I have been fighting with this one all day. I have run malwarebytes by the directions on bleeping computer twice, once in safe mode with almost everything shut down. I have run it once in tandem with AVG antivirus. I have followed all the directions, including using the rkill step, and even when rkill is running it doesn't stop ping.exe. Right now i have ping.exe suspended as I found it in my task manager window. I'm going to try to keep that up since it'll restart if I try to stop it.
I'm attaching the DDS log like it said and the last malwarebytes log as well.
Thank you for the help.
Hi and Welcome!!
My name is
Jeff . I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
I will be working on your Malware issues, this may or may not, solve other issues you have with your machine. Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Watch Topic button to the right of your topic title and then choosing the notification method ( Recommended: Inmediate Notification) The fixes are specific to your problem and should only be used for the issues on this machine. Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear. It's often worth reading through these instructions and printing them for ease of reference. If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry. Please reply to this thread. Do not start a new topic. IMPORTANT NOTE : Please do not delete anything unless instructed to.DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision .
Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
Stay with this topic until I give you the all clean post.
———-
**WARNING** Unfortunately one or more of the infections I have identified are
Backdoor Trojans, IRCBots or other Malware capable of stealing very important information. You need to
stop using all Internet Banking sites, change passwords to all sites with sensitive information from a clean computer and phone your bank to inform them that you may be a victim of identify theft . More often than not, we advise users that a full reinstallation of their Operating System is the only way to ensure that their computer will ever be 100% clean again.
Unfortunately I have found what is known as the
ZeroAccess rootkit on your system. It is an
especially nasty infection that can take quite some time to clean as well as may have damaged your system files itself. As a warning, during the cleaning (if you choose to do so) you may lose internet access with this computer and in the end
we may need to reinstall the operating system anyway depending on the extent of the infection .
If you would like to format and reinstall your Operating System please let me know and we can assist you with that.
If you would like to continue with the cleaning, please continue with the following instructions and I will be more than happy to help.
———-
GMER
Download
GMER Rootkit Scanner from
here or
here .
Extract the contents of the zipped file to desktop. Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent . If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO .[external image: Posted Image] Click the image to enlarge it In the right panel, you will see several boxes that have been checked. Uncheck the following … IAT/EAT Drives/Partition other than Systemdrive (typically C:\) Show All (don't miss this one) Then click the Scan button & wait for it to finish. Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post. Save it where you can easily find it, such as your desktop, and attach it in your reply. **Caution** .
———-
Please download
TDSSKiller.zip
Extract it to your desktop Double click TDSSKiller.exe Press Start Scan Only if Malicious Cure is selected Then click Continue > Reboot now Copy and paste the log in your next replyA copy of the log will be saved automatically to the root of the drive (typically C:\)
———–
If you have chosen to attempt to clean your system please post the logs created by GMER and TDSSKiller into your next reply.
i've downloaded and opened gmer as an administrator, which it wasn't letting me do earlier. the only boxes that have checks when it comes up (and aren't grayed out) are services, registry, files, and ADS.
also on the reinstall, when i bought this computer they never gave me a windows reinstall disc so i can't do that. so do you have any advice beyond that since this is my only computer?
Hi catherine,
Don't worry about running GMER.
Go to My Computer and see if you have a D:\ folder that is could be your backup folder.
Go ahead and run TDSSKiller. Post the log created into your next reply and let me know if you have that backup folder.
gmer is already running. no d drive on this compy, but i have something that looks like a microsoft screwed up thing called 'Microsoft Office Click-to-Run 2010 (Protected) Q:'
13:55:15.0936 6484 TDSS rootkit removing tool [removed] Dec 13 2011 10:39:31
13:55:16.0339 6484 ============================================================
13:55:16.0339 6484 Current date / time: 2011/12/15 13:55:16.0339
13:55:16.0339 6484 SystemInfo:
13:55:16.0339 6484
13:55:16.0339 6484 OS Version: 6.1.7601 ServicePack: 1.0
13:55:16.0339 6484 Product type: Workstation
13:55:16.0339 6484 ComputerName: LAPTOP-PC
13:55:16.0339 6484 UserName: laptop
13:55:16.0339 6484 Windows directory: C:\windows
13:55:16.0339 6484 System windows directory: C:\windows
13:55:16.0339 6484 Running under WOW64
13:55:16.0339 6484 Processor architecture: Intel x64
13:55:16.0339 6484 Number of processors: 2
13:55:16.0339 6484 Page size: 0x1000
13:55:16.0339 6484 Boot type: Normal boot
13:55:16.0339 6484 ============================================================
13:55:17.0921 6484 Initialize success
13:57:01.0833 6792 ============================================================
13:57:01.0833 6792 Scan started
13:57:01.0833 6792 Mode: Manual;
13:57:01.0833 6792 ============================================================
13:57:02.0375 6792 1394ohci (a87d604aea360176311474c87a63bb88) C:\windows\system32\drivers\1394ohci.sys
13:57:02.0378 6792 1394ohci - ok
13:57:02.0619 6792 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\windows\system32\drivers\ACPI.sys
13:57:02.0624 6792 ACPI - ok
13:57:02.0892 6792 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\windows\system32\drivers\acpipmi.sys
