Hey guys
Need some help I have acquired a google redirect and something that hijacked the PING.exe. I have webroot and malewarebytes. I have tried a few other suggestions I found but none seem to work then I came across this forum. I suspend the ping.exe in the resource moniter but I realize this is only a temporary fix. Any help would be greatly appriciated.
Benton
Hi and Welcome!!
My name is
Jeff . I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
The fixes are specific to your problem and should only be used for the issues on this machine. It's often worth reading through these instructions and printing them for ease of reference. If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry. Please reply to this thread. Do not start a new topic. IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so. DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.
Having said that….
Let's get going !!
———-
Please download
DDS from either of these links
LINK 1 LINK 2
and save it to your
desktop.
Disable any script blocking protection Right-click and Run as Administrator dds to run the tool. When done, two DDS.txt's will open. Save both reports to your desktop. —————————————————
Please include the contents of the following in your next reply:
DDS.txt
Attach.txt
———-
Download
GMER Rootkit Scanner from
here or
here .
Extract the contents of the zipped file to desktop. Right-click and Run as Administrator GMER.exe. If asked to allow gmer.sys driver to load, please consent . If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO .[external image: Posted Image] Click the image to enlarge it In the right panel, you will see several boxes that have been checked. Uncheck the following … IAT/EAT Drives/Partition other than Systemdrive (typically C:\) Show All (don't miss this one) Then click the Scan button & wait for it to finish. Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post. Save it where you can easily find it, such as your desktop, and attach it in your reply. **Caution** .
———-
Please download
aswMBR to your desktop.
Right click and Run as Administrator the aswMBR icon to run it. Click the Scan button to start scan. When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply. [external image: Posted Image]
Click the image to enlarge it
———-
In your next reply please post the logs created by DDS, GMER and aswMBR.
First off thanks alot Jeff for your help!!
here is the dds.
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29
Run by [removed] at 20:54:53 on 2011-11-10
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.5942.3769 [GMT -5:00]
.
AV: Webroot Internet Security Complete *Enabled/Updated* {53211D91-0C31-95F2-E3A5-7661FB22889E}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Webroot Internet Security Complete *Enabled/Updated* {E840FC75-2A0B-9A7C-D915-4D1380A5C223}
FW: Webroot Internet Security Complete *Enabled* {6B1A9CB4-465E-94AA-C8FA-DF5405F1CFE5}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\vcsFPService.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\DigitalPersona\Bin\DpHostW.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\IDT\WDM\AESTSr64.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Webroot\Security\current\plugins\antimalware\AEI.exe
C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\atieclxx.exe
C:\PROGRA~2\Webroot\Security\Current\plugins\cleanup\WRCLEA~1.EXE
C:\Program Files (x86)\Webroot\Security\current\plugins\antimalware\SSU.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\DigitalPersona\Bin\DPAgent.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnect.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\DigitalPersona\Bin\DPAgent.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Nero\Update\NASvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\System32\perfmon.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
C:\Windows\SysWOW64\ping.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uSearch Page =
uSearch Bar =
mStart Page = hxxp://www.bigseekpro.com/hypercam/{08F5E82F-7002-4FDF-BD31-99AB2DD58CA0}
mSearchAssistant =
mWinlogon: Userinit=userinit.exe,
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Webroot Browser Helper Object: {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\Program Files (x86)\Webroot\Security\install\products\WISC\toolbar\LPBar.dll
BHO: WebrootBHO Class: {d93ec24d-8741-4d41-b83d-a5793b998416} - C:\Program Files (x86)\Webroot\Security\current\plugins\browserextension\WebrootBHO.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Webroot Toolbar: {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\Program Files (x86)\Webroot\Security\install\products\WISC\toolbar\LPBar.dll
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
uRun: [LightScribe Control Panel] "C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" -hidden
uRun: [igndlm.exe] "C:\Program Files (x86)\Download Manager\DLM.exe" /windowsstart /startifwork
uRun: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [HP Software Update] "C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe"
mRun: [WebrootTrayApp] "C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
LSP: mswsock.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: intuit.com\ttlc
Trusted Zone: soe.com
Trusted Zone: sony.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{EBA12C3E-2801-40F4-A02A-5F372C411AA6} : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{EBA12C3E-2801-40F4-A02A-5F372C411AA6}\14E64627F69646455647865627 : DhcpNameServer = 192.168.2.254
TCP: Interfaces\{EBA12C3E-2801-40F4-A02A-5F372C411AA6}\D41425945424552545F4E4D28405F5E4564777F627B6F513 : DhcpNameServer = 192.168.2.1 192.168.2.1
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
LSA: Notification Packages = DPPassFilter scecli
SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Webroot Browser Helper Object: {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\Program Files (x86)\Webroot\Security\install\products\WISC\toolbar\LPBar.dll
BHO-X64: Webroot Browser Helper Object - No File
BHO-X64: WebrootBHO Class: {D93EC24D-8741-4D41-B83D-A5793B998416} - C:\Program Files (x86)\Webroot\Security\current\plugins\browserextension\WebrootBHO.dll
BHO-X64: WRCommonBHO - No File
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB-X64: Webroot Toolbar: {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\Program Files (x86)\Webroot\Security\install\products\WISC\toolbar\LPBar.dll
TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [HP Software Update] "C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe"
mRun-x64: [WebrootTrayApp] "C:\Program Files (x86)\Webroot\Security\Current\Framework\WRTray.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Benton\AppData\Roaming\Mozilla\Firefox\Profiles\dh9p4v9x.default\
FF - prefs.js: network.proxy.type - 0
FF - component: C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt\components\dpffcli.dll
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Download Manager\npfpdlm.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\NPcol400.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Benton\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
FF - plugin: C:\Users\Benton\AppData\Local\HuluDesktop\instances\0.9.14.1\nphdplg.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R1 CbFs;CbFs;\??\C:\Windows\system32\drivers\cbfs64.sys –> C:\Windows\system32\drivers\cbfs64.sys [?]
R1 pwipf6;Privacyware Filter Driver;C:\Windows\system32\DRIVERS\pwipf6.sys –> C:\Windows\system32\DRIVERS\pwipf6.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys –> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2010-12-15 89600]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe –> C:\Windows\system32\atiesrxx.exe [?]
R2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe [2010-6-7 408576]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-7-21 103992]
R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-8-5 291896]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-7-5 227384]
R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe –> C:\Windows\system32\Hpservice.exe [?]
R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-6-14 26680]
R2 MotoConnect Service;MotoConnect Service;C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2010-6-24 91456]
R2 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2010-5-4 503080]
R2 RoxioNow Service;RoxioNow Service;C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-9-11 399344]
R2 ssfmonm;ssfmonm;C:\Windows\system32\DRIVERS\ssfmonm.sys –> C:\Windows\system32\DRIVERS\ssfmonm.sys [?]
R2 UNS;Intel® Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-15 2533400]
R2 vcsFPService;Validity VCS Fingerprint Service;C:\Windows\System32\vcsFPService.exe [2010-2-23 1799472]
R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;C:\Program Files (x86)\Webroot\Security\Current\plugins\antimalware\AEI.exe [2011-8-15 3997912]
R2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe [2010-6-7 911872]
R2 WRConsumerService;Webroot Client Service;C:\Program Files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe [2011-11-8 3386840]
R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys –> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys –> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys –> C:\Windows\system32\drivers\AtihdW76.sys [?]
R3 bpenum;bpenum;C:\Windows\system32\DRIVERS\bpenum.sys –> C:\Windows\system32\DRIVERS\bpenum.sys [?]
R3 bpmp;Intel® Centrino® WiMAX 6050 Series;C:\Windows\system32\DRIVERS\bpmp.sys –> C:\Windows\system32\DRIVERS\bpmp.sys [?]
R3 bpusb;bpusb;C:\Windows\system32\Drivers\bpusb.sys –> C:\Windows\system32\Drivers\bpusb.sys [?]
R3 clwvd;HP Webcam Splitter;C:\Windows\system32\DRIVERS\clwvd.sys –> C:\Windows\system32\DRIVERS\clwvd.sys [?]
R3 HECIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys –> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 Impcd;Impcd;C:\Windows\system32\DRIVERS\Impcd.sys –> C:\Windows\system32\DRIVERS\Impcd.sys [?]
R3 intelkmd;intelkmd;C:\Windows\system32\DRIVERS\igdpmd64.sys –> C:\Windows\system32\DRIVERS\igdpmd64.sys [?]
R3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:\Windows\system32\DRIVERS\NETwNs64.sys –> C:\Windows\system32\DRIVERS\NETwNs64.sys [?]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys –> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
R3 wdkmd;Intel WiDi KMD;C:\Windows\system32\DRIVERS\WDKMD.sys –> C:\Windows\system32\DRIVERS\WDKMD.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 BTCFilterService;USB Networking Driver Filter Service;C:\Windows\system32\DRIVERS\motfilt.sys –> C:\Windows\system32\DRIVERS\motfilt.sys [?]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-8-31 1431888]
S3 motccgp;Motorola USB Composite Device Driver;C:\Windows\system32\DRIVERS\motccgp.sys –> C:\Windows\system32\DRIVERS\motccgp.sys [?]
S3 motccgpfl;MotCcgpFlService;C:\Windows\system32\DRIVERS\motccgpfl.sys –> C:\Windows\system32\DRIVERS\motccgpfl.sys [?]
S3 Motousbnet;Motorola USB Networking Driver Service;C:\Windows\system32\DRIVERS\Motousbnet.sys –> C:\Windows\system32\DRIVERS\Motousbnet.sys [?]
S3 motusbdevice;Motorola USB Dev Driver;C:\Windows\system32\DRIVERS\motusbdevice.sys –> C:\Windows\system32\DRIVERS\motusbdevice.sys [?]
S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2010-7-19 340240]
S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys –> C:\Windows\system32\DRIVERS\netw5v64.sys [?]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\system32\Drivers\RtsUStor.sys –> C:\Windows\system32\Drivers\RtsUStor.sys [?]
S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys –> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS –> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS –> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS –> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\system32\DRIVERS\wdcsam64.sys –> C:\Windows\system32\DRIVERS\wdcsam64.sys [?]
S3 wrssweep;Webroots Volume Access Driver;C:\PROGRA~2\Webroot\Security\Current\plugins\cleanup\wrssweep.sys [2011-8-15 26040]
S3 WSDPrintDevice;WSD Print Support via UMB;C:\Windows\system32\DRIVERS\WSDPrint.sys –> C:\Windows\system32\DRIVERS\WSDPrint.sys [?]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys –> C:\Windows\system32\DRIVERS\yk62x64.sys [?]
.
=============== Created Last 30 ================
.
2011-11-10 12:15:39 69000 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{5F0DF07F-51B9-4B09-927C-AC3B2A2BDF00}\offreg.dll
2011-11-10 01:15:33 ——– d—–w- C:\Users\Benton\AppData\Local\Norman Malware Cleaner
2011-11-09 03:54:58 ——– d—–w- C:\ProgramData\Kaspersky Lab
2011-11-09 03:54:02 460888 —-a-w- C:\Windows\System32\drivers\79483416.sys
2011-11-08 07:38:19 8570192 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{5F0DF07F-51B9-4B09-927C-AC3B2A2BDF00}\mpengine.dll
2011-11-08 04:10:06 ——– d—–w- C:\Windows\SysWow64\?????????‰›???????????
2011-11-08 04:09:48 ——– d—–w- C:\Windows\SysWow64\??????????›???????????
2011-11-08 04:09:29 ——– d—–w- C:\Windows\SysWow64\??????????›???????????
2011-11-08 04:09:10 ——– d—–w- C:\Windows\SysWow64\??????????›???????????
2011-11-08 04:08:52 ——– d—–w- C:\Windows\SysWow64\??????????›???????????
2011-11-08 04:08:33 ——– d—–w- C:\Windows\SysWow64\??????????›???????????
2011-11-08 04:08:15 ——– d—–w- C:\Windows\SysWow64\??????????›???????????
2011-11-08 04:07:49 ——– d—–w- C:\Windows\SysWow64\??????????›???????????
2011-11-08 04:07:30 ——– d—–w- C:\Windows\SysWow64\??????????›???????????
2011-11-08 04:07:10 ——– d—–w- C:\Windows\SysWow64\??????????›???????????
2011-11-08 04:06:50 ——– d—–w- C:\Windows\SysWow64\??????????›???????????
2011-11-08 04:06:32 ——– d—–w- C:\Windows\SysWow64\??????????›???????????
2011-11-08 04:05:55 ——– d—–w- C:\Windows\SysWow64\??????????›???????????
2011-11-08 04:05:11 ——– d—–w- C:\Windows\SysWow64\?????????‰›???????????
2011-11-08 04:04:36 ——– d—–w- C:\Windows\SysWow64\??????????›???????????
2011-11-08 04:04:13 ——– d—–w- C:\Windows\SysWow64\??????????›???????????
2011-11-08 04:03:45 ——– d—–w- C:\Windows\SysWow64\??????????›???????????
2011-11-07 02:21:07 ——– d—–w- C:\Users\Benton\AppData\Local\Kobo
2011-11-07 02:20:21 ——– d—–w- C:\Program Files (x86)\Kobo
2011-11-06 22:39:54 ——– d—–w- C:\Users\Benton\AppData\Roaming\NhwCIP1bpJf
2011-11-06 22:37:06 ——– d—–w- C:\Users\Benton\AppData\Roaming\WjUCekIBrOyAuSi
2011-11-06 22:37:06 ——– d—–w- C:\Users\Benton\AppData\Roaming\c3pnG4aQH
2011-11-06 22:37:01 ——– d—–w- C:\Users\Benton\AppData\Roaming\sA0uvS2ib3n5Q6W
2011-11-06 22:37:00 ——– d—–w- C:\Users\Benton\AppData\Roaming\oTTXXwjUCelIrP
2011-11-06 22:35:56 ——– d—–w- C:\Users\Benton\AppData\Roaming\xPP00yccA1iD2n
2011-11-06 22:34:54 ——– d—–w- C:\Users\Benton\AppData\Roaming\TWK8fRL9hXjCkBz
2011-11-06 22:33:56 ——– d—–w- C:\Users\Benton\AppData\Roaming\RzzzONNyxA0vSib
2011-11-06 22:32:57 ——– d—–w- C:\Users\Benton\AppData\Roaming\FEEKK8fRZ9hT
2011-11-06 22:32:56 ——– d—–w- C:\Users\Benton\AppData\Roaming\zQQJJ7dEEKgRZ
2011-11-06 22:32:52 ——– d—–w- C:\Users\Benton\AppData\Roaming\sXXXwjjUCelIrz
2011-11-06 22:32:51 ——– d—–w- C:\Users\Benton\AppData\Roaming\eyyccAA1uvD
2011-11-06 22:32:48 ——– d—–w- C:\Users\Benton\AppData\Roaming\SSS22obbF3pG5Q6
2011-11-06 22:32:47 ——– d—–w- C:\Users\Benton\AppData\Roaming\mbbbF44pmG5sJ
2011-11-06 22:32:43 ——– d—–w- C:\Users\Benton\AppData\Roaming\SddWWK8ffR9hT
2011-11-06 22:32:42 ——– d—–w- C:\Users\Benton\AppData\Roaming\whTTXXwjUCelBrP
2011-11-06 22:32:38 ——– d—–we C:\Windows\system64
2011-11-06 22:32:38 ——– d—–w- C:\Users\Benton\AppData\Roaming\aaaQQJ66dWKfR9h
2011-11-06 22:32:37 ——– d—–w- C:\Users\Benton\AppData\Roaming\JpppmGG5s
2011-10-12 21:24:09 3138048 —-a-w- C:\Windows\System32\win32k.sys
2011-10-12 21:24:05 75776 —-a-w- C:\Windows\SysWow64\psisrndr.ax
2011-10-12 21:24:05 613888 —-a-w- C:\Windows\System32\psisdecd.dll
2011-10-12 21:24:05 465408 —-a-w- C:\Windows\SysWow64\psisdecd.dll
2011-10-12 21:24:05 108032 —-a-w- C:\Windows\System32\psisrndr.ax
2011-10-12 21:23:40 571904 —-a-w- C:\Windows\SysWow64\oleaut32.dll
2011-10-12 21:23:40 331776 —-a-w- C:\Windows\System32\oleacc.dll
2011-10-12 21:23:40 233472 —-a-w- C:\Windows\SysWow64\oleacc.dll
2011-10-12 21:23:39 861696 —-a-w- C:\Windows\System32\oleaut32.dll
.
