This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Detection of virus, then automatic reboot, then "Startup Repair&q

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I'm not too worried about the GMER scan showing no results at this point. TDSSKiller and the DDS logs have shown me the files that need attention. I'm very glad to hear the system is booting normally again. In upcoming steps you will need to reconnect to the internet, so running Combofix is the last step you can do before it will be necessary. (Just thought I'd let you know ahead of time.)
Hi Doris, I wasn't able to get to the library yesterday to download ComboFix; I'm hoping to get to it tonight. Please don't close my ticket. mark_law_ok
Thanks for letting me know. I'll keep it open. But again, I do not see any harm in reconnecting to the internet at this point in time. We clean systems every day which are infected and yet are still connected. It's very unlikely it would cause any additional problems on the machine. The choice is yours at this point.
Just a status update, Doris. I downloaded ComboFix last night from another computer. I had to go out of town for the day early this morning and didn't have a chance to run it. I should be able to get you the logs either tonight or tomorrow morning. Thank you for your patience in keeping the ticket open. mark_law_ok
Just checking in to see if you've run Combofix yet. If not, I would STRONGLY urge you to reconnect to the internet before doing so, as Combofix has been updated since the 22nd and it may prompt for the updated version when you run it.
Doris, thanks for the inquiry. I would have sent you the logs earlier, but my understanding is that WhatTheTech posters are not supposed to reply to their own postings. That is why I was waiting to hear back from you. I am attaching the text of the TDSSKiller and ComboFix log reports, as you requested. I ran ComboFix on Sunday, October 23. Note that I have not had any physical connection to the internet since my home computer had the problems that I first wrote you about (the problems started on or about October 12), so the infections I picked up would also not have been more current than that date. If you believe it would be wise for me to update ComboFix and re-run it, I can re-run it tonight when I get home. Do you have an updated link I can download from? (I am at a library computer at the moment.) I still haven't reconnected to the internet at home because I first wanted your thoughts after your review of the logs below.

A few questions before I get to the logs:

1. As I mentioned in an earlier posting, Microsoft Security Essentials had "allowed" a Trojan.Dropper right around the date when the problems first started; and when I copied WinZip (which I downloaded from my library) onto my home machine, Stopzilla found something called FakeAntivirus.G. Do the logs below indicate whether these two infections were removed? If they haven't been removed, should they be?

2. As you instructed, I disabled MSE and Stopzilla before I ran ComboFix (as well as TDSSKiller, DDS and GMER, previously). After ComboFix ran and produced its log, I re-enabled MSE and Stopzilla, at which point Stopzilla immediately popped up the following warning:

"Stopzilla has just deleted and blocked the following infections: SystemPolicies.DisableRegistryTools [and] CatchMe. Would you like to scan and remove now?"

I chose "No" as the response, since I thought the "infections" might somehow be related to ComboFix. Remember, I had not connected to the internet, so I don't know where else those "infections" could have come from. Again, the warning was not the result of my running a scan of Stopzilla; it spontaneously sent me the warning when it was re-enabled.

3. Can you tell me anything about the infections that ComboFix deleted?

Here are the logs:

