——– d—–w- C:\Users\Mark Law\AppData\Local\{BEA70E58-C0AE-4FDC-9314-A940B99FE145}
2011-09-25 05:28:23 ——– d—–w- C:\Users\Mark Law\AppData\Local\{1EBD2C56-85A0-42EA-B0CE-347899C95EDD}
2011-09-25 05:28:14 ——– d—–w- C:\Users\Mark Law\AppData\Local\{4F9A7D06-F108-4BCD-A62C-32274EF7FE77}
.
==================== Find3M ====================
.
2011-09-26 14:31:29 404640 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-08-31 21:00:50 25416 —-a-w- C:\Windows\System32\drivers\mbam.sys
2011-08-02 21:58:06 546256 —-a-r- C:\Windows\SysWow64\SZComp5.dll
2011-08-02 21:58:06 22992 —-a-r- C:\Windows\SysWow64\SZIO5.dll
2011-08-02 21:58:06 132560 —-a-r- C:\Windows\SysWow64\IS3HTUI5.dll
2011-08-02 21:58:04 99792 —-a-r- C:\Windows\SysWow64\IS3Svc5.dll
2011-08-02 21:58:04 67024 —-a-r- C:\Windows\SysWow64\IS3Hks5.dll
2011-08-02 21:58:04 456144 —-a-r- C:\Windows\SysWow64\SZBase5.dll
2011-08-02 21:58:04 398800 —-a-r- C:\Windows\SysWow64\IS3DBA5.dll
2011-08-02 21:58:04 28624 —-a-r- C:\Windows\SysWow64\IS3XDat5.dll
2011-08-02 21:58:02 99792 —-a-r- C:\Windows\SysWow64\IS3Inet5.dll
2011-08-02 21:58:02 738768 —-a-r- C:\Windows\SysWow64\IS3Base5.dll
2011-08-02 21:58:02 390608 —-a-r- C:\Windows\SysWow64\IS3UI5.dll
2011-08-02 21:58:02 230864 —-a-r- C:\Windows\SysWow64\IS3Win325.dll
2011-07-27 02:42:03 12872 —-a-w- C:\Windows\System32\bootdelete.exe
2011-07-27 02:32:53 23112 —-a-w- C:\Windows\System32\drivers\hitmanpro35.sys
2011-07-26 09:10:24 1152 —-a-w- C:\Windows\SysWow64\windrv.sys
2011-07-24 23:22:35 175616 —-a-w- C:\Windows\System32\msclmd.dll
2011-07-24 23:22:35 152576 —-a-w- C:\Windows\SysWow64\msclmd.dll
2011-07-22 05:42:23 2303488 —-a-w- C:\Windows\System32\jscript9.dll
2011-07-22 05:36:16 1389056 —-a-w- C:\Windows\System32\wininet.dll
2011-07-22 05:32:40 2382848 —-a-w- C:\Windows\System32\mshtml.tlb
2011-07-22 02:54:43 1797632 —-a-w- C:\Windows\SysWow64\jscript9.dll
2011-07-22 02:48:26 1126912 —-a-w- C:\Windows\SysWow64\wininet.dll
2011-07-22 02:44:36 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb
.
============= FINISH: 18:00:00.87 ===============