13:57:02.0893 6792 AcpiPmi - ok
13:57:03.0239 6792 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\windows\system32\drivers\adp94xx.sys
13:57:03.0245 6792 adp94xx - ok
13:57:03.0478 6792 adpahci (597f78224ee9224ea1a13d6350ced962) C:\windows\system32\drivers\adpahci.sys
13:57:03.0484 6792 adpahci - ok
13:57:03.0771 6792 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\windows\system32\drivers\adpu320.sys
13:57:03.0774 6792 adpu320 - ok
13:57:04.0010 6792 AFD (d31dc7a16dea4a9baf179f3d6fbdb38c) C:\windows\system32\drivers\afd.sys
13:57:04.0016 6792 AFD - ok
13:57:04.0260 6792 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\windows\system32\drivers\agp440.sys
13:57:04.0262 6792 agp440 - ok
13:57:04.0516 6792 aliide (5812713a477a3ad7363c7438ca2ee038) C:\windows\system32\drivers\aliide.sys
13:57:04.0517 6792 aliide - ok
13:57:04.0749 6792 amdide (1ff8b4431c353ce385c875f194924c0c) C:\windows\system32\drivers\amdide.sys
13:57:04.0751 6792 amdide - ok
13:57:05.0017 6792 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\windows\system32\drivers\amdk8.sys
13:57:05.0019 6792 AmdK8 - ok
13:57:06.0044 6792 amdkmdag (194d76d2083318a2e7071a988e02ecf4) C:\windows\system32\DRIVERS\atikmdag.sys
13:57:06.0277 6792 amdkmdag - ok
13:57:06.0508 6792 amdkmdap (1eeffce9a3a65a56a28793eaa3f57026) C:\windows\system32\DRIVERS\atikmpag.sys
13:57:06.0513 6792 amdkmdap - ok
13:57:06.0745 6792 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\windows\system32\DRIVERS\amdppm.sys
13:57:06.0747 6792 AmdPPM - ok
13:57:07.0010 6792 amdsata (6ec6d772eae38dc17c14aed9b178d24b) C:\windows\system32\drivers\amdsata.sys
13:57:07.0012 6792 amdsata - ok
13:57:07.0281 6792 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\windows\system32\drivers\amdsbs.sys
13:57:07.0284 6792 amdsbs - ok
13:57:07.0489 6792 amdxata (1142a21db581a84ea5597b03a26ebaa0) C:\windows\system32\drivers\amdxata.sys
13:57:07.0490 6792 amdxata - ok
13:57:07.0728 6792 AppID (89a69c3f2f319b43379399547526d952) C:\windows\system32\drivers\appid.sys
13:57:07.0730 6792 AppID - ok
13:57:08.0019 6792 arc (c484f8ceb1717c540242531db7845c4e) C:\windows\system32\drivers\arc.sys
13:57:08.0020 6792 arc - ok
13:57:08.0480 6792 arcsas (019af6924aefe7839f61c830227fe79c) C:\windows\system32\drivers\arcsas.sys
13:57:08.0486 6792 arcsas - ok
13:57:08.0732 6792 AsyncMac (769765ce2cc62867468cea93969b2242) C:\windows\system32\DRIVERS\asyncmac.sys
13:57:08.0733 6792 AsyncMac - ok
13:57:09.0017 6792 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\windows\system32\drivers\atapi.sys
13:57:09.0018 6792 atapi - ok
13:57:09.0510 6792 athr (b2931c83cfb12a3223a47b180473ae1a) C:\windows\system32\DRIVERS\athrx.sys
13:57:09.0573 6792 athr - ok
13:57:09.0913 6792 AtiHDAudioService (4bf5bca6e2608cd8a00bc4a6673a9f47) C:\windows\system32\drivers\AtihdW76.sys
13:57:09.0915 6792 AtiHDAudioService - ok
13:57:10.0220 6792 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\windows\system32\drivers\bxvbda.sys
13:57:10.0231 6792 b06bdrv - ok
13:57:10.0511 6792 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\windows\system32\DRIVERS\b57nd60a.sys
13:57:10.0516 6792 b57nd60a - ok
13:57:10.0750 6792 Beep (16a47ce2decc9b099349a5f840654746) C:\windows\system32\drivers\Beep.sys
13:57:10.0752 6792 Beep - ok
13:57:11.0212 6792 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\windows\system32\DRIVERS\blbdrive.sys
13:57:11.0213 6792 blbdrive - ok
13:57:11.0425 6792 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\windows\system32\DRIVERS\bowser.sys
13:57:11.0427 6792 bowser - ok
13:57:11.0633 6792 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\windows\system32\drivers\BrFiltLo.sys
13:57:11.0637 6792 BrFiltLo - ok
13:57:11.0955 6792 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\windows\system32\drivers\BrFiltUp.sys
13:57:11.0956 6792 BrFiltUp - ok
13:57:12.0154 6792 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\windows\System32\Drivers\Brserid.sys
13:57:12.0159 6792 Brserid - ok
13:57:12.0354 6792 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\windows\System32\Drivers\BrSerWdm.sys
13:57:12.0356 6792 BrSerWdm - ok
13:57:12.0576 6792 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\windows\System32\Drivers\BrUsbMdm.sys
13:57:12.0577 6792 BrUsbMdm - ok
13:57:12.0865 6792 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\windows\System32\Drivers\BrUsbSer.sys
13:57:12.0867 6792 BrUsbSer - ok
13:57:13.0101 6792 BtFilter (2347abbd13bada65826fdab4caafe357) C:\windows\system32\DRIVERS\btfilter.sys
13:57:13.0103 6792 BtFilter - ok
13:57:13.0389 6792 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\windows\system32\drivers\bthmodem.sys
13:57:13.0391 6792 BTHMODEM - ok
13:57:13.0679 6792 cdfs (b8bd2bb284668c84865658c77574381a) C:\windows\system32\DRIVERS\cdfs.sys
13:57:13.0681 6792 cdfs - ok
13:57:13.0922 6792 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\windows\system32\DRIVERS\cdrom.sys
13:57:13.0925 6792 cdrom - ok
13:57:14.0182 6792 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\windows\system32\drivers\circlass.sys
13:57:14.0184 6792 circlass - ok
13:57:14.0413 6792 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\windows\system32\CLFS.sys
13:57:14.0418 6792 CLFS - ok
13:57:14.0734 6792 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\windows\system32\DRIVERS\CmBatt.sys
13:57:14.0735 6792 CmBatt - ok
13:57:14.0973 6792 cmdide (e19d3f095812725d88f9001985b94edd) C:\windows\system32\drivers\cmdide.sys
13:57:14.0974 6792 cmdide - ok
13:57:15.0216 6792 CNG (d5fea92400f12412b3922087c09da6a5) C:\windows\system32\Drivers\cng.sys
13:57:15.0223 6792 CNG - ok
13:57:15.0446 6792 Compbatt (102de219c3f61415f964c88e9085ad14) C:\windows\system32\drivers\compbatt.sys
13:57:15.0447 6792 Compbatt - ok
13:57:15.0635 6792 CompositeBus (03edb043586cceba243d689bdda370a8) C:\windows\system32\DRIVERS\CompositeBus.sys
13:57:15.0637 6792 CompositeBus - ok
13:57:15.0896 6792 crcdisk (1c827878a998c18847245fe1f34ee597) C:\windows\system32\drivers\crcdisk.sys
13:57:15.0899 6792 crcdisk - ok
13:57:16.0410 6792 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\windows\system32\Drivers\dfsc.sys
13:57:16.0443 6792 DfsC - ok