TDSSKiller

18:16:45.0493 6212 TDSS rootkit removing tool 2.6.9.0 Oct 14 2011 11:33:24
18:16:45.0503 6212 ============================================================
18:16:45.0503 6212 Current date / time: 2011/10/19 18:16:45.0503
18:16:45.0503 6212 SystemInfo:
18:16:45.0503 6212
18:16:45.0503 6212 OS Version: 6.1.7601 ServicePack: 1.0
18:16:45.0503 6212 Product type: Workstation
18:16:45.0503 6212 ComputerName: MARKLAW-PC
18:16:45.0503 6212 UserName: Mark Law
18:16:45.0503 6212 Windows directory: C:\Windows
18:16:45.0503 6212 System windows directory: C:\Windows
18:16:45.0503 6212 Running under WOW64
18:16:45.0503 6212 Processor architecture: Intel x64
18:16:45.0503 6212 Number of processors: 2
18:16:45.0503 6212 Page size: 0x1000
18:16:45.0503 6212 Boot type: Normal boot
18:16:45.0503 6212 ============================================================
18:16:46.0299 6212 Initialize success
18:16:59.0228 2024 ============================================================
18:16:59.0228 2024 Scan started
18:16:59.0228 2024 Mode: Manual;
18:16:59.0229 2024 ============================================================
18:16:59.0995 2024 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
18:16:59.0997 2024 1394ohci - ok
18:17:00.0050 2024 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
18:17:00.0053 2024 ACPI - ok
18:17:00.0100 2024 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
18:17:00.0101 2024 AcpiPmi - ok
18:17:00.0147 2024 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
18:17:00.0152 2024 adp94xx - ok
18:17:00.0172 2024 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
18:17:00.0174 2024 adpahci - ok
18:17:00.0191 2024 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
18:17:00.0193 2024 adpu320 - ok
18:17:00.0274 2024 AFD (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys
18:17:00.0290 2024 AFD - ok
18:17:00.0336 2024 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
18:17:00.0337 2024 agp440 - ok
18:17:00.0360 2024 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
18:17:00.0361 2024 aliide - ok
18:17:00.0393 2024 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
18:17:00.0393 2024 amdide - ok
18:17:00.0411 2024 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
18:17:00.0412 2024 AmdK8 - ok
18:17:00.0425 2024 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
18:17:00.0426 2024 AmdPPM - ok
18:17:00.0477 2024 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
18:17:00.0478 2024 amdsata - ok
18:17:00.0493 2024 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
18:17:00.0495 2024 amdsbs - ok
18:17:00.0513 2024 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
18:17:00.0514 2024 amdxata - ok
18:17:00.0588 2024 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
18:17:00.0589 2024 AppID - ok
18:17:00.0644 2024 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
18:17:00.0646 2024 arc - ok
18:17:00.0663 2024 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
18:17:00.0664 2024 arcsas - ok
18:17:00.0702 2024 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
18:17:00.0702 2024 AsyncMac - ok
18:17:00.0747 2024 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
18:17:00.0747 2024 atapi - ok
18:17:00.0889 2024 atikmdag (80793852021864a9ed344843eeba5fdb) C:\Windows\system32\DRIVERS\atikmdag.sys
18:17:00.0990 2024 atikmdag - ok
18:17:01.0027 2024 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
18:17:01.0032 2024 b06bdrv - ok
18:17:01.0047 2024 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
18:17:01.0049 2024 b57nd60a - ok
18:17:01.0081 2024 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
18:17:01.0081 2024 Beep - ok
18:17:01.0118 2024 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
18:17:01.0119 2024 blbdrive - ok
18:17:01.0198 2024 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
18:17:01.0200 2024 bowser - ok
18:17:01.0231 2024 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
18:17:01.0232 2024 BrFiltLo - ok
18:17:01.0245 2024 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
18:17:01.0246 2024 BrFiltUp - ok
18:17:01.0272 2024 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
18:17:01.0275 2024 Brserid - ok
18:17:01.0289 2024 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
18:17:01.0289 2024 BrSerWdm - ok
18:17:01.0302 2024 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
18:17:01.0303 2024 BrUsbMdm - ok
18:17:01.0314 2024 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
18:17:01.0315 2024 BrUsbSer - ok
18:17:01.0331 2024 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
18:17:01.0331 2024 BTHMODEM - ok
18:17:01.0351 2024 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
18:17:01.0352 2024 cdfs - ok
18:17:01.0405 2024 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
18:17:01.0407 2024 cdrom - ok
18:17:01.0431 2024 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
18:17:01.0432 2024 circlass - ok
18:17:01.0461 2024 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
18:17:01.0465 2024 CLFS - ok
18:17:01.0605 2024 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
18:17:01.0605 2024 CmBatt - ok
18:17:01.0666 2024 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
18:17:01.0666 2024 cmdide - ok
18:17:01.0736 2024 CNG (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys
18:17:01.0740 2024 CNG - ok
18:17:01.0755 2024 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
18:17:01.0756 2024 Compbatt - ok
18:17:01.0822 2024 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
18:17:01.0823 2024 CompositeBus - ok
18:17:01.0835 2024 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
18:17:01.0836 2024 crcdisk - ok
18:17:01.0924 2024 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
18:17:01.0941 2024 CSC - ok
18:17:02.0007 2024 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
18:17:02.0008 2024 DfsC - ok
18:17:02.0029 2024 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
18:17:02.0030 2024 discache - ok
18:17:02.0089 2024 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
18:17:02.0090 2024 Disk - ok
18:17:02.0139 2024 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
18:17:02.0139 2024 drmkaud - ok
18:17:02.0205 2024 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
18:17:02.0214 2024 DXGKrnl - ok
18:17:02.0296 2024 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
18:17:02.0357 2024 ebdrv - ok
18:17:02.0390 2024 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
18:17:02.0393 2024 elxstor - ok
18:17:02.0438 2024 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
18:17:02.0438 2024 ErrDev - ok
18:17:02.0474 2024 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
18:17:02.0477 2024 exfat - ok
18:17:02.0537 2024 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
18:17:02.0539 2024 fastfat - ok
18:17:02.0562 2024 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
18:17:02.0563 2024 fdc - ok
18:17:02.0591 2024 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
18:17:02.0592 2024 FileInfo - ok
18:17:02.0609 2024 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
18:17:02.0610 2024 Filetrace - ok
18:17:02.0618 2024 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
18:17:02.0618 2024 flpydisk - ok
18:17:02.0672 2024 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
18:17:02.0675 2024 FltMgr - ok
18:17:02.0692 2024 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
18:17:02.0693 2024 FsDepends - ok
18:17:02.0719 2024 fssfltr (6c06701bf1db05405804d7eb610991ce) C:\Windows\system32\DRIVERS\fssfltr.sys
18:17:02.0720 2024 fssfltr - ok
18:17:02.0742 2024 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
18:17:02.0742 2024 Fs_Rec - ok
18:17:02.0793 2024 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
18:17:02.0795 2024 fvevol - ok
18:17:02.0813 2024 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
18:17:02.0815 2024 gagp30kx - ok
18:17:02.0880 2024 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
18:17:02.0881 2024 GEARAspiWDM - ok
18:17:02.0922 2024 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
18:17:02.0923 2024 hcw85cir - ok
18:17:02.0985 2024 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
18:17:02.0990 2024 HdAudAddService - ok
18:17:03.0053 2024 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
18:17:03.0055 2024 HDAudBus - ok
18:17:03.0064 2024 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
18:17:03.0065 2024 HidBatt - ok
18:17:03.0078 2024 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
18:17:03.0079 2024 HidBth - ok
18:17:03.0089 2024 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
18:17:03.0090 2024 HidIr - ok
18:17:03.0151 2024 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
18:17:03.0151 2024 HidUsb - ok
18:17:03.0191 2024 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
18:17:03.0192 2024 HpSAMD - ok
18:17:03.0261 2024 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
18:17:03.0279 2024 HTTP - ok
18:17:03.0331 2024 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
18:17:03.0332 2024 hwpolicy - ok
18:17:03.0355 2024 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
18:17:03.0356 2024 i8042prt - ok
18:17:03.0392 2024 iaStor (1d004cb1da6323b1f55caef7f94b61d9) C:\Windows\system32\DRIVERS\iaStor.sys
18:17:03.0396 2024 iaStor - ok
18:17:03.0423 2024 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
18:17:03.0427 2024 iaStorV - ok
18:17:03.0486 2024 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
18:17:03.0487 2024 iirsp - ok
18:17:03.0565 2024 IntcAzAudAddService (f2b52c7b1c8e6a4fc4c4564f4a421f23) C:\Windows\system32\drivers\RTKVHD64.sys