==================== Find3M ====================
.
2011-11-09 23:03:18 691 —-a-w- C:\Users\Benton\AppData\Roaming\GetValue.vbs
2011-11-09 23:03:18 35 —-a-w- C:\Users\Benton\AppData\Roaming\SetValue.bat
2011-11-09 23:03:18 1162 —-a-w- C:\Windows\SysWow64\tmp.reg
2011-11-03 11:15:41 404640 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-07 17:52:18 37376 —-a-w- C:\Windows\SysWow64\libusb0.dll
2011-10-07 17:52:18 21504 —-a-w- C:\Windows\SysWow64\drivers\libusb0.sys
2011-10-03 10:06:03 472808 —-a-w- C:\Windows\SysWow64\deployJava1.dll
2011-09-13 02:48:02 6285008 —-a-w- C:\Program Files (x86)\Common Files\wruninstall.exe
2011-09-04 18:27:08 178800 —-a-w- C:\Windows\SysWow64\CmdLineExt_x64.dll
2011-09-01 05:24:07 2309120 —-a-w- C:\Windows\System32\jscript9.dll
2011-09-01 05:17:57 1389056 —-a-w- C:\Windows\System32\wininet.dll
2011-09-01 05:12:04 2382848 —-a-w- C:\Windows\System32\mshtml.tlb
2011-09-01 02:35:59 1798144 —-a-w- C:\Windows\SysWow64\jscript9.dll
2011-09-01 02:28:15 1126912 —-a-w- C:\Windows\SysWow64\wininet.dll
2011-09-01 02:22:54 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb
2011-08-31 21:00:50 25416 —-a-w- C:\Windows\System32\drivers\mbam.sys
2011-08-16 00:19:50 72280 —-a-w- C:\Windows\System32\drivers\sbapifs.sys
2011-08-16 00:16:49 55384 —-a-w- C:\Windows\System32\drivers\SBREDrv.sys
.
============= FINISH: 20:56:54.75 ===============
Attachments:
[attachment removed: attach.zip]
here is the aswmbr log
aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-11-10 21:27:49
—————————–
21:27:49.073 OS Version: Windows x64 6.1.7601 Service Pack 1
21:27:49.073 Number of processors: 4 586 0x2505
21:27:49.074 ComputerName: CUDA-LAPTOP UserName: Benton
21:27:49.737 Initialize success
21:28:15.411 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:28:15.414 Disk 0 Vendor: SAMSUNG_ 2AJ1 Size: 610480MB BusType: 3
21:28:15.416 Disk 0 MBR read error 0
21:28:15.418 Disk 0 MBR scan
21:28:15.420 Disk 0 unknown MBR code
21:28:15.423 MBR BIOS signature not found 0
21:28:15.427 Service scanning
21:28:16.645 Service pwipf6 C:\Windows\system32\DRIVERS\pwipf6.sys **LOCKED**
21:28:16.685 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
21:28:17.248 Modules scanning
21:28:17.255 Disk 0 trace - called modules:
21:28:17.285 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys iaStor.sys spuu.sys hal.dll
21:28:17.291 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8008992060]
21:28:17.294 3 CLASSPNP.SYS[fffff88001da743f] -> nt!IofCallDriver -> [0xfffffa8006a98860]
21:28:17.300 5 hpdskflt.sys[fffff88001d4e2bd] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8006916050]
21:28:17.305 Scan finished successfully
21:28:32.894 Disk 0 MBR has been saved successfully to "C:\Users\Benton\Desktop\MBR.dat"
21:28:32.901 The log file has been saved successfully to "C:\Users\Benton\Desktop\aswMBR.txt"
on the GMER The only clickable areas were Services, Registry, Files, the drives, ads, adn the show all. I'm running it now with Services, registry, Files, the C Drive, and ads checked. Not sure if I did something wrong there. But everything above Services was "grayed" out and un clickable. I also ran it as admin. I will post the log.
Hi z0ne,
You are doing just fine. When you get that log go ahead and post it as I am reviewing your other logs now.
Hi z0ne,
**WARNING** Unfortunately one or more of the infections I have identified are
Backdoor Trojans, IRCBots or other Malware capable of stealing very important information. You need to
stop using all Internet Banking sites, change passwords to all sites with sensitive information from a clean computer and phone your bank to inform them that you may be a victim of identify theft . More often than not, we advise users that a full reinstallation of their Operating System is the only way to ensure that their computer will ever be 100% clean again.
It looks like you more than likely have the
ZeroAccess rootkit which is a particularly nasty infection. We can do our best to clean this infection, but there is a chance that we may have to format and reinstall your operating system later regardless of what we do.
If you would like to format and reinstall your Operating System please let me know and we can assist you with that.
If you would like to continue with the cleaning, please continue with the following instructions and I will be more than happy to help.
———-
Please download
TDSSKiller.zip
Extract it to your desktop Right-click and Run as Administrator TDSSKiller.exe Press Start Scan Only if Malicious Cure is selected Then click Continue > Reboot now Copy and paste the log in your next replyA copy of the log will be saved automatically to the root of the drive (typically C:\)
———-
Download
Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2
**Note: It is important that it is saved directly to your desktop**
——————————————————————–
IMPORTANT -
Disable your AntiVirus and AntiSpyware applications , usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link
here
——————————————————————–
Right-Click and Run as Administrator on
ComboFix.exe & follow the prompts.
When finished, it will produce a report for you. Please post the C:\ComboFix.txt for further review.
well that kinda sucks. lol
I will try the fix first I guess. Then I will get important files off and do then reinstall OS. I'm actually heading to bed now and I will post the logs to,orrow evening.
TDSSKILLER LOG
17:22:14.0378 5800 TDSS rootkit removing tool [removed] Nov 11 2011 15:47:15
17:22:14.0487 5800 ============================================================
17:22:14.0487 5800 Current date / time: 2011/11/11 17:22:14.0487
17:22:14.0487 5800 SystemInfo:
17:22:14.0487 5800
17:22:14.0487 5800 OS Version: 6.1.7601 ServicePack: 1.0
17:22:14.0487 5800 Product type: Workstation
17:22:14.0487 5800 ComputerName: CUDA-LAPTOP
17:22:14.0487 5800 UserName: Benton
17:22:14.0487 5800 Windows directory: C:\Windows
17:22:14.0487 5800 System windows directory: C:\Windows
17:22:14.0487 5800 Running under WOW64
17:22:14.0487 5800 Processor architecture: Intel x64
17:22:14.0487 5800 Number of processors: 4
17:22:14.0487 5800 Page size: 0x1000
17:22:14.0487 5800 Boot type: Normal boot
17:22:14.0487 5800 ============================================================
17:22:15.0283 5800 Initialize success
17:22:44.0923 0884 ============================================================
17:22:44.0923 0884 Scan started
17:22:44.0923 0884 Mode: Manual;
17:22:44.0923 0884 ============================================================
17:22:48.0262 0884 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
17:22:48.0277 0884 1394ohci - ok
17:22:48.0792 0884 Accelerometer (3e2427d4966c7606097341e55ab4e105) C:\Windows\system32\DRIVERS\Accelerometer.sys
17:22:48.0792 0884 Accelerometer - ok
17:22:49.0276 0884 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
17:22:49.0291 0884 ACPI - ok
17:22:49.0900 0884 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
17:22:49.0915 0884 AcpiPmi - ok
17:22:50.0321 0884 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
17:22:50.0368 0884 adp94xx - ok
17:22:50.0929 0884 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
17:22:50.0945 0884 adpahci - ok
17:22:51.0366 0884 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
17:22:51.0413 0884 adpu320 - ok
17:22:52.0115 0884 AFD (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys
17:22:52.0115 0884 AFD - ok
17:22:52.0255 0884 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
17:22:52.0302 0884 agp440 - ok
17:22:52.0411 0884 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
17:22:52.0427 0884 aliide - ok
17:22:52.0614 0884 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
17:22:52.0630 0884 amdide - ok
17:22:52.0754 0884 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
17:22:52.0770 0884 AmdK8 - ok
17:22:55.0562 0884 amdkmdag (06bf0785de714637eba9bb1084b28626) C:\Windows\system32\DRIVERS\atikmdag.sys
17:22:55.0750 0884 amdkmdag - ok
17:22:56.0296 0884 amdkmdap (2dec3274589ff6889ab05adceeb0f642) C:\Windows\system32\DRIVERS\atikmpag.sys
17:22:56.0296 0884 amdkmdap - ok
17:22:56.0623 0884 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
17:22:56.0670 0884 AmdPPM - ok
17:22:57.0013 0884 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
17:22:57.0029 0884 amdsata - ok
17:22:57.0466 0884 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
17:22:57.0481 0884 amdsbs - ok
17:22:57.0980 0884 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
17:22:57.0996 0884 amdxata - ok
17:22:58.0370 0884 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
17:22:58.0386 0884 AppID - ok
17:22:59.0088 0884 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
17:22:59.0104 0884 arc - ok
17:22:59.0260 0884 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
17:22:59.0291 0884 arcsas - ok
17:22:59.0868 0884 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
17:22:59.0884 0884 AsyncMac - ok
17:23:00.0258 0884 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
17:23:00.0274 0884 atapi - ok
17:23:00.0804 0884 AtiHDAudioService (4bf5bca6e2608cd8a00bc4a6673a9f47) C:\Windows\system32\drivers\AtihdW76.sys
17:23:00.0804 0884 AtiHDAudioService - ok
17:23:01.0225 0884 AtiHdmiService (2d648572ba9a610952fcafba1e119c2d) C:\Windows\system32\drivers\AtiHdmi.sys
17:23:01.0241 0884 AtiHdmiService - ok
17:23:01.0756 0884 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
17:23:01.0834 0884 b06bdrv - ok
17:23:02.0317 0884 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
17:23:02.0333 0884 b57nd60a - ok
17:23:02.0910 0884 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
17:23:02.0926 0884 Beep - ok
17:23:03.0097 0884 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
17:23:03.0113 0884 blbdrive - ok
17:23:03.0378 0884 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
17:23:03.0378 0884 bowser - ok
17:23:03.0550 0884 bpenum (f46dd257fad7d2d097ef32e72220a06c) C:\Windows\system32\DRIVERS\bpenum.sys
17:23:03.0565 0884 bpenum - ok
17:23:03.0784 0884 bpmp (e82060aed0f28ed8909f2b07fa276185) C:\Windows\system32\DRIVERS\bpmp.sys
17:23:03.0799 0884 bpmp - ok
17:23:03.0908 0884 bpusb (fc6313a5a45c1ae53d0491f0057d5a4d) C:\Windows\system32\Drivers\bpusb.sys
17:23:03.0924 0884 bpusb - ok
17:23:04.0064 0884 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
17:23:04.0064 0884 BrFiltLo - ok
17:23:04.0189 0884 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
17:23:04.0205 0884 BrFiltUp - ok
17:23:04.0408 0884 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
17:23:04.0439 0884 Brserid - ok
17:23:04.0579 0884 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
17:23:04.0595 0884 BrSerWdm - ok
17:23:04.0985 0884 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
17:23:05.0000 0884 BrUsbMdm - ok
17:23:05.0344 0884 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
17:23:05.0359 0884 BrUsbSer - ok
17:23:05.0827 0884 BTCFilterService (ff7c57973eead140062238c5a0b7d455) C:\Windows\system32\DRIVERS\motfilt.sys
17:23:05.0858 0884 BTCFilterService - ok
17:23:05.0952 0884 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
17:23:05.0983 0884 BTHMODEM - ok
17:23:06.0139 0884 CbFs (5fe05bb71c1d0878163334f5c8d99016) C:\Windows\system32\drivers\cbfs64.sys
17:23:06.0139 0884 CbFs - ok
17:23:06.0280 0884 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
17:23:06.0311 0884 cdfs - ok
17:23:06.0420 0884 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
17:23:06.0436 0884 cdrom - ok
17:23:06.0857 0884 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
17:23:06.0872 0884 circlass - ok
17:23:07.0262 0884 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
17:23:07.0278 0884 CLFS - ok
17:23:07.0715 0884 clwvd (d68d9f4d53010b7e84d4e80a2e485554) C:\Windows\system32\DRIVERS\clwvd.sys
17:23:07.0715 0884 clwvd - ok
17:23:08.0027 0884 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
17:23:08.0027 0884 CmBatt - ok
17:23:08.0401 0884 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
17:23:08.0401 0884 cmdide - ok
17:23:08.0588 0884 CNG (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys
17:23:08.0604 0884 CNG - ok
17:23:09.0025 0884 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
17:23:09.0025 0884 Compbatt - ok
17:23:09.0306 0884 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
17:23:09.0306 0884 CompositeBus - ok
17:23:09.0353 0884 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
17:23:09.0353 0884 crcdisk - ok
17:23:09.0446 0884 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
17:23:09.0446 0884 DfsC - ok
17:23:09.0493 0884 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
17:23:09.0493 0884 discache - ok
17:23:09.0540 0884 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
17:23:09.0540 0884 Disk - ok
17:23:09.0914 0884 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
17:23:09.0946 0884 drmkaud - ok
17:23:10.0367 0884 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
17:23:10.0585 0884 DXGKrnl - ok
17:23:11.0927 0884 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
17:23:12.0020 0884 ebdrv - ok
17:23:12.0738 0884 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
17:23:12.0738 0884 elxstor - ok
17:23:13.0066 0884 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
17:23:13.0066 0884 ErrDev - ok
17:23:13.0471 0884 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
17:23:13.0487 0884 exfat - ok
17:23:13.0986 0884 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
17:23:13.0986 0884 fastfat - ok
17:23:14.0064 0884 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
17:23:14.0080 0884 fdc - ok
17:23:14.0126 0884 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
17:23:14.0126 0884 FileInfo - ok
17:23:14.0142 0884 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
17:23:14.0142 0884 Filetrace - ok
17:23:14.0220 0884 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
17:23:14.0220 0884 flpydisk - ok
17:23:14.0454 0884 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
17:23:14.0485 0884 FltMgr - ok
17:23:14.0626 0884 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
17:23:14.0626 0884 FsDepends - ok
17:23:14.0657 0884 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
17:23:14.0657 0884 Fs_Rec - ok