13:57:16.0692 6792 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\windows\system32\drivers\discache.sys
13:57:16.0693 6792 discache - ok
13:57:16.0988 6792 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\windows\system32\drivers\disk.sys
13:57:16.0990 6792 Disk - ok
13:57:17.0227 6792 drmkaud (9b19f34400d24df84c858a421c205754) C:\windows\system32\drivers\drmkaud.sys
13:57:17.0228 6792 drmkaud - ok
13:57:17.0484 6792 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\windows\System32\drivers\dxgkrnl.sys
13:57:17.0557 6792 DXGKrnl - ok
13:57:17.0855 6792 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\windows\system32\drivers\evbda.sys
13:57:17.0966 6792 ebdrv - ok
13:57:18.0158 6792 elxstor (0e5da5369a0fcaea12456dd852545184) C:\windows\system32\drivers\elxstor.sys
13:57:18.0165 6792 elxstor - ok
13:57:18.0355 6792 ErrDev (34a3c54752046e79a126e15c51db409b) C:\windows\system32\drivers\errdev.sys
13:57:18.0356 6792 ErrDev - ok
13:57:18.0559 6792 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\windows\system32\drivers\exfat.sys
13:57:18.0563 6792 exfat - ok
13:57:18.0753 6792 fastfat (0adc83218b66a6db380c330836f3e36d) C:\windows\system32\drivers\fastfat.sys
13:57:18.0756 6792 fastfat - ok
13:57:18.0986 6792 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\windows\system32\drivers\fdc.sys
13:57:18.0987 6792 fdc - ok
13:57:19.0143 6792 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\windows\system32\drivers\fileinfo.sys
13:57:19.0145 6792 FileInfo - ok
13:57:19.0337 6792 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\windows\system32\drivers\filetrace.sys
13:57:19.0338 6792 Filetrace - ok
13:57:19.0510 6792 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\windows\system32\drivers\flpydisk.sys
13:57:19.0511 6792 flpydisk - ok
13:57:19.0758 6792 FltMgr (da6b67270fd9db3697b20fce94950741) C:\windows\system32\drivers\fltmgr.sys
13:57:19.0763 6792 FltMgr - ok
13:57:19.0945 6792 FsDepends (d43703496149971890703b4b1b723eac) C:\windows\system32\drivers\FsDepends.sys
13:57:19.0946 6792 FsDepends - ok
13:57:20.0066 6792 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\windows\system32\drivers\Fs_Rec.sys
13:57:20.0067 6792 Fs_Rec - ok
13:57:20.0319 6792 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\windows\system32\DRIVERS\fvevol.sys
13:57:20.0323 6792 fvevol - ok
13:57:20.0461 6792 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\windows\system32\drivers\gagp30kx.sys
13:57:20.0462 6792 gagp30kx - ok
13:57:20.0644 6792 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\windows\system32\drivers\hcw85cir.sys
13:57:20.0646 6792 hcw85cir - ok
13:57:20.0846 6792 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\windows\system32\drivers\HdAudio.sys
13:57:20.0851 6792 HdAudAddService - ok
13:57:21.0042 6792 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\windows\system32\DRIVERS\HDAudBus.sys
13:57:21.0044 6792 HDAudBus - ok
13:57:21.0200 6792 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\windows\system32\drivers\HidBatt.sys
13:57:21.0201 6792 HidBatt - ok
13:57:21.0346 6792 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\windows\system32\drivers\hidbth.sys
13:57:21.0348 6792 HidBth - ok
13:57:21.0482 6792 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\windows\system32\drivers\hidir.sys
13:57:21.0483 6792 HidIr - ok
13:57:21.0708 6792 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\windows\system32\DRIVERS\hidusb.sys
13:57:21.0709 6792 HidUsb - ok
13:57:21.0962 6792 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\windows\system32\drivers\HpSAMD.sys
13:57:21.0964 6792 HpSAMD - ok
13:57:22.0133 6792 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\windows\system32\drivers\HTTP.sys
13:57:22.0143 6792 HTTP - ok
13:57:22.0262 6792 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\windows\system32\drivers\hwpolicy.sys
13:57:22.0263 6792 hwpolicy - ok
13:57:22.0493 6792 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\windows\system32\DRIVERS\i8042prt.sys
13:57:22.0495 6792 i8042prt - ok
13:57:22.0817 6792 iaStorV (3df4395a7cf8b7a72a5f4606366b8c2d) C:\windows\system32\drivers\iaStorV.sys
13:57:22.0823 6792 iaStorV - ok
13:57:23.0027 6792 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\windows\system32\drivers\iirsp.sys
13:57:23.0028 6792 iirsp - ok
13:57:23.0632 6792 IntcAzAudAddService (028e40182a6f0374978c755f85b9f07c) C:\windows\system32\drivers\RTKVHD64.sys
13:57:23.0717 6792 IntcAzAudAddService - ok
13:57:23.0873 6792 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\windows\system32\drivers\intelide.sys
13:57:23.0874 6792 intelide - ok
13:57:24.0052 6792 intelppm (ada036632c664caa754079041cf1f8c1) C:\windows\system32\drivers\intelppm.sys
13:57:24.0054 6792 intelppm - ok
13:57:24.0275 6792 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\windows\system32\DRIVERS\ipfltdrv.sys
13:57:24.0277 6792 IpFilterDriver - ok
13:57:24.0488 6792 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\windows\system32\drivers\IPMIDrv.sys
13:57:24.0490 6792 IPMIDRV - ok
13:57:24.0744 6792 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\windows\system32\drivers\ipnat.sys
13:57:24.0747 6792 IPNAT - ok
13:57:24.0966 6792 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\windows\system32\drivers\irenum.sys
13:57:24.0967 6792 IRENUM - ok
13:57:25.0281 6792 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\windows\system32\drivers\isapnp.sys
13:57:25.0282 6792 isapnp - ok
13:57:25.0543 6792 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\windows\system32\drivers\msiscsi.sys
13:57:25.0547 6792 iScsiPrt - ok
13:57:25.0711 6792 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\windows\system32\DRIVERS\kbdclass.sys
13:57:25.0712 6792 kbdclass - ok
13:57:25.0891 6792 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\windows\system32\DRIVERS\kbdhid.sys
13:57:25.0892 6792 kbdhid - ok
13:57:26.0060 6792 KSecDD (ccd53b5bd33ce0c889e830d839c8b66e) C:\windows\system32\Drivers\ksecdd.sys
13:57:26.0062 6792 KSecDD - ok
13:57:26.0238 6792 KSecPkg (9ff918a261752c12639e8ad4208d2c2f) C:\windows\system32\Drivers\ksecpkg.sys
13:57:26.0240 6792 KSecPkg - ok