18:17:03.0581 2024 IntcAzAudAddService - ok
18:17:03.0592 2024 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
18:17:03.0593 2024 intelide - ok
18:17:03.0623 2024 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
18:17:03.0624 2024 intelppm - ok
18:17:03.0704 2024 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
18:17:03.0706 2024 IpFilterDriver - ok
18:17:03.0808 2024 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
18:17:03.0809 2024 IPMIDRV - ok
18:17:03.0873 2024 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
18:17:03.0875 2024 IPNAT - ok
18:17:03.0910 2024 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
18:17:03.0910 2024 IRENUM - ok
18:17:03.0923 2024 is3srv - ok
18:17:03.0935 2024 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
18:17:03.0936 2024 isapnp - ok
18:17:03.0958 2024 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
18:17:03.0959 2024 iScsiPrt - ok
18:17:03.0979 2024 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
18:17:03.0980 2024 kbdclass - ok
18:17:03.0995 2024 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
18:17:03.0995 2024 kbdhid - ok
18:17:04.0014 2024 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys
18:17:04.0015 2024 KSecDD - ok
18:17:04.0072 2024 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys
18:17:04.0074 2024 KSecPkg - ok
18:17:04.0094 2024 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
18:17:04.0095 2024 ksthunk - ok
18:17:04.0124 2024 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
18:17:04.0124 2024 lltdio - ok
18:17:04.0162 2024 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
18:17:04.0163 2024 LSI_FC - ok
18:17:04.0182 2024 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
18:17:04.0183 2024 LSI_SAS - ok
18:17:04.0197 2024 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
18:17:04.0198 2024 LSI_SAS2 - ok
18:17:04.0218 2024 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
18:17:04.0219 2024 LSI_SCSI - ok
18:17:04.0240 2024 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
18:17:04.0241 2024 luafv - ok
18:17:04.0272 2024 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
18:17:04.0272 2024 megasas - ok
18:17:04.0286 2024 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
18:17:04.0288 2024 MegaSR - ok
18:17:04.0302 2024 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
18:17:04.0303 2024 Modem - ok
18:17:04.0368 2024 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
18:17:04.0369 2024 monitor - ok
18:17:04.0428 2024 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
18:17:04.0429 2024 mouclass - ok
18:17:04.0450 2024 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
18:17:04.0451 2024 mouhid - ok
18:17:04.0503 2024 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
18:17:04.0505 2024 mountmgr - ok
18:17:04.0555 2024 MpFilter (c177a7ebf5e8a0b596f618870516cab8) C:\Windows\system32\DRIVERS\MpFilter.sys
18:17:04.0556 2024 MpFilter - ok
18:17:04.0650 2024 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
18:17:04.0652 2024 mpio - ok
18:17:04.0728 2024 MpNWMon (8fbf6b31fe8af1833d93c5913d5b4d55) C:\Windows\system32\DRIVERS\MpNWMon.sys
18:17:04.0730 2024 MpNWMon - ok
18:17:04.0746 2024 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
18:17:04.0747 2024 mpsdrv - ok
18:17:04.0808 2024 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
18:17:04.0810 2024 MRxDAV - ok
18:17:04.0855 2024 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
18:17:04.0857 2024 mrxsmb - ok
18:17:04.0888 2024 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
18:17:04.0893 2024 mrxsmb10 - ok
18:17:04.0907 2024 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
18:17:04.0909 2024 mrxsmb20 - ok
18:17:04.0972 2024 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
18:17:04.0972 2024 msahci - ok
18:17:04.0987 2024 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
18:17:04.0989 2024 msdsm - ok
18:17:05.0019 2024 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
18:17:05.0019 2024 Msfs - ok
18:17:05.0046 2024 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
18:17:05.0046 2024 mshidkmdf - ok
18:17:05.0095 2024 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
18:17:05.0096 2024 msisadrv - ok
18:17:05.0130 2024 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
18:17:05.0131 2024 MSKSSRV - ok
18:17:05.0163 2024 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
18:17:05.0164 2024 MSPCLOCK - ok
18:17:05.0177 2024 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
18:17:05.0178 2024 MSPQM - ok
18:17:05.0231 2024 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
18:17:05.0235 2024 MsRPC - ok
18:17:05.0258 2024 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
18:17:05.0259 2024 mssmbios - ok
18:17:05.0276 2024 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
18:17:05.0276 2024 MSTEE - ok
18:17:05.0287 2024 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
18:17:05.0288 2024 MTConfig - ok
18:17:05.0308 2024 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
18:17:05.0309 2024 Mup - ok
18:17:05.0343 2024 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
18:17:05.0346 2024 NativeWifiP - ok
18:17:05.0409 2024 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
18:17:05.0418 2024 NDIS - ok
18:17:05.0465 2024 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
18:17:05.0466 2024 NdisCap - ok
18:17:05.0489 2024 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
18:17:05.0490 2024 NdisTapi - ok
18:17:05.0549 2024 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
18:17:05.0550 2024 Ndisuio - ok
18:17:05.0603 2024 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
18:17:05.0605 2024 NdisWan - ok
18:17:05.0632 2024 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
18:17:05.0633 2024 NDProxy - ok
18:17:05.0674 2024 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
18:17:05.0676 2024 NetBIOS - ok
18:17:05.0732 2024 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
18:17:05.0735 2024 NetBT - ok
18:17:05.0770 2024 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
18:17:05.0771 2024 nfrd960 - ok
18:17:05.0794 2024 NisDrv (5f7d72cbcdd025af1f38fdeee5646968) C:\Windows\system32\DRIVERS\NisDrvWFP.sys
18:17:05.0795 2024 NisDrv - ok
18:17:05.0816 2024 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
18:17:05.0816 2024 Npfs - ok
18:17:05.0830 2024 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
18:17:05.0830 2024 nsiproxy - ok
18:17:05.0914 2024 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
18:17:05.0929 2024 Ntfs - ok
18:17:05.0945 2024 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
18:17:05.0946 2024 Null - ok
18:17:05.0997 2024 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
18:17:05.0999 2024 nvraid - ok
18:17:06.0057 2024 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
18:17:06.0059 2024 nvstor - ok
18:17:06.0075 2024 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
18:17:06.0076 2024 nv_agp - ok
18:17:06.0141 2024 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
18:17:06.0142 2024 ohci1394 - ok
18:17:06.0174 2024 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
18:17:06.0175 2024 Parport - ok
18:17:06.0221 2024 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
18:17:06.0221 2024 partmgr - ok
18:17:06.0288 2024 PCDSRVC{1E208CE0-FB7451FF-06020101}_0 (7317a0b550f7ac0223b7070897670476) c:\program files\dell support center\pcdsrvc_x64.pkms
18:17:06.0289 2024 PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - ok
18:17:06.0322 2024 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
18:17:06.0324 2024 pci - ok
18:17:06.0357 2024 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
18:17:06.0358 2024 pciide - ok
18:17:06.0381 2024 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
18:17:06.0383 2024 pcmcia - ok
18:17:06.0406 2024 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
18:17:06.0407 2024 pcw - ok
18:17:06.0452 2024 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
18:17:06.0470 2024 PEAUTH - ok
18:17:06.0577 2024 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
18:17:06.0579 2024 PptpMiniport - ok
18:17:06.0598 2024 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
18:17:06.0600 2024 Processor - ok
18:17:06.0673 2024 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
18:17:06.0675 2024 Psched - ok
18:17:06.0707 2024 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys
18:17:06.0708 2024 PxHlpa64 - ok
18:17:06.0749 2024 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
18:17:06.0764 2024 ql2300 - ok
18:17:06.0783 2024 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
18:17:06.0784 2024 ql40xx - ok
18:17:06.0800 2024 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
18:17:06.0801 2024 QWAVEdrv - ok
18:17:06.0815 2024 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
18:17:06.0815 2024 RasAcd - ok
18:17:06.0853 2024 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
18:17:06.0855 2024 RasAgileVpn - ok
18:17:06.0922 2024 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
18:17:06.0923 2024 Rasl2tp - ok
18:17:06.0941 2024 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
18:17:06.0943 2024 RasPppoe - ok
18:17:06.0955 2024 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
18:17:06.0956 2024 RasSstp - ok
18:17:07.0012 2024 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
18:17:07.0017 2024 rdbss - ok
18:17:07.0027 2024 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
18:17:07.0028 2024 rdpbus - ok
18:17:07.0049 2024 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
18:17:07.0050 2024 RDPCDD - ok