17:23:14.0844 0884 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
17:23:14.0875 0884 fvevol - ok
17:23:14.0938 0884 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
17:23:14.0938 0884 gagp30kx - ok
17:23:14.0984 0884 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
17:23:14.0984 0884 hcw85cir - ok
17:23:15.0062 0884 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
17:23:15.0094 0884 HdAudAddService - ok
17:23:15.0156 0884 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
17:23:15.0172 0884 HDAudBus - ok
17:23:15.0218 0884 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys
17:23:15.0218 0884 HECIx64 - ok
17:23:15.0452 0884 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
17:23:15.0484 0884 HidBatt - ok
17:23:15.0499 0884 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
17:23:15.0499 0884 HidBth - ok
17:23:15.0546 0884 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
17:23:15.0562 0884 HidIr - ok
17:23:15.0593 0884 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
17:23:15.0593 0884 HidUsb - ok
17:23:15.0655 0884 hpdskflt (ccbe758967cc0f53f5ba3b271653c4e6) C:\Windows\system32\DRIVERS\hpdskflt.sys
17:23:15.0655 0884 hpdskflt - ok
17:23:15.0702 0884 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
17:23:15.0702 0884 HpSAMD - ok
17:23:15.0920 0884 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
17:23:15.0952 0884 HTTP - ok
17:23:15.0998 0884 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
17:23:15.0998 0884 hwpolicy - ok
17:23:16.0201 0884 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
17:23:16.0217 0884 i8042prt - ok
17:23:16.0591 0884 iaStor (1384872112e8e7fd5786eceb8bddf4c9) C:\Windows\system32\DRIVERS\iaStor.sys
17:23:16.0591 0884 iaStor - ok
17:23:16.0669 0884 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
17:23:16.0685 0884 iaStorV - ok
17:23:18.0214 0884 igfx (1be8d9ca4f2363b8e8015621878e0043) C:\Windows\system32\DRIVERS\igdkmd64.sys
17:23:18.0432 0884 igfx - ok
17:23:18.0806 0884 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
17:23:18.0822 0884 iirsp - ok
17:23:19.0040 0884 Impcd (36fdf367a1dabff903e2214023d71368) C:\Windows\system32\DRIVERS\Impcd.sys
17:23:19.0040 0884 Impcd - ok
17:23:19.0150 0884 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
17:23:19.0150 0884 intelide - ok
17:23:20.0179 0884 intelkmd (1be8d9ca4f2363b8e8015621878e0043) C:\Windows\system32\DRIVERS\igdpmd64.sys
17:23:20.0366 0884 intelkmd - ok
17:23:20.0663 0884 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
17:23:20.0678 0884 intelppm - ok
17:23:20.0866 0884 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
17:23:20.0866 0884 IpFilterDriver - ok
17:23:20.0912 0884 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
17:23:20.0912 0884 IPMIDRV - ok
17:23:20.0959 0884 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
17:23:20.0975 0884 IPNAT - ok
17:23:20.0990 0884 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
17:23:20.0990 0884 IRENUM - ok
17:23:21.0037 0884 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
17:23:21.0053 0884 isapnp - ok
17:23:21.0068 0884 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
17:23:21.0084 0884 iScsiPrt - ok
17:23:21.0100 0884 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
17:23:21.0100 0884 kbdclass - ok
17:23:21.0131 0884 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
17:23:21.0131 0884 kbdhid - ok
17:23:21.0178 0884 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys
17:23:21.0193 0884 KSecDD - ok
17:23:21.0240 0884 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys
17:23:21.0240 0884 KSecPkg - ok
17:23:21.0302 0884 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
17:23:21.0302 0884 ksthunk - ok
17:23:21.0334 0884 libusb0 - ok
17:23:21.0380 0884 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
17:23:21.0380 0884 lltdio - ok
17:23:21.0521 0884 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
17:23:21.0536 0884 LSI_FC - ok
17:23:21.0568 0884 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
17:23:21.0583 0884 LSI_SAS - ok
17:23:21.0614 0884 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
17:23:21.0614 0884 LSI_SAS2 - ok
17:23:21.0630 0884 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
17:23:21.0630 0884 LSI_SCSI - ok
17:23:21.0677 0884 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
17:23:21.0692 0884 luafv - ok
17:23:21.0739 0884 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
17:23:21.0739 0884 megasas - ok
17:23:21.0786 0884 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
17:23:21.0802 0884 MegaSR - ok
17:23:21.0817 0884 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
17:23:21.0833 0884 Modem - ok
17:23:21.0880 0884 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
17:23:21.0880 0884 monitor - ok
17:23:21.0926 0884 motccgp (93f5adcad940111f6d4d71ae1d9ec7f6) C:\Windows\system32\DRIVERS\motccgp.sys
17:23:21.0926 0884 motccgp - ok
17:23:21.0942 0884 motccgpfl (d51e009baeda07ebc107d49d224c2414) C:\Windows\system32\DRIVERS\motccgpfl.sys
17:23:21.0942 0884 motccgpfl - ok
17:23:22.0020 0884 motmodem (db83dc223b9133da3e41afcbdecc46b5) C:\Windows\system32\DRIVERS\motmodem.sys
17:23:22.0036 0884 motmodem - ok
17:23:22.0067 0884 MotoSwitchService (ebd05f60cafc5bba2602b8d7101082d3) C:\Windows\system32\DRIVERS\motswch.sys
17:23:22.0067 0884 MotoSwitchService - ok
17:23:22.0082 0884 Motousbnet (87701078c3f720ac7a028e937994cc49) C:\Windows\system32\DRIVERS\Motousbnet.sys
17:23:22.0082 0884 Motousbnet - ok
17:23:22.0114 0884 motusbdevice (307727f9829fb46ff4be0e4d1dac5002) C:\Windows\system32\DRIVERS\motusbdevice.sys
17:23:22.0114 0884 motusbdevice - ok
17:23:22.0160 0884 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
17:23:22.0160 0884 mouclass - ok
17:23:22.0285 0884 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
17:23:22.0285 0884 mouhid - ok
17:23:22.0348 0884 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
17:23:22.0363 0884 mountmgr - ok
17:23:22.0472 0884 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
17:23:22.0488 0884 mpio - ok
17:23:22.0566 0884 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
17:23:22.0566 0884 mpsdrv - ok
17:23:22.0660 0884 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
17:23:22.0675 0884 MRxDAV - ok
17:23:22.0738 0884 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
17:23:22.0738 0884 mrxsmb - ok
17:23:22.0800 0884 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
17:23:22.0816 0884 mrxsmb10 - ok
17:23:22.0862 0884 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
17:23:22.0862 0884 mrxsmb20 - ok
17:23:22.0940 0884 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
17:23:22.0940 0884 msahci - ok
17:23:22.0987 0884 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
17:23:22.0987 0884 msdsm - ok
17:23:23.0050 0884 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
17:23:23.0050 0884 Msfs - ok
17:23:23.0081 0884 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
17:23:23.0081 0884 mshidkmdf - ok
17:23:23.0096 0884 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
17:23:23.0096 0884 msisadrv - ok
17:23:23.0237 0884 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
17:23:23.0268 0884 MSKSSRV - ok
17:23:23.0299 0884 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
17:23:23.0299 0884 MSPCLOCK - ok
17:23:23.0408 0884 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
17:23:23.0408 0884 MSPQM - ok
17:23:23.0502 0884 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
17:23:23.0533 0884 MsRPC - ok
17:23:23.0611 0884 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
17:23:23.0611 0884 mssmbios - ok
17:23:23.0642 0884 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
17:23:23.0642 0884 MSTEE - ok
17:23:23.0720 0884 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
17:23:23.0720 0884 MTConfig - ok
17:23:23.0752 0884 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
17:23:23.0752 0884 Mup - ok
17:23:23.0876 0884 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
17:23:23.0892 0884 NativeWifiP - ok
17:23:24.0064 0884 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
17:23:24.0095 0884 NDIS - ok
17:23:24.0173 0884 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
17:23:24.0173 0884 NdisCap - ok
17:23:24.0235 0884 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
17:23:24.0235 0884 NdisTapi - ok
17:23:24.0344 0884 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
17:23:24.0360 0884 Ndisuio - ok
17:23:24.0422 0884 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
17:23:24.0422 0884 NdisWan - ok
17:23:24.0469 0884 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
17:23:24.0485 0884 NDProxy - ok
17:23:24.0547 0884 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
17:23:24.0547 0884 NetBIOS - ok
17:23:24.0625 0884 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
17:23:24.0641 0884 NetBT - ok
17:23:25.0546 0884 netw5v64 (64428dfdaf6e88366cb51f45a79c5f69) C:\Windows\system32\DRIVERS\netw5v64.sys
17:23:25.0639 0884 netw5v64 - ok
17:23:26.0606 0884 NETwNs64 (b9c587bdaa61a689883439d5ae6fe7f3) C:\Windows\system32\DRIVERS\NETwNs64.sys
17:23:26.0731 0884 NETwNs64 - ok
17:23:27.0137 0884 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
17:23:27.0168 0884 nfrd960 - ok
17:23:27.0558 0884 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
17:23:27.0558 0884 Npfs - ok
17:23:27.0605 0884 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
17:23:27.0605 0884 nsiproxy - ok
17:23:28.0151 0884 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
17:23:28.0166 0884 Ntfs - ok
17:23:28.0244 0884 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
17:23:28.0260 0884 Null - ok
17:23:28.0322 0884 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
17:23:28.0338 0884 nvraid - ok
17:23:28.0369 0884 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
17:23:28.0369 0884 nvstor - ok
17:23:28.0478 0884 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
17:23:28.0510 0884 nv_agp - ok
17:23:28.0541 0884 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
17:23:28.0541 0884 ohci1394 - ok
17:23:28.0588 0884 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
17:23:28.0588 0884 Parport - ok
17:23:28.0634 0884 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
17:23:28.0650 0884 partmgr - ok
17:23:28.0744 0884 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
17:23:28.0744 0884 pci - ok
17:23:28.0822 0884 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
17:23:28.0837 0884 pciide - ok
17:23:28.0946 0884 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
17:23:28.0962 0884 pcmcia - ok
17:23:29.0180 0884 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
17:23:29.0196 0884 pcw - ok
17:23:29.0227 0884 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
17:23:29.0227 0884 PEAUTH - ok
17:23:29.0305 0884 Point64 (b8d8ec78b0f9ed8e220506181274f3d3) C:\Windows\system32\DRIVERS\point64.sys
17:23:29.0305 0884 Point64 - ok
17:23:29.0399 0884 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
17:23:29.0414 0884 PptpMiniport - ok
17:23:29.0477 0884 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
17:23:29.0477 0884 Processor - ok
17:23:29.0586 0884 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
17:23:29.0586 0884 Psched - ok
17:23:29.0680 0884 pwipf6 (e13e8c164432d9ff0d2d51d3d02ffeae) C:\Windows\system32\DRIVERS\pwipf6.sys
17:23:29.0680 0884 pwipf6 - ok
17:23:30.0038 0884 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
17:23:30.0054 0884 ql2300 - ok
17:23:30.0460 0884 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
17:23:30.0475 0884 ql40xx - ok
17:23:30.0553 0884 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
17:23:30.0553 0884 QWAVEdrv - ok
17:23:30.0584 0884 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
17:23:30.0584 0884 RasAcd - ok
17:23:30.0631 0884 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
17:23:30.0631 0884 RasAgileVpn - ok
17:23:30.0725 0884 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
17:23:30.0740 0884 Rasl2tp - ok
17:23:30.0881 0884 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
17:23:30.0881 0884 RasPppoe - ok
17:23:30.0896 0884 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
17:23:30.0912 0884 RasSstp - ok
17:23:31.0052 0884 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
17:23:31.0068 0884 rdbss - ok
17:23:31.0146 0884 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
17:23:31.0146 0884 rdpbus - ok
17:23:31.0193 0884 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
17:23:31.0193 0884 RDPCDD - ok
17:23:31.0208 0884 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
17:23:31.0208 0884 RDPENCDD - ok
17:23:31.0224 0884 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
17:23:31.0224 0884 RDPREFMP - ok
17:23:31.0302 0884 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
17:23:31.0302 0884 RDPWD - ok
17:23:31.0364 0884 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
17:23:31.0380 0884 rdyboost - ok
17:23:31.0458 0884 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
17:23:31.0458 0884 rspndr - ok
17:23:31.0536 0884 RSUSBSTOR (907c4464381b5ebdfdc60f6c7d0dedfc) C:\Windows\system32\Drivers\RtsUStor.sys
17:23:31.0536 0884 RSUSBSTOR - ok
17:23:32.0004 0884 RTL8167 (4b42bc58294e83a6a92ec8b88c14c4a3) C:\Windows\system32\DRIVERS\Rt64win7.sys
17:23:32.0004 0884 RTL8167 - ok
17:23:32.0534 0884 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
17:23:32.0550 0884 sbp2port - ok
17:23:32.0987 0884 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
17:23:33.0002 0884 scfilter - ok
17:23:33.0533 0884 sdbus (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\drivers\sdbus.sys
17:23:33.0548 0884 sdbus - ok
17:23:33.0689 0884 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
17:23:33.0704 0884 secdrv - ok
17:23:34.0032 0884 Ser2pl (c284622531b1238e41df70e84b7524ce) C:\Windows\system32\DRIVERS\ser2pl64.sys
17:23:34.0048 0884 Ser2pl - ok
17:23:34.0110 0884 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
17:23:34.0110 0884 Serenum - ok
17:23:34.0188 0884 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
17:23:34.0188 0884 Serial - ok
17:23:34.0235 0884 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
17:23:34.0250 0884 sermouse - ok
17:23:34.0282 0884 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
17:23:34.0297 0884 sffdisk - ok
17:23:34.0328 0884 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
17:23:34.0328 0884 sffp_mmc - ok
17:23:34.0344 0884 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
17:23:34.0344 0884 sffp_sd - ok
17:23:34.0375 0884 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
17:23:34.0375 0884 sfloppy - ok
17:23:34.0438 0884 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
17:23:34.0453 0884 SiSRaid2 - ok
17:23:34.0469 0884 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
17:23:34.0469 0884 SiSRaid4 - ok
17:23:34.0500 0884 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
17:23:34.0500 0884 Smb - ok
17:23:34.0531 0884 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
17:23:34.0531 0884 spldr - ok
17:23:34.0734 0884 sptd (602884696850c86434530790b110e8eb) C:\Windows\system32\Drivers\sptd.sys
17:23:34.0734 0884 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 602884696850c86434530790b110e8eb
17:23:34.0765 0884 sptd ( LockedFile.Multi.Generic ) - warning
17:23:34.0765 0884 sptd - detected LockedFile.Multi.Generic (1)
17:23:34.0843 0884 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
17:23:34.0859 0884 srv - ok
17:23:35.0030 0884 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
17:23:35.0030 0884 srv2 - ok
17:23:35.0093 0884 SrvHsfHDA (0c4540311e11664b245a263e1154cef8) C:\Windows\system32\DRIVERS\VSTAZL6.SYS
17:23:35.0108 0884 SrvHsfHDA - ok
17:23:35.0155 0884 SrvHsfV92 (02071d207a9858fbe3a48cbfd59c4a04) C:\Windows\system32\DRIVERS\VSTDPV6.SYS
17:23:35.0171 0884 SrvHsfV92 - ok
17:23:35.0202 0884 SrvHsfWinac (18e40c245dbfaf36fd0134a7ef2df396) C:\Windows\system32\DRIVERS\VSTCNXT6.SYS
17:23:35.0202 0884 SrvHsfWinac - ok
17:23:35.0327 0884 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
17:23:35.0342 0884 srvnet - ok
17:23:35.0467 0884 ssfmonm (a4c4a1fedfbed04b39efae9f1311ed5e) C:\Windows\system32\DRIVERS\ssfmonm.sys
17:23:35.0467 0884 ssfmonm - ok
17:23:35.0545 0884 ssidrv (1cc88f50bd4e6fd6eac5c5365ceb6583) C:\Windows\system32\DRIVERS\ssidrv.sys
17:23:35.0545 0884 ssidrv - ok
17:23:35.0608 0884 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
17:23:35.0623 0884 stexstor - ok
17:23:35.0686 0884 STHDA (da40d9c9ccb9836d6abd1706935a2277) C:\Windows\system32\DRIVERS\stwrt64.sys
17:23:35.0701 0884 STHDA - ok
17:23:35.0748 0884 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
17:23:35.0748 0884 swenum - ok
17:23:35.0920 0884 SynTP (961cfac2a5318e212f459d651f28e0a4) C:\Windows\system32\DRIVERS\SynTP.sys
17:23:35.0935 0884 SynTP - ok
17:23:36.0590 0884 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
17:23:36.0622 0884 Tcpip - ok
17:23:37.0636 0884 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
17:23:37.0651 0884 TCPIP6 - ok
17:23:38.0322 0884 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
17:23:38.0338 0884 tcpipreg - ok
17:23:38.0634 0884 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
17:23:38.0665 0884 TDPIPE - ok
17:23:39.0024 0884 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
17:23:39.0071 0884 TDTCP - ok
17:23:39.0617 0884 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
17:23:39.0617 0884 tdx - ok
17:23:39.0648 0884 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
17:23:39.0648 0884 TermDD - ok
17:23:39.0757 0884 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
17:23:39.0757 0884 tssecsrv - ok
17:23:39.0835 0884 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
17:23:39.0851 0884 TsUsbFlt - ok
17:23:39.0898 0884 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
17:23:39.0898 0884 tunnel - ok
17:23:39.0929 0884 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
17:23:39.0960 0884 uagp35 - ok
17:23:40.0038 0884 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
17:23:40.0054 0884 udfs - ok
17:23:40.0116 0884 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
17:23:40.0116 0884 uliagpkx - ok
17:23:40.0163 0884 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
17:23:40.0163 0884 umbus - ok
17:23:40.0194 0884 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
17:23:40.0194 0884 UmPass - ok
17:23:40.0241 0884 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
17:23:40.0241 0884 usbaudio - ok
17:23:40.0303 0884 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
17:23:40.0303 0884 usbccgp - ok
17:23:40.0381 0884 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
17:23:40.0428 0884 usbcir - ok
17:23:40.0459 0884 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
17:23:40.0459 0884 usbehci - ok
17:23:40.0522 0884 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
17:23:40.0522 0884 usbhub - ok
17:23:40.0600 0884 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
17:23:40.0600 0884 usbohci - ok
17:23:40.0662 0884 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
17:23:40.0678 0884 usbprint - ok
17:23:40.0724 0884 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
17:23:40.0724 0884 USBSTOR - ok
17:23:40.0771 0884 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
17:23:40.0787 0884 usbuhci - ok
17:23:40.0943 0884 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys
17:23:40.0974 0884 usbvideo - ok
17:23:41.0021 0884 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
17:23:41.0021 0884 vdrvroot - ok
17:23:41.0052 0884 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
17:23:41.0052 0884 vga - ok
17:23:41.0083 0884 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
17:23:41.0083 0884 VgaSave - ok
17:23:41.0114 0884 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
17:23:41.0114 0884 vhdmp - ok
17:23:41.0192 0884 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
17:23:41.0208 0884 viaide - ok
17:23:41.0239 0884 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
17:23:41.0255 0884 volmgr - ok
17:23:41.0333 0884 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
17:23:41.0348 0884 volmgrx - ok
17:23:41.0395 0884 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
17:23:41.0411 0884 volsnap - ok
17:23:41.0426 0884 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
17:23:41.0442 0884 vsmraid - ok
17:23:41.0489 0884 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
17:23:41.0489 0884 vwifibus - ok
17:23:41.0567 0884 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
17:23:41.0567 0884 vwififlt - ok
17:23:41.0582 0884 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
17:23:41.0582 0884 vwifimp - ok
17:23:41.0614 0884 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
17:23:41.0629 0884 WacomPen - ok
17:23:41.0676 0884 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
17:23:41.0692 0884 WANARP - ok
17:23:41.0692 0884 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
17:23:41.0707 0884 Wanarpv6 - ok
17:23:41.0785 0884 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
17:23:41.0785 0884 Wd - ok
17:23:41.0832 0884 WDC_SAM (a3d04ebf5227886029b4532f20d026f7) C:\Windows\system32\DRIVERS\wdcsam64.sys
17:23:41.0832 0884 WDC_SAM - ok
17:23:41.0988 0884 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
17:23:42.0004 0884 Wdf01000 - ok
17:23:42.0097 0884 wdkmd (fe31110e39a0b11abae1ba43a2dc94f9) C:\Windows\system32\DRIVERS\WDKMD.sys
17:23:42.0097 0884 wdkmd - ok
17:23:42.0144 0884 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
17:23:42.0144 0884 WfpLwf - ok
17:23:42.0206 0884 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
17:23:42.0206 0884 WIMMount - ok
17:23:42.0394 0884 WinUSB (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUSB.sys
17:23:42.0425 0884 WinUSB - ok
17:23:42.0503 0884 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
17:23:42.0503 0884 WmiAcpi - ok
17:23:43.0205 0884 wrssweep (8d1a46ecb2b031c09f0234abf13df887) C:\PROGRA~2\Webroot\Security\Current\plugins\cleanup\wrssweep.sys
17:23:43.0205 0884 wrssweep - ok
17:23:43.0579 0884 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
17:23:43.0595 0884 ws2ifsl - ok
17:23:43.0642 0884 WSDPrintDevice (8d918b1db190a4d9b1753a66fa8c96e8) C:\Windows\system32\DRIVERS\WSDPrint.sys
17:23:43.0642 0884 WSDPrintDevice - ok
17:23:43.0720 0884 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
17:23:43.0720 0884 WudfPf - ok
17:23:43.0766 0884 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
17:23:43.0782 0884 WUDFRd - ok
17:23:43.0813 0884 yukonw7 (b3eeacf62445e24fbb2cd4b0fb4db026) C:\Windows\system32\DRIVERS\yk62x64.sys
17:23:43.0829 0884 yukonw7 - ok
17:23:43.0844 0884 MBR (0x1B8) (84c4bb848bcf4b34eccce4de251a80b4) \Device\Harddisk0\DR0
17:23:43.0844 0884 \Device\Harddisk0\DR0 - ok
17:23:43.0860 0884 Boot (0x1200) (0fc2b991f841b22ac2fbaf5a2f4846df) \Device\Harddisk0\DR0\Partition0
17:23:43.0860 0884 \Device\Harddisk0\DR0\Partition0 - ok
17:23:43.0860 0884 Boot (0x1200) (81e1d76dc52080c42c8b17e77fc3d008) \Device\Harddisk0\DR0\Partition1
17:23:43.0860 0884 \Device\Harddisk0\DR0\Partition1 - ok
17:23:43.0876 0884 Boot (0x1200) (f4fe37eeb80e5430cf6d68606f0c6ee1) \Device\Harddisk0\DR0\Partition2
17:23:43.0938 0884 \Device\Harddisk0\DR0\Partition2 - ok
17:23:43.0985 0884 Boot (0x1200) (678d594a50119c5a98a0a3312aa5236a) \Device\Harddisk0\DR0\Partition3
17:23:44.0016 0884 \Device\Harddisk0\DR0\Partition3 - ok
17:23:44.0016 0884 ============================================================
17:23:44.0016 0884 Scan finished
17:23:44.0016 0884 ============================================================
17:23:44.0047 7120 Detected object count: 1
17:23:44.0047 7120 Actual detected object count: 1
17:28:00.0168 7120 C:\Windows\system32\Drivers\sptd.sys - copied to quarantine
17:28:00.0168 7120 sptd ( LockedFile.Multi.Generic ) - User select action: Quarantine
17:28:09.0794 6888 ============================================================
17:28:09.0794 6888 Scan started
17:28:09.0794 6888 Mode: Manual;
17:28:09.0794 6888 ============================================================
17:28:09.0981 6888 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
17:28:09.0981 6888 1394ohci - ok
17:28:10.0028 6888 Accelerometer (3e2427d4966c7606097341e55ab4e105) C:\Windows\system32\DRIVERS\Accelerometer.sys
17:28:10.0028 6888 Accelerometer - ok
17:28:10.0090 6888 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
17:28:10.0090 6888 ACPI - ok
17:28:10.0121 6888 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
17:28:10.0121 6888 AcpiPmi - ok
17:28:10.0152 6888 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
17:28:10.0168 6888 adp94xx - ok
17:28:10.0184 6888 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
17:28:10.0184 6888 adpahci - ok
17:28:10.0230 6888 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
17:28:10.0230 6888 adpu320 - ok
17:28:10.0277 6888 AFD (d5b031c308a409a0a576bff4cf083d30) C:\Windows\system32\drivers\afd.sys
17:28:10.0277 6888 AFD - ok
17:28:10.0340 6888 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
17:28:10.0340 6888 agp440 - ok
17:28:10.0371 6888 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
17:28:10.0371 6888 aliide - ok
17:28:10.0402 6888 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
17:28:10.0402 6888 amdide - ok
17:28:10.0464 6888 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
17:28:10.0464 6888 AmdK8 - ok
17:28:10.0605 6888 amdkmdag (06bf0785de714637eba9bb1084b28626) C:\Windows\system32\DRIVERS\atikmdag.sys
17:28:10.0636 6888 amdkmdag - ok
17:28:10.0730 6888 amdkmdap (2dec3274589ff6889ab05adceeb0f642) C:\Windows\system32\DRIVERS\atikmpag.sys
17:28:10.0730 6888 amdkmdap - ok
17:28:10.0776 6888 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
17:28:10.0776 6888 AmdPPM - ok
17:28:10.0823 6888 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
17:28:10.0823 6888 amdsata - ok
17:28:10.0854 6888 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
17:28:10.0854 6888 amdsbs - ok
17:28:10.0886 6888 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
17:28:10.0886 6888 amdxata - ok
17:28:10.0932 6888 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
17:28:10.0932 6888 AppID - ok
17:28:10.0948 6888 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
17:28:10.0948 6888 arc - ok
17:28:10.0979 6888 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
17:28:10.0979 6888 arcsas - ok
17:28:11.0010 6888 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
17:28:11.0010 6888 AsyncMac - ok
17:28:11.0073 6888 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
17:28:11.0073 6888 atapi - ok
17:28:11.0104 6888 AtiHDAudioService (4bf5bca6e2608cd8a00bc4a6673a9f47) C:\Windows\system32\drivers\AtihdW76.sys
17:28:11.0104 6888 AtiHDAudioService - ok
17:28:11.0151 6888 AtiHdmiService (2d648572ba9a610952fcafba1e119c2d) C:\Windows\system32\drivers\AtiHdmi.sys
17:28:11.0151 6888 AtiHdmiService - ok
17:28:11.0182 6888 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
17:28:11.0182 6888 b06bdrv - ok
17:28:11.0229 6888 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
17:28:11.0229 6888 b57nd60a - ok
17:28:11.0244 6888 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
17:28:11.0244 6888 Beep - ok
17:28:11.0260 6888 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
17:28:11.0260 6888 blbdrive - ok
17:28:11.0307 6888 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
17:28:11.0307 6888 bowser - ok
17:28:11.0338 6888 bpenum (f46dd257fad7d2d097ef32e72220a06c) C:\Windows\system32\DRIVERS\bpenum.sys
17:28:11.0338 6888 bpenum - ok
17:28:11.0369 6888 bpmp (e82060aed0f28ed8909f2b07fa276185) C:\Windows\system32\DRIVERS\bpmp.sys
17:28:11.0369 6888 bpmp - ok
17:28:11.0385 6888 bpusb (fc6313a5a45c1ae53d0491f0057d5a4d) C:\Windows\system32\Drivers\bpusb.sys
17:28:11.0385 6888 bpusb - ok
17:28:11.0416 6888 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
17:28:11.0416 6888 BrFiltLo - ok
17:28:11.0447 6888 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
17:28:11.0447 6888 BrFiltUp - ok
17:28:11.0478 6888 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
17:28:11.0478 6888 Brserid - ok
17:28:11.0510 6888 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
17:28:11.0510 6888 BrSerWdm - ok
17:28:11.0525 6888 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
17:28:11.0525 6888 BrUsbMdm - ok
17:28:11.0541 6888 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
17:28:11.0541 6888 BrUsbSer - ok
17:28:11.0588 6888 BTCFilterService (ff7c57973eead140062238c5a0b7d455) C:\Windows\system32\DRIVERS\motfilt.sys
17:28:11.0588 6888 BTCFilterService - ok
17:28:11.0634 6888 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
17:28:11.0634 6888 BTHMODEM - ok
17:28:11.0681 6888 CbFs (5fe05bb71c1d0878163334f5c8d99016) C:\Windows\system32\drivers\cbfs64.sys
17:28:11.0681 6888 CbFs - ok
17:28:11.0728 6888 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
17:28:11.0728 6888 cdfs - ok
17:28:11.0759 6888 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
17:28:11.0759 6888 cdrom - ok
17:28:11.0790 6888 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
17:28:11.0790 6888 circlass - ok
17:28:11.0837 6888 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
17:28:11.0837 6888 CLFS - ok
17:28:11.0884 6888 clwvd (d68d9f4d53010b7e84d4e80a2e485554) C:\Windows\system32\DRIVERS\clwvd.sys
17:28:11.0884 6888 clwvd - ok
17:28:11.0915 6888 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
17:28:11.0915 6888 CmBatt - ok
17:28:11.0962 6888 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
17:28:11.0962 6888 cmdide - ok
17:28:12.0009 6888 CNG (d5fea92400f12412b3922087c09da6a5) C:\Windows\system32\Drivers\cng.sys
17:28:12.0009 6888 CNG - ok
17:28:12.0024 6888 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
17:28:12.0024 6888 Compbatt - ok
17:28:12.0071 6888 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
17:28:12.0071 6888 CompositeBus - ok
17:28:12.0102 6888 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
17:28:12.0102 6888 crcdisk - ok
17:28:12.0149 6888 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
17:28:12.0149 6888 DfsC - ok
17:28:12.0180 6888 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
17:28:12.0180 6888 discache - ok
17:28:12.0212 6888 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
17:28:12.0212 6888 Disk - ok
17:28:12.0243 6888 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
17:28:12.0243 6888 drmkaud - ok
17:28:12.0290 6888 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
17:28:12.0290 6888 DXGKrnl - ok
17:28:12.0383 6888 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
17:28:12.0399 6888 ebdrv - ok
17:28:12.0492 6888 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
17:28:12.0492 6888 elxstor - ok
17:28:12.0555 6888 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
17:28:12.0555 6888 ErrDev - ok
17:28:12.0586 6888 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
17:28:12.0586 6888 exfat - ok
17:28:12.0602 6888 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
17:28:12.0602 6888 fastfat - ok
17:28:12.0633 6888 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
17:28:12.0633 6888 fdc - ok
17:28:12.0664 6888 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
17:28:12.0664 6888 FileInfo - ok
17:28:12.0680 6888 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
17:28:12.0680 6888 Filetrace - ok
17:28:12.0711 6888 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
17:28:12.0711 6888 flpydisk - ok
17:28:12.0758 6888 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
17:28:12.0758 6888 FltMgr - ok
17:28:12.0789 6888 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
17:28:12.0789 6888 FsDepends - ok
17:28:12.0804 6888 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
17:28:12.0804 6888 Fs_Rec - ok
17:28:12.0851 6888 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
17:28:12.0851 6888 fvevol - ok
17:28:12.0898 6888 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
17:28:12.0898 6888 gagp30kx - ok
17:28:12.0929 6888 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
17:28:12.0929 6888 hcw85cir - ok
17:28:12.0976 6888 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
17:28:12.0976 6888 HdAudAddService - ok
17:28:13.0007 6888 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
17:28:13.0007 6888 HDAudBus - ok
17:28:13.0038 6888 HECIx64 (b6ac71aaa2b10848f57fc49d55a651af) C:\Windows\system32\DRIVERS\HECIx64.sys
17:28:13.0038 6888 HECIx64 - ok
17:28:13.0070 6888 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
17:28:13.0070 6888 HidBatt - ok
17:28:13.0085 6888 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
17:28:13.0085 6888 HidBth - ok
17:28:13.0132 6888 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
17:28:13.0132 6888 HidIr - ok
17:28:13.0163 6888 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
17:28:13.0163 6888 HidUsb - ok
17:28:13.0210 6888 hpdskflt (ccbe758967cc0f53f5ba3b271653c4e6) C:\Windows\system32\DRIVERS\hpdskflt.sys
17:28:13.0210 6888 hpdskflt - ok
17:28:13.0241 6888 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
17:28:13.0241 6888 HpSAMD - ok
17:28:13.0304 6888 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
17:28:13.0304 6888 HTTP - ok
17:28:13.0366 6888 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
17:28:13.0366 6888 hwpolicy - ok
17:28:13.0413 6888 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
17:28:13.0413 6888 i8042prt - ok
17:28:13.0460 6888 iaStor (1384872112e8e7fd5786eceb8bddf4c9) C:\Windows\system32\DRIVERS\iaStor.sys
17:28:13.0460 6888 iaStor - ok
17:28:13.0506 6888 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
17:28:13.0522 6888 iaStorV - ok
17:28:13.0787 6888 igfx (1be8d9ca4f2363b8e8015621878e0043) C:\Windows\system32\DRIVERS\igdkmd64.sys
17:28:13.0834 6888 igfx - ok
17:28:13.0959 6888 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
17:28:13.0959 6888 iirsp - ok
17:28:13.0990 6888 Impcd (36fdf367a1dabff903e2214023d71368) C:\Windows\system32\DRIVERS\Impcd.sys
17:28:13.0990 6888 Impcd - ok
17:28:14.0037 6888 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
17:28:14.0037 6888 intelide - ok
17:28:14.0286 6888 intelkmd (1be8d9ca4f2363b8e8015621878e0043) C:\Windows\system32\DRIVERS\igdpmd64.sys
17:28:14.0333 6888 intelkmd - ok
17:28:14.0411 6888 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
17:28:14.0411 6888 intelppm - ok
17:28:14.0458 6888 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
17:28:14.0458 6888 IpFilterDriver - ok
17:28:14.0505 6888 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
17:28:14.0520 6888 IPMIDRV - ok
17:28:14.0552 6888 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
17:28:14.0552 6888 IPNAT - ok
17:28:14.0567 6888 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
17:28:14.0567 6888 IRENUM - ok
17:28:14.0614 6888 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
17:28:14.0614 6888 isapnp - ok
17:28:14.0645 6888 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
17:28:14.0645 6888 iScsiPrt - ok
17:28:14.0676 6888 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
17:28:14.0676 6888 kbdclass - ok
17:28:14.0708 6888 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
17:28:14.0708 6888 kbdhid - ok
17:28:14.0754 6888 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\Windows\system32\Drivers\ksecdd.sys
17:28:14.0754 6888 KSecDD - ok
17:28:14.0801 6888 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\Windows\system32\Drivers\ksecpkg.sys
17:28:14.0801 6888 KSecPkg - ok
17:28:14.0832 6888 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
17:28:14.0832 6888 ksthunk - ok
17:28:14.0848 6888 libusb0 - ok
17:28:14.0879 6888 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
17:28:14.0879 6888 lltdio - ok
17:28:14.0895 6888 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
17:28:14.0910 6888 LSI_FC - ok
17:28:14.0926 6888 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
17:28:14.0942 6888 LSI_SAS - ok
17:28:14.0957 6888 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
17:28:14.0957 6888 LSI_SAS2 - ok
17:28:14.0973 6888 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
17:28:14.0973 6888 LSI_SCSI - ok
17:28:14.0988 6888 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
17:28:14.0988 6888 luafv - ok
17:28:15.0020 6888 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
17:28:15.0020 6888 megasas - ok
17:28:15.0051 6888 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
17:28:15.0051 6888 MegaSR - ok
17:28:15.0082 6888 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
17:28:15.0082 6888 Modem - ok
17:28:15.0098 6888 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
17:28:15.0098 6888 monitor - ok
17:28:15.0129 6888 motccgp (93f5adcad940111f6d4d71ae1d9ec7f6) C:\Windows\system32\DRIVERS\motccgp.sys
17:28:15.0129 6888 motccgp - ok
17:28:15.0160 6888 motccgpfl (d51e009baeda07ebc107d49d224c2414) C:\Windows\system32\DRIVERS\motccgpfl.sys
17:28:15.0160 6888 motccgpfl - ok
17:28:15.0207 6888 motmodem (db83dc223b9133da3e41afcbdecc46b5) C:\Windows\system32\DRIVERS\motmodem.sys
17:28:15.0207 6888 motmodem - ok
17:28:15.0238 6888 MotoSwitchService (ebd05f60cafc5bba2602b8d7101082d3) C:\Windows\system32\DRIVERS\motswch.sys
17:28:15.0238 6888 MotoSwitchService - ok
17:28:15.0254 6888 Motousbnet (87701078c3f720ac7a028e937994cc49) C:\Windows\system32\DRIVERS\Motousbnet.sys
17:28:15.0254 6888 Motousbnet - ok
17:28:15.0269 6888 motusbdevice (307727f9829fb46ff4be0e4d1dac5002) C:\Windows\system32\DRIVERS\motusbdevice.sys
17:28:15.0285 6888 motusbdevice - ok
17:28:15.0332 6888 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
17:28:15.0332 6888 mouclass - ok
17:28:15.0347 6888 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
17:28:15.0363 6888 mouhid - ok
17:28:15.0410 6888 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
17:28:15.0410 6888 mountmgr - ok
17:28:15.0441 6888 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
17:28:15.0441 6888 mpio - ok
17:28:15.0488 6888 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
17:28:15.0488 6888 mpsdrv - ok
17:28:15.0519 6888 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
17:28:15.0519 6888 MRxDAV - ok
17:28:15.0566 6888 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
17:28:15.0566 6888 mrxsmb - ok
17:28:15.0612 6888 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
17:28:15.0612 6888 mrxsmb10 - ok
17:28:15.0628 6888 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
17:28:15.0628 6888 mrxsmb20 - ok
17:28:15.0675 6888 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
17:28:15.0675 6888 msahci - ok
17:28:15.0706 6888 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
17:28:15.0706 6888 msdsm - ok
17:28:15.0737 6888 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
17:28:15.0737 6888 Msfs - ok
17:28:15.0768 6888 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
17:28:15.0768 6888 mshidkmdf - ok
17:28:15.0784 6888 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
17:28:15.0784 6888 msisadrv - ok
17:28:15.0815 6888 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
17:28:15.0815 6888 MSKSSRV - ok
17:28:15.0831 6888 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
17:28:15.0831 6888 MSPCLOCK - ok
17:28:15.0862 6888 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
17:28:15.0862 6888 MSPQM - ok
17:28:15.0924 6888 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
17:28:15.0924 6888 MsRPC - ok
17:28:15.0971 6888 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
17:28:15.0971 6888 mssmbios - ok
17:28:15.0987 6888 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
17:28:15.0987 6888 MSTEE - ok
17:28:16.0018 6888 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
17:28:16.0018 6888 MTConfig - ok
17:28:16.0034 6888 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
17:28:16.0034 6888 Mup - ok
17:28:16.0065 6888 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
17:28:16.0065 6888 NativeWifiP - ok
17:28:16.0143 6888 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
17:28:16.0143 6888 NDIS - ok
17:28:16.0174 6888 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
17:28:16.0174 6888 NdisCap - ok
17:28:16.0190 6888 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
17:28:16.0190 6888 NdisTapi - ok
17:28:16.0252 6888 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
17:28:16.0252 6888 Ndisuio - ok
17:28:16.0299 6888 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
17:28:16.0314 6888 NdisWan - ok
17:28:16.0361 6888 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
17:28:16.0361 6888 NDProxy - ok
17:28:16.0392 6888 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
17:28:16.0392 6888 NetBIOS - ok
17:28:16.0439 6888 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
17:28:16.0439 6888 NetBT - ok
17:28:16.0564 6888 netw5v64 (64428dfdaf6e88366cb51f45a79c5f69) C:\Windows\system32\DRIVERS\netw5v64.sys
17:28:16.0580 6888 netw5v64 - ok
17:28:16.0845 6888 NETwNs64 (b9c587bdaa61a689883439d5ae6fe7f3) C:\Windows\system32\DRIVERS\NETwNs64.sys
17:28:16.0876 6888 NETwNs64 - ok
17:28:16.0970 6888 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
17:28:16.0970 6888 nfrd960 - ok
17:28:17.0001 6888 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
17:28:17.0001 6888 Npfs - ok
17:28:17.0032 6888 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
17:28:17.0032 6888 nsiproxy - ok
17:28:17.0094 6888 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
17:28:17.0110 6888 Ntfs - ok
17:28:17.0172 6888 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
17:28:17.0172 6888 Null - ok
17:28:17.0219 6888 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
17:28:17.0219 6888 nvraid - ok
17:28:17.0266 6888 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
17:28:17.0266 6888 nvstor - ok
17:28:17.0313 6888 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
17:28:17.0313 6888 nv_agp - ok
17:28:17.0328 6888 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
17:28:17.0344 6888 ohci1394 - ok
17:28:17.0375 6888 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
17:28:17.0375 6888 Parport - ok
17:28:17.0406 6888 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
17:28:17.0406 6888 partmgr - ok
17:28:17.0438 6888 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
17:28:17.0438 6888 pci - ok
17:28:17.0453 6888 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
17:28:17.0453 6888 pciide - ok
17:28:17.0500 6888 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
17:28:17.0500 6888 pcmcia - ok
17:28:17.0547 6888 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
17:28:17.0547 6888 pcw - ok
17:28:17.0578 6888 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
17:28:17.0578 6888 PEAUTH - ok
17:28:17.0625 6888 Point64 (b8d8ec78b0f9ed8e220506181274f3d3) C:\Windows\system32\DRIVERS\point64.sys
17:28:17.0625 6888 Point64 - ok
17:28:17.0687 6888 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
17:28:17.0687 6888 PptpMiniport - ok
17:28:17.0703 6888 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
17:28:17.0718 6888 Processor - ok
17:28:17.0750 6888 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
17:28:17.0765 6888 Psched - ok
17:28:17.0812 6888 pwipf6 (e13e8c164432d9ff0d2d51d3d02ffeae) C:\Windows\system32\DRIVERS\pwipf6.sys
17:28:17.0812 6888 pwipf6 - ok
17:28:17.0859 6888 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
17:28:17.0859 6888 ql2300 - ok
17:28:17.0906 6888 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
17:28:17.0906 6888 ql40xx - ok
17:28:17.0952 6888 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
17:28:17.0952 6888 QWAVEdrv - ok
17:28:17.0984 6888 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
17:28:17.0984 6888 RasAcd - ok
17:28:18.0015 6888 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
17:28:18.0015 6888 RasAgileVpn - ok
17:28:18.0062 6888 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
17:28:18.0062 6888 Rasl2tp - ok
17:28:18.0093 6888 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
17:28:18.0093 6888 RasPppoe - ok
17:28:18.0108 6888 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
17:28:18.0108 6888 RasSstp - ok
17:28:18.0155 6888 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
17:28:18.0155 6888 rdbss - ok
17:28:18.0187 6888 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
17:28:18.0187 6888 rdpbus - ok
17:28:18.0218 6888 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
17:28:18.0218 6888 RDPCDD - ok
17:28:18.0233 6888 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
17:28:18.0233 6888 RDPENCDD - ok
17:28:18.0249 6888 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
17:28:18.0249 6888 RDPREFMP - ok
17:28:18.0296 6888 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys
17:28:18.0296 6888 RDPWD - ok
17:28:18.0343 6888 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
17:28:18.0343 6888 rdyboost - ok
17:28:18.0374 6888 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
17:28:18.0374 6888 rspndr - ok
17:28:18.0421 6888 RSUSBSTOR (907c4464381b5ebdfdc60f6c7d0dedfc) C:\Windows\system32\Drivers\RtsUStor.sys
17:28:18.0421 6888 RSUSBSTOR - ok
17:28:18.0452 6888 RTL8167 (4b42bc58294e83a6a92ec8b88c14c4a3) C:\Windows\system32\DRIVERS\Rt64win7.sys
17:28:18.0452 6888 RTL8167 - ok
17:28:18.0499 6888 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
17:28:18.0499 6888 sbp2port - ok
17:28:18.0545 6888 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
17:28:18.0545 6888 scfilter - ok
17:28:18.0592 6888 sdbus (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\drivers\sdbus.sys
17:28:18.0592 6888 sdbus - ok
17:28:18.0623 6888 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
17:28:18.0623 6888 secdrv - ok
17:28:18.0670 6888 Ser2pl (c284622531b1238e41df70e84b7524ce) C:\Windows\system32\DRIVERS\ser2pl64.sys
17:28:18.0670 6888 Ser2pl - ok
17:28:18.0686 6888 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
17:28:18.0686 6888 Serenum - ok
17:28:18.0717 6888 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
17:28:18.0717 6888 Serial - ok
17:28:18.0764 6888 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
17:28:18.0764 6888 sermouse - ok
17:28:18.0795 6888 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
17:28:18.0811 6888 sffdisk - ok
17:28:18.0857 6888 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
17:28:18.0857 6888 sffp_mmc - ok
17:28:18.0873 6888 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
17:28:18.0889 6888 sffp_sd - ok
17:28:18.0889 6888 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
17:28:18.0889 6888 sfloppy - ok
17:28:18.0920 6888 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
17:28:18.0920 6888 SiSRaid2 - ok
17:28:18.0967 6888 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
17:28:18.0967 6888 SiSRaid4 - ok
17:28:18.0982 6888 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
17:28:18.0982 6888 Smb - ok
17:28:19.0013 6888 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
17:28:19.0013 6888 spldr - ok
17:28:19.0076 6888 sptd (602884696850c86434530790b110e8eb) C:\Windows\system32\Drivers\sptd.sys
17:28:19.0076 6888 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: 602884696850c86434530790b110e8eb
17:28:19.0076 6888 sptd ( LockedFile.Multi.Generic ) - warning
17:28:19.0076 6888 sptd - detected LockedFile.Multi.Generic (1)
17:28:19.0138 6888 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
17:28:19.0138 6888 srv - ok
17:28:19.0169 6888 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
17:28:19.0169 6888 srv2 - ok
17:28:19.0201 6888 SrvHsfHDA (0c4540311e11664b245a263e1154cef8) C:\Windows\system32\DRIVERS\VSTAZL6.SYS
17:28:19.0201 6888 SrvHsfHDA - ok
17:28:19.0232 6888 SrvHsfV92 (02071d207a9858fbe3a48cbfd59c4a04) C:\Windows\system32\DRIVERS\VSTDPV6.SYS
17:28:19.0247 6888 SrvHsfV92 - ok
17:28:19.0279 6888 SrvHsfWinac (18e40c245dbfaf36fd0134a7ef2df396) C:\Windows\system32\DRIVERS\VSTCNXT6.SYS
17:28:19.0279 6888 SrvHsfWinac - ok
17:28:19.0325 6888 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
17:28:19.0325 6888 srvnet - ok
17:28:19.0357 6888 ssfmonm (a4c4a1fedfbed04b39efae9f1311ed5e) C:\Windows\system32\DRIVERS\ssfmonm.sys
17:28:19.0357 6888 ssfmonm - ok
17:28:19.0388 6888 ssidrv (1cc88f50bd4e6fd6eac5c5365ceb6583) C:\Windows\system32\DRIVERS\ssidrv.sys
17:28:19.0388 6888 ssidrv - ok
17:28:19.0419 6888 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
17:28:19.0419 6888 stexstor - ok
17:28:19.0466 6888 STHDA (da40d9c9ccb9836d6abd1706935a2277) C:\Windows\system32\DRIVERS\stwrt64.sys
17:28:19.0466 6888 STHDA - ok
17:28:19.0513 6888 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
17:28:19.0513 6888 swenum - ok
17:28:19.0575 6888 SynTP (961cfac2a5318e212f459d651f28e0a4) C:\Windows\system32\DRIVERS\SynTP.sys
17:28:19.0575 6888 SynTP - ok
17:28:19.0653 6888 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
17:28:19.0669 6888 Tcpip - ok
17:28:19.0840 6888 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
17:28:19.0856 6888 TCPIP6 - ok
17:28:20.0012 6888 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
17:28:20.0012 6888 tcpipreg - ok
17:28:20.0043 6888 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
17:28:20.0043 6888 TDPIPE - ok
17:28:20.0074 6888 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
17:28:20.0074 6888 TDTCP - ok
17:28:20.0105 6888 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
17:28:20.0105 6888 tdx - ok
17:28:20.0152 6888 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
17:28:20.0152 6888 TermDD - ok
17:28:20.0215 6888 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
17:28:20.0215 6888 tssecsrv - ok
17:28:20.0261 6888 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
17:28:20.0261 6888 TsUsbFlt - ok
17:28:20.0308 6888 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
17:28:20.0308 6888 tunnel - ok
17:28:20.0355 6888 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
17:28:20.0355 6888 uagp35 - ok
17:28:20.0417 6888 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
17:28:20.0417 6888 udfs - ok
17:28:20.0464 6888 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
17:28:20.0464 6888 uliagpkx - ok
17:28:20.0527 6888 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
17:28:20.0527 6888 umbus - ok
17:28:20.0542 6888 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
17:28:20.0542 6888 UmPass - ok
17:28:20.0589 6888 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
17:28:20.0589 6888 usbaudio - ok
17:28:20.0636 6888 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
17:28:20.0636 6888 usbccgp - ok
17:28:20.0683 6888 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
17:28:20.0683 6888 usbcir - ok
17:28:20.0698 6888 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
17:28:20.0698 6888 usbehci - ok
17:28:20.0729 6888 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
17:28:20.0729 6888 usbhub - ok
17:28:20.0745 6888 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
17:28:20.0745 6888 usbohci - ok
17:28:20.0792 6888 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
17:28:20.0792 6888 usbprint - ok
17:28:20.0839 6888 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
17:28:20.0839 6888 USBSTOR - ok
17:28:20.0870 6888 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
17:28:20.0870 6888 usbuhci - ok
17:28:20.0917 6888 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys
17:28:20.0917 6888 usbvideo - ok
17:28:20.0963 6888 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
17:28:20.0963 6888 vdrvroot - ok
17:28:21.0010 6888 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
17:28:21.0010 6888 vga - ok
17:28:21.0041 6888 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
17:28:21.0041 6888 VgaSave - ok
17:28:21.0057 6888 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
17:28:21.0057 6888 vhdmp - ok
17:28:21.0073 6888 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
17:28:21.0073 6888 viaide - ok
17:28:21.0104 6888 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
17:28:21.0104 6888 volmgr - ok
17:28:21.0151 6888 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
17:28:21.0151 6888 volmgrx - ok
17:28:21.0182 6888 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
17:28:21.0182 6888 volsnap - ok
17:28:21.0213 6888 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
17:28:21.0213 6888 vsmraid - ok
17:28:21.0244 6888 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
17:28:21.0244 6888 vwifibus - ok
17:28:21.0260 6888 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
17:28:21.0260 6888 vwififlt - ok
17:28:21.0275 6888 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
17:28:21.0275 6888 vwifimp - ok
17:28:21.0322 6888 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
17:28:21.0322 6888 WacomPen - ok
17:28:21.0385 6888 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
17:28:21.0385 6888 WANARP - ok
17:28:21.0385 6888 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
17:28:21.0385 6888 Wanarpv6 - ok
17:28:21.0416 6888 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
17:28:21.0416 6888 Wd - ok
17:28:21.0431 6888 WDC_SAM (a3d04ebf5227886029b4532f20d026f7) C:\Windows\system32\DRIVERS\wdcsam64.sys
17:28:21.0431 6888 WDC_SAM - ok
17:28:21.0463 6888 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
17:28:21.0478 6888 Wdf01000 - ok
17:28:21.0509 6888 wdkmd (fe31110e39a0b11abae1ba43a2dc94f9) C:\Windows\system32\DRIVERS\WDKMD.sys
17:28:21.0509 6888 wdkmd - ok
17:28:21.0541 6888 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
17:28:21.0541 6888 WfpLwf - ok
17:28:21.0556 6888 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
17:28:21.0556 6888 WIMMount - ok
17:28:21.0619 6888 WinUSB (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUSB.sys
17:28:21.0619 6888 WinUSB - ok
17:28:21.0634 6888 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
17:28:21.0634 6888 WmiAcpi - ok
17:28:21.0759 6888 wrssweep (8d1a46ecb2b031c09f0234abf13df887) C:\PROGRA~2\Webroot\Security\Current\plugins\cleanup\wrssweep.sys
17:28:21.0759 6888 wrssweep - ok
17:28:21.0775 6888 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
17:28:21.0775 6888 ws2ifsl - ok
17:28:21.0837 6888 WSDPrintDevice (8d918b1db190a4d9b1753a66fa8c96e8) C:\Windows\system32\DRIVERS\WSDPrint.sys
17:28:21.0837 6888 WSDPrintDevice - ok
17:28:21.0899 6888 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
17:28:21.0899 6888 WudfPf - ok
17:28:21.0915 6888 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
17:28:21.0915 6888 WUDFRd - ok
17:28:21.0962 6888 yukonw7 (b3eeacf62445e24fbb2cd4b0fb4db026) C:\Windows\system32\DRIVERS\yk62x64.sys
17:28:21.0962 6888 yukonw7 - ok
17:28:21.0993 6888 MBR (0x1B8) (84c4bb848bcf4b34eccce4de251a80b4) \Device\Harddisk0\DR0
17:28:21.0993 6888 \Device\Harddisk0\DR0 - ok
17:28:21.0993 6888 Boot (0x1200) (0fc2b991f841b22ac2fbaf5a2f4846df) \Device\Harddisk0\DR0\Partition0
17:28:21.0993 6888 \Device\Harddisk0\DR0\Partition0 - ok
17:28:22.0009 6888 Boot (0x1200) (81e1d76dc52080c42c8b17e77fc3d008) \Device\Harddisk0\DR0\Partition1
17:28:22.0009 6888 \Device\Harddisk0\DR0\Partition1 - ok
17:28:22.0024 6888 Boot (0x1200) (f4fe37eeb80e5430cf6d68606f0c6ee1) \Device\Harddisk0\DR0\Partition2
17:28:22.0024 6888 \Device\Harddisk0\DR0\Partition2 - ok
17:28:22.0055 6888 Boot (0x1200) (678d594a50119c5a98a0a3312aa5236a) \Device\Harddisk0\DR0\Partition3
17:28:22.0055 6888 \Device\Harddisk0\DR0\Partition3 - ok
17:28:22.0055 6888 ============================================================
17:28:22.0055 6888 Scan finished
17:28:22.0055 6888 ============================================================
17:28:22.0055 3196 Detected object count: 1
17:28:22.0055 3196 Actual detected object count: 1
17:28:31.0088 3196 C:\Windows\system32\Drivers\sptd.sys - copied to quarantine
17:28:31.0088 3196 sptd ( LockedFile.Multi.Generic ) - User select action: Quarantine
Combofix
ComboFix 11-11-11.06 - Benton 11/11/2011 19:50:31.2.4 - x64 NETWORK
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.5942.4968 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Webroot Internet Security Complete *Disabled/Updated* {53211D91-0C31-95F2-E3A5-7661FB22889E}
FW: Webroot Internet Security Complete *Enabled* {6B1A9CB4-465E-94AA-C8FA-DF5405F1CFE5}
SP: Webroot Internet Security Complete *Disabled/Updated* {E840FC75-2A0B-9A7C-D915-4D1380A5C223}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\consrv.dll
c:\windows\System64
c:\windows\SysWow64\404Fix.exe
c:\windows\SysWow64\Agent.OMZ.Fix.exe
c:\windows\SysWow64\dumphive.exe
c:\windows\SysWow64\IEDFix.C.exe
c:\windows\SysWow64\IEDFix.exe
c:\windows\SysWow64\o4Patch.exe
c:\windows\SysWow64\Process.exe
c:\windows\SysWow64\SrchSTS.exe
c:\windows\SysWow64\tmp.reg
c:\windows\SysWow64\VACFix.exe
c:\windows\SysWow64\VCCLSID.exe
c:\windows\SysWow64\WS2Fix.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-10-12 to 2011-11-12 )))))))))))))))))))))))))))))))
.
.
2011-11-12 00:59 . 2011-11-12 00:59 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-11-11 22:28 . 2011-11-11 22:28 ——– d—–w- C:\TDSSKiller_Quarantine
2011-11-11 22:22 . 2011-10-07 04:16 8570192 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C93AC8C4-1A36-4349-83A5-C4B9CF274266}\mpengine.dll
2011-11-11 22:21 . 2011-11-11 22:21 ——– d—–w- c:\users\Benton\AppData\Local\WinZip
2011-11-10 12:22 . 2011-10-01 05:45 886784 —-a-w- c:\program files\Common Files\System\wab32.dll
2011-11-10 12:22 . 2011-10-01 04:37 708608 —-a-w- c:\program files (x86)\Common Files\System\wab32.dll
2011-11-10 12:22 . 2011-09-29 16:29 1923952 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-10 12:22 . 2011-09-29 04:03 3144704 —-a-w- c:\windows\system32\win32k.sys
2011-11-10 01:15 . 2011-11-10 01:15 ——– d—–w- c:\users\Benton\AppData\Local\Norman Malware Cleaner
2011-11-09 04:24 . 2011-11-09 23:03 691 —-a-w- c:\users\Benton\AppData\Roaming\GetValue.vbs
2011-11-09 04:24 . 2011-11-09 23:03 35 —-a-w- c:\users\Benton\AppData\Roaming\SetValue.bat
2011-11-09 03:54 . 2011-11-09 03:54 ——– d—–w- c:\programdata\Kaspersky Lab
2011-11-09 03:54 . 2011-11-09 10:52 460888 —-a-w- c:\windows\system32\drivers\79483416.sys
2011-11-08 12:07 . 2011-11-08 12:07 ——– d—–w- c:\program files (x86)\Common Files\Java
2011-11-08 04:10 . 2011-11-08 04:10 ——– d—–w- c:\windows\SysWow64\272F~1
2011-11-08 04:09 . 2011-11-08 04:09 ——– d—–w- c:\windows\SysWow64\6FDA~1
2011-11-08 04:09 . 2011-11-08 04:09 ——– d—–w- c:\windows\SysWow64\FE19~1
2011-11-08 04:09 . 2011-11-08 04:09 ——– d—–w- c:\windows\SysWow64\7632~1
2011-11-08 04:08 . 2011-11-08 04:08 ——– d—–w- c:\windows\SysWow64\5183~1
2011-11-08 04:08 . 2011-11-08 04:08 ——– d—–w- c:\windows\SysWow64\1D7D~1
2011-11-08 04:08 . 2011-11-08 04:08 ——– d—–w- c:\windows\SysWow64\1D58~1
2011-11-08 04:07 . 2011-11-08 04:07 ——– d—–w- c:\windows\SysWow64\3026~1
2011-11-08 04:07 . 2011-11-08 04:07 ——– d—–w- c:\windows\SysWow64\DFB4~1
2011-11-08 04:07 . 2011-11-08 04:07 ——– d—–w- c:\windows\SysWow64\E4ED~1
2011-11-08 04:06 . 2011-11-08 04:06 ——– d—–w- c:\windows\SysWow64\99FF~1
2011-11-08 04:06 . 2011-11-08 04:06 ——– d—–w- c:\windows\SysWow64\9915~1
2011-11-08 04:05 . 2011-11-08 04:05 ——– d—–w- c:\windows\SysWow64\B398~1
2011-11-08 04:05 . 2011-11-08 04:05 ——– d—–w- c:\windows\SysWow64\6656~1
2011-11-08 04:04 . 2011-11-08 04:04 ——– d—–w- c:\windows\SysWow64\F2CD~1
2011-11-08 04:04 . 2011-11-08 04:04 ——– d—–w- c:\windows\SysWow64\6F86~1
2011-11-08 04:03 . 2011-11-08 04:03 ——– d—–w- c:\windows\SysWow64\68E5~1
2011-11-07 02:21 . 2011-11-07 02:21 ——– d—–w- c:\users\Benton\AppData\Local\Kobo
2011-11-07 02:20 . 2011-11-07 02:21 ——– d—–w- c:\program files (x86)\Kobo
2011-11-06 22:39 . 2011-11-06 22:39 ——– d—–w- c:\users\Benton\AppData\Roaming\NhwCIP1bpJf
2011-11-06 22:37 . 2011-11-06 22:37 ——– d—–w- c:\users\Benton\AppData\Roaming\WjUCekIBrOyAuSi
2011-11-06 22:37 . 2011-11-06 22:37 ——– d—–w- c:\users\Benton\AppData\Roaming\c3pnG4aQH
2011-11-06 22:37 . 2011-11-06 22:37 ——– d—–w- c:\users\Benton\AppData\Roaming\sA0uvS2ib3n5Q6W
2011-11-06 22:37 . 2011-11-06 22:37 ——– d—–w- c:\users\Benton\AppData\Roaming\oTTXXwjUCelIrP
2011-11-06 22:35 . 2011-11-06 22:35 ——– d—–w- c:\users\Benton\AppData\Roaming\xPP00yccA1iD2n
2011-11-06 22:34 . 2011-11-06 22:34 ——– d—–w- c:\users\Benton\AppData\Roaming\TWK8fRL9hXjCkBz
2011-11-06 22:33 . 2011-11-06 22:33 ——– d—–w- c:\users\Benton\AppData\Roaming\RzzzONNyxA0vSib
2011-11-06 22:32 . 2011-11-06 22:32 ——– d—–w- c:\users\Benton\AppData\Roaming\FEEKK8fRZ9hT
2011-11-06 22:32 . 2011-11-06 22:32 ——– d—–w- c:\users\Benton\AppData\Roaming\zQQJJ7dEEKgRZ
2011-11-06 22:32 . 2011-11-06 22:32 ——– d—–w- c:\users\Benton\AppData\Roaming\sXXXwjjUCelIrz
2011-11-06 22:32 . 2011-11-06 22:32 ——– d—–w- c:\users\Benton\AppData\Roaming\eyyccAA1uvD
2011-11-06 22:32 . 2011-11-06 22:32 ——– d—–w- c:\users\Benton\AppData\Roaming\SSS22obbF3pG5Q6
2011-11-06 22:32 . 2011-11-06 22:32 ——– d—–w- c:\users\Benton\AppData\Roaming\mbbbF44pmG5sJ
2011-11-06 22:32 . 2011-11-06 22:32 ——– d—–w- c:\users\Benton\AppData\Roaming\SddWWK8ffR9hT
2011-11-06 22:32 . 2011-11-06 22:32 ——– d—–w- c:\users\Benton\AppData\Roaming\whTTXXwjUCelBrP
2011-11-06 22:32 . 2011-11-06 22:32 ——– d—–w- c:\users\Benton\AppData\Roaming\aaaQQJ66dWKfR9h
2011-11-06 22:32 . 2011-11-06 22:32 ——– d—–w- c:\users\Benton\AppData\Roaming\JpppmGG5s
2011-10-26 22:35 . 2011-10-26 22:35 ——– d—–w- c:\users\Mcx1-CUDA-LAPTOP
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-10 22:14 . 2011-06-01 07:49 737072 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll
2011-11-10 22:13 . 2011-04-03 22:14 4283672 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-11-10 22:12 . 2011-04-03 22:14 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-11-10 22:12 . 2011-04-03 22:13 539968 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-11-08 07:25 . 2011-04-03 22:15 737072 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2011-11-08 07:24 . 2011-04-12 22:37 4283672 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2011-11-08 07:23 . 2011-04-12 22:36 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2011-11-03 11:15 . 2011-05-25 22:50 404640 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-07 17:52 . 2011-10-07 17:52 37376 —-a-w- c:\windows\SysWow64\libusb0.dll
2011-10-07 17:52 . 2011-10-07 17:52 21504 —-a-w- c:\windows\SysWow64\drivers\libusb0.sys
2011-10-03 10:06 . 2010-10-16 19:37 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll
2011-09-13 02:48 . 2011-08-15 22:13 6285008 —-a-w- c:\program files (x86)\Common Files\wruninstall.exe
2011-09-04 18:27 . 2011-09-04 18:27 178800 —-a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-09-01 05:24 . 2011-10-12 23:07 2309120 —-a-w- c:\windows\system32\jscript9.dll
2011-09-01 05:17 . 2011-10-12 23:07 1389056 —-a-w- c:\windows\system32\wininet.dll
2011-09-01 05:12 . 2011-10-12 23:07 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2011-09-01 02:35 . 2011-10-12 23:07 1798144 —-a-w- c:\windows\SysWow64\jscript9.dll
2011-09-01 02:28 . 2011-10-12 23:07 1126912 —-a-w- c:\windows\SysWow64\wininet.dll
2011-09-01 02:22 . 2011-10-12 23:07 2382848 —-a-w- c:\windows\SysWow64\mshtml.tlb
2011-08-31 21:00 . 2011-09-06 17:10 25416 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-27 05:37 . 2011-10-12 21:23 861696 —-a-w- c:\windows\system32\oleaut32.dll
2011-08-27 05:37 . 2011-10-12 21:23 331776 —-a-w- c:\windows\system32\oleacc.dll
2011-08-27 04:26 . 2011-10-12 21:23 571904 —-a-w- c:\windows\SysWow64\oleaut32.dll
2011-08-27 04:26 . 2011-10-12 21:23 233472 —-a-w- c:\windows\SysWow64\oleacc.dll
2011-08-17 05:26 . 2011-10-12 21:24 613888 —-a-w- c:\windows\system32\psisdecd.dll
2011-08-17 05:25 . 2011-10-12 21:24 108032 —-a-w- c:\windows\system32\psisrndr.ax
2011-08-17 04:24 . 2011-10-12 21:24 465408 —-a-w- c:\windows\SysWow64\psisdecd.dll
2011-08-17 04:19 . 2011-10-12 21:24 75776 —-a-w- c:\windows\SysWow64\psisrndr.ax
2011-08-16 00:19 . 2011-08-16 00:19 72280 —-a-w- c:\windows\system32\drivers\sbapifs.sys
2011-08-16 00:16 . 2011-08-16 00:16 55384 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-11-22 2736128]
"igndlm.exe"="c:\program files (x86)\Download Manager\DLM.exe" [2009-10-27 1103216]
"ISUSPM"="c:\programdata\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2008-10-20 210208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-09-09 98304]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"WebrootTrayApp"="c:\program files (x86)\Webroot\Security\Current\Framework\WRTray.exe" [2011-11-08 1382984]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ DPPassFilter scecli
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-09-01 1431888]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [x]
R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-07-20 340240]
R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [x]
R3 wrssweep;Webroots Volume Access Driver;c:\progra~2\Webroot\Security\Current\plugins\cleanup\wrssweep.sys [2011-07-21 26040]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 CbFs;CbFs;c:\windows\system32\drivers\cbfs64.sys [x]
S1 pwipf6;Privacyware Filter Driver;c:\windows\system32\DRIVERS\pwipf6.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-04 89600]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;c:\program files\Intel\WiMAX\Bin\DMAgent.exe [2010-06-07 408576]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 291896]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-07-05 227384]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-06-14 26680]
S2 MotoConnect Service;MotoConnect Service;c:\program files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2010-06-24 91456]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-09-11 399344]
S2 ssfmonm;ssfmonm;c:\windows\system32\DRIVERS\ssfmonm.sys [x]
S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-05-01 2533400]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-02-23 2192176]
S2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;c:\program files\Intel\WiMAX\Bin\AppSrv.exe [2010-06-07 911872]
S2 WRConsumerService;Webroot Client Service;c:\program files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe [2011-11-08 3386840]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 bpenum;bpenum;c:\windows\system32\DRIVERS\bpenum.sys [x]
S3 bpmp;Intel® Centrino® WiMAX 6050 Series;c:\windows\system32\DRIVERS\bpmp.sys [x]
S3 bpusb;bpusb;c:\windows\system32\Drivers\bpusb.sys [x]
S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys [x]
S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-11-22 18:18 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-12 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-637982829-1949637309-3597935670-1000Core.job
- c:\users\Benton\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-08-19 23:03]
.
2011-11-12 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-637982829-1949637309-3597935670-1000UA.job
- c:\users\Benton\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-08-19 23:03]
.
2011-10-14 c:\windows\Tasks\HPCeeScheduleForBenton.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
2011-11-05 c:\windows\Tasks\HPCeeScheduleForCUDA-LAPTOP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]
@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"
[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]
@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"
[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]
@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"
[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]
@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"
[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]
@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"
[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp]
@="{6B78A880-15CA-468f-8422-A7960AD6FBB9}"
[HKEY_CLASSES_ROOT\CLSID\{6B78A880-15CA-468f-8422-A7960AD6FBB9}]
2011-10-29 04:16 404792 —-a-w- c:\program files (x86)\Webroot\Security\Current\plugins\sync\WebRootShellExt_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending]
@="{4EE7A346-5845-471e-9FAB-002EAF83F8B0}"
[HKEY_CLASSES_ROOT\CLSID\{4EE7A346-5845-471e-9FAB-002EAF83F8B0}]
2011-10-29 04:16 404792 —-a-w- c:\program files (x86)\Webroot\Security\Current\plugins\sync\WebRootShellExt_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot]
@="{53DABC15-4F29-44ad-B09A-E0D0F9A3D075}"
[HKEY_CLASSES_ROOT\CLSID\{53DABC15-4F29-44ad-B09A-E0D0F9A3D075}]
2011-10-29 04:16 404792 —-a-w- c:\program files (x86)\Webroot\Security\Current\plugins\sync\WebRootShellExt_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared]
@="{493FC96E-B938-4924-9B38-C4088E9B8AC2}"
[HKEY_CLASSES_ROOT\CLSID\{493FC96E-B938-4924-9B38-C4088E9B8AC2}]
2011-10-29 04:16 404792 —-a-w- c:\program files (x86)\Webroot\Security\Current\plugins\sync\WebRootShellExt_x64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-07-23 487424]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-07-20 1931024]
"IntelWirelessWiMAX"="c:\program files\Intel\WiMAX\Bin\WiMAXCU.exe" [2010-06-08 1441792]
"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2010-09-01 611896]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 2327952]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-28 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-28 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-07-28 415256]
"combofix"="c:\combofix\CF17279.3XE" [2010-11-20 345088]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences Pro\FencesMenu64.dll" [2010-09-16 464744]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://www.bigseekpro.com/hypercam/{08F5E82F-7002-4FDF-BD31-99AB2DD58CA0}
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: intuit.com\ttlc
Trusted Zone: soe.com
Trusted Zone: sony.com
FF - ProfilePath - c:\users\Benton\AppData\Roaming\Mozilla\Firefox\Profiles\dh9p4v9x.default\
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:41,5f,ea,cf,75,0b,cc,01
.
[HKEY_USERS\S-1-5-21-637982829-1949637309-3597935670-1000\Software\SecuROM\License information*]
"datasecu"=hex:0b,b8,5b,dd,91,30,93,ef,26,ae,ac,83,d9,b8,92,1b,41,e2,c0,18,74,
45,fb,77,57,bb,3f,17,30,75,91,0a,cb,7f,87,a1,86,fb,dd,8c,35,34,66,96,bf,a8,\
"rkeysecu"=hex:86,09,40,0a,49,e7,71,52,20,94,10,c5,16,02,15,0c
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
———————— Other Running Processes ————————
.
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Webroot\Security\current\plugins\antimalware\AEI.exe
c:\program files (x86)\DigitalPersona\Bin\DPAgent.exe
c:\progra~2\Webroot\Security\Current\plugins\cleanup\WRCLEA~1.EXE
c:\program files (x86)\Motorola\MotoConnectService\MotoConnect.exe
c:\program files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Completion time: 2011-11-11 20:16:21 - machine was rebooted
ComboFix-quarantined-files.txt 2011-11-12 01:16
.
Pre-Run: 373,341,749,248 bytes free
Post-Run: 373,187,059,712 bytes free
.
- - End Of File - - 2ADA7DB79C42A40B8B63085281AEA0E1
once i get my personal files I would like for you to assist me in formating and reinstalling OS. I wanna make sure that everything is fixed and that I do it right.
thanks again
Hi z0ne,
Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside DDS::
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: intuit.com\ttlc
Trusted Zone: soe.com
Trusted Zone: sony.com
BHO-X64: Webroot Browser Helper Object - No File
BHO-X64: WRCommonBHO - No File
File::
c:\users\Benton\AppData\Roaming\GetValue.vbs
c:\users\Benton\AppData\Roaming\SetValue.bat
c:\windows\system32\drivers\79483416.sys
Folder::
c:\windows\SysWow64\272F~1
c:\windows\SysWow64\6FDA~1
c:\windows\SysWow64\FE19~1
c:\windows\SysWow64\7632~1
c:\windows\SysWow64\5183~1
c:\windows\SysWow64\1D7D~1
c:\windows\SysWow64\1D58~1
c:\windows\SysWow64\3026~1
c:\windows\SysWow64\DFB4~1
c:\windows\SysWow64\E4ED~1
c:\windows\SysWow64\99FF~1
c:\windows\SysWow64\9915~1
c:\windows\SysWow64\B398~1
c:\windows\SysWow64\6656~1
c:\windows\SysWow64\F2CD~1
c:\windows\SysWow64\6F86~1
c:\windows\SysWow64\68E5~1
c:\users\Benton\AppData\Roaming\NhwCIP1bpJf
c:\users\Benton\AppData\Roaming\WjUCekIBrOyAuSi
c:\users\Benton\AppData\Roaming\c3pnG4aQH
c:\users\Benton\AppData\Roaming\sA0uvS2ib3n5Q6W
c:\users\Benton\AppData\Roaming\oTTXXwjUCelIrP
c:\users\Benton\AppData\Roaming\xPP00yccA1iD2n
c:\users\Benton\AppData\Roaming\TWK8fRL9hXjCkBz
c:\users\Benton\AppData\Roaming\RzzzONNyxA0vSib
c:\users\Benton\AppData\Roaming\FEEKK8fRZ9hT
c:\users\Benton\AppData\Roaming\zQQJJ7dEEKgRZ
c:\users\Benton\AppData\Roaming\sXXXwjjUCelIrz
c:\users\Benton\AppData\Roaming\eyyccAA1uvD
c:\users\Benton\AppData\Roaming\SSS22obbF3pG5Q6
c:\users\Benton\AppData\Roaming\mbbbF44pmG5sJ
c:\users\Benton\AppData\Roaming\SddWWK8ffR9hT
c:\users\Benton\AppData\Roaming\whTTXXwjUCelBrP
c:\users\Benton\AppData\Roaming\aaaQQJ66dWKfR9h
c:\users\Benton\AppData\Roaming\JpppmGG5s
RegLock::
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.[external image: Posted Image] Very Important! Referring to the screenshot above, drag CFScript.txt into ComboFix.exe. ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal. When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply. CAUTION : Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-
hope i did it right
ComboFix 11-11-11.06 - Benton 11/11/2011 23:16:50.3.4 - x64 NETWORK
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.5942.4999 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Benton\Desktop\CFScript.txt
AV: Webroot Internet Security Complete *Disabled/Updated* {53211D91-0C31-95F2-E3A5-7661FB22889E}
FW: Webroot Internet Security Complete *Enabled* {6B1A9CB4-465E-94AA-C8FA-DF5405F1CFE5}
SP: Webroot Internet Security Complete *Disabled/Updated* {E840FC75-2A0B-9A7C-D915-4D1380A5C223}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
FILE ::
"c:\users\Benton\AppData\Roaming\GetValue.vbs"
"c:\users\Benton\AppData\Roaming\SetValue.bat"
"c:\windows\system32\drivers\79483416.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Benton\AppData\Roaming\aaaQQJ66dWKfR9h
c:\users\Benton\AppData\Roaming\c3pnG4aQH
c:\users\Benton\AppData\Roaming\eyyccAA1uvD
c:\users\Benton\AppData\Roaming\FEEKK8fRZ9hT
c:\users\Benton\AppData\Roaming\GetValue.vbs
c:\users\Benton\AppData\Roaming\JpppmGG5s
c:\users\Benton\AppData\Roaming\mbbbF44pmG5sJ
c:\users\Benton\AppData\Roaming\NhwCIP1bpJf
c:\users\Benton\AppData\Roaming\oTTXXwjUCelIrP
c:\users\Benton\AppData\Roaming\RzzzONNyxA0vSib
c:\users\Benton\AppData\Roaming\sA0uvS2ib3n5Q6W
c:\users\Benton\AppData\Roaming\SddWWK8ffR9hT
c:\users\Benton\AppData\Roaming\SetValue.bat
c:\users\Benton\AppData\Roaming\SSS22obbF3pG5Q6
c:\users\Benton\AppData\Roaming\sXXXwjjUCelIrz
c:\users\Benton\AppData\Roaming\TWK8fRL9hXjCkBz
c:\users\Benton\AppData\Roaming\whTTXXwjUCelBrP
c:\users\Benton\AppData\Roaming\WjUCekIBrOyAuSi
c:\users\Benton\AppData\Roaming\xPP00yccA1iD2n
c:\users\Benton\AppData\Roaming\zQQJJ7dEEKgRZ
c:\windows\system32\drivers\79483416.sys
c:\windows\SysWow64\1D58~1
c:\windows\SysWow64\1D7D~1
c:\windows\SysWow64\272F~1
c:\windows\SysWow64\3026~1
c:\windows\SysWow64\5183~1
c:\windows\SysWow64\6656~1
c:\windows\SysWow64\68E5~1
c:\windows\SysWow64\6F86~1
c:\windows\SysWow64\6FDA~1
c:\windows\SysWow64\7632~1
c:\windows\SysWow64\9915~1
c:\windows\SysWow64\99FF~1
c:\windows\SysWow64\B398~1
c:\windows\SysWow64\DFB4~1
c:\windows\SysWow64\E4ED~1
c:\windows\SysWow64\F2CD~1
c:\windows\SysWow64\FE19~1
.
.
((((((((((((((((((((((((( Files Created from 2011-10-12 to 2011-11-12 )))))))))))))))))))))))))))))))
.
.
2011-11-12 04:24 . 2011-11-12 04:24 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-11-12 01:15 . 2011-11-12 01:43 69000 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C93AC8C4-1A36-4349-83A5-C4B9CF274266}\offreg.dll
2011-11-11 22:28 . 2011-11-11 22:28 ——– d—–w- C:\TDSSKiller_Quarantine
2011-11-11 22:22 . 2011-10-07 04:16 8570192 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C93AC8C4-1A36-4349-83A5-C4B9CF274266}\mpengine.dll
2011-11-11 22:21 . 2011-11-11 22:21 ——– d—–w- c:\users\Benton\AppData\Local\WinZip
2011-11-10 12:22 . 2011-10-01 05:45 886784 —-a-w- c:\program files\Common Files\System\wab32.dll
2011-11-10 12:22 . 2011-10-01 04:37 708608 —-a-w- c:\program files (x86)\Common Files\System\wab32.dll
2011-11-10 12:22 . 2011-09-29 16:29 1923952 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-10 12:22 . 2011-09-29 04:03 3144704 —-a-w- c:\windows\system32\win32k.sys
2011-11-10 01:15 . 2011-11-10 01:15 ——– d—–w- c:\users\Benton\AppData\Local\Norman Malware Cleaner
2011-11-09 03:54 . 2011-11-09 03:54 ——– d—–w- c:\programdata\Kaspersky Lab
2011-11-08 12:07 . 2011-11-08 12:07 ——– d—–w- c:\program files (x86)\Common Files\Java
2011-11-07 02:21 . 2011-11-07 02:21 ——– d—–w- c:\users\Benton\AppData\Local\Kobo
2011-11-07 02:20 . 2011-11-07 02:21 ——– d—–w- c:\program files (x86)\Kobo
2011-11-06 22:39 . 2011-11-06 22:39 ——– d—–w- c:\users\Benton\AppData\Roaming\gItyDFmQdKf9jIN
2011-11-06 22:36 . 2011-11-06 22:36 ——– d—–w- c:\users\Benton\AppData\Roaming\oIIBBtzzPNyA1vD
2011-11-06 22:35 . 2011-11-06 22:35 ——– d—–w- c:\users\Benton\AppData\Roaming\dzzPPNyyc
2011-11-06 22:34 . 2011-11-06 22:34 ——– d—–w- c:\users\Benton\AppData\Roaming\wycA1uvD2b
2011-11-06 22:33 . 2011-11-06 22:33 ——– d—–w- c:\users\Benton\AppData\Roaming\n222obbF3pmG
2011-11-03 11:15 . 2011-11-03 11:15 ——– d—–w- c:\users\Benton\AppData\Local\SCE
2011-10-26 22:35 . 2011-10-26 22:35 ——– d—–w- c:\users\Mcx1-CUDA-LAPTOP
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-10 22:14 . 2011-06-01 07:49 737072 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll
2011-11-10 22:13 . 2011-04-03 22:14 4283672 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-11-10 22:12 . 2011-04-03 22:14 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-11-10 22:12 . 2011-04-03 22:13 539968 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-11-08 07:25 . 2011-04-03 22:15 737072 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2011-11-08 07:24 . 2011-04-12 22:37 4283672 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2011-11-08 07:23 . 2011-04-12 22:36 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2011-11-03 11:15 . 2011-05-25 22:50 404640 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-07 17:52 . 2011-10-07 17:52 37376 —-a-w- c:\windows\SysWow64\libusb0.dll
2011-10-07 17:52 . 2011-10-07 17:52 21504 —-a-w- c:\windows\SysWow64\drivers\libusb0.sys
2011-10-03 10:06 . 2010-10-16 19:37 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll
2011-09-13 02:48 . 2011-08-15 22:13 6285008 —-a-w- c:\program files (x86)\Common Files\wruninstall.exe
2011-09-04 18:27 . 2011-09-04 18:27 178800 —-a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2011-09-01 05:24 . 2011-10-12 23:07 2309120 —-a-w- c:\windows\system32\jscript9.dll
2011-09-01 05:17 . 2011-10-12 23:07 1389056 —-a-w- c:\windows\system32\wininet.dll
2011-09-01 05:12 . 2011-10-12 23:07 2382848 —-a-w- c:\windows\system32\mshtml.tlb
2011-09-01 02:35 . 2011-10-12 23:07 1798144 —-a-w- c:\windows\SysWow64\jscript9.dll
2011-09-01 02:28 . 2011-10-12 23:07 1126912 —-a-w- c:\windows\SysWow64\wininet.dll
2011-09-01 02:22 . 2011-10-12 23:07 2382848 —-a-w- c:\windows\SysWow64\mshtml.tlb
2011-08-31 21:00 . 2011-09-06 17:10 25416 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-08-27 05:37 . 2011-10-12 21:23 861696 —-a-w- c:\windows\system32\oleaut32.dll
2011-08-27 05:37 . 2011-10-12 21:23 331776 —-a-w- c:\windows\system32\oleacc.dll
2011-08-27 04:26 . 2011-10-12 21:23 571904 —-a-w- c:\windows\SysWow64\oleaut32.dll
2011-08-27 04:26 . 2011-10-12 21:23 233472 —-a-w- c:\windows\SysWow64\oleacc.dll
2011-08-17 05:26 . 2011-10-12 21:24 613888 —-a-w- c:\windows\system32\psisdecd.dll
2011-08-17 05:25 . 2011-10-12 21:24 108032 —-a-w- c:\windows\system32\psisrndr.ax
2011-08-17 04:24 . 2011-10-12 21:24 465408 —-a-w- c:\windows\SysWow64\psisdecd.dll
2011-08-17 04:19 . 2011-10-12 21:24 75776 —-a-w- c:\windows\SysWow64\psisrndr.ax
2011-08-16 00:19 . 2011-08-16 00:19 72280 —-a-w- c:\windows\system32\drivers\sbapifs.sys
2011-08-16 00:16 . 2011-08-16 00:16 55384 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-11-12_01.04.27 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 05:10 . 2011-11-12 01:07 39448 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-11-12 01:36 39448 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-02-04 14:30 . 2011-11-12 01:36 11590 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-637982829-1949637309-3597935670-1000_UserData.bin
+ 2010-12-15 08:42 . 2011-11-12 01:29 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-12-15 08:42 . 2011-11-12 01:01 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-12-15 08:42 . 2011-11-12 01:29 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-12-15 08:42 . 2011-11-12 01:01 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-11-12 01:29 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:54 . 2011-11-12 01:01 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-11-12 01:00 . 2011-11-12 01:39 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-11-12 01:00 . 2011-11-12 01:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-11-12 01:00 . 2011-11-12 01:39 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-11-12 01:00 . 2011-11-12 01:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 04:54 . 2011-11-12 01:00 589824 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2011-11-12 01:39 589824 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 02:36 . 2011-11-11 22:19 663472 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-11-12 01:51 663472 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-11-12 01:51 122308 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-11-11 22:19 122308 c:\windows\system32\perfc009.dat
- 2009-07-14 04:54 . 2011-11-12 01:00 4734976 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2011-11-12 01:39 4734976 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-11-12 01:00 16187392 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-11-12 01:39 16187392 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-11-22 2736128]
"igndlm.exe"="c:\program files (x86)\Download Manager\DLM.exe" [2009-10-27 1103216]
"ISUSPM"="c:\programdata\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2008-10-20 210208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-09-09 98304]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"WebrootTrayApp"="c:\program files (x86)\Webroot\Security\Current\Framework\WRTray.exe" [2011-11-08 1382984]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ DPPassFilter scecli
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"
.
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
R1 CbFs;CbFs;c:\windows\system32\drivers\cbfs64.sys [x]
R2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2009-03-04 89600]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 DMAgent;Intel® PROSet/Wireless WiMAX Red Bend Device Management Service;c:\program files\Intel\WiMAX\Bin\DMAgent.exe [2010-06-07 408576]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992]
R2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 291896]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-07-05 227384]
R2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
R2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2011-06-14 26680]
R2 MotoConnect Service;MotoConnect Service;c:\program files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2010-06-24 91456]
R2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]
R2 RoxioNow Service;RoxioNow Service;c:\program files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-09-11 399344]
R2 ssfmonm;ssfmonm;c:\windows\system32\DRIVERS\ssfmonm.sys [x]
R2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-05-01 2533400]
R2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2010-02-23 2192176]
R2 WiMAXAppSrv;Intel® PROSet/Wireless WiMAX Service;c:\program files\Intel\WiMAX\Bin\AppSrv.exe [2010-06-07 911872]
R2 WRConsumerService;Webroot Client Service;c:\program files (x86)\Webroot\Security\Current\Framework\WRConsumerService.exe [2011-11-08 3386840]
R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
R3 bpenum;bpenum;c:\windows\system32\DRIVERS\bpenum.sys [x]
R3 bpmp;Intel® Centrino® WiMAX 6050 Series;c:\windows\system32\DRIVERS\bpmp.sys [x]
R3 bpusb;bpusb;c:\windows\system32\Drivers\bpusb.sys [x]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [x]
R3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-09-01 1431888]
R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
R3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys [x]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [x]
R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-07-20 340240]
R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [x]
R3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [x]
R3 wrssweep;Webroots Volume Access Driver;c:\progra~2\Webroot\Security\Current\plugins\cleanup\wrssweep.sys [2011-07-21 26040]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
S1 pwipf6;Privacyware Filter Driver;c:\windows\system32\DRIVERS\pwipf6.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 NETwNs64;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-11-22 18:18 451872 —-a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-12 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-637982829-1949637309-3597935670-1000Core.job
- c:\users\Benton\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-08-19 23:03]
.
2011-11-12 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-637982829-1949637309-3597935670-1000UA.job
- c:\users\Benton\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-08-19 23:03]
.
2011-10-14 c:\windows\Tasks\HPCeeScheduleForBenton.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
2011-11-05 c:\windows\Tasks\HPCeeScheduleForCUDA-LAPTOP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]
@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"
[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]
@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"
[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]
@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"
[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]
@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"
[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]
@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"
[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]
2010-09-23 04:53 2210304 —-a-w- c:\program files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp]
@="{6B78A880-15CA-468f-8422-A7960AD6FBB9}"
[HKEY_CLASSES_ROOT\CLSID\{6B78A880-15CA-468f-8422-A7960AD6FBB9}]
2011-10-29 04:16 404792 —-a-w- c:\program files (x86)\Webroot\Security\Current\plugins\sync\WebRootShellExt_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending]
@="{4EE7A346-5845-471e-9FAB-002EAF83F8B0}"
[HKEY_CLASSES_ROOT\CLSID\{4EE7A346-5845-471e-9FAB-002EAF83F8B0}]
2011-10-29 04:16 404792 —-a-w- c:\program files (x86)\Webroot\Security\Current\plugins\sync\WebRootShellExt_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot]
@="{53DABC15-4F29-44ad-B09A-E0D0F9A3D075}"
[HKEY_CLASSES_ROOT\CLSID\{53DABC15-4F29-44ad-B09A-E0D0F9A3D075}]
2011-10-29 04:16 404792 —-a-w- c:\program files (x86)\Webroot\Security\Current\plugins\sync\WebRootShellExt_x64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared]
@="{493FC96E-B938-4924-9B38-C4088E9B8AC2}"
[HKEY_CLASSES_ROOT\CLSID\{493FC96E-B938-4924-9B38-C4088E9B8AC2}]
2011-10-29 04:16 404792 —-a-w- c:\program files (x86)\Webroot\Security\Current\plugins\sync\WebRootShellExt_x64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-07-23 487424]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-07-20 1931024]
"IntelWirelessWiMAX"="c:\program files\Intel\WiMAX\Bin\WiMAXCU.exe" [2010-06-08 1441792]
"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2010-09-01 611896]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 2327952]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-28 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-28 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-07-28 415256]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences Pro\FencesMenu64.dll" [2010-09-16 464744]
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://www.bigseekpro.com/hypercam/{08F5E82F-7002-4FDF-BD31-99AB2DD58CA0}
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Benton\AppData\Roaming\Mozilla\Firefox\Profiles\dh9p4v9x.default\
FF - prefs.js: network.proxy.type - 0
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:41,5f,ea,cf,75,0b,cc,01
.
[HKEY_USERS\S-1-5-21-637982829-1949637309-3597935670-1000\Software\SecuROM\License information*]
"datasecu"=hex:0b,b8,5b,dd,91,30,93,ef,26,ae,ac,83,d9,b8,92,1b,41,e2,c0,18,74,
45,fb,77,57,bb,3f,17,30,75,91,0a,cb,7f,87,a1,86,fb,dd,8c,35,34,66,96,bf,a8,\
"rkeysecu"=hex:86,09,40,0a,49,e7,71,52,20,94,10,c5,16,02,15,0c
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-11-11 23:25:46
ComboFix-quarantined-files.txt 2011-11-12 04:25
ComboFix2.txt 2011-11-12 01:16
.
Pre-Run: 373,279,207,424 bytes free
Post-Run: 373,222,359,040 bytes free
.
- - End Of File - - C998708850E0BAEA168290C57D7EE535
My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following: