Hi
ESET found 3 threats and was unable to clean one.
Here is the log:
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=03786d979b8f154fbc15fcff7b01ee22
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-04 07:16:48
# local_time=2012-01-04 02:16:48 (-0500, Eastern Standard Time)
# country="United States"
# lang=9
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776574 66 100 41079383 162301054 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=264434
# found=3
# cleaned=2
# scan_time=11081
C:\Users\Susan\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\e5a51ab-5b2a0336 a variant of Java/Agent.DZ trojan (deleted - quarantined) 00000000000000000000000000000000 C
C:\Windows\System32\drivers\smb.sys Win32/Sirefef.DA trojan (unable to clean) 00000000000000000000000000000000 I
C:\Windows\winsxs\x86_microsoft-windows-nbsmb_31bf3856ad364e35_6.0.6002.18005_none_61560a3ff5180c84\smb.sys Win32/Sirefef.DA trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
Download TDSSKiller from
here and save it to your Desktop.
Note: if the Cure option is not there, please select 'Skip'.
Please read carefully and follow these steps.
A report will be created in your root directory, (usually C:\ folder) in the form of
"TDSSKiller.[Version]_[Date]_[Time]_log.txt" . Please copy and paste its contents on your next reply.
Yay! That was a fast scan! Here is the log:
11:52:06.0114 5276 TDSS rootkit removing tool 2.6.25.0 Dec 23 2011 14:51:16
11:52:06.0599 5276 ============================================================
11:52:06.0599 5276 Current date / time: 2012/01/05 11:52:06.0599
11:52:06.0599 5276 SystemInfo:
11:52:06.0599 5276
11:52:06.0599 5276 OS Version: 6.0.6002 ServicePack: 2.0
11:52:06.0599 5276 Product type: Workstation
11:52:06.0599 5276 ComputerName: SUSAN-PC
11:52:06.0599 5276 UserName: Susan
11:52:06.0599 5276 Windows directory: C:\Windows
11:52:06.0599 5276 System windows directory: C:\Windows
11:52:06.0599 5276 Processor architecture: Intel x86
11:52:06.0599 5276 Number of processors: 2
11:52:06.0599 5276 Page size: 0x1000
11:52:06.0599 5276 Boot type: Normal boot
11:52:06.0599 5276 ============================================================
11:52:09.0036 5276 Initialize success
11:52:16.0536 5188 ============================================================
11:52:16.0536 5188 Scan started
11:52:16.0536 5188 Mode: Manual; SigCheck; TDLFS;
11:52:16.0536 5188 ============================================================
11:52:17.0739 5188 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
11:52:17.0958 5188 ACPI - ok
11:52:18.0099 5188 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
11:52:18.0130 5188 adp94xx - ok
11:52:18.0255 5188 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
11:52:18.0286 5188 adpahci - ok
11:52:18.0349 5188 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
11:52:18.0364 5188 adpu160m - ok
11:52:18.0427 5188 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
11:52:18.0442 5188 adpu320 - ok
11:52:18.0599 5188 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys
11:52:18.0661 5188 AFD - ok
11:52:18.0755 5188 agp440 (8b10ce1c1f9f1d47e4deb1a547a00cd4) C:\Windows\system32\drivers\agp440.sys
11:52:18.0770 5188 agp440 - ok
11:52:18.0817 5188 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
11:52:18.0833 5188 aic78xx - ok
11:52:18.0895 5188 aliide (dc67a153fdb8105b25d05334b5e1d8e2) C:\Windows\system32\drivers\aliide.sys
11:52:18.0911 5188 aliide - ok
11:52:18.0958 5188 amdagp (848f27e5b27c1c253f6cefdc1a5d8f21) C:\Windows\system32\drivers\amdagp.sys
11:52:18.0974 5188 amdagp - ok
11:52:19.0020 5188 amdide (835c4c3355088298a5ebd818fa31430f) C:\Windows\system32\drivers\amdide.sys
11:52:19.0052 5188 amdide - ok
11:52:19.0130 5188 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
11:52:19.0192 5188 AmdK7 - ok
11:52:19.0270 5188 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\DRIVERS\amdk8.sys
11:52:19.0317 5188 AmdK8 - ok
11:52:19.0489 5188 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
11:52:19.0505 5188 arc - ok
11:52:19.0552 5188 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
11:52:19.0567 5188 arcsas - ok
11:52:19.0677 5188 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
11:52:19.0708 5188 AsyncMac - ok
11:52:19.0833 5188 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
11:52:19.0833 5188 atapi - ok
11:52:19.0989 5188 AtiPcie (a356e45e8432432c06981ea63a1e0fe8) C:\Windows\system32\DRIVERS\AtiPcie.sys
11:52:19.0989 5188 AtiPcie - ok
11:52:20.0083 5188 BCM43XX (509f672686af40f95859fde67108449b) C:\Windows\system32\DRIVERS\bcmwl6.sys
11:52:20.0099 5188 BCM43XX - ok
11:52:20.0208 5188 bcm4sbxp (cd4646067cc7dcba1907fa0acf7e3966) C:\Windows\system32\DRIVERS\bcm4sbxp.sys
11:52:20.0224 5188 bcm4sbxp - ok
11:52:20.0458 5188 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
11:52:20.0739 5188 Beep - ok
11:52:20.0802 5188 blbdrive - ok
11:52:20.0927 5188 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
11:52:20.0942 5188 bowser - ok
11:52:20.0989 5188 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
11:52:21.0020 5188 BrFiltLo - ok
11:52:21.0036 5188 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
11:52:21.0067 5188 BrFiltUp - ok
11:52:21.0130 5188 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
11:52:21.0177 5188 Brserid - ok
11:52:21.0239 5188 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
11:52:21.0302 5188 BrSerWdm - ok
11:52:21.0349 5188 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
11:52:21.0427 5188 BrUsbMdm - ok
11:52:21.0630 5188 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
11:52:21.0692 5188 BrUsbSer - ok
11:52:21.0895 5188 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
11:52:22.0036 5188 BTHMODEM - ok
11:52:22.0224 5188 catchme - ok
11:52:22.0536 5188 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
11:52:22.0599 5188 cdfs - ok
11:52:22.0739 5188 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
11:52:22.0770 5188 cdrom - ok
11:52:22.0849 5188 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
11:52:22.0911 5188 circlass - ok
11:52:23.0005 5188 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
11:52:23.0020 5188 CLFS - ok
11:52:23.0161 5188 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
11:52:23.0208 5188 CmBatt - ok
11:52:23.0255 5188 cmdide (e79cbb2195e965f6e3256e2c1b23fd1c) C:\Windows\system32\drivers\cmdide.sys
11:52:23.0270 5188 cmdide - ok
11:52:23.0427 5188 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
11:52:23.0442 5188 Compbatt - ok
11:52:23.0567 5188 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
11:52:23.0583 5188 crcdisk - ok
11:52:23.0645 5188 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
11:52:23.0724 5188 Crusoe - ok
11:52:23.0880 5188 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys
11:52:23.0895 5188 DfsC - ok
11:52:24.0036 5188 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
11:52:24.0052 5188 disk - ok
11:52:24.0208 5188 Dot4 (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys
11:52:24.0270 5188 Dot4 - ok
11:52:24.0411 5188 Dot4Print (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys
11:52:24.0442 5188 Dot4Print - ok
11:52:24.0552 5188 dot4usb (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys
11:52:24.0583 5188 dot4usb - ok
11:52:24.0770 5188 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
11:52:24.0802 5188 drmkaud - ok
11:52:24.0911 5188 DSproct (413f2d5f9d802688242c23b38f767ecb) C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys
11:52:25.0302 5188 DSproct ( UnsignedFile.Multi.Generic ) - warning
11:52:25.0302 5188 DSproct - detected UnsignedFile.Multi.Generic (1)
11:52:25.0474 5188 dsunidrv (dfeabb7cfffadea4a912ab95bdc3177a) C:\Windows\system32\DRIVERS\dsunidrv.sys
11:52:25.0489 5188 dsunidrv - ok
11:52:25.0630 5188 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
11:52:25.0692 5188 DXGKrnl - ok
11:52:25.0786 5188 e1express (7505290504c8e2d172fa378cc0497bcc) C:\Windows\system32\DRIVERS\e1e6032.sys
11:52:25.0849 5188 e1express - ok
11:52:25.0974 5188 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
11:52:26.0036 5188 E1G60 - ok
11:52:26.0224 5188 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
11:52:26.0239 5188 Ecache - ok
11:52:26.0349 5188 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
11:52:26.0364 5188 elxstor - ok
11:52:26.0630 5188 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
11:52:26.0645 5188 exfat - ok
11:52:26.0739 5188 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
11:52:26.0770 5188 fastfat - ok
11:52:26.0895 5188 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
11:52:26.0958 5188 fdc - ok
11:52:27.0145 5188 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
11:52:27.0161 5188 FileInfo - ok
11:52:27.0239 5188 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
11:52:27.0286 5188 Filetrace - ok
11:52:27.0349 5188 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
11:52:27.0395 5188 flpydisk - ok
11:52:27.0567 5188 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
11:52:27.0583 5188 FltMgr - ok
11:52:27.0677 5188 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
11:52:27.0708 5188 Fs_Rec - ok
11:52:27.0786 5188 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
11:52:27.0802 5188 gagp30kx - ok
11:52:27.0911 5188 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
11:52:27.0989 5188 HdAudAddService - ok
11:52:28.0208 5188 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
11:52:28.0442 5188 HDAudBus - ok
11:52:28.0520 5188 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
11:52:28.0583 5188 HidBth - ok
11:52:28.0645 5188 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
11:52:28.0708 5188 HidIr - ok
11:52:28.0864 5188 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
11:52:28.0895 5188 HidUsb - ok
11:52:28.0989 5188 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
11:52:29.0005 5188 HpCISSs - ok
11:52:29.0145 5188 HSF_DPV (53229dcf431d76434816cd29251168a0) C:\Windows\system32\DRIVERS\HSX_DPV.sys
11:52:29.0177 5188 HSF_DPV - ok
11:52:29.0302 5188 HSXHWAZL (31f949d452201f2f0af0c88d7db512cd) C:\Windows\system32\DRIVERS\HSXHWAZL.sys
11:52:29.0317 5188 HSXHWAZL - ok
11:52:29.0395 5188 HTCAND32 (cbd09ed9cf6822177ee85aea4d8816a2) C:\Windows\system32\Drivers\ANDROIDUSB.sys
11:52:29.0427 5188 HTCAND32 - ok
11:52:29.0536 5188 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
11:52:29.0599 5188 HTTP - ok
11:52:29.0692 5188 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
11:52:29.0708 5188 i2omp - ok
11:52:29.0817 5188 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
11:52:29.0849 5188 i8042prt - ok
11:52:29.0895 5188 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
11:52:29.0911 5188 iaStorV - ok
11:52:30.0005 5188 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
11:52:30.0020 5188 iirsp - ok
11:52:30.0145 5188 intelide (0084046c084d68e494f8cf36bcf08186) C:\Windows\system32\drivers\intelide.sys
11:52:30.0161 5188 intelide - ok
11:52:30.0239 5188 intelppm (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys
11:52:30.0302 5188 intelppm - ok
11:52:30.0505 5188 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
11:52:30.0536 5188 IpFilterDriver - ok
11:52:30.0552 5188 IpInIp - ok
11:52:30.0614 5188 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
11:52:30.0677 5188 IPMIDRV - ok
11:52:30.0817 5188 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
11:52:30.0849 5188 IPNAT - ok
11:52:30.0958 5188 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
11:52:30.0989 5188 IRENUM - ok
11:52:31.0052 5188 isapnp (2f8ece2699e7e2070545e9b0960a8ed2) C:\Windows\system32\drivers\isapnp.sys
11:52:31.0067 5188 isapnp - ok
11:52:31.0192 5188 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
11:52:31.0208 5188 iScsiPrt - ok
11:52:31.0255 5188 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
11:52:31.0270 5188 iteatapi - ok
11:52:31.0333 5188 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
11:52:31.0349 5188 iteraid - ok
11:52:31.0474 5188 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
11:52:31.0489 5188 kbdclass - ok
11:52:31.0802 5188 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys
11:52:31.0833 5188 kbdhid - ok
11:52:32.0177 5188 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys
11:52:32.0349 5188 KSecDD - ok
11:52:32.0552 5188 Lavasoft Kernexplorer (6c4a3804510ad8e0f0c07b5be3d44ddb) C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys
11:52:32.0630 5188 Lavasoft Kernexplorer - ok
11:52:32.0755 5188 Lbd - ok
11:52:32.0895 5188 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
11:52:32.0942 5188 lltdio - ok
11:52:33.0239 5188 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
11:52:33.0255 5188 LSI_FC - ok
11:52:33.0317 5188 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
11:52:33.0333 5188 LSI_SAS - ok
11:52:33.0395 5188 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
11:52:33.0411 5188 LSI_SCSI - ok
11:52:33.0520 5188 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
11:52:33.0552 5188 luafv - ok
11:52:33.0645 5188 MBAMProtector (b7ca8cc3f978201856b6ab82f40953c3) C:\Windows\system32\drivers\mbam.sys
11:52:33.0661 5188 MBAMProtector - ok
11:52:33.0739 5188 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys
11:52:33.0770 5188 mdmxsdk - ok
11:52:33.0864 5188 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
11:52:33.0880 5188 megasas - ok
11:52:33.0989 5188 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
11:52:34.0036 5188 Modem - ok
11:52:34.0177 5188 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
11:52:34.0208 5188 monitor - ok
11:52:34.0317 5188 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
11:52:34.0333 5188 mouclass - ok
11:52:34.0458 5188 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
11:52:34.0692 5188 mouhid - ok
11:52:34.0802 5188 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
11:52:34.0817 5188 MountMgr - ok
11:52:34.0927 5188 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
11:52:34.0958 5188 mpio - ok
11:52:35.0083 5188 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
11:52:35.0114 5188 mpsdrv - ok
11:52:35.0208 5188 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
11:52:35.0224 5188 Mraid35x - ok
11:52:35.0317 5188 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
11:52:35.0333 5188 MRxDAV - ok
11:52:35.0427 5188 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys
11:52:35.0442 5188 mrxsmb - ok
11:52:35.0552 5188 mrxsmb10 (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys
11:52:35.0567 5188 mrxsmb10 - ok
11:52:35.0708 5188 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
11:52:35.0739 5188 mrxsmb20 - ok
11:52:35.0802 5188 msahci (d420bc42a637ac3cc4f411220549c0dc) C:\Windows\system32\drivers\msahci.sys
11:52:35.0817 5188 msahci - ok
11:52:35.0880 5188 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
11:52:35.0895 5188 msdsm - ok
11:52:35.0974 5188 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
11:52:36.0005 5188 Msfs - ok
11:52:36.0099 5188 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
11:52:36.0114 5188 msisadrv - ok
11:52:36.0255 5188 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
11:52:36.0286 5188 MSKSSRV - ok
11:52:36.0333 5188 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
11:52:36.0364 5188 MSPCLOCK - ok
11:52:36.0505 5188 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
11:52:36.0552 5188 MSPQM - ok
11:52:36.0755 5188 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
11:52:36.0849 5188 MsRPC - ok
11:52:36.0942 5188 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
11:52:36.0958 5188 mssmbios - ok
11:52:37.0036 5188 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
11:52:37.0083 5188 MSTEE - ok
11:52:37.0224 5188 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
11:52:37.0239 5188 Mup - ok
11:52:37.0380 5188 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
11:52:37.0411 5188 NativeWifiP - ok
11:52:37.0505 5188 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
11:52:37.0536 5188 NDIS - ok
11:52:37.0677 5188 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
11:52:37.0708 5188 NdisTapi - ok
11:52:37.0849 5188 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
11:52:37.0895 5188 Ndisuio - ok
11:52:38.0052 5188 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
11:52:38.0083 5188 NdisWan - ok
11:52:38.0192 5188 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
11:52:38.0224 5188 NDProxy - ok
11:52:38.0349 5188 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
11:52:38.0395 5188 NetBIOS - ok
11:52:38.0474 5188 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
11:52:38.0505 5188 netbt - ok
11:52:38.0599 5188 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
11:52:38.0614 5188 nfrd960 - ok
11:52:38.0786 5188 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
11:52:38.0817 5188 Npfs - ok
11:52:38.0864 5188 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
11:52:38.0895 5188 nsiproxy - ok
11:52:39.0052 5188 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
11:52:39.0177 5188 Ntfs - ok
11:52:39.0239 5188 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
11:52:39.0286 5188 ntrigdigi - ok
11:52:39.0380 5188 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
11:52:39.0411 5188 Null - ok
11:52:39.0474 5188 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
11:52:39.0474 5188 nvraid - ok
11:52:39.0536 5188 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
11:52:39.0552 5188 nvstor - ok
11:52:39.0599 5188 nv_agp (055081fd5076401c1ee1bcab08d81911) C:\Windows\system32\drivers\nv_agp.sys
11:52:39.0614 5188 nv_agp - ok
11:52:39.0661 5188 NwlnkFlt - ok
11:52:39.0692 5188 NwlnkFwd - ok
11:52:39.0817 5188 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys
11:52:39.0849 5188 ohci1394 - ok
11:52:39.0989 5188 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
11:52:40.0411 5188 Parport - ok
11:52:40.0630 5188 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
11:52:40.0645 5188 partmgr - ok
11:52:40.0724 5188 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
11:52:40.0786 5188 Parvdm - ok
11:52:40.0880 5188 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
11:52:40.0895 5188 pci - ok
11:52:41.0067 5188 pciide (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys
11:52:41.0099 5188 pciide - ok
11:52:41.0161 5188 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys
11:52:41.0177 5188 pcmcia - ok
11:52:41.0255 5188 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
11:52:41.0349 5188 PEAUTH - ok
11:52:41.0692 5188 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
11:52:41.0724 5188 PptpMiniport - ok
11:52:41.0817 5188 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
11:52:41.0880 5188 Processor - ok
11:52:42.0036 5188 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
11:52:42.0052 5188 PSched - ok
11:52:42.0145 5188 PxHelp20 (feffcfdc528764a04c8ed63d5fa6e711) C:\Windows\system32\Drivers\PxHelp20.sys
11:52:42.0161 5188 PxHelp20 ( UnsignedFile.Multi.Generic ) - warning
11:52:42.0161 5188 PxHelp20 - detected UnsignedFile.Multi.Generic (1)
11:52:42.0270 5188 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
11:52:42.0302 5188 ql2300 - ok
11:52:42.0380 5188 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
11:52:42.0395 5188 ql40xx - ok
11:52:42.0505 5188 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
11:52:42.0520 5188 QWAVEdrv - ok
11:52:42.0661 5188 R300 (554685122b4f973e21d66c2baaf29543) C:\Windows\system32\DRIVERS\atikmdag.sys
11:52:42.0770 5188 R300 - ok
11:52:42.0895 5188 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
11:52:42.0927 5188 RasAcd - ok
11:52:43.0052 5188 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
11:52:43.0099 5188 Rasl2tp - ok
11:52:43.0239 5188 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
11:52:43.0255 5188 RasPppoe - ok
11:52:43.0380 5188 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
11:52:43.0411 5188 RasSstp - ok
11:52:43.0536 5188 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
11:52:43.0567 5188 rdbss - ok
11:52:43.0677 5188 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
11:52:43.0724 5188 RDPCDD - ok
11:52:43.0786 5188 rdpdr (0245418224cfa77bf4b41c2fe0622258) C:\Windows\system32\drivers\rdpdr.sys
11:52:43.0817 5188 rdpdr - ok
11:52:43.0895 5188 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
11:52:43.0942 5188 RDPENCDD - ok
11:52:44.0067 5188 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys
11:52:44.0552 5188 RDPWD - ok
11:52:44.0645 5188 rimmptsk (d85e3fa9f5b1f29bb4ed185c450d1470) C:\Windows\system32\DRIVERS\rimmptsk.sys
11:52:44.0677 5188 rimmptsk - ok
11:52:44.0724 5188 rimsptsk (db8eb01c58c9fada00c70b1775278ae0) C:\Windows\system32\drivers\rimsptsk.sys
11:52:44.0770 5188 rimsptsk - ok
11:52:44.0880 5188 rismxdp (6c1f93c0760c9f79a1869d07233df39d) C:\Windows\system32\drivers\rixdptsk.sys
11:52:44.0895 5188 rismxdp - ok
11:52:45.0083 5188 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
11:52:45.0114 5188 rspndr - ok
11:52:45.0192 5188 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
11:52:45.0208 5188 sbp2port - ok
11:52:45.0380 5188 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys
11:52:45.0411 5188 sdbus - ok
11:52:45.0458 5188 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
11:52:45.0520 5188 secdrv - ok
11:52:45.0614 5188 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys
11:52:45.0677 5188 Serenum - ok
11:52:45.0786 5188 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
11:52:45.0849 5188 Serial - ok
11:52:46.0005 5188 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
11:52:46.0036 5188 sermouse - ok
11:52:46.0161 5188 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys
11:52:46.0192 5188 sffdisk - ok
11:52:46.0286 5188 sffp_mmc (96ded8b20c734ac41641ce275250e55d) C:\Windows\system32\drivers\sffp_mmc.sys
11:52:46.0302 5188 sffp_mmc - ok
11:52:46.0411 5188 sffp_sd (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys
11:52:46.0442 5188 sffp_sd - ok
11:52:46.0614 5188 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
11:52:46.0724 5188 sfloppy - ok
11:52:46.0833 5188 sisagp (08072b2fb92477fc813271a84b3a8698) C:\Windows\system32\drivers\sisagp.sys
11:52:46.0864 5188 sisagp - ok
11:52:46.0911 5188 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
11:52:46.0927 5188 SiSRaid2 - ok
11:52:46.0989 5188 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
11:52:47.0005 5188 SiSRaid4 - ok
11:52:47.0130 5188 Smb (7459cc8a1300e5e21f666eae28f615cb) C:\Windows\system32\DRIVERS\smb.sys
11:52:47.0145 5188 Smb ( UnsignedFile.Multi.Generic ) - warning
11:52:47.0145 5188 Smb - detected UnsignedFile.Multi.Generic (1)
11:52:47.0239 5188 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
11:52:47.0255 5188 spldr - ok
11:52:47.0411 5188 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
11:52:47.0489 5188 srv - ok
11:52:47.0614 5188 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys
11:52:47.0645 5188 srv2 - ok
11:52:47.0677 5188 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys
11:52:47.0692 5188 srvnet - ok
11:52:47.0817 5188 STHDA (9cea131b5eb0ea653f6b3ea80b54956d) C:\Windows\system32\drivers\stwrt.sys
11:52:47.0849 5188 STHDA - ok
11:52:47.0942 5188 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
11:52:48.0099 5188 swenum - ok
11:52:48.0161 5188 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
11:52:48.0177 5188 Symc8xx - ok
11:52:48.0224 5188 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
11:52:48.0239 5188 Sym_hi - ok
11:52:48.0286 5188 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
11:52:48.0302 5188 Sym_u3 - ok
11:52:48.0395 5188 SynTP (1f5192248a364d4ab68db063d18a2139) C:\Windows\system32\DRIVERS\SynTP.sys
11:52:48.0411 5188 SynTP - ok
11:52:48.0552 5188 Tcpip (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys
11:52:48.0583 5188 Tcpip - ok
11:52:48.0677 5188 Tcpip6 (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys
11:52:48.0708 5188 Tcpip6 - ok
11:52:48.0817 5188 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
11:52:48.0849 5188 tcpipreg - ok
11:52:48.0958 5188 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
11:52:48.0989 5188 TDPIPE - ok
11:52:49.0052 5188 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
11:52:49.0083 5188 TDTCP - ok
11:52:49.0177 5188 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
11:52:49.0208 5188 tdx - ok
11:52:49.0317 5188 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
11:52:49.0333 5188 TermDD - ok
11:52:49.0520 5188 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
11:52:49.0552 5188 tssecsrv - ok
11:52:49.0692 5188 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
11:52:49.0724 5188 tunmp - ok
11:52:49.0755 5188 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
11:52:49.0770 5188 tunnel - ok
11:52:49.0833 5188 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
11:52:49.0849 5188 uagp35 - ok
11:52:49.0958 5188 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
11:52:49.0989 5188 udfs - ok
11:52:50.0067 5188 uliagpkx (6d72ef05921abdf59fc45c7ebfe7e8dd) C:\Windows\system32\drivers\uliagpkx.sys
11:52:50.0333 5188 uliagpkx - ok
11:52:50.0442 5188 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
11:52:50.0458 5188 uliahci - ok
11:52:50.0505 5188 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
11:52:50.0520 5188 UlSata - ok
11:52:50.0552 5188 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
11:52:50.0567 5188 ulsata2 - ok
11:52:50.0645 5188 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
11:52:50.0692 5188 umbus - ok
11:52:50.0849 5188 usbaudio (32db9517628ff0d070682aab61e688f0) C:\Windows\system32\drivers\usbaudio.sys
11:52:50.0880 5188 usbaudio - ok
11:52:50.0974 5188 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
11:52:51.0005 5188 usbccgp - ok
11:52:51.0052 5188 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
11:52:51.0130 5188 usbcir - ok
11:52:51.0286 5188 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
11:52:51.0302 5188 usbehci - ok
11:52:51.0349 5188 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
11:52:51.0395 5188 usbhub - ok
11:52:51.0614 5188 usbohci (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys
11:52:51.0630 5188 usbohci - ok
11:52:51.0708 5188 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys
11:52:51.0739 5188 usbprint - ok
11:52:51.0849 5188 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys
11:52:51.0864 5188 usbscan - ok
11:52:51.0989 5188 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
11:52:52.0020 5188 USBSTOR - ok
11:52:52.0052 5188 usbuhci (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys
11:52:52.0208 5188 usbuhci - ok
11:52:52.0442 5188 usb_rndisx (35c9095fa7076466afbfc5b9ec4b779e) C:\Windows\system32\DRIVERS\usb8023x.sys
11:52:52.0474 5188 usb_rndisx - ok
11:52:52.0552 5188 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
11:52:52.0614 5188 vga - ok
11:52:52.0708 5188 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
11:52:52.0739 5188 VgaSave - ok
11:52:52.0817 5188 viaagp (d5929a28bdff4367a12caf06af901971) C:\Windows\system32\drivers\viaagp.sys
11:52:52.0833 5188 viaagp - ok
11:52:52.0880 5188 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
11:52:52.0942 5188 ViaC7 - ok
11:52:53.0036 5188 viaide (f3b4762eb85a2aff4999401f14c3262b) C:\Windows\system32\drivers\viaide.sys
11:52:53.0052 5188 viaide - ok
11:52:53.0145 5188 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
11:52:53.0161 5188 volmgr - ok
11:52:53.0286 5188 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
11:52:53.0302 5188 volmgrx - ok
11:52:53.0411 5188 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
11:52:53.0427 5188 volsnap - ok
11:52:53.0489 5188 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
11:52:53.0505 5188 vsmraid - ok
11:52:53.0599 5188 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
11:52:53.0661 5188 WacomPen - ok
11:52:53.0817 5188 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
11:52:53.0849 5188 Wanarp - ok
11:52:53.0880 5188 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
11:52:53.0911 5188 Wanarpv6 - ok
11:52:54.0036 5188 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
11:52:54.0052 5188 Wd - ok
11:52:54.0161 5188 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
11:52:54.0192 5188 Wdf01000 - ok
11:52:54.0349 5188 winachsf (6d2350bb6e77e800fc4be4e5b7a2e89a) C:\Windows\system32\DRIVERS\HSX_CNXT.sys
11:52:54.0380 5188 winachsf - ok
11:52:54.0661 5188 WINUSB (676f4b665bdd8053eaa53ac1695b8074) C:\Windows\system32\DRIVERS\WinUSB.SYS
11:52:54.0692 5188 WINUSB - ok
11:52:54.0802 5188 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys
11:52:54.0833 5188 WmiAcpi - ok
11:52:54.0989 5188 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
11:52:55.0036 5188 ws2ifsl - ok
11:52:55.0208 5188 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
11:52:55.0239 5188 WUDFRd - ok
11:52:55.0317 5188 XAudio (5a7ff9a18ff6d7e0527fe3abf9204ef8) C:\Windows\system32\DRIVERS\xaudio.sys
11:52:55.0333 5188 XAudio - ok
11:52:55.0411 5188 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
11:52:55.0567 5188 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
11:52:55.0567 5188 \Device\Harddisk0\DR0 - detected TDSS File System (1)
11:52:55.0630 5188 Boot (0x1200) (44d268eb113fe5333af5319d6591d1e4) \Device\Harddisk0\DR0\Partition0
11:52:55.0630 5188 \Device\Harddisk0\DR0\Partition0 - ok
11:52:55.0645 5188 Boot (0x1200) (4e7e7df791dee5f846411593e3df8553) \Device\Harddisk0\DR0\Partition1
11:52:55.0645 5188 \Device\Harddisk0\DR0\Partition1 - ok
11:52:55.0645 5188 ============================================================
11:52:55.0645 5188 Scan finished
11:52:55.0645 5188 ============================================================
11:52:55.0677 5168 Detected object count: 4
11:52:55.0677 5168 Actual detected object count: 4
11:53:13.0317 5168 DSproct ( UnsignedFile.Multi.Generic ) - skipped by user
11:53:13.0317 5168 DSproct ( UnsignedFile.Multi.Generic ) - User select action: Skip
11:53:13.0317 5168 PxHelp20 ( UnsignedFile.Multi.Generic ) - skipped by user
11:53:13.0317 5168 PxHelp20 ( UnsignedFile.Multi.Generic ) - User select action: Skip
11:53:13.0333 5168 Smb ( UnsignedFile.Multi.Generic ) - skipped by user
11:53:13.0333 5168 Smb ( UnsignedFile.Multi.Generic ) - User select action: Skip
11:53:13.0333 5168 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
11:53:13.0333 5168 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip
11:53:19.0270 5064 Deinitialize success
11:53:13.0333 5168 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by useraswMBR.exe ( 511KB ) to your desktop. [external image: Posted Image] [external image: Posted Image]
Was quickscan the right one to do?
Here's the log (it found 2 things):
aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software
Run date: 2012-01-06 16:17:26
—————————–
16:17:26.834 OS Version: Windows 6.0.6002 Service Pack 2
16:17:26.834 Number of processors: 2 586 0x6801
16:17:26.834 ComputerName: SUSAN-PC UserName: Susan
16:18:02.819 Initialize success
16:21:40.970 AVAST engine defs: 12010601
16:22:16.111 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
16:22:16.111 Disk 0 Vendor: ST9120822AS 3.CDD Size: 114473MB BusType: 3
16:22:16.142 Disk 0 MBR read successfully
16:22:16.142 Disk 0 MBR scan
16:22:16.157 Disk 0 Windows VISTA default MBR code
16:22:16.173 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 78 MB offset 63
16:22:16.204 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 161792
16:22:16.236 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 104153 MB offset 21133312
16:22:16.251 Disk 0 scanning sectors +234438656
16:22:16.376 Disk 0 scanning C:\Windows\system32\drivers
16:22:32.454 File: C:\Windows\system32\drivers\smb.sys **INFECTED** Win32:Aluroot [Rtk]
16:22:38.251 Disk 0 trace - called modules:
16:22:38.282 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS hal.dll pciide.sys PCIIDEX.SYS atapi.sys
16:22:38.798 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x858a9ac8]
16:22:38.829 3 CLASSPNP.SYS[837a78b3] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x857ee030]
16:22:39.673 AVAST engine scan C:\Windows
16:22:45.454 AVAST engine scan C:\Windows\system32
16:27:11.986 AVAST engine scan C:\Windows\system32\drivers
16:27:27.314 File: C:\Windows\system32\drivers\smb.sys **INFECTED** Win32:Aluroot [Rtk]
16:27:33.907 AVAST engine scan C:\Users\Susan
16:32:02.517 Disk 0 MBR has been saved successfully to "C:\Users\Susan\Desktop\MBR.dat"
16:32:02.532 The log file has been saved successfully to "C:\Users\Susan\Desktop\aswMBR.txt"
Re-Run aswMBR Scan
A strange thing happened on the way to this forum- Ad-aware updater kept starting up & freezing, until my ram was used up. I had to go to task manager and end all of the started files. And then that was all. It's weird because I can't find the ad-aware exe file, only the updater file on my computer. I don't know if I accidently deleted ad-aware but not the updater. Anyway, that's just an aside. I don't think its related to the virus stuff.
Here's the log:
aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software
Run date: 2012-01-07 15:07:56
—————————–
15:07:56.707 OS Version: Windows 6.0.6002 Service Pack 2
15:07:56.707 Number of processors: 2 586 0x6801
15:07:56.707 ComputerName: SUSAN-PC UserName: Susan
15:08:04.473 Initialize success
15:08:14.254 AVAST engine defs: 12010601
15:08:22.598 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
15:08:22.613 Disk 0 Vendor: ST9120822AS 3.CDD Size: 114473MB BusType: 3
15:08:22.738 Disk 0 MBR read successfully
15:08:22.738 Disk 0 MBR scan
15:08:22.754 Disk 0 Windows VISTA default MBR code
15:08:22.816 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 78 MB offset 63
15:08:22.926 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 161792
15:08:22.941 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 104153 MB offset 21133312
15:08:22.988 Disk 0 scanning sectors +234438656
15:08:23.504 Disk 0 scanning C:\Windows\system32\drivers
15:08:57.738 File: C:\Windows\system32\drivers\smb.sys **INFECTED** Win32:Aluroot [Rtk]
15:09:09.035 Disk 0 trace - called modules:
15:09:09.066 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS hal.dll pciide.sys PCIIDEX.SYS atapi.sys
15:09:09.082 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x858a9ac8]
15:09:09.098 3 CLASSPNP.SYS[837a78b3] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x857ee030]
15:09:09.785 AVAST engine scan C:\Windows
15:09:33.207 AVAST engine scan C:\Windows\system32
15:14:01.363 AVAST engine scan C:\Windows\system32\drivers
15:14:18.379 File: C:\Windows\system32\drivers\smb.sys **INFECTED** Win32:Aluroot [Rtk]
15:14:25.519 AVAST engine scan C:\Users\Susan
15:36:54.082 AVAST engine scan C:\ProgramData
16:01:22.644 Scan finished successfully
18:47:44.723 Fixing … C:\Windows\system32\drivers\smb.sys
18:48:00.442 File C:\Windows\system32\drivers\smb.sys fixed successfully - please reboot ASAP
18:48:00.551 Moved: C:\Users\Susan\AppData\Local\Temp\~Quarantine.aswMBR\smb.sys
18:48:00.551 Moved: C:\Users\Susan\AppData\Local\Temp\~Quarantine.aswMBR\smb.sys
19:15:44.551 Disk 0 MBR has been saved successfully to "C:\Users\Susan\Desktop\MBR.dat"
19:15:44.551 The log file has been saved successfully to "C:\Users\Susan\Desktop\aswMBR.txt"
19:16:47.630 Disk 0 MBR has been saved successfully to "C:\Users\Susan\Desktop\MBR.dat"
19:16:47.646 The log file has been saved successfully to "C:\Users\Susan\Desktop\aswMBR2.txt"
18:48:00.442 File C:\Windows\system32\drivers\smb.sys fixed successfully - please reboot ASAP [external image: Posted Image] [external image: Posted Image]
I did restart right after I made the log. Sorry.
Here is the new log, which now found another infected file.
aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software
Run date: 2012-01-10 12:31:22
—————————–
12:31:22.765 OS Version: Windows 6.0.6002 Service Pack 2
12:31:22.765 Number of processors: 2 586 0x6801
12:31:22.765 ComputerName: SUSAN-PC UserName: Susan
12:31:31.046 Initialize success
12:32:16.928 AVAST engine defs: 12011000
12:32:55.444 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
12:32:55.459 Disk 0 Vendor: ST9120822AS 3.CDD Size: 114473MB BusType: 3
12:32:55.475 Disk 0 MBR read successfully
12:32:55.491 Disk 0 MBR scan
12:32:55.506 Disk 0 Windows VISTA default MBR code
12:32:55.522 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 78 MB offset 63
12:32:55.553 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 161792
12:32:55.584 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 104153 MB offset 21133312
12:32:55.616 Disk 0 scanning sectors +234438656
12:32:55.756 Disk 0 scanning C:\Windows\system32\drivers
12:33:17.288 Service scanning
12:33:19.709 Modules scanning
12:33:32.444 Disk 0 trace - called modules:
12:33:32.491 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS hal.dll pciide.sys PCIIDEX.SYS atapi.sys
12:33:32.506 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8590c728]
12:33:32.522 3 CLASSPNP.SYS[8379d8b3] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x857ee030]
12:33:33.256 AVAST engine scan C:\Windows
12:33:38.959 AVAST engine scan C:\Windows\system32
12:37:28.366 AVAST engine scan C:\Windows\system32\drivers
12:37:50.350 AVAST engine scan C:\Users\Susan
12:52:12.225 File: C:\Users\Susan\AppData\Local\temp\~Quarantine.aswMBR\smb.sys **INFECTED** Win32:Aluroot [Rtk]
13:06:57.928 AVAST engine scan C:\ProgramData
13:26:45.413 Scan finished successfully
13:33:30.610 Disk 0 MBR has been saved successfully to "C:\Users\Susan\Desktop\MBR.dat"
13:33:30.625 The log file has been saved successfully to "C:\Users\Susan\Desktop\aswMBR3.txt"
Delete this file
C:\Users\Susan\AppData\Local\temp\~Quarantine.aswMBR\
smb.sys
Run TFC Cleaner.
Download
TFC to your
desktop
Close any open windows. Double click the TFC icon to run the program TFC will close all open programs itself Click the Start button to begin the process. Allow TFC to run uninterrupted. The program should not take long to finish it's job Once its finished it should automatically reboot your machine, if it doesn't, manually reboot to ensure a complete clean
After reboot let me know how it's running.
Hi
Everything seems good right now. When I go to run errands, I will run the scan one more time to see if it finds anything, and if it does, I will post the log.
Thanks!
So frustrating! Another rootkit! Where are they coming from? How do I stop them? I'm not even downloading anything!
Here's the new log, in the meantime, I am going to run an ESET scan.
aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software
Run date: 2012-01-12 05:51:02
—————————–
05:51:02.073 OS Version: Windows 6.0.6002 Service Pack 2
05:51:02.073 Number of processors: 2 586 0x6801
05:51:02.073 ComputerName: SUSAN-PC UserName: Susan
05:51:40.214 Initialize success
05:55:13.325 AVAST engine defs: 12011200
06:07:35.888 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
06:07:35.888 Disk 0 Vendor: ST9120822AS 3.CDD Size: 114473MB BusType: 3
06:07:35.997 Disk 0 MBR read successfully
06:07:35.997 Disk 0 MBR scan
06:07:36.106 Disk 0 Windows VISTA default MBR code
06:07:36.153 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 78 MB offset 63
06:07:36.216 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 10240 MB offset 161792
06:07:36.309 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 104153 MB offset 21133312
06:07:36.325 Disk 0 scanning sectors +234438656
06:07:36.575 Disk 0 scanning C:\Windows\system32\drivers
06:08:07.075 Service scanning
06:08:09.544 Modules scanning
06:08:25.997 Disk 0 trace - called modules:
06:08:26.028 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS hal.dll pciide.sys PCIIDEX.SYS atapi.sys
06:08:26.044 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x858adac8]
06:08:26.044 3 CLASSPNP.SYS[8379e8b3] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x857ee030]
06:08:27.028 AVAST engine scan C:\Windows
06:08:30.903 File: C:\Windows\PEV.exe **INFECTED** Win32:Rootkit-gen [Rtk]
06:08:33.778 AVAST engine scan C:\Windows\system32
06:13:41.559 AVAST engine scan C:\Windows\system32\drivers
06:14:16.934 AVAST engine scan C:\Users\Susan
06:38:12.231 AVAST engine scan C:\ProgramData
06:57:59.169 Scan finished successfully
07:13:28.200 Disk 0 MBR has been saved successfully to "C:\Users\Susan\Desktop\MBR.dat"
07:13:28.216 The log file has been saved successfully to "C:\Users\Susan\Desktop\aswMBR4.txt"
06:08:30.903 File: C:\Windows\PEV.exe **INFECTED** Win32:Rootkit-gen [Rtk]
That's a Combofix file.
Uninstall combofix and run the scan again
The following will implement some cleanup procedures as well as reset System Restore points:
For XP:
Click START run Now type ComboFix /Uninstall in the runbox and click OK . Note the space between the X and the / , it needs to be there.
For Vista / Windows 7
Click START Search Now type ComboFix /Uninstall in the runbox and click OK . Note the space between the X and the / , it needs to be there.
Hi
I'm trying to do that, but I have 2 problems.
1) if I type slow, I get as far as typing "c" in the start menu (Windows vista) and then it says windows explorere has stopped working.
2) if I type really fast, I can type in combofix /uninstall (with the space) but it can't find iexplorere.exe which is on my desktop.
I don't get it.
Thanks,
Sue
ETA: I don't get the "stopped working" window when typing regedit really slow. only with words that start with "c"