18:17:07.0115 2024 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
18:17:07.0117 2024 RDPDR - ok
18:17:07.0152 2024 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
18:17:07.0152 2024 RDPENCDD - ok
18:17:07.0169 2024 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
18:17:07.0169 2024 RDPREFMP - ok
18:17:07.0229 2024 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
18:17:07.0231 2024 RDPWD - ok
18:17:07.0287 2024 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
18:17:07.0290 2024 rdyboost - ok
18:17:07.0343 2024 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
18:17:07.0344 2024 rspndr - ok
18:17:07.0381 2024 RTL8167 (4b42bc58294e83a6a92ec8b88c14c4a3) C:\Windows\system32\DRIVERS\Rt64win7.sys
18:17:07.0382 2024 RTL8167 - ok
18:17:07.0457 2024 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
18:17:07.0458 2024 s3cap - ok
18:17:07.0554 2024 SASDIFSV - ok
18:17:07.0562 2024 SASKUTIL - ok
18:17:07.0609 2024 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
18:17:07.0610 2024 sbp2port - ok
18:17:07.0669 2024 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
18:17:07.0670 2024 scfilter - ok
18:17:07.0715 2024 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
18:17:07.0716 2024 secdrv - ok
18:17:07.0741 2024 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
18:17:07.0741 2024 Serenum - ok
18:17:07.0775 2024 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
18:17:07.0777 2024 Serial - ok
18:17:07.0827 2024 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
18:17:07.0828 2024 sermouse - ok
18:17:07.0898 2024 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
18:17:07.0899 2024 sffdisk - ok
18:17:07.0914 2024 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
18:17:07.0915 2024 sffp_mmc - ok
18:17:07.0929 2024 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
18:17:07.0930 2024 sffp_sd - ok
18:17:07.0952 2024 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
18:17:07.0952 2024 sfloppy - ok
18:17:07.0979 2024 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
18:17:07.0980 2024 SiSRaid2 - ok
18:17:07.0998 2024 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
18:17:07.0999 2024 SiSRaid4 - ok
18:17:08.0026 2024 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
18:17:08.0027 2024 Smb - ok
18:17:08.0068 2024 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
18:17:08.0069 2024 spldr - ok
18:17:08.0151 2024 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
18:17:08.0159 2024 srv - ok
18:17:08.0179 2024 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
18:17:08.0184 2024 srv2 - ok
18:17:08.0198 2024 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
18:17:08.0200 2024 srvnet - ok
18:17:08.0272 2024 stdriver (353ad29837f1a9a4685edb65af57f87d) C:\Windows\system32\DRIVERS\stdriver64.sys
18:17:08.0273 2024 stdriver - ok
18:17:08.0294 2024 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
18:17:08.0294 2024 stexstor - ok
18:17:08.0374 2024 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
18:17:08.0375 2024 storflt - ok
18:17:08.0397 2024 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
18:17:08.0397 2024 storvsc - ok
18:17:08.0412 2024 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
18:17:08.0413 2024 swenum - ok
18:17:08.0441 2024 szkg5 - ok
18:17:08.0513 2024 Tcpip (f0e98c00a09fdf791525829a1d14240f) C:\Windows\system32\drivers\tcpip.sys
18:17:08.0522 2024 Tcpip - ok
18:17:08.0585 2024 TCPIP6 (f0e98c00a09fdf791525829a1d14240f) C:\Windows\system32\DRIVERS\tcpip.sys
18:17:08.0603 2024 TCPIP6 - ok
18:17:08.0655 2024 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
18:17:08.0656 2024 tcpipreg - ok
18:17:08.0681 2024 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
18:17:08.0682 2024 TDPIPE - ok
18:17:08.0691 2024 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
18:17:08.0692 2024 TDTCP - ok
18:17:08.0739 2024 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
18:17:08.0741 2024 tdx - ok
18:17:08.0760 2024 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
18:17:08.0761 2024 TermDD - ok
18:17:08.0835 2024 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
18:17:08.0836 2024 tssecsrv - ok
18:17:08.0946 2024 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
18:17:08.0947 2024 TsUsbFlt - ok
18:17:09.0081 2024 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
18:17:09.0083 2024 tunnel - ok
18:17:09.0106 2024 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
18:17:09.0107 2024 uagp35 - ok
18:17:09.0176 2024 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
18:17:09.0180 2024 udfs - ok
18:17:09.0217 2024 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
18:17:09.0218 2024 uliagpkx - ok
18:17:09.0251 2024 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
18:17:09.0252 2024 umbus - ok
18:17:09.0292 2024 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
18:17:09.0293 2024 UmPass - ok
18:17:09.0362 2024 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
18:17:09.0366 2024 usbaudio - ok
18:17:09.0414 2024 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
18:17:09.0416 2024 usbccgp - ok
18:17:09.0478 2024 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
18:17:09.0480 2024 usbcir - ok
18:17:09.0519 2024 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
18:17:09.0521 2024 usbehci - ok
18:17:09.0556 2024 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
18:17:09.0561 2024 usbhub - ok
18:17:09.0583 2024 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
18:17:09.0584 2024 usbohci - ok
18:17:09.0601 2024 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
18:17:09.0602 2024 usbprint - ok
18:17:09.0662 2024 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
18:17:09.0663 2024 usbscan - ok
18:17:09.0682 2024 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
18:17:09.0684 2024 USBSTOR - ok
18:17:09.0700 2024 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys
18:17:09.0701 2024 usbuhci - ok
18:17:09.0724 2024 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
18:17:09.0725 2024 vdrvroot - ok
18:17:09.0736 2024 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
18:17:09.0736 2024 vga - ok
18:17:09.0756 2024 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
18:17:09.0757 2024 VgaSave - ok
18:17:09.0768 2024 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
18:17:09.0770 2024 vhdmp - ok
18:17:09.0813 2024 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
18:17:09.0814 2024 viaide - ok
18:17:09.0839 2024 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
18:17:09.0842 2024 vmbus - ok
18:17:09.0852 2024 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
18:17:09.0853 2024 VMBusHID - ok
18:17:09.0871 2024 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
18:17:09.0872 2024 volmgr - ok
18:17:09.0919 2024 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
18:17:09.0921 2024 volmgrx - ok
18:17:09.0942 2024 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
18:17:09.0946 2024 volsnap - ok
18:17:09.0962 2024 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
18:17:09.0963 2024 vsmraid - ok
18:17:09.0978 2024 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
18:17:09.0979 2024 vwifibus - ok
18:17:09.0998 2024 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
18:17:09.0998 2024 WacomPen - ok
18:17:10.0026 2024 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
18:17:10.0026 2024 WANARP - ok
18:17:10.0030 2024 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
18:17:10.0031 2024 Wanarpv6 - ok
18:17:10.0059 2024 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
18:17:10.0060 2024 Wd - ok
18:17:10.0085 2024 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
18:17:10.0089 2024 Wdf01000 - ok
18:17:10.0129 2024 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
18:17:10.0130 2024 WfpLwf - ok
18:17:10.0174 2024 WimFltr (b14ef15bd757fa488f9c970eee9c0d35) C:\Windows\system32\DRIVERS\wimfltr.sys
18:17:10.0176 2024 WimFltr - ok
18:17:10.0193 2024 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
18:17:10.0194 2024 WIMMount - ok
18:17:10.0293 2024 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
18:17:10.0294 2024 WmiAcpi - ok
18:17:10.0330 2024 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
18:17:10.0330 2024 ws2ifsl - ok
18:17:10.0402 2024 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
18:17:10.0403 2024 WudfPf - ok
18:17:10.0421 2024 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
18:17:10.0424 2024 WUDFRd - ok
18:17:10.0454 2024 MBR (0x1B8) (de1996b5390bac8242e23168f828c750) \Device\Harddisk0\DR0
18:17:10.0455 2024 \Device\Harddisk0\DR0 ( Rootkit.Win32.TDSS.tdl4 ) - infected
18:17:10.0455 2024 \Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0)
18:17:10.0465 2024 Boot (0x1200) (1dd6de8dd57ead416f8a089267ea0655) \Device\Harddisk0\DR0\Partition0
18:17:10.0466 2024 \Device\Harddisk0\DR0\Partition0 - ok
18:17:10.0479 2024 Boot (0x1200) (c5e6c8a2e58d94ce1928a4919bce7b9a) \Device\Harddisk0\DR0\Partition1
18:17:10.0481 2024 \Device\Harddisk0\DR0\Partition1 - ok
18:17:10.0481 2024 ============================================================
18:17:10.0481 2024 Scan finished
18:17:10.0481 2024 ============================================================
18:17:10.0490 4704 Detected object count: 1
18:17:10.0491 4704 Actual detected object count: 1
18:18:41.0654 4704 \Device\Harddisk0\DR0 ( Rootkit.Win32.TDSS.tdl4 ) - will be cured on reboot
18:18:41.0654 4704 \Device\Harddisk0\DR0 - ok
18:18:41.0656 4704 \Device\Harddisk0\DR0 ( Rootkit.Win32.TDSS.tdl4 ) - User select action: Cure
18:19:09.0514 6176 Deinitialize success

ComboFix

ComboFix 11-10-21.06 - Mark Law 10/23/2011 14:35:49.1.2 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8191.5333 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Outdated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Outdated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: STOPzilla Anti-Spyware *Disabled/Updated* {B2E69928-50DC-94CA-6A80-AAB054008761}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\PCDr\5830\Downloads\f9dc840b-c6f7-42a5-acec-50cc7a2827fd.dll
c:\users\Admin\AppData\Roaming\Itbaat
c:\users\Admin\AppData\Roaming\Itbaat\xyime.exe
c:\users\Mark Law\g2mdlhlpx.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-09-23 to 2011-10-23 )))))))))))))))))))))))))))))))
.
.
2011-10-23 18:45 . 2011-10-23 18:45 69000 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DE5DABD8-2B68-43FE-9886-7802C50B1789}\offreg.dll
2011-10-23 18:42 . 2011-10-23 18:42 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-10-23 18:42 . 2011-10-23 18:42 ——– d—–w- c:\users\Admin\AppData\Local\temp
2011-10-19 01:23 . 2011-09-13 00:26 9049936 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DE5DABD8-2B68-43FE-9886-7802C50B1789}\mpengine.dll
2011-10-18 20:53 . 2011-10-18 21:28 ——– d—–w- c:\programdata\WinZip
2011-10-11 13:45 . 2011-10-11 13:45 917840 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FAC2DBFD-5ADD-4D30-85BB-8CA65D967277}\gapaengine.dll
2011-10-01 00:50 . 2011-10-01 00:50 ——– d—–w- c:\program files (x86)\Ask.com
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-26 14:31 . 2011-07-27 04:22 404640 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-09-13 00:26 . 2011-08-11 02:21 9049936 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-08-31 21:00 . 2011-07-26 09:42 25416 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-10 06:40 . 2011-08-10 06:40 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-08-09 21:22 . 2011-08-12 15:17 601424 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2011-08-02 21:58 . 2011-08-02 21:58 546256 —-a-r- c:\windows\SysWow64\SZComp5.dll
2011-08-02 21:58 . 2011-08-02 21:58 22992 —-a-r- c:\windows\SysWow64\SZIO5.dll
2011-08-02 21:58 . 2011-08-02 21:58 132560 —-a-r- c:\windows\SysWow64\IS3HTUI5.dll
2011-08-02 21:58 . 2011-08-02 21:58 99792 —-a-r- c:\windows\SysWow64\IS3Svc5.dll
2011-08-02 21:58 . 2011-08-02 21:58 67024 —-a-r- c:\windows\SysWow64\IS3Hks5.dll
2011-08-02 21:58 . 2011-08-02 21:58 456144 —-a-r- c:\windows\SysWow64\SZBase5.dll
2011-08-02 21:58 . 2011-08-02 21:58 398800 —-a-r- c:\windows\SysWow64\IS3DBA5.dll
2011-08-02 21:58 . 2011-08-02 21:58 28624 —-a-r- c:\windows\SysWow64\IS3XDat5.dll
2011-08-02 21:58 . 2011-08-02 21:58 99792 —-a-r- c:\windows\SysWow64\IS3Inet5.dll
2011-08-02 21:58 . 2011-08-02 21:58 738768 —-a-r- c:\windows\SysWow64\IS3Base5.dll
2011-08-02 21:58 . 2011-08-02 21:58 390608 —-a-r- c:\windows\SysWow64\IS3UI5.dll
2011-08-02 21:58 . 2011-08-02 21:58 230864 —-a-r- c:\windows\SysWow64\IS3Win325.dll
2011-07-28 22:26 . 2011-07-28 22:26 91648 —-a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-07-28 22:26 . 2011-07-28 22:26 89088 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-07-28 22:26 . 2011-07-28 22:26 86528 —-a-w- c:\windows\SysWow64\iesysprep.dll
2011-07-28 22:26 . 2011-07-28 22:26 85504 —-a-w- c:\windows\system32\iesetup.dll
2011-07-28 22:26 . 2011-07-28 22:26 76800 —-a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2011-07-28 22:26 . 2011-07-28 22:26 76800 —-a-w- c:\windows\system32\tdc.ocx
2011-07-28 22:26 . 2011-07-28 22:26 74752 —-a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2011-07-28 22:26 . 2011-07-28 22:26 74752 —-a-w- c:\windows\SysWow64\iesetup.dll
2011-07-28 22:26 . 2011-07-28 22:26 63488 —-a-w- c:\windows\SysWow64\tdc.ocx
2011-07-28 22:26 . 2011-07-28 22:26 603648 —-a-w- c:\windows\system32\vbscript.dll
2011-07-28 22:26 . 2011-07-28 22:26 49664 —-a-w- c:\windows\system32\imgutil.dll
2011-07-28 22:26 . 2011-07-28 22:26 48640 —-a-w- c:\windows\SysWow64\mshtmler.dll
2011-07-28 22:26 . 2011-07-28 22:26 48640 —-a-w- c:\windows\system32\mshtmler.dll
2011-07-28 22:26 . 2011-07-28 22:26 448512 —-a-w- c:\windows\system32\html.iec
2011-07-28 22:26 . 2011-07-28 22:26 420864 —-a-w- c:\windows\SysWow64\vbscript.dll
2011-07-28 22:26 . 2011-07-28 22:26 367104 —-a-w- c:\windows\SysWow64\html.iec
2011-07-28 22:26 . 2011-07-28 22:26 35840 —-a-w- c:\windows\SysWow64\imgutil.dll
2011-07-28 22:26 . 2011-07-28 22:26 30720 —-a-w- c:\windows\system32\licmgr10.dll
2011-07-28 22:26 . 2011-07-28 22:26 23552 —-a-w- c:\windows\SysWow64\licmgr10.dll
2011-07-28 22:26 . 2011-07-28 22:26 222208 —-a-w- c:\windows\system32\msls31.dll
2011-07-28 22:26 . 2011-07-28 22:26 173056 —-a-w- c:\windows\system32\ieUnatt.exe
2011-07-28 22:26 . 2011-07-28 22:26 165888 —-a-w- c:\windows\system32\iexpress.exe
2011-07-28 22:26 . 2011-07-28 22:26 161792 —-a-w- c:\windows\SysWow64\msls31.dll
2011-07-28 22:26 . 2011-07-28 22:26 160256 —-a-w- c:\windows\system32\wextract.exe
2011-07-28 22:26 . 2011-07-28 22:26 152064 —-a-w- c:\windows\SysWow64\wextract.exe
2011-07-28 22:26 . 2011-07-28 22:26 150528 —-a-w- c:\windows\SysWow64\iexpress.exe
2011-07-28 22:26 . 2011-07-28 22:26 1492992 —-a-w- c:\windows\system32\inetcpl.cpl
2011-07-28 22:26 . 2011-07-28 22:26 142848 —-a-w- c:\windows\SysWow64\ieUnatt.exe
2011-07-28 22:26 . 2011-07-28 22:26 1427456 —-a-w- c:\windows\SysWow64\inetcpl.cpl
2011-07-28 22:26 . 2011-07-28 22:26 135168 —-a-w- c:\windows\system32\IEAdvpack.dll
2011-07-28 22:26 . 2011-07-28 22:26 12288 —-a-w- c:\windows\system32\mshta.exe
2011-07-28 22:26 . 2011-07-28 22:26 11776 —-a-w- c:\windows\SysWow64\mshta.exe
2011-07-28 22:26 . 2011-07-28 22:26 114176 —-a-w- c:\windows\system32\admparse.dll
2011-07-28 22:26 . 2011-07-28 22:26 111616 —-a-w- c:\windows\system32\iesysprep.dll
2011-07-28 22:26 . 2011-07-28 22:26 110592 —-a-w- c:\windows\SysWow64\IEAdvpack.dll
2011-07-28 22:26 . 2011-07-28 22:26 101888 —-a-w- c:\windows\SysWow64\admparse.dll
2011-07-27 02:42 . 2011-07-27 02:42 12872 —-a-w- c:\windows\system32\bootdelete.exe
2011-07-27 02:32 . 2011-07-27 02:32 23112 —-a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-07-26 09:10 . 2011-07-26 09:10 1152 —-a-w- c:\windows\SysWow64\windrv.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c2db4fe6-8409-45ce-8010-189a7b5cce86}"= "c:\program files (x86)\NCH\prxtbNCH.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{c2db4fe6-8409-45ce-8010-189a7b5cce86}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 20:54 175912 —-a-w- c:\program files (x86)\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{652853ad-5592-4231-88c6-706613a52e61}]
2011-07-21 16:40 81920 —-a-w- c:\program files (x86)\somototoolbar\vmntemplateX.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{c2db4fe6-8409-45ce-8010-189a7b5cce86}]