Attach.txt:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 12/30/2009 11:41:24 AM
System Uptime: 10/18/2011 3:49:29 PM (3 hours ago)
.
Motherboard: Dell Inc. | | 0M017G
Processor: Pentium® Dual-Core CPU E5300 @ 2.60GHz | CPU 1 | 2603/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 584 GiB total, 151.289 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
G: is Removable
H: is Removable
I: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: SASDIFSV
Device ID: ROOT\LEGACY_SASDIFSV\0000
Manufacturer:
Name: SASDIFSV
PNP Device ID: ROOT\LEGACY_SASDIFSV\0000
Service: SASDIFSV
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: SASKUTIL
Device ID: ROOT\LEGACY_SASKUTIL\0000
Manufacturer:
Name: SASKUTIL
PNP Device ID: ROOT\LEGACY_SASKUTIL\0000
Service: SASKUTIL
.
==== System Restore Points ===================
.
RP278: 9/29/2011 3:00:10 AM - Windows Update
RP281: 10/1/2011 5:13:30 AM - Microsoft Antimalware Checkpoint
RP282: 10/2/2011 10:26:46 AM - Windows Update
RP283: 10/5/2011 10:34:35 AM - Windows Update
RP286: 10/8/2011 11:28:02 AM - Microsoft Antimalware Checkpoint
RP287: 10/9/2011 2:08:07 AM - Windows Update
RP288: 10/12/2011 2:09:37 AM - Windows Update
RP290: 10/15/2011 6:27:42 PM - Microsoft Antimalware Checkpoint
RP293: 10/18/2011 4:52:58 PM - Installed WinZip 15.5
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
2007 Microsoft Office system
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop Elements 2.0
Adobe Reader 9.4.3
AnswerWorks 4.0 Runtime - English
AnswerWorks 5.0 English Runtime
Apple Application Support
Apple Software Update
ArcSoft PhotoStudio 5
ArcSoft PhotoStudio 5.5
Ask Toolbar
ATI Catalyst Control Center
Brother P-touch Editor 5.0
Business Contact Manager for Outlook 2007 SP2
Canon CanoScan LiDE 200 User Registration
Canon MP Navigator EX 2.0
Canon Utilities Solution Menu
CanoScan Toolbox Ver4.1
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-core-static
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help English
CCC Help French
CCC Help German
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Portuguese
CCC Help Spanish
CCC Help Turkish
CleanUp!
Compatibility Pack for the 2007 Office system
Conduit Engine
D3DX10
Dell DataSafe Local Backup
Dell DataSafe Local Backup - Support Software
Dell DataSafe Online
Dell Getting Started Guide
DirectXInstallService
Dragon NaturallySpeaking 10
Drive Letter Recognition Software
Dup Scout 2.4.38
Express Accounts
Express Dictate
Express Invoice
Express Scribe
Google Earth
Google Update Helper
GoToAssist 8.0.0.514
GoToMeeting 4.5.0.457
HourGuard Time Sheet
HP LaserJet P1500 series
hppMSRedist
hppusgP1500
HPSSupply
Inventoria Stock Manager
Java™ 6 Update 17
Junk Mail filter update
Malwarebytes' Anti-Malware version 1.51.2.1300
Manual CanoScan LiDE 80
MarketResearch
McAfee Security Scan Plus
MediaRECOVER
Meeting Service
Mesh Runtime
Messenger Companion
Microsoft .NET Framework 1.1
Microsoft Easy Assist v2
Microsoft Office 2003 Web Components
Microsoft Office 2007 Primary Interop Assemblies
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Accounting 2007
Microsoft Office Accounting ADP Payroll Addin
Microsoft Office Accounting Equifax Addin
Microsoft Office Accounting Fixed Asset Manager
Microsoft Office Accounting PayPal Addin
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office Live Add-in 1.5
Microsoft Office Live Meeting 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Professional Hybrid 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Small Business Connectivity Components
Microsoft Office Suite Activation Assistant
Microsoft Office Word MUI (English) 2007
Microsoft Outlook Personal Folders Backup
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
Microsoft SQL Server Setup Support Files (English)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Microsoft Works
Mozilla Firefox (3.6.23)
MrvlUsgTracking
MSVCRT
MSVCRT_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NCH Toolbar
NCH Toolbox
PersonalBrain 5
PerSono
PowerDVD DX
QuickTime
RadarSync PC Updater 2010
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealPlayer
Realtek High Definition Audio Driver
RealUpgrade 1.1
Roxio Activation Module
Roxio CinePlayer Decoder Pack
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator Premier
Roxio Creator Premier 10
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Update Manager
ScanSoft OmniPage 16
ScanSoft PaperPort 11
Security Update for 2007 Microsoft Office System (KB2288621)
Security Update for 2007 Microsoft Office System (KB2288931)
Security Update for 2007 Microsoft Office System (KB2345043)
Security Update for 2007 Microsoft Office System (KB2553074)
Security Update for 2007 Microsoft Office System (KB2553089)
Security Update for 2007 Microsoft Office System (KB2553090)
Security Update for 2007 Microsoft Office System (KB2584063)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB2553073)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office PowerPoint 2007 (KB2535818)
Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)
Security Update for Microsoft Office Publisher 2007 (KB2284697)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2344993)
Skins
Snagit 9.1.3
SoundTap Streaming Audio Recorder
STOPzilla
Temp File Cleaner
Temp File Cleaner FileBulldog Toolbar
The Weather Channel Desktop 6
The Weather Channel Toolbar
Times Reader
TurboTax 2008
TurboTax 2008 WinPerFedFormset
TurboTax 2008 WinPerProgramHelp
TurboTax 2008 WinPerReleaseEngine
TurboTax 2008 WinPerTaxSupport
TurboTax 2008 WinPerUserEducation
TurboTax 2008 wrapper
TurboTax 2009
TurboTax 2009 WinPerFedFormset
TurboTax 2009 WinPerReleaseEngine
TurboTax 2009 WinPerTaxSupport
TurboTax 2009 wnyiper
TurboTax 2009 wrapper
TurboTax Deluxe 2005
TurboTax Deluxe 2007
TurboTax Home & Business 2006
TurboTax ItsDeductible 2005
TurboTax ItsDeductible 2006
Update for 2007 Microsoft Office System (KB2284654)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 System (KB2539530)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2583910)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (KB2553110)
Verizon FiOS Activation
Vz In Home Agent
WexTech AnswerWorks
WildTangent Games
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Windows Media Player Firefox Plugin
WinZip 15.5
WordPerfect Office 2002
.
==== Event Viewer Messages From Past Week ========
.
10/18/2011 5:59:44 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
10/18/2011 5:59:44 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 5:59:44 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 5:59:44 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 5:59:44 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 5:59:44 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 5:59:44 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 5:59:44 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 5:59:44 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 5:50:36 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
10/18/2011 5:49:41 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff80003264f6b, 0x0000000000000000, 0x000007fffffa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 101811-32744-01.
10/18/2011 5:49:29 AM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 0.0.0.0;0.0.0.0 Engine version: 0.0.0.0
10/18/2011 4:24:55 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
10/18/2011 4:23:47 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x000000000000f79d, 0x0000000000000002, 0x0000000000000001, 0xfffff800032b3ab5). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 101811-27253-01.
10/18/2011 4:23:42 AM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 0.0.0.0;0.0.0.0 Engine version: 0.0.0.0
10/18/2011 4:00:13 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 4:00:13 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 4:00:13 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 4:00:13 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 4:00:13 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 4:00:13 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 4:00:13 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 4:00:13 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 4:00:12 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
10/18/2011 3:52:44 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
10/18/2011 3:52:28 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
10/18/2011 3:52:28 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/18/2011 3:52:06 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SftService service.
10/18/2011 3:51:16 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
10/18/2011 3:50:58 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: is3srv SASDIFSV SASKUTIL
10/18/2011 3:50:56 PM, Error: Service Control Manager [7000] - The LogMeIn Rescue (e901ddf2-7619-4e15-b875-cef118c099b5) service failed to start due to the following error: The system cannot find the file specified.
10/18/2011 3:46:57 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
10/18/2011 3:45:41 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000005, 0xfffff800032bbf6b, 0x0000000000000000, 0x000007fffffa0000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 101811-28548-01.
10/18/2011 3:45:36 PM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 0.0.0.0;0.0.0.0 Engine version: 0.0.0.0
10/18/2011 3:15:25 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.
10/18/2011 3:13:40 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
10/18/2011 2:23:47 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
10/18/2011 2:21:52 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
10/18/2011 2:21:52 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 2:21:52 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 2:21:52 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 2:21:52 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 2:21:52 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 2:21:52 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 2:21:52 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/18/2011 2:21:52 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/17/2011 9:37:59 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
10/17/2011 9:33:38 AM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
10/17/2011 12:24:51 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
10/17/2011 12:23:39 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000096, 0xfffff800032fcb5a, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 101711-33555-01.
10/17/2011 12:23:31 PM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 0.0.0.0;0.0.0.0 Engine version: 0.0.0.0
10/17/2011 1:47:11 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
10/17/2011 1:47:11 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/17/2011 1:47:11 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/17/2011 1:47:11 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/17/2011 1:47:11 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=187…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/17/2011 1:47:11 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/17/2011 1:47:11 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/17/2011 1:47:11 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/17/2011 1:47:11 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121…5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved
10/17/2011 1:37:58 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
10/17/2011 1:37:07 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001e (0xffffffffc0000096, 0xfffff80003308b5a, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 101711-36363-01.
10/17/2011 1:36:56 PM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 0.0.0.0;0.0.0.0 Engine version: 0.0.0.0
10/15/2011 3:25:35 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1423.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
10/15/2011 3:19:39 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Intuit Update Service service to connect.
10/15/2011 3:19:39 PM, Error: Service Control Manager [7000] - The Intuit Update Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
10/15/2011 3:16:48 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
10/15/2011 3:15:28 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x000000000000268f, 0x0000000000000002, 0x0000000000000001, 0xfffff800032caab5). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 101511-21060-01.
10/15/2011 12:50:34 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
10/15/2011 12:39:20 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
10/15/2011 12:37:50 PM, Error: Microsoft Antimalware [2004] - Microsoft Antimalware has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: Current Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 0.0.0.0;0.0.0.0 Engine version: 0.0.0.0
10/12/2011 7:09:11 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80004005 Error description: Unspecified error Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
10/12/2011 2:10:58 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Definition Update for Microsoft Security Essentials - KB2310138 (Definition 1.113.1471.0).
10/12/2011 2:10:45 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.113.1445.0 Update Source: Microsoft Update Server Update Stage: Install Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.7702.0 Error code: 0x80070643 Error description: Fatal error during installation.
.
==== End Of File ===========================

Thank you again for your help.

mark_law_ok

I do understand your concerns about posting the logs, and of course, being cautious online is always prudent. But rest assured, there is precious little in these logs that data stealers would find useful. Now, let's see about getting this computer of yours back up and running better



Please read carefully and follow these steps. This time we are going to use TDSSKiller to remove at least one of the items causing trouble.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and right-click and choose Run as Administrator on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

I'm hoping that you will then reboot into normal mode with no issues. If upon reboot the system does not boot normally, you should then try to boot with driver sign verification disabled.

After you have rebooted please do the following:

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

** Please be aware that sometimes Combofix can take a little while to run and/or it may reboot your computer. Please let it run until it has finished. I have seen it take as long as 40 minutes to finish so please don't think it has stalled. It may also take a bit from the time it tells you it's producing the report until the time you see it on screen. Again, please be patient. Doing anything else on the computer when Combofix is running may cause it to stall and we certainly don't want that to happen.

Thank you for the prompt response, Doris, and for expressing understanding about my concerns. I ran TDSSKiller, selected "Cure" and "Continue" after the scan, and then rebooted when directed. To all appearances, the computer rebooted normally (for the first time in six days). I found the log and copied it to my thumb drive. I'm still skittish about using the internet on the computer, so I will have to wait until my next visit to the library (probably tomorrow night) before I can download ComboFix. I will send all the logs after I run ComboFix at home. I assume you didn't have a problem with the fact that the GMER scan gave me no results? Thank you again for the help.Things seem to be moving in the right direction. mark_law_ok