13:57:26.0469 6792 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\windows\system32\drivers\ksthunk.sys
13:57:26.0470 6792 ksthunk - ok
13:57:26.0771 6792 lltdio (1538831cf8ad2979a04c423779465827) C:\windows\system32\DRIVERS\lltdio.sys
13:57:26.0773 6792 lltdio - ok
13:57:27.0130 6792 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\windows\system32\drivers\lsi_fc.sys
13:57:27.0132 6792 LSI_FC - ok
13:57:27.0354 6792 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\windows\system32\drivers\lsi_sas.sys
13:57:27.0356 6792 LSI_SAS - ok
13:57:27.0588 6792 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\windows\system32\drivers\lsi_sas2.sys
13:57:27.0590 6792 LSI_SAS2 - ok
13:57:27.0813 6792 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\windows\system32\drivers\lsi_scsi.sys
13:57:27.0815 6792 LSI_SCSI - ok
13:57:28.0028 6792 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\windows\system32\drivers\luafv.sys
13:57:28.0030 6792 luafv - ok
13:57:28.0263 6792 MBAMProtector (23a854450dab5c9b7a42ab9be6f2e4bd) C:\windows\system32\drivers\mbam.sys
13:57:28.0265 6792 MBAMProtector - ok
13:57:28.0417 6792 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\windows\system32\drivers\megasas.sys
13:57:28.0419 6792 megasas - ok
13:57:28.0591 6792 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\windows\system32\drivers\MegaSR.sys
13:57:28.0595 6792 MegaSR - ok
13:57:28.0790 6792 Modem (800ba92f7010378b09f9ed9270f07137) C:\windows\system32\drivers\modem.sys
13:57:28.0791 6792 Modem - ok
13:57:29.0002 6792 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\windows\system32\DRIVERS\monitor.sys
13:57:29.0004 6792 monitor - ok
13:57:29.0254 6792 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\windows\system32\DRIVERS\mouclass.sys
13:57:29.0255 6792 mouclass - ok
13:57:29.0443 6792 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\windows\system32\DRIVERS\mouhid.sys
13:57:29.0444 6792 mouhid - ok
13:57:29.0588 6792 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\windows\system32\drivers\mountmgr.sys
13:57:29.0590 6792 mountmgr - ok
13:57:29.0821 6792 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\windows\system32\drivers\mpio.sys
13:57:29.0824 6792 mpio - ok
13:57:30.0005 6792 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\windows\system32\drivers\mpsdrv.sys
13:57:30.0007 6792 mpsdrv - ok
13:57:30.0212 6792 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\windows\system32\drivers\mrxdav.sys
13:57:30.0215 6792 MRxDAV - ok
13:57:30.0352 6792 mrxsmb (c2b4651001a867ff3f8865863b592991) C:\windows\system32\DRIVERS\mrxsmb.sys
13:57:30.0354 6792 mrxsmb - ok
13:57:30.0522 6792 mrxsmb10 (7e79946afc5f799ab62982282be5ac13) C:\windows\system32\DRIVERS\mrxsmb10.sys
13:57:30.0526 6792 mrxsmb10 - ok
13:57:30.0654 6792 mrxsmb20 (5fb954100cea2bfec6446fbbecaa3f79) C:\windows\system32\DRIVERS\mrxsmb20.sys
13:57:30.0656 6792 mrxsmb20 - ok
13:57:30.0792 6792 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\windows\system32\DRIVERS\msahci.sys
13:57:30.0793 6792 msahci - ok
13:57:31.0069 6792 msdsm (db801a638d011b9633829eb6f663c900) C:\windows\system32\drivers\msdsm.sys
13:57:31.0071 6792 msdsm - ok
13:57:31.0293 6792 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\windows\system32\drivers\Msfs.sys
13:57:31.0295 6792 Msfs - ok
13:57:31.0492 6792 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\windows\System32\drivers\mshidkmdf.sys
13:57:31.0493 6792 mshidkmdf - ok
13:57:31.0690 6792 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\windows\system32\drivers\msisadrv.sys
13:57:31.0691 6792 msisadrv - ok
13:57:31.0963 6792 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\windows\system32\drivers\MSKSSRV.sys
13:57:31.0964 6792 MSKSSRV - ok
13:57:32.0174 6792 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\windows\system32\drivers\MSPCLOCK.sys
13:57:32.0175 6792 MSPCLOCK - ok
13:57:32.0352 6792 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\windows\system32\drivers\MSPQM.sys
13:57:32.0353 6792 MSPQM - ok
13:57:32.0534 6792 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\windows\system32\drivers\MsRPC.sys
13:57:32.0538 6792 MsRPC - ok
13:57:32.0663 6792 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\windows\system32\DRIVERS\mssmbios.sys
13:57:32.0665 6792 mssmbios - ok
13:57:32.0883 6792 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\windows\system32\drivers\MSTEE.sys
13:57:32.0885 6792 MSTEE - ok
13:57:33.0083 6792 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\windows\system32\drivers\MTConfig.sys
13:57:33.0085 6792 MTConfig - ok
13:57:33.0339 6792 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\windows\system32\Drivers\mup.sys
13:57:33.0341 6792 Mup - ok
13:57:33.0675 6792 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\windows\system32\DRIVERS\nwifi.sys
13:57:33.0680 6792 NativeWifiP - ok
13:57:33.0873 6792 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\windows\system32\drivers\ndis.sys
13:57:33.0885 6792 NDIS - ok
13:57:34.0076 6792 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\windows\system32\DRIVERS\ndiscap.sys
13:57:34.0077 6792 NdisCap - ok
13:57:34.0303 6792 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\windows\system32\DRIVERS\ndistapi.sys
13:57:34.0304 6792 NdisTapi - ok
13:57:34.0518 6792 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\windows\system32\DRIVERS\ndisuio.sys
13:57:34.0520 6792 Ndisuio - ok
13:57:34.0715 6792 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\windows\system32\DRIVERS\ndiswan.sys
13:57:34.0718 6792 NdisWan - ok
13:57:34.0850 6792 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\windows\system32\drivers\NDProxy.sys
13:57:34.0851 6792 NDProxy - ok
13:57:35.0174 6792 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\windows\system32\DRIVERS\netbios.sys
13:57:35.0176 6792 NetBIOS - ok
13:57:35.0351 6792 NetBT (09594d1089c523423b32a4229263f068) C:\windows\system32\DRIVERS\netbt.sys
13:57:35.0356 6792 NetBT - ok
13:57:35.0620 6792 nfrd960 (77889813be4d166cdab78ddba990da92) C:\windows\system32\drivers\nfrd960.sys
13:57:35.0623 6792 nfrd960 - ok
13:57:35.0832 6792 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\windows\system32\drivers\Npfs.sys
13:57:35.0834 6792 Npfs - ok
13:57:36.0017 6792 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\windows\system32\drivers\nsiproxy.sys
13:57:36.0018 6792 nsiproxy - ok
13:57:36.0352 6792 Ntfs (05d78aa5cb5f3f5c31160bdb955d0b7c) C:\windows\system32\drivers\Ntfs.sys
13:57:36.0411 6792 Ntfs - ok
13:57:36.0556 6792 Null (9899284589f75fa8724ff3d16aed75c1) C:\windows\system32\drivers\Null.sys
13:57:36.0557 6792 Null - ok
13:57:36.0805 6792 nvraid (5d9fd91f3d38dc9da01e3cb5fa89cd48) C:\windows\system32\drivers\nvraid.sys
13:57:36.0808 6792 nvraid - ok
13:57:37.0041 6792 nvstor (f7cd50fe7139f07e77da8ac8033d1832) C:\windows\system32\drivers\nvstor.sys
13:57:37.0044 6792 nvstor - ok
13:57:37.0198 6792 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\windows\system32\drivers\nv_agp.sys
13:57:37.0201 6792 nv_agp - ok
13:57:37.0404 6792 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\windows\system32\drivers\ohci1394.sys
13:57:37.0406 6792 ohci1394 - ok
13:57:37.0639 6792 Parport (0086431c29c35be1dbc43f52cc273887) C:\windows\system32\drivers\parport.sys
13:57:37.0643 6792 Parport - ok
13:57:37.0788 6792 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\windows\system32\drivers\partmgr.sys
13:57:37.0790 6792 partmgr - ok
13:57:37.0935 6792 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\windows\system32\drivers\pci.sys
13:57:37.0937 6792 pci - ok
13:57:38.0079 6792 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\windows\system32\DRIVERS\pciide.sys
13:57:38.0080 6792 pciide - ok
13:57:38.0243 6792 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\windows\system32\drivers\pcmcia.sys
13:57:38.0247 6792 pcmcia - ok
13:57:38.0424 6792 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\windows\system32\drivers\pcw.sys
13:57:38.0426 6792 pcw - ok
13:57:38.0651 6792 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\windows\system32\drivers\peauth.sys
13:57:38.0683 6792 PEAUTH - ok
13:57:38.0930 6792 PGEffect (91111cebbde8015e822c46120ed9537c) C:\windows\system32\DRIVERS\pgeffect.sys
13:57:38.0931 6792 PGEffect - ok
13:57:39.0241 6792 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\windows\system32\DRIVERS\raspptp.sys
13:57:39.0243 6792 PptpMiniport - ok
13:57:39.0378 6792 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\windows\system32\drivers\processr.sys
13:57:39.0380 6792 Processor - ok
13:57:39.0633 6792 Psched (0557cf5a2556bd58e26384169d72438d) C:\windows\system32\DRIVERS\pacer.sys
13:57:39.0635 6792 Psched - ok
13:57:39.0851 6792 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\windows\system32\drivers\ql2300.sys
13:57:39.0871 6792 ql2300 - ok
13:57:40.0024 6792 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\windows\system32\drivers\ql40xx.sys
13:57:40.0027 6792 ql40xx - ok
13:57:40.0213 6792 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\windows\system32\drivers\qwavedrv.sys
13:57:40.0215 6792 QWAVEdrv - ok
13:57:40.0402 6792 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\windows\system32\DRIVERS\rasacd.sys
13:57:40.0403 6792 RasAcd - ok
13:57:40.0573 6792 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\windows\system32\DRIVERS\AgileVpn.sys
13:57:40.0574 6792 RasAgileVpn - ok
13:57:40.0819 6792 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\windows\system32\DRIVERS\rasl2tp.sys
13:57:40.0821 6792 Rasl2tp - ok
13:57:41.0007 6792 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\windows\system32\DRIVERS\raspppoe.sys
13:57:41.0008 6792 RasPppoe - ok
13:57:41.0211 6792 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\windows\system32\DRIVERS\rassstp.sys
13:57:41.0213 6792 RasSstp - ok
13:57:41.0371 6792 rdbss (77f665941019a1594d887a74f301fa2f) C:\windows\system32\DRIVERS\rdbss.sys
13:57:41.0375 6792 rdbss - ok
13:57:41.0585 6792 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\windows\system32\drivers\rdpbus.sys
13:57:41.0586 6792 rdpbus - ok
13:57:41.0751 6792 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\windows\system32\DRIVERS\RDPCDD.sys
13:57:41.0752 6792 RDPCDD - ok
13:57:41.0960 6792 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\windows\system32\drivers\rdpencdd.sys
13:57:41.0961 6792 RDPENCDD - ok
13:57:42.0146 6792 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\windows\system32\drivers\rdprefmp.sys
13:57:42.0147 6792 RDPREFMP - ok
13:57:42.0333 6792 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\windows\system32\drivers\RDPWD.sys
13:57:42.0336 6792 RDPWD - ok
13:57:42.0583 6792 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\windows\system32\drivers\rdyboost.sys
13:57:42.0586 6792 rdyboost - ok
13:57:42.0894 6792 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\windows\system32\DRIVERS\rspndr.sys
13:57:42.0896 6792 rspndr - ok
13:57:43.0198 6792 RSUSBSTOR (be29b0a3ac1e8bd02ffab8cee86badfa) C:\windows\system32\Drivers\RtsUStor.sys
13:57:43.0201 6792 RSUSBSTOR - ok
13:57:43.0351 6792 RTL8167 (6d3c7e7d82d3dc92dc2a8b0df9f20f8a) C:\windows\system32\DRIVERS\Rt64win7.sys
13:57:43.0357 6792 RTL8167 - ok
13:57:43.0552 6792 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\windows\system32\drivers\sbp2port.sys
13:57:43.0554 6792 sbp2port - ok
13:57:43.0696 6792 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\windows\system32\DRIVERS\scfilter.sys
13:57:43.0697 6792 scfilter - ok
13:57:43.0887 6792 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\windows\system32\drivers\secdrv.sys
13:57:43.0889 6792 secdrv - ok
13:57:44.0045 6792 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\windows\system32\drivers\serenum.sys
13:57:44.0047 6792 Serenum - ok
13:57:44.0303 6792 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\windows\system32\drivers\serial.sys
13:57:44.0305 6792 Serial - ok
13:57:44.0459 6792 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\windows\system32\drivers\sermouse.sys
13:57:44.0460 6792 sermouse - ok
13:57:44.0637 6792 sffdisk (a554811bcd09279536440c964ae35bbf) C:\windows\system32\drivers\sffdisk.sys
13:57:44.0638 6792 sffdisk - ok
13:57:44.0848 6792 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\windows\system32\drivers\sffp_mmc.sys
13:57:44.0850 6792 sffp_mmc - ok
13:57:44.0993 6792 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\windows\system32\drivers\sffp_sd.sys
13:57:44.0995 6792 sffp_sd - ok
13:57:45.0117 6792 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\windows\system32\drivers\sfloppy.sys
13:57:45.0118 6792 sfloppy - ok
13:57:45.0301 6792 Sftfs (d5183ed285d2795491dc15bddcbee5ad) C:\windows\system32\DRIVERS\Sftfslh.sys
13:57:45.0311 6792 Sftfs - ok
13:57:45.0471 6792 Sftplay (00f118b68c50d2206dd51634f9142b83) C:\windows\system32\DRIVERS\Sftplaylh.sys
13:57:45.0475 6792 Sftplay - ok
13:57:45.0682 6792 Sftredir (76a827df5640bfe16a0cdbb4108adeca) C:\windows\system32\DRIVERS\Sftredirlh.sys
13:57:45.0683 6792 Sftredir - ok
13:57:45.0862 6792 Sftvol (1b4c9701645086bab8cafffce30ed284) C:\windows\system32\DRIVERS\Sftvollh.sys
13:57:45.0863 6792 Sftvol - ok
13:57:46.0130 6792 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\windows\system32\drivers\SiSRaid2.sys
13:57:46.0132 6792 SiSRaid2 - ok
13:57:46.0286 6792 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\windows\system32\drivers\sisraid4.sys
13:57:46.0288 6792 SiSRaid4 - ok
13:57:46.0588 6792 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\windows\system32\DRIVERS\smb.sys
13:57:46.0590 6792 Smb - ok
13:57:46.0942 6792 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\windows\system32\drivers\spldr.sys
13:57:46.0944 6792 spldr - ok
13:57:47.0183 6792 srv (65bbf4920148c2ee279055da7228fc7b) C:\windows\system32\DRIVERS\srv.sys
13:57:47.0189 6792 srv - ok
13:57:47.0387 6792 srv2 (da939f762a1ccc2d77428621ddbd40a7) C:\windows\system32\DRIVERS\srv2.sys
13:57:47.0393 6792 srv2 - ok
13:57:47.0564 6792 srvnet (3f847c9dc87299516f7dc82fb6572865) C:\windows\system32\DRIVERS\srvnet.sys
13:57:47.0568 6792 srvnet - ok
13:57:47.0976 6792 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\windows\system32\drivers\stexstor.sys
13:57:47.0977 6792 stexstor - ok
13:57:48.0240 6792 StillCam (decacb6921ded1a38642642685d77dac) C:\windows\system32\DRIVERS\serscan.sys
13:57:48.0242 6792 StillCam - ok
13:57:48.0509 6792 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\windows\system32\DRIVERS\swenum.sys
13:57:48.0510 6792 swenum - ok
13:57:48.0858 6792 SynTP (f5b46df59feaa48a442aed7eeb754d4b) C:\windows\system32\DRIVERS\SynTP.sys
13:57:48.0911 6792 SynTP - ok
13:57:49.0286 6792 Tcpip (dc08410db2d0cc542dacac7a90e6cb7a) C:\windows\system32\drivers\tcpip.sys
13:57:49.0359 6792 Tcpip - ok
13:57:49.0663 6792 TCPIP6 (dc08410db2d0cc542dacac7a90e6cb7a) C:\windows\system32\DRIVERS\tcpip.sys
13:57:49.0679 6792 TCPIP6 - ok
13:57:49.0807 6792 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\windows\system32\drivers\tcpipreg.sys
13:57:49.0808 6792 tcpipreg - ok
13:57:49.0952 6792 tdcmdpst (fd542b661bd22fa69ca789ad0ac58c29) C:\windows\system32\DRIVERS\tdcmdpst.sys
13:57:49.0953 6792 tdcmdpst - ok
13:57:50.0165 6792 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\windows\system32\drivers\tdpipe.sys
13:57:50.0166 6792 TDPIPE - ok
13:57:50.0287 6792 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\windows\system32\drivers\tdtcp.sys
13:57:50.0289 6792 TDTCP - ok
13:57:50.0642 6792 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\windows\system32\DRIVERS\tdx.sys
13:57:50.0644 6792 tdx - ok
13:57:50.0828 6792 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\windows\system32\DRIVERS\termdd.sys
13:57:50.0830 6792 TermDD - ok
13:57:51.0669 6792 Tosrfcom - ok
13:57:51.0924 6792 tosrfec (f5e3ac4cbcd154ee80849b21887fd0b0) C:\windows\system32\DRIVERS\tosrfec.sys
13:57:51.0925 6792 tosrfec - ok
13:57:52.0141 6792 Tosrfusb (7a0048693f98460ff537be31c741b927) C:\windows\system32\DRIVERS\tosrfusb.sys
13:57:52.0143 6792 Tosrfusb - ok
13:57:52.0492 6792 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\windows\system32\DRIVERS\tssecsrv.sys
13:57:52.0494 6792 tssecsrv - ok
13:57:52.0736 6792 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\windows\system32\drivers\tsusbflt.sys
13:57:52.0737 6792 TsUsbFlt - ok
13:57:52.0883 6792 TsUsbGD (9cc2ccae8a84820eaecb886d477cbcb8) C:\windows\system32\drivers\TsUsbGD.sys
13:57:52.0884 6792 TsUsbGD - ok
13:57:53.0110 6792 tunnel (3566a8daafa27af944f5d705eaa64894) C:\windows\system32\DRIVERS\tunnel.sys
13:57:53.0113 6792 tunnel - ok
13:57:53.0335 6792 TVALZ (550b567f9364d8f7684c3fb3ea665a72) C:\windows\system32\DRIVERS\TVALZ_O.SYS
13:57:53.0336 6792 TVALZ - ok
13:57:53.0595 6792 TVALZFL (9c7191f4b2e49bff47a6c1144b5923fa) C:\windows\system32\DRIVERS\TVALZFL.sys
13:57:53.0596 6792 TVALZFL - ok
13:57:53.0775 6792 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\windows\system32\drivers\uagp35.sys
13:57:53.0777 6792 uagp35 - ok
13:57:53.0993 6792 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\windows\system32\DRIVERS\udfs.sys
13:57:53.0998 6792 udfs - ok
13:57:54.0151 6792 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\windows\system32\drivers\uliagpkx.sys
13:57:54.0152 6792 uliagpkx - ok
13:57:54.0366 6792 umbus (dc54a574663a895c8763af0fa1ff7561) C:\windows\system32\DRIVERS\umbus.sys
13:57:54.0367 6792 umbus - ok
13:57:54.0518 6792 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\windows\system32\drivers\umpass.sys
13:57:54.0520 6792 UmPass - ok
13:57:54.0671 6792 usbccgp (481dff26b4dca8f4cbac1f7dce1d6829) C:\windows\system32\DRIVERS\usbccgp.sys
13:57:54.0673 6792 usbccgp - ok
13:57:54.0878 6792 usbcir (af0892a803fdda7492f595368e3b68e7) C:\windows\system32\drivers\usbcir.sys
13:57:54.0881 6792 usbcir - ok
13:57:55.0010 6792 usbehci (74ee782b1d9c241efe425565854c661c) C:\windows\system32\DRIVERS\usbehci.sys
13:57:55.0012 6792 usbehci - ok
13:57:55.0211 6792 usbhub (dc96bd9ccb8403251bcf25047573558e) C:\windows\system32\DRIVERS\usbhub.sys
13:57:55.0216 6792 usbhub - ok
13:57:55.0358 6792 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\windows\system32\DRIVERS\usbohci.sys
13:57:55.0359 6792 usbohci - ok
13:57:55.0543 6792 usbprint (73188f58fb384e75c4063d29413cee3d) C:\windows\system32\drivers\usbprint.sys
13:57:55.0545 6792 usbprint - ok
13:57:55.0710 6792 USBSTOR (d76510cfa0fc09023077f22c2f979d86) C:\windows\system32\DRIVERS\USBSTOR.SYS
13:57:55.0712 6792 USBSTOR - ok
13:57:55.0868 6792 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\windows\system32\drivers\usbuhci.sys
13:57:55.0871 6792 usbuhci - ok
13:57:56.0093 6792 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\windows\system32\Drivers\usbvideo.sys
13:57:56.0095 6792 usbvideo - ok
13:57:56.0358 6792 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\windows\system32\drivers\vdrvroot.sys
13:57:56.0360 6792 vdrvroot - ok
13:57:56.0729 6792 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\windows\system32\DRIVERS\vgapnp.sys
13:57:56.0730 6792 vga - ok
13:57:56.0936 6792 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\windows\System32\drivers\vga.sys
13:57:56.0971 6792 VgaSave - ok
13:57:57.0125 6792 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\windows\system32\drivers\vhdmp.sys
13:57:57.0128 6792 vhdmp - ok
13:57:57.0279 6792 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\windows\system32\drivers\viaide.sys
13:57:57.0281 6792 viaide - ok
13:57:57.0560 6792 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\windows\system32\drivers\volmgr.sys
13:57:57.0590 6792 volmgr - ok
13:57:57.0713 6792 volmgrx (a255814907c89be58b79ef2f189b843b) C:\windows\system32\drivers\volmgrx.sys
13:57:57.0719 6792 volmgrx - ok
13:57:57.0872 6792 volsnap (df8126bd41180351a093a3ad2fc8903b) C:\windows\system32\drivers\volsnap.sys
13:57:57.0876 6792 volsnap - ok
13:57:58.0111 6792 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\windows\system32\drivers\vsmraid.sys
13:57:58.0114 6792 vsmraid - ok
13:57:58.0236 6792 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\windows\system32\DRIVERS\vwifibus.sys
13:57:58.0237 6792 vwifibus - ok
13:57:58.0530 6792 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\windows\system32\DRIVERS\vwififlt.sys
13:57:58.0532 6792 vwififlt - ok
13:57:58.0774 6792 vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\windows\system32\DRIVERS\vwifimp.sys
13:57:58.0775 6792 vwifimp - ok
13:57:59.0035 6792 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\windows\system32\drivers\wacompen.sys
13:57:59.0050 6792 WacomPen - ok
13:57:59.0316 6792 WANARP (356afd78a6ed4457169241ac3965230c) C:\windows\system32\DRIVERS\wanarp.sys
13:57:59.0318 6792 WANARP - ok
13:57:59.0347 6792 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\windows\system32\DRIVERS\wanarp.sys
13:57:59.0349 6792 Wanarpv6 - ok
13:57:59.0540 6792 Wd (72889e16ff12ba0f235467d6091b17dc) C:\windows\system32\drivers\wd.sys
13:57:59.0541 6792 Wd - ok
13:57:59.0839 6792 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\windows\system32\drivers\Wdf01000.sys
13:57:59.0848 6792 Wdf01000 - ok
13:58:00.0156 6792 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\windows\system32\DRIVERS\wfplwf.sys
13:58:00.0157 6792 WfpLwf - ok
13:58:00.0324 6792 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\windows\system32\drivers\wimmount.sys
13:58:00.0325 6792 WIMMount - ok
13:58:00.0674 6792 WinUsb (fe88b288356e7b47b74b13372add906d) C:\windows\system32\DRIVERS\WinUsb.sys
13:58:00.0676 6792 WinUsb - ok
13:58:00.0886 6792 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\windows\system32\DRIVERS\wmiacpi.sys
13:58:00.0887 6792 WmiAcpi - ok
13:58:01.0148 6792 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\windows\system32\drivers\ws2ifsl.sys
13:58:01.0150 6792 ws2ifsl - ok
13:58:01.0322 6792 WSDPrintDevice (8d918b1db190a4d9b1753a66fa8c96e8) C:\windows\system32\DRIVERS\WSDPrint.sys
13:58:01.0324 6792 WSDPrintDevice - ok
13:58:01.0593 6792 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\windows\system32\drivers\WudfPf.sys
13:58:01.0595 6792 WudfPf - ok
13:58:02.0130 6792 WUDFRd (cf8d590be3373029d57af80914190682) C:\windows\system32\DRIVERS\WUDFRd.sys
13:58:02.0133 6792 WUDFRd - ok
13:58:02.0184 6792 MBR (0x1B8) (5b5e648d12fcadc244c1ec30318e1eb9) \Device\Harddisk0\DR0
13:58:02.0197 6792 \Device\Harddisk0\DR0 - ok
13:58:02.0229 6792 Boot (0x1200) (cbf87cf696aedd2a137cfa9ce4d041d6) \Device\Harddisk0\DR0\Partition0
13:58:02.0230 6792 \Device\Harddisk0\DR0\Partition0 - ok
13:58:02.0231 6792 ============================================================
13:58:02.0231 6792 Scan finished
13:58:02.0231 6792 ============================================================
13:58:02.0246 4364 Detected object count: 0
13:58:02.0246 4364 Actual detected object count: 0
Hi catherine,
gmer is already running
When that is done post the log and we will go from there.
Don't worry about that Microsoft Office Click-to-Run. It isn't what I was looking for.
i should mention, re: the backup harddrive, i do have a 500G external hard drive (no operating system on it) if we need one. right now it's got some stories and music on it. i have another one but i'm not sure if it's running 98 or XP. it's from an older computer but it has a lot of stuff on it that i can't afford to lose.
i ended up running gmer twice because i accidentally hit a key while watching it run and the 'ok' button shut it down.
this came off the first:
GMER 1.0.15.15641 -
http://www.gmer.net
Rootkit scan 2011-12-15 14:22:28
Windows 6.1.7601 Service Pack 1
Running: gmer.exe
—- Files - GMER 1.0.15 —-
File C:\TDSSKiller.2.6.23.0_15.12.2011_13.55.15_log.txt 76108 bytes
—- EOF - GMER 1.0.15 —-
and this came off the second:
GMER found no system modifications. the log is empty.
Hi catherine,
Thanks for that additional info about the ext hard drive.
————
Download
Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2
**Note: It is important that it is saved directly to your desktop**
——————————————————————–
IMPORTANT -
Disable your AntiVirus and AntiSpyware applications , usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link
here
——————————————————————–
Right-Click and Run as Administrator on
ComboFix.exe & follow the prompts.
When finished, it will produce a report for you. Please post the C:\ComboFix.txt for further review.
after running it, and it restarting the computer, it froze when the log came up so i had to restart the computer again. don't know if that matters at all.
ComboFix 11-12-15.02 - laptop 12/15/2011 15:14:07.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3562.1151 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\consrv.dll
c:\windows\System64
.
.
((((((((((((((((((((((((( Files Created from 2011-11-15 to 2011-12-15 )))))))))))))))))))))))))))))))
.
.
2011-12-15 20:27 . 2011-12-15 20:27 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-13 23:01 . 2011-12-14 05:58 ——– d—–w- c:\programdata\AVG2012
2011-12-13 23:00 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\AVG
2011-12-13 22:50 . 2011-12-13 22:50 ——– d–h–w- c:\programdata\Common Files
2011-12-13 22:49 . 2011-12-14 05:54 ——– d—–w- c:\programdata\MFAData
2011-12-13 19:45 . 2011-12-13 19:45 ——– d—–w- c:\users\laptop\AppData\Roaming\Malwarebytes
2011-12-13 19:44 . 2011-12-14 05:54 ——– d—–w- c:\programdata\Malwarebytes
2011-12-13 19:44 . 2011-12-14 05:58 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-12-13 19:44 . 2011-08-31 22:00 25416 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-12-04 04:36 . 2011-12-04 04:38 ——– d—–w- c:\program files (x86)\Dark Parables - Rise of the Snow Queen Collector's Edition
2011-12-03 23:49 . 2011-12-07 16:15 ——– d—–w- c:\programdata\Playrix Entertainment
2011-12-03 22:21 . 2011-12-03 22:21 ——– d—–w- c:\programdata\TERMINAL Studio
2011-12-03 17:45 . 2011-12-03 17:46 ——– d—–w- c:\users\laptop\AppData\Local\Tific
2011-12-03 16:17 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Luxor Adventures
2011-12-03 16:17 . 2009-08-19 01:26 57344 —-a-w- c:\windows\SysWow64\Big Kahuna Reef.scr
2011-12-03 16:17 . 2011-12-12 00:23 ——– d—–w- c:\program files (x86)\Big Kahuna Reef
2011-12-03 16:02 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Double Play Jewel Quest 2 and 3
2011-12-03 15:55 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Royal Envoy
2011-12-03 15:42 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Samantha Swift and the Mystery from Atlantis
2011-12-03 15:26 . 2011-12-04 02:31 ——– d—–w- c:\program files (x86)\Big Kahuna Reef 2
2011-12-03 15:25 . 2011-12-11 23:32 ——– d—–w- c:\program files (x86)\The Rise Of Atlantis
2011-12-03 15:23 . 2011-12-03 22:42 ——– d—–w- c:\program files (x86)\Sky Kingdoms
2011-12-03 15:20 . 2011-12-11 21:22 ——– d—–w- c:\program files (x86)\Heroes Of Hellas
2011-12-03 15:19 . 2011-12-04 02:38 ——– d—–w- c:\program files (x86)\Call Of Atlantis
2011-12-03 15:13 . 2011-12-04 06:42 ——– d—–w- c:\program files (x86)\Atlantis Quest
2011-12-03 15:11 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Luxor HD
2011-12-03 15:10 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Samantha Swift Fountains of Fate
2011-12-03 14:52 . 2011-12-03 14:52 ——– d—–w- c:\programdata\Amazon
2011-12-03 14:52 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Amazon
2011-12-03 04:34 . 2011-12-03 04:34 ——– d—–w- c:\programdata\Fugazo
2011-12-02 21:57 . 2011-12-02 21:57 ——– d—–w- c:\program files (x86)\Mythic Pearls - The Legend of Tirnanog
2011-12-02 21:53 . 2011-12-02 21:53 ——– d—–w- c:\programdata\Intenium
2011-12-02 21:45 . 2011-12-02 21:45 ——– d—–w- c:\program files (x86)\Luxor - 5th Passage
2011-11-30 17:10 . 2011-11-30 17:10 ——– d—–w- c:\users\laptop\AppData\Roaming\OpenOffice.org
2011-11-30 17:08 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\OpenOffice.org 3
2011-11-30 17:08 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Common Files\Java
2011-11-30 17:08 . 2011-11-30 17:08 472808 —-a-w- c:\program files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
2011-11-30 17:08 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Java
2011-11-30 16:31 . 2011-12-14 05:54 ——– d—–w- c:\program files (x86)\Common Files\Adobe
2011-11-28 00:04 . 2011-11-30 05:03 ——– d—–w- c:\users\laptop\AppData\Roaming\Oberon Games
2011-11-20 03:42 . 2011-11-20 03:42 ——– d—–w- c:\users\laptop\AppData\Roaming\Fuzzy Games
2011-11-16 20:23 . 2011-11-16 20:23 ——– d—–w- c:\users\laptop\AppData\Roaming\HdO Adventure
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-30 17:08 . 2011-04-28 03:24 472808 —-a-w- c:\windows\SysWow64\deployJava1.dll
2011-10-07 01:29 . 2011-09-13 23:56 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2010-11-29 1294712]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-06-08 336384]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"AmazonGSDownloaderTray"="c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R3 Amazon Download Agent;Amazon Download Agent;c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [2009-10-23 401920]
R3 BtFilter;Bluetooth LowerFilter Class Filter Driver;c:\windows\system32\DRIVERS\btfilter.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-11-29 54136]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-12-08 137632]
R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2011-04-06 828336]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
S2 GFNEXSrv;GFNEX Service;c:\windows\System32\GFNEXSrv.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 Norton PC Checkup Application Launcher;Toshiba Laptop Checkup Application Launcher;c:\program files (x86)\Norton PC Checkup\Engine\2.0.10.26\SymcPCCULaunchSvc.exe [2011-12-03 135608]
S2 PCCUJobMgr;Common Client Job Manager Service;c:\program files (x86)\Norton PC Checkup\Engine\2.0.10.26\ccSvcHst.exe [2011-02-03 126392]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2009-12-03 483688]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2011-04-07 294328]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2009-12-03 209768]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
.
——— x86-64 ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-07-07 12558440]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-03 2226280]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-12-08 710040]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"combofix"="c:\combofix\CF20352.3XE" [2010-11-21 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://start.toshiba.com
uInternet Settings,ProxyOverride =
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\laptop\AppData\Roaming\Mozilla\Firefox\Profiles\i1p7oxmi.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Read It Later: [removed] - %profile%\extensions\[removed]
FF - Ext: Webmail Ad Blocker: [removed] - %profile%\extensions\[removed]
FF - Ext: Ad blocker: {4DC70064-89E2-4a55-8FC6-E8CDEAE3612C} - %profile%\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C}
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-Desktop Software - c:\program files (x86)\Common Files\SupportSoft\bin\bcont.exe
Wow6432Node-HKLM-Run-TSleepSrv - %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
Toolbar-Locked - (no file)
HKLM-Run-(Default) - (no file)
HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
HKLM-Run-HSON - c:\program files (x86)\TOSHIBA\TBS\HSON.exe
HKLM-Run-TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-Teco - c:\program files (x86)\TOSHIBA\TECO\Teco.exe
HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe
HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCCUJobMgr]
"ImagePath"="\"c:\program files (x86)\Norton PC Checkup\Engine\2.0.10.26\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files (x86)\Norton PC Checkup\Engine\2.0.10.26\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-12-15 15:50:42 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-15 20:50
.
Pre-Run: 517,595,598,848 bytes free
Post-Run: 517,074,563,072 bytes free
.
- - End Of File - - B5F6F1F98893DA0F79591BD12BB8FD68
Hi catherine,
Looks like it ran just fine. Good job.
———-
Please download
SystemLook from one of the links below and save it to your
Desktop .
Download Mirror #1 Download Mirror #2 Right-click and Run as Administrator SystemLook.exe to run it. Copy the content of the following codebox into the main textfield::filefind
consrv.dll
Click the Look button to start the scan. When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. Note: The log can also be found on your Desktop entitled
SystemLook.txt
SystemLook 30.07.11 by jpshortstuff
Log created at 16:07 on 15/12/2011 by laptop
Administrator - Elevation successful
WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results.
========== filefind ==========
Searching for "consrv.dll"
No files found.
-= EOF =-
i just went looking and realized i had to reinstall my avg antivirus. i've downloaded a new copy. i know the free one isn't as good but i need free right now for at least another three months. is zone alarm going to help? i used to have it on an older computer and i'm not sure if it's still a free firewall that works or not? thank you for the advice and the help with all this stuff.
Hi catherine,
You can use AVG free and that will be fine. I prefer either
Microsoft Security Essentials or
Avast
Were you able to get SystemLook run yet? If so please post the log that was created.
i posted it above but i'll repost it.
SystemLook 30.07.11 by jpshortstuff
Log created at 17:16 on 15/12/2011 by laptop
Administrator - Elevation successful
WARNING: SystemLook running under WOW64. Use SystemLook_x64 for accurate results.
========== filefind ==========
Searching for "consrv.dll"
No files found.
-= EOF =-
also, i checked, ping.exe is still on the computer but it's not running. is that normal? and thank you for that rec on the firewall.
Hi catherine,
Ok…please delete your copy of ComboFix using
right click >> delete and then download a fresh copy. Then run a new scan with ComboFix and post the new log into your next reply.
My name is