2011-01-17 20:54 175912 —-a-w- c:\program files (x86)\NCH\prxtbNCH.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-08-24 01:20 1515688 —-a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{c2db4fe6-8409-45ce-8010-189a7b5cce86}"= "c:\program files (x86)\NCH\prxtbNCH.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files (x86)\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
"{652853ad-5592-4231-88c6-706613a52e61}"= "c:\program files (x86)\somototoolbar\vmntemplateX.dll" [2011-07-21 81920]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-08-24 1515688]
.
[HKEY_CLASSES_ROOT\clsid\{c2db4fe6-8409-45ce-8010-189a7b5cce86}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CLASSES_ROOT\clsid\{652853ad-5592-4231-88c6-706613a52e61}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184]
"msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2011-05-13 4283256]
"ihanotify"="c:\program files (x86)\Verizon\FiOS\ihs\IHANotify.exe" [2010-09-03 237568]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SSBkgdUpdate"="c:\program files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"DNS7reminder"="c:\program files (x86)\Nuance\NaturallySpeaking10\Ereg\Ereg.exe" [2007-04-16 259624]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-03-07 421160]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"HourGuard"="c:\program files (x86)\NCH Software\HourGuard\hourguard.exe" [2011-04-17 638980]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2011-05-31 273544]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2011-08-24 887976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"="c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [2011-10-05 559616]
"Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\scheduler\Launcher.exe" [2011-01-13 165184]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R0 is3srv;is3srv;c:\windows\SySWOW64\drivers\is3srv64.sys [2011-06-02 74768]
R1 SASDIFSV;SASDIFSV;c:\users\Admin\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV64.SYS [x]
R1 SASKUTIL;SASKUTIL;c:\users\Admin\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL64.SYS [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-29 136176]
R2 LMIRescue_e901ddf2-7619-4e15-b875-cef118c099b5;LogMeIn Rescue (e901ddf2-7619-4e15-b875-cef118c099b5);c:\users\Admin\AppData\Local\Temp\LMIA535.tmp\LMI_Rescue_srv.exe [x]
R2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [2009-06-10 166384]
R3 ExpressAccountsService;Express Accounts;c:\program files (x86)\NCH Software\ExpressAccounts\expressaccounts.exe [2011-08-01 2640900]
R3 ExpressInvoiceService;Express Invoice;c:\program files (x86)\NCH Software\ExpressInvoice\expressinvoice.exe [2011-08-01 1765380]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-29 136176]
R3 InventoriaService;Inventoria Stock Manager;c:\program files (x86)\NCH Software\Inventoria\inventoria.exe [2011-08-01 1363460]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2011-07-21 25072]
R3 RoxMediaDB10;RoxMediaDB10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-06-10 1124848]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 RoxLiveShare10;LiveShare P2P Server 10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [2009-06-10 309744]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S0 szkg5;szkg5;c:\windows\SySWOW64\DRIVERS\szkg64.sys [2011-06-02 74768]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-03-31 92160]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Sony\Drive Letter Recognition Software\RIconMan.exe [2011-01-18 1750016]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.exe [2011-08-18 1692480]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 stdriver;Sound tap driver Upper Class Filter Driver v2.0.0.0;c:\windows\system32\DRIVERS\stdriver64.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-29 07:11]
.
2011-10-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-04-29 07:11]
.
2011-10-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-292652012-3167168373-1995768977-1008Core.job
- c:\users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-29 21:19]
.
2011-10-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-292652012-3167168373-1995768977-1008UA.job
- c:\users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-29 21:19]
.
2011-10-08 c:\windows\Tasks\NatSpeak Periodic Acoustic Optimization.job
- c:\program files (x86)\Nuance\NaturallySpeaking10\Program\schedmgr.exe [2009-03-16 23:45]
.
2011-10-10 c:\windows\Tasks\NatSpeak Periodic Data Collection.job
- c:\program files (x86)\Nuance\NaturallySpeaking10\Program\datacollector.exe [2009-03-16 23:44]
.
2011-10-10 c:\windows\Tasks\NatSpeak Periodic Language Model Optimization.job
- c:\program files (x86)\Nuance\NaturallySpeaking10\Program\schedmgr.exe [2009-03-16 23:45]
.
2011-10-23 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-07-25 17:44]
.
2011-10-23 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-07-25 17:44]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Mark Law\AppData\Roaming\Mozilla\Firefox\Profiles\vig57khw.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Amazon Toolbar: [removed] - %profile%\extensions\[removed]
FF - Ext: NCH Community Toolbar: {c2db4fe6-8409-45ce-8010-189a7b5cce86} - %profile%\extensions\{c2db4fe6-8409-45ce-8010-189a7b5cce86}
FF - Ext: SomotoToolbar: {652853ad-5592-4231-88c6-706613a52e61} - %profile%\extensions\{652853ad-5592-4231-88c6-706613a52e61}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-Spyware Doctor - c:\users\Mark Law\Desktop\sdsetup_revwire207[1].exe
Toolbar-Locked - (no file)
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
WebBrowser-{C2DB4FE6-8409-45CE-8010-189A7B5CCE86} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0]
"ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10t_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10t_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10t.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
c:\program files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
c:\program files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
.
**************************************************************************
.
Completion time: 2011-10-23 14:54:21 - machine was rebooted
ComboFix-quarantined-files.txt 2011-10-23 18:54
.
Pre-Run: 163,236,339,712 bytes free
Post-Run: 163,138,396,160 bytes free
.
- - End Of File - - A22BF884339D37DA5C707A8CAB7B6D74
There is no need to re-run Combofix. The replying to your own post is only an issue when there has been no response. We look for posts with 0 replies first, figuring people with 1+ replies are already being helped. If you were to reply to your own initial post - we would inadvertently think you were already receiving assistance, and it would delay our response to you. Once you've been contacted and are working with us, you can post back as often as needed.

If it were me, I would remove Somoto Toolbar and Ask Toolbar. These are both what we call PUPs (Potentially Unwanted Programs). The following types of things are what they are known for:
  • It promotes its toolbars on sites targeted at kids.
  • It promotes its toolbars through ads that appear to be part of other companies' sites.
  • It promotes its toolbars through other companies' spyware.
  • It is Installed without any disclosure whatsoever and without any consent from the user whatsoever.
  • It solicits installations via "deceptive door openers" that do not accurately describe the offer; failing to affirmatively show a license agreement; linking to a EULA via an off-screen link.
  • It makes confusing changes to user's browsers - increasing Ask's revenues while taking users to pages they didn't intend to visit.

Should you choose to do so, you can uninstall these through Programs and Features in your Control Panel. If it were my computer I would not want them on there, but the choice is yours.



The next steps will require you to connect to the internet again. From the results of TDSSKiller and Combofix, I would certainly say it is safe to do so. We need to do a couple of updates and then an online scan as a final double check before we remove the remaining tools. Different tools scan different locations, and as a final check we like to use an online scan to be sure we haven't missed anything.


Update Adobe Reader
There have been updates to Adobe Reader to address security vulnerabilities. You should download the latest version from the Adobe website.



Your Java is out of date. Older versions have many vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 7 update 1 and Save it to your Desktop.
  • Scroll down to where it says Java SE 7
  • Click the Download JRE button to the right.
  • Read the License Agreement then select Accept License Agreement
  • Click on the link to download Windows x86 Offline and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-7u1-windows-i586.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      Applications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.





This scan make take awhile depending on how many items are on the computer. You may want to run it at a time you won't be needing the machine. It should be run from IE and I'd recommend not doing anything else while it's running.


http://www.eset.eu/online-scanner
Go here to run an online scannner from ESET.
Click the green ESET Online Scanner button.
Read the End User License Agreement and check the box: YES, I accept the Terms of Use.
Click on the Start button next to it.
You may receive an alert on the address bar that "This site might require the following ActiveX control…Click here to install…". Click on that alert and then click Insall ActiveX component.
A new window will appear asking "Do you want to install this software?"".
Answer Yes to download and install the ActiveX controls that allows the scan to run.
Click Start.
Uncheck Remove found threats.
Click Scan to begin.
If offered the option to get information or buy software. Just close the window.
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
Copy and paste that log as a reply to this topic.



Hopefully, all has been running well now. After I take one final look at the ESET log, we'll remove our tools and I'll give you some final tips. You've done a great job and I'm sure going back and forth to the library has been tiring. I'm glad to be able to tell you it's safe to reconnect now :)
Thanks for the suggestions and the clear instructions, Doris. When I get home tonight, I will take all the actions described in your post and will follow up with you after I am done. mark_law_ok
Hi Doris, Just a quick follow-up to my posting on Tuesday. I've arrived home late the last three nights and haven't yet had a chance to complete all the actions you specified in your post. I will finish up this weekend and get back to you with the results. Thanks again for your patience. mark_law_ok
Doris, I'm in the middle of carrying out your instructions, and I had a couple of questions. I figured, better to ask than to "assume" and end up doing something wrong.

First, I successfully uninstalled the Ask toolbar using Programs and Features, but I didn't find any listing of the Somoto toolbar in Programs and Features. In my Firefox browser, I clicked on a toolbar icon, which brought up a Somoto drop-down menu, including an uninstall option, which I selected. A box came up, saying, "Completing the Somoto Toolbar 1.0.0.0 Uninstall Wizard. Somoto Toolbar 1.0.0.0 has now been removed from your computer. Click Finish to close the wizard." Nevertheless, a "somototoolbar" folder still exists under C:\Program Files (x86). The folder also has some folders underneath it, although none of the folders seem to contain any executable files (or any files, for that matter). Can I assume the uninstall process was successful?

Second, after updating to Adobe Reader 10.1.1, I downloaded the JRE7update1 file to my desktop and followed your instructions about removing old Java programs, rebooting and installing JRE7u1. However, after JRE7u1 installed and I opened the Control Panel and proceeded to the "Delete Files and Applications" box (under Temporary Files Settings), I was given three options (not two, as your posting suggested). The first two options – "Trace and Log Files" and "Cached Applications and Applets" – were checked, but the third – "Installed Applications and Applets" – was unchecked. I wasn't sure what to do with this third option; hence this posting.

Should I check the third box or leave it unchecked?

mark_law_ok
As long as the toolbar no longer shows in Firefox then it was successfully removed. You may need to reboot for it to show completely gone. It's not unusual to have files and folders left behind when you uninstall things. If it no longer shows in Firefox, you can right-click and delete the main folder for the toolbar. As for Java, just leave the third option unchecked.
Did the updates go ok? If so, is the system still running well? We do need to clean up a few tools and I'll give you some suggestions for the future, but I wanted to confirm all is well now.
Hi Doris, Sorry for the delay in responding. I was out of town most of this week. The ESET scan, which I ran this past Monday night, did indeed take a while – almost eight hours – and it completed just as I was heading out the door on Tuesday morning. I had no time to copy the log file to a thumb drive to take with me. Here is the text of the log (only three lines): ESETSmartInstaller@High as CAB hook log: OnlineScanner64.ocx - registred OK OnlineScanner.ocx - registred OK I wanted to mention one anomaly, which may have something to do with Java. As you may recall from my October 30 posting, after I installed JRE7 update 1, I was stymied by the presence of a third option ("Installed Applications and Applets") in the "Delete Files and Applications" dialog box. At that point, after scratching my head, I posted my question to you, exited out of my applications, and shut down my computer. On Monday night, after I got home (by which time I had received your October 31 response), I set out to complete the "Delete Files . . ." process and run ESET. But first, I needed to boot up the computer, and that's when a few strange things happened. After I logged on under one of my user accounts, it seemed to take forever to get to my desktop. A message I don't remember ever seeing before came up – "Preparing your desktop" – and when my desktop finally came up, it showed no icons. Instead, I saw a message that said, "You have logged on with a temporary profile. You cannot access your files and files created in this profile with be deleted when you log off." As I had gotten back onto the internet for the first time in 18 days when I downloaded the JRE7u1 setup file on October 30, my first thought was, "Not another infection!" I switched to the alternative user account and got to that desktop, but all the icons were scrambled, and the first column of icons was mainly empty. I couldn't tell at that point whether any of them were missing or whether they were just rearranged (I believe it was the latter situation). On top of that, a box popped up, saying, "TWC Desktop – Error. Unable to Initialize 'Page'." I rebooted twice and got the same "TWC Desktop – Error" box. On another reboot, I didn't see the box and that is when I downloaded and ran ESET. I wondered if this issue arose because I had shut the computer down after installing JRE7u1 but before deleting the "Trace and Log Files" and "Cached Applications and Applets"? Anyway, I've been able to get to the desktops for both user accounts (albeit with scrambled icons, still), and I haven't seen the "TWC Desktop – Error" box. Can you confirm that that little diversion isn't anything I need to be concerned about (i.e., not malware-related)? Finally, whenever I boot up, STOPzilla loads and says that a "previous" scan found infections, including not only System.Policies and CatchMe – which I assume are in some way associated with ComboFix – but also "Fake.Antivirus.G." I mentioned this last one in my October 25 posting; it seems to have made its way in on the back of an unzip program I loaded in order to open the TDSSKiller application. I haven't run a STOPzilla scan since you began helping me, so it may be an artifact from the STOPzilla detection on October 25. From your reading of the ComboFix and ESET logs, are you comfortable that Fake.Antivirus.G (and the Trojan.Dropper file that Microsoft Security Essentials "allowed") have both been removed? Again, many thanks for your help. I understand that if the ESET log looks OK to you, your next post will tell me how to remove the tools. I'm also looking forward to getting your suggestions on how to prevent future malware infections. mark_law_ok
From what I've been able to find, the "You have logged on with a temporary profile." Is a Windows 7 issue, but rebooting typically fixes the problem. It does not appear to be malware related, but may be caused due to a restored user profile. With all the start-up repair issues you had, I wouldn't worry too much about it. But if it continues and should you wish to address it, I would direct you to our Windows Forum for additional help. They would be more familiar with how to fix Windows specific errors. When posting there, please feel free to include a link to this post in case they need to see any information contained in the logs.

The TWC Desktop error is related to The Weather Channel. If you have installed the desktop (sidebar) gadget, I would uninstall and then reinstall it and see if that fixes the problem.
CatchMe is a part of Combofix and it will be removed when we take care of tools cleanup in a moment.
The ESET log does indeed look clean and I can say that you appear to be free of malware at this point :thumbup:


The following will implement some cleanup procedures as well as reset System Restore points:
  • Click the Windows Key + R to open the Run box.
  • Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]

If there are any remaining tools or logs on your desktop you can right-click and delete them.



Great job! Your logs appear to be malware free and you do not appear to be experiencing any malware related problems.
Please follow these simple steps in order to keep your computer malware free and secure:

Use and Update your AntiVirus Software
It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall
I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this. Simply using a Firewall in its default configuration can lower your risk greatly.

Use only one antivirus and one firewall on your machine
Having more than one anti-virus program and one firewall on your machine, even if only one is running, can cause conflicts and slowdowns in the performance of the machine.

If you need more information on free anti-virus or firewall options please let me know and I will give you some recommendations.

Make your Internet Explorer more secure
This can be done by following these simple instructions:
1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click once on the Security tab
3. Click once on the Internet icon so it becomes highlighted.
4. Click once on the Custom Level button.
5. Change the Download signed ActiveX controls to Prompt
6. Change the Download unsigned ActiveX controls to Disable
7. Change the Initialize and script ActiveX controls not marked as safe to Disable
8. Change the Installation of desktop items to Prompt
9. Change the Launching programs and files in an IFRAME to Prompt
10. Change the Navigate sub-frames across different domains to Prompt
11. When all these settings have been made, click on the OK button.
12. If it prompts you as to whether or not you want to save the settings, press the Yes button.
13. Next press the Apply button and then the OK to exit the Internet Properties page.

Keep your Java, Adobe Reader and Adobe Flash Up to Date
Older versions of these programs can contain security vulnerabilities. It is very important to keep them updated.

Update and Run Malwarebytes Anti-Malware
Scan your computer with this program on a regular basis just as you would an antivirus software making sure you update definitions each time you scan.

To simplify making sure you have the latest version of many of your security programs and applications, you may want to consider:
Secunia's Personal Software Inspector (PSI). It is a free utility that scans your computer for installed applications and checks to see if they have the latest security patches and updates. If it finds any applications with possible security issues, links and/or instructions are provided for the necessariy updates.

Filehippo's Update Checker. It is free utilitiy that scan your computer for installed software, checks the versions and then sends this information to see if there are any newer releases. Available software updates are displayed and you can decide which ones to download and install. Among many other types of programs, they includes a number of the Anti-Spyware, Firewall/Security and Anti-Virus programs that have been recommended (though not all of them). Note: Definition files should be updated from within the programs themselves. The Update Checker look for newer versions of the software program, not definition files.

I would suggest you read:
Tony Klein's excellent article: How I got Infected in the First Place
PC Safety and Security–What Do I Need?
How to Prevent Malware

Good luck & Happy surfing!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI