Spyware / Malware / Virus Removal

boot.tidserv [Closed]

18 min read

Looking for the outcome? Ask AI

oldbloke Topic Starter

Post #1December 23, 2011, 11:14 AM UTC

I have the above appearing in my symantec log, it is log only.
I also have a cookie: [removed]/ showing on my symantec log, and it reappears after deletion, is it related?
First question is, should I keep this PC from rebooting?
This post will likely time out as we are breaking for the holiday, but all and any help appreciated.

OTL.txt is below. Extras.txt is not happening even after retries

OTL logfile created on: 23/12/2011 10:58:44 - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Sales\Desktop
Professional (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 1.28 Gb Available Physical Memory | 42.61% Memory free
5.99 Gb Paging File | 4.16 Gb Available in Paging File | 69.40% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148.18 Gb Total Space | 88.36 Gb Free Space | 59.63% Space Free | Partition Type: NTFS
Drive D: | 149.05 Gb Total Space | 148.91 Gb Free Space | 99.91% Space Free | Partition Type: NTFS
Drive E: | 750.00 Mb Total Space | 549.41 Mb Free Space | 73.26% Space Free | Partition Type: NTFS
Drive P: | 222.61 Gb Total Space | 103.29 Gb Free Space | 46.40% Space Free | Partition Type: NTFS

Computer Name: SALES-7-PC | User Name: Sales | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Sales\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\hasplms.exe (SafeNet Inc.)
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\SavUI.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (Symantec Corporation)
PRC - C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
PRC - C:\Windows\System32\spool\drivers\w32x86\3\EKAiO2MUI.exe (Eastman Kodak Company)
PRC - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\UPS\WSTD\WSTDMessaging.exe ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\UPS\WSTD\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\UPS\WSTD\UPSNA1Msgr.exe ()
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\fd6d00c3c7d56a2e3651769081e8f412\System.EnterpriseServices.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\45a20172acfdcc160ecb6bd358179c31\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\834be57d8ab824b4ebcbf01161791d70\System.Transactions.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d76221993c2fdfb991b8c12ae50a30eb\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\0e245eb9c1067cabd5673fe832d28613\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\275680f2b9db0501d53c50ea7d7a43f0\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e9ebeb7959f1c916ebf6fca8f7077d6c\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\95b9866ab6e4437ef5dc5855ebab4e33\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll ()
MOD - C:\UPS\WSTD\WSTDMessaging.exe ()
MOD - C:\UPS\WSTD\UPSNA1Msgr.exe ()
MOD - C:\UPS\WSTD\POLICYMGR\UPS.Components.NA1MessengerServer.dll ()
MOD - C:\UPS\WSTD\POLICYMGR\Microsoft.ApplicationBlocks.Data.dll ()
MOD - C:\UPS\WSTD\POLICYMGR\UPS.Components.PolicyHolder.dll ()
MOD - C:\UPS\WSTD\UPSResourceManager.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()

========== Win32 Services (SafeList) ==========

SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (hasplms) – C:\Windows\System32\hasplms.exe (SafeNet Inc.)
SRV - (Symantec AntiVirus) – C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)
SRV - (SmcService) – C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation)
SRV - (SNAC) – C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE (Symantec Corporation)
SRV - (Kodak AiO Network Discovery Service) – C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
SRV - (ccSetMgr) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccEvtMgr) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (AdobeARMservice) – C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE (Symantec Corporation)
SRV - (MSSQL$UPSWSDBSERVER) SQL Server (UPSWSDBSERVER) – C:\UPS\WSTD\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (StorSvc) – C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (SymEvent) – C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (aksfridge) – C:\Windows\System32\drivers\aksfridge.sys (SafeNet Inc.)
DRV - (SysPlant) – C:\Windows\SYSTEM32\Drivers\SysPlant.sys (Symantec Corporation)
DRV - (WPS) – C:\Windows\System32\drivers\WPSDRVnt.sys (Symantec Corporation)
DRV - (SRTSPL) – C:\Windows\System32\drivers\srtspl.sys (Symantec Corporation)
DRV - (SRTSP) – C:\Windows\System32\drivers\srtsp.sys (Symantec Corporation)
DRV - (SRTSPX) – C:\Windows\System32\drivers\srtspx.sys (Symantec Corporation)
DRV - (akshhl) – C:\Windows\System32\drivers\akshhl.sys (SafeNet Inc.)
DRV - (NAVEX15) – C:\ProgramData\Symantec\Definitions\VirusDefs\20111222.032\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Symantec\Definitions\VirusDefs\20111222.032\NAVENG.SYS (Symantec Corporation)
DRV - (hardlock) – C:\Windows\System32\drivers\hardlock.sys (SafeNet Inc.)
DRV - (aksusb) – C:\Windows\System32\drivers\aksusb.sys (SafeNet Inc.)
DRV - (WpsHelper) – C:\Windows\System32\drivers\wpshelper.sys (Symantec Corporation)
DRV - (Teefer3) – C:\Windows\System32\drivers\Teefer3.sys (Symantec Corporation)
DRV - (akshasp) – C:\Windows\System32\drivers\akshasp.sys (Aladdin Knowledge Systems Ltd.)
DRV - (SPBBCDrv) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (SYMTDI) – C:\Windows\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMREDRV) – C:\Windows\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (vmbus) – C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (k57nd60x) Broadcom NetLink ™ – C:\Windows\System32\drivers\k57nd60x.sys (Broadcom Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www-int.cadlink.com:1443/clicks/login.php
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 47 39 BA 80 E3 B4 CC 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

O1 HOSTS File: ([2009/06/10 21:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [Conime] %windir%\system32\conime.exe File not found
O4 - HKLM..\Run: [EKAIO2StatusMonitor] C:\Windows\System32\spool\drivers\w32x86\3\EKAiO2MUI.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [NA1Messenger] C:\UPS\WSTD\UPSNA1Msgr.exe ()
O4 - HKCU..\Run: [BrowserChoice] C:\Windows\System32\browserchoice.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4cb46b41-0023-43e9-b21b-1f265fc87433}: DhcpNameServer = 192.168.16.10 192.168.16.2 192.168.16.5 192.168.16.8
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4cb46b41-0023-43e9-b21b-1f265fc87433}: Domain = ottawa.cadlink.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4cb46b41-0023-43e9-b21b-1f265fc87433}: NameServer = 192.168.16.10 192.168.16.5 192.168.16.2 192.168.16.8
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F3CF3095-575F-4ACA-A683-B1867705300B}: DhcpNameServer = 10.0.0.2
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 21:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/23 10:35:29 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Sales\Desktop\OTL.exe
[2011/12/14 03:01:21 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2011/12/14 02:29:50 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/12/14 02:29:50 | 000,606,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/12/14 02:29:50 | 000,599,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/12/14 02:29:50 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/12/14 02:29:50 | 000,381,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/12/14 02:29:50 | 000,185,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/12/14 02:29:50 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/12/14 02:29:50 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/12/14 02:29:50 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/12/14 02:29:50 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/12/14 02:29:50 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/12/14 02:29:50 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/12/14 02:29:03 | 002,340,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/12/14 02:28:58 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2011/12/14 02:28:46 | 000,534,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EncDec.dll
[2011/12/14 02:27:45 | 000,038,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\csrsrv.dll
[2011/12/14 02:27:43 | 003,957,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/12/14 02:27:43 | 003,901,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/12/09 16:31:53 | 000,293,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\browserchoice.exe
[2011/12/09 16:30:40 | 000,000,000 | —D | C] – C:\Program Files\MSXML 4.0
[2011/12/09 11:52:02 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UPS
[2011/12/09 11:50:14 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Analysis Services
[2011/12/09 11:49:56 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft SQL Server 2005
[2011/12/09 11:38:29 | 000,000,000 | —D | C] – C:\UPS
[2011/12/09 11:02:34 | 000,414,368 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/12/09 11:02:33 | 000,000,000 | —D | C] – C:\Windows\System32\Macromed
[2011/12/09 09:39:46 | 000,284,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\usbport.sys
[2011/12/09 09:39:46 | 000,005,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\usbd.sys
[2011/12/09 09:39:44 | 000,146,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\storport.sys
[2011/12/09 09:39:44 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fsutil.exe
[2011/12/09 03:35:59 | 000,000,000 | —D | C] – C:\Windows\System32\Wat
[2011/12/09 03:14:25 | 000,295,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHost.exe
[2011/12/09 03:14:25 | 000,099,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHostProxy.dll
[2011/12/09 03:14:25 | 000,049,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netfxperf.dll
[2011/12/09 03:01:14 | 000,190,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\ks.sys
[2011/12/08 15:38:07 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2011/12/08 15:37:58 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Roaming\Google
[2011/12/08 15:33:01 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Local\Google
[2011/12/08 15:32:56 | 000,000,000 | —D | C] – C:\ProgramData\Google
[2011/12/08 15:32:56 | 000,000,000 | —D | C] – C:\Program Files\Google
[2011/12/08 15:14:18 | 000,000,000 | —D | C] – C:\Program Files\MICROSOFT SQL SERVER
[2011/12/08 14:43:19 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Local\Eastman_Kodak_Company
[2011/12/08 14:29:30 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Local\Eastman Kodak Company
[2011/12/08 14:29:22 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kodak
[2011/12/08 14:24:36 | 000,000,000 | —D | C] – C:\Windows\System32\kodak
[2011/12/08 14:08:56 | 000,000,000 | —D | C] – C:\Program Files\Kodak
[2011/12/08 14:03:20 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Roaming\Temp
[2011/12/08 14:03:20 | 000,000,000 | —D | C] – C:\ProgramData\Kodak
[2011/12/08 13:45:55 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Local\Symantec
[2011/12/08 13:45:49 | 000,167,936 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\wpshelper.sys
[2011/12/08 13:44:18 | 000,357,792 | —- | C] (Symantec Corporation) – C:\Windows\System32\Sysfer.dll
[2011/12/08 13:44:17 | 000,099,744 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\SysPlant.sys
[2011/12/08 13:43:55 | 000,126,584 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\SYMEVENT.SYS
[2011/12/08 13:43:43 | 001,060,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MFC71.DLL
[2011/12/08 13:43:43 | 000,511,328 | —- | C] (Microsoft Corporation) – C:\Windows\System32\capicom.dll
[2011/12/08 13:43:23 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Symantec Shared
[2011/12/08 13:43:23 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Symantec Endpoint Protection
[2011/12/08 13:43:23 | 000,000,000 | —D | C] – C:\ProgramData\Symantec
[2011/12/08 13:43:23 | 000,000,000 | —D | C] – C:\Program Files\Symantec
[2011/12/08 11:52:19 | 000,000,000 | R–D | C] – C:\Users\Sales\Documents\Scanned Documents
[2011/12/08 11:52:18 | 000,000,000 | —D | C] – C:\Users\Sales\Documents\Fax
[2011/12/08 11:18:34 | 001,324,032 | —- | C] (Borland Software Corporation) – C:\Windows\System32\vcl60.bpl
[2011/12/08 11:18:34 | 000,931,840 | —- | C] (Elevate Software) – C:\Windows\System32\db312d6r.bpl
[2011/12/08 11:18:34 | 000,641,536 | —- | C] (Borland Software Corporation) – C:\Windows\System32\rtl60.bpl
[2011/12/08 11:18:34 | 000,262,656 | —- | C] (Borland Software Corporation) – C:\Windows\System32\vcldb60.bpl
[2011/12/08 11:18:34 | 000,254,464 | —- | C] (Borland Software Corporation) – C:\Windows\System32\dbrtl60.bpl
[2011/12/08 11:18:31 | 000,000,000 | -H-D | C] – C:\Program Files\InstallShield Installation Information
[2011/12/08 11:18:31 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TNT
[2011/12/08 11:18:31 | 000,000,000 | —D | C] – C:\Program Files\TNT
[2011/12/08 11:04:42 | 000,000,000 | —D | C] – C:\Program Files\Common Files\InstallShield
[2011/12/08 03:23:23 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\prevhost.exe
[2011/12/08 03:22:42 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dnscacheugc.exe
[2011/12/08 03:22:39 | 000,294,912 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2011/12/08 03:22:39 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2011/12/08 03:22:22 | 000,197,632 | —- | C] (Intel® Corporation) – C:\Windows\System32\ir32_32.dll
[2011/12/08 03:22:22 | 000,082,944 | —- | C] (Radius Inc.) – C:\Windows\System32\iccvid.dll
[2011/12/08 03:22:13 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\t2embed.dll
[2011/12/08 03:22:08 | 000,417,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdri.dll
[2011/12/08 03:21:48 | 000,465,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisdecd.dll
[2011/12/08 03:21:48 | 000,075,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisrndr.ax
[2011/12/08 03:21:47 | 000,204,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSNP.ax
[2011/12/08 03:21:47 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Mpeg2Data.ax
[2011/12/08 03:21:47 | 000,059,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSDvbNP.ax
[2011/12/08 03:21:40 | 000,496,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskschd.dll
[2011/12/08 03:21:39 | 000,351,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmicmiplugin.dll
[2011/12/08 03:21:39 | 000,305,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskcomp.dll
[2011/12/08 03:21:39 | 000,179,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\schtasks.exe
[2011/12/08 03:20:44 | 001,320,960 | —- | C] (Microsoft Corporation) – C:\Windows\System32\CertEnroll.dll
[2011/12/08 03:20:44 | 000,507,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winload.exe
[2011/12/08 03:20:43 | 000,442,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winresume.exe
[2011/12/08 03:20:25 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\asycfilt.dll
[2011/12/08 03:20:22 | 000,954,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40.dll
[2011/12/08 03:20:22 | 000,954,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40u.dll
[2011/12/08 03:19:55 | 012,625,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmploc.DLL
[2011/12/08 03:19:52 | 001,401,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssrch.dll
[2011/12/08 03:19:51 | 001,553,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tquery.dll
[2011/12/08 03:19:51 | 000,666,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssvp.dll
[2011/12/08 03:19:51 | 000,337,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssph.dll
[2011/12/08 03:19:51 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssphtb.dll
[2011/12/08 03:19:51 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msscntrs.dll
[2011/12/08 03:19:41 | 000,191,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FXSCOVER.exe
[2011/12/08 03:19:39 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fontsub.dll
[2011/12/08 03:19:37 | 000,442,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsPrint.dll
[2011/12/08 03:19:31 | 000,288,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsGdiConverter.dll
[2011/12/08 03:19:28 | 001,328,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2011/12/08 03:19:28 | 000,084,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciavi32.dll
[2011/12/08 03:19:27 | 000,850,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sbe.dll
[2011/12/08 03:19:27 | 000,642,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\CPFilters.dll
[2011/12/08 03:19:27 | 000,199,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mpg2splt.ax
[2011/12/08 03:19:20 | 002,614,784 | —- | C] (Microsoft Corporation) – C:\Windows\explorer.exe
[2011/12/08 03:19:18 | 000,314,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\webio.dll
[2011/12/08 03:19:07 | 000,271,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\conhost.exe
[2011/12/08 03:19:07 | 000,169,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2011/12/08 03:19:07 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2011/12/08 03:19:07 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2011/12/08 03:19:07 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2011/12/08 03:19:07 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/12/08 03:19:07 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2011/12/08 03:19:07 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2011/12/08 03:19:07 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2011/12/08 03:19:07 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2011/12/08 03:19:06 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2011/12/08 03:19:06 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2011/12/08 03:19:06 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2011/12/08 03:19:06 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2011/12/08 03:19:06 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2011/12/08 03:18:03 | 000,319,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbcjt32.dll
[2011/12/08 03:18:03 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbctrac.dll
[2011/12/08 03:18:03 | 000,122,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbccp32.dll
[2011/12/08 03:18:03 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbccu32.dll
[2011/12/08 03:18:03 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbccr32.dll
[2011/12/08 03:17:47 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1.dll
[2011/12/08 03:17:36 | 003,181,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mf.dll
[2011/12/08 03:17:36 | 001,170,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10warp.dll
[2011/12/08 03:17:36 | 001,074,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2011/12/08 03:17:36 | 000,739,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d2d1.dll
[2011/12/08 03:17:35 | 001,619,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMVDECOD.DLL
[2011/12/08 03:17:35 | 001,495,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ExplorerFrame.dll
[2011/12/08 03:17:35 | 000,218,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1core.dll
[2011/12/08 03:17:35 | 000,196,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfreadwrite.dll
[2011/12/08 03:17:35 | 000,135,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsRasterService.dll
[2011/12/08 03:17:23 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wscapi.dll
[2011/12/08 03:17:23 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\slwga.dll
[2011/12/08 03:17:18 | 000,738,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpmde.dll
[2011/12/08 03:17:17 | 000,101,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\consent.exe
[2011/12/08 03:17:16 | 000,369,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc.dll
[2011/12/08 03:17:16 | 000,365,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_isv.dll
[2011/12/08 03:17:16 | 000,324,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_isv.exe
[2011/12/08 03:17:16 | 000,320,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate.exe
[2011/12/08 03:17:16 | 000,280,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp.exe
[2011/12/08 03:17:16 | 000,277,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp_isv.exe
[2011/12/08 03:17:16 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp_isv.dll
[2011/12/08 03:17:16 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp.dll
[2011/12/08 03:17:09 | 001,164,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42u.dll
[2011/12/08 03:17:09 | 001,137,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42.dll
[2011/12/08 03:16:45 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\poqexec.exe
[2011/12/08 03:16:42 | 000,026,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\Diskdump.sys
[2011/12/08 03:09:44 | 000,219,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\dxgmms1.sys
[2011/12/08 03:09:44 | 000,107,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cdd.dll
[2011/12/07 19:52:15 | 000,000,000 | —D | C] – C:\Windows\Panther
[2011/12/07 19:52:01 | 000,000,000 | -HSD | C] – C:\Boot
[2011/12/07 19:51:50 | 000,000,000 | —D | C] – C:\Windows\System32\oem
[2011/12/07 19:43:05 | 000,000,000 | —D | C] – C:\Windows.old
[2011/12/07 17:00:06 | 000,000,000 | —D | C] – C:\Program Files\CADlink Technology Corp
[2011/12/07 16:59:04 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Data Burner ActiveX Control
[2011/12/07 16:59:04 | 000,000,000 | —D | C] – C:\Program Files\Data Burner ActiveX Control
[2011/12/07 16:57:19 | 000,000,000 | —D | C] – C:\Windows\System32\appmgmt
[2011/12/07 16:56:36 | 000,000,000 | —D | C] – C:\Users\Sales\Desktop\BurnBox 2.0 Beta
[2011/12/07 16:33:53 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Roaming\TeamViewer
[2011/12/07 16:28:45 | 004,883,400 | —- | C] (SafeNet Inc.) – C:\Windows\System32\hasplms.exe
[2011/12/07 16:28:41 | 000,198,088 | —- | C] (Aladdin Knowledge Systems Ltd.) – C:\Windows\System32\hlvdd.dll
[2011/12/07 16:28:39 | 000,046,720 | —- | C] (SafeNet Inc.) – C:\Windows\System32\drivers\akshhl.sys
[2011/12/07 16:28:39 | 000,016,512 | —- | C] (SafeNet Inc.) – C:\Windows\System32\drivers\aksusb.sys
[2011/12/07 16:28:39 | 000,011,392 | —- | C] (SafeNet Inc.) – C:\Windows\System32\drivers\aksclass.sys
[2011/12/07 16:28:38 | 000,000,000 | —D | C] – C:\Program Files\Common Files\SafeNet Sentinel
[2011/12/07 16:28:23 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Wise Installation Wizard
[2011/12/07 16:21:54 | 000,000,000 | —D | C] – C:\ProgramData\Adobe
[2011/12/07 16:21:53 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2011/12/07 16:21:53 | 000,000,000 | —D | C] – C:\Program Files\Adobe
[2011/12/07 16:21:43 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Roaming\Macromedia
[2011/12/07 16:21:43 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Roaming\Adobe
[2011/12/07 16:21:43 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Local\Adobe
[2011/12/07 15:51:13 | 000,000,000 | —D | C] – C:\ProgramData\Font Downloader
[2011/12/07 15:50:55 | 000,020,480 | —- | C] (Euro Plus d.o.o.) – C:\Windows\System32\zdnPMntS.dll
[2011/12/07 15:50:55 | 000,019,456 | —- | C] (Euro Plus d.o.o.) – C:\Windows\System32\zdnPMntU.dll
[2011/12/07 15:49:25 | 000,000,000 | -H-D | C] – C:\ProgramData\{B8113D28-DEB3-477F-974F-637E3A2089FC}
[2011/12/07 15:49:24 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zebra Technologies
[2011/12/07 15:49:24 | 000,000,000 | —D | C] – C:\Program Files\Zebra Technologies
[2011/12/07 15:47:12 | 008,151,454 | —- | C] (Zebra Technologies ) – C:\Users\Sales\Desktop\ZSU_114838.exe
[2011/12/07 15:42:27 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Local\CADlink_Technology_Corp
[2011/12/07 15:01:49 | 000,000,000 | —D | C] – C:\Program Files\CADlink
[2011/12/07 14:48:32 | 000,000,000 | —D | C] – C:\Program Files\psqlODBC
[2011/12/07 13:48:03 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2011/12/07 13:47:31 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Works
[2011/12/07 13:47:17 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio
[2011/12/07 13:47:17 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DESIGNER
[2011/12/07 13:47:13 | 000,000,000 | —D | C] – C:\Windows\PCHEALTH
[2011/12/07 13:47:13 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2011/12/07 13:46:01 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Local\Microsoft Help
[2011/12/07 13:45:59 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2011/12/07 13:45:59 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft Help
[2011/12/07 13:45:57 | 000,000,000 | -HSD | C] – C:\Windows\Installer
[2011/12/07 13:28:18 | 000,222,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe
[2011/12/07 13:21:31 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Local\ElevatedDiagnostics
[2011/12/07 13:08:34 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Local\Diagnostics
[2011/12/07 12:14:08 | 000,000,000 | R–D | C] – C:\Users\Sales\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011/12/07 12:14:08 | 000,000,000 | R–D | C] – C:\Users\Sales\Searches
[2011/12/07 12:14:08 | 000,000,000 | R–D | C] – C:\Users\Sales\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011/12/07 12:14:08 | 000,000,000 | -H-D | C] – C:\Users\Sales\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2011/12/07 12:13:58 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Roaming\Identities
[2011/12/07 12:13:57 | 000,000,000 | R–D | C] – C:\Users\Sales\Contacts
[2011/12/07 12:13:51 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Local\VirtualStore
[2011/12/07 12:13:50 | 000,000,000 | –SD | C] – C:\Users\Sales\AppData\Roaming\Microsoft
[2011/12/07 12:13:50 | 000,000,000 | R–D | C] – C:\Users\Sales\Videos
[2011/12/07 12:13:50 | 000,000,000 | R–D | C] – C:\Users\Sales\Saved Games
[2011/12/07 12:13:50 | 000,000,000 | R–D | C] – C:\Users\Sales\Pictures
[2011/12/07 12:13:50 | 000,000,000 | R–D | C] – C:\Users\Sales\Music
[2011/12/07 12:13:50 | 000,000,000 | R–D | C] – C:\Users\Sales\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011/12/07 12:13:50 | 000,000,000 | R–D | C] – C:\Users\Sales\Links
[2011/12/07 12:13:50 | 000,000,000 | R–D | C] – C:\Users\Sales\Favorites
[2011/12/07 12:13:50 | 000,000,000 | R–D | C] – C:\Users\Sales\Downloads
[2011/12/07 12:13:50 | 000,000,000 | R–D | C] – C:\Users\Sales\Documents
[2011/12/07 12:13:50 | 000,000,000 | R–D | C] – C:\Users\Sales\Desktop
[2011/12/07 12:13:50 | 000,000,000 | R–D | C] – C:\Users\Sales\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\AppData\Local\Temporary Internet Files
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\Templates
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\Start Menu
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\SendTo
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\Recent
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\PrintHood
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\NetHood
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\Documents\My Videos
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\Documents\My Pictures
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\Documents\My Music
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\My Documents
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\Local Settings
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\AppData\Local\History
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\Cookies
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\Application Data
[2011/12/07 12:13:50 | 000,000,000 | -HSD | C] – C:\Users\Sales\AppData\Local\Application Data
[2011/12/07 12:13:50 | 000,000,000 | -H-D | C] – C:\Users\Sales\AppData
[2011/12/07 12:13:50 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Local\Temp
[2011/12/07 12:13:50 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Local\Microsoft
[2011/12/07 12:13:50 | 000,000,000 | —D | C] – C:\Users\Sales\AppData\Roaming\Media Center Programs
[2011/12/07 12:13:29 | 000,000,000 | -HSD | C] – C:\Recovery
[2011/12/07 11:55:56 | 000,000,000 | —D | C] – C:\Windows\SoftwareDistribution
[2011/12/07 11:53:36 | 000,000,000 | —D | C] – C:\Windows\Prefetch

========== Files - Modified Within 30 Days ==========

[2011/12/23 10:43:02 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/23 10:38:34 | 000,014,256 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/23 10:38:34 | 000,014,256 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/23 10:35:36 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Sales\Desktop\OTL.exe
[2011/12/23 09:04:55 | 000,001,419 | —- | M] () – C:\Users\Sales\Desktop\Internet Explorer.lnk
[2011/12/22 15:43:00 | 000,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/21 14:46:57 | 000,677,636 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/12/21 14:46:57 | 000,128,874 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/12/15 08:44:31 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/12/14 15:43:35 | 000,000,199 | —- | M] () – C:\Windows\wstdUPSWSHIP.INI
[2011/12/14 15:41:41 | 2414,321,664 | -HS- | M] () – C:\hiberfil.sys
[2011/12/14 11:35:42 | 001,057,496 | —- | M] () – C:\Program Files\RMA_1.emf
[2011/12/14 03:27:51 | 000,302,216 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/12/12 15:55:54 | 000,032,037 | —- | M] () – C:\Users\Sales\Desktop\Signlab.htm
[2011/12/12 10:35:42 | 000,001,586 | —- | M] () – C:\Users\Sales\Desktop\Shortcut to H Dongle List.lnk
[2011/12/09 11:52:06 | 000,001,172 | —- | M] () – C:\Windows\ODBC.INI
[2011/12/09 11:52:03 | 000,000,749 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\UPS WorldShip Messaging Utility.lnk
[2011/12/09 11:52:03 | 000,000,695 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\UPS WorldShip PLD Reminder Utility.lnk
[2011/12/09 11:52:03 | 000,000,657 | —- | M] () – C:\Users\Public\Desktop\UPS WorldShip.lnk
[2011/12/09 11:46:48 | 000,002,006 | —- | M] () – C:\Windows\System32\msrCheckResult.xml
[2011/12/09 11:02:34 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/12/09 09:15:40 | 000,001,109 | —- | M] () – C:\Users\Sales\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk
[2011/12/08 15:38:22 | 000,001,991 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/12/08 14:43:16 | 000,002,116 | —- | M] () – C:\Users\Public\Desktop\KODAK AiO Home Center.lnk
[2011/12/08 13:44:09 | 000,126,584 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\SYMEVENT.SYS
[2011/12/08 13:44:09 | 000,007,468 | —- | M] () – C:\Windows\System32\drivers\SYMEVENT.CAT
[2011/12/08 13:44:09 | 000,000,806 | —- | M] () – C:\Windows\System32\drivers\SYMEVENT.INF
[2011/12/08 11:18:31 | 000,001,002 | —- | M] () – C:\Users\Public\Desktop\Express Shipper.lnk
[2011/12/07 19:52:03 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2011/12/07 17:11:26 | 000,001,804 | —- | M] () – C:\Users\Sales\Desktop\BurnBox.lnk
[2011/12/07 16:16:17 | 015,105,363 | —- | M] () – C:\Users\Sales\Desktop\Sentinel_HASP_Run-time_setup.zip
[2011/12/07 15:49:25 | 000,002,293 | —- | M] () – C:\Users\Public\Desktop\Zebra Setup Utilities.lnk
[2011/12/07 15:48:01 | 009,179,136 | —- | M] () – C:\Users\Sales\Desktop\ZD266312Certified
[2011/12/07 15:47:22 | 008,151,454 | —- | M] (Zebra Technologies ) – C:\Users\Sales\Desktop\ZSU_114838.exe
[2011/12/07 15:26:12 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2011/12/07 13:28:18 | 000,222,080 | —- | M] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe
[2011/12/07 12:19:55 | 000,001,413 | —- | M] () – C:\Users\Sales\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/12/07 11:56:08 | 000,040,833 | —- | M] () – C:\Windows\System32\license.rtf
[2011/12/07 11:54:39 | 000,000,000 | —- | M] () – C:\Windows\ativpsrm.bin
[2011/12/07 11:54:39 | 000,000,000 | —- | M] () – C:\Windows\System32\atiicdxx.dat
[2011/11/24 04:23:31 | 002,340,352 | —- | M] (Microsoft Corporation) – C:\Windows\System32\win32k.sys

========== Files Created - No Company Name ==========

[2011/12/23 09:04:55 | 000,001,419 | —- | C] () – C:\Users\Sales\Desktop\Internet Explorer.lnk
[2011/12/12 15:55:53 | 000,032,037 | —- | C] () – C:\Users\Sales\Desktop\Signlab.htm
[2011/12/09 11:52:08 | 000,000,199 | —- | C] () – C:\Windows\wstdUPSWSHIP.INI
[2011/12/09 11:52:03 | 000,000,749 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\UPS WorldShip Messaging Utility.lnk
[2011/12/09 11:52:03 | 000,000,695 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\UPS WorldShip PLD Reminder Utility.lnk
[2011/12/09 11:52:03 | 000,000,657 | —- | C] () – C:\Users\Public\Desktop\UPS WorldShip.lnk
[2011/12/08 15:38:22 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2011/12/08 15:38:22 | 000,001,991 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader X.lnk
[2011/12/08 15:33:04 | 000,000,884 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/08 15:33:03 | 000,000,880 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/08 15:12:45 | 000,002,006 | —- | C] () – C:\Windows\System32\msrCheckResult.xml
[2011/12/08 14:43:16 | 000,002,116 | —- | C] () – C:\Users\Public\Desktop\KODAK AiO Home Center.lnk
[2011/12/08 13:43:55 | 000,007,468 | —- | C] () – C:\Windows\System32\drivers\SYMEVENT.CAT
[2011/12/08 13:43:55 | 000,000,806 | —- | C] () – C:\Windows\System32\drivers\SYMEVENT.INF
[2011/12/08 11:18:31 | 000,001,002 | —- | C] () – C:\Users\Public\Desktop\Express Shipper.lnk
[2011/12/08 10:53:48 | 000,001,586 | —- | C] () – C:\Users\Sales\Desktop\Shortcut to H Dongle List.lnk
[2011/12/08 10:53:48 | 000,000,591 | —- | C] () – C:\Users\Sales\Desktop\Shortcut to E Dongle List.lnk
[2011/12/08 10:23:54 | 001,057,496 | —- | C] () – C:\Program Files\RMA_1.emf
[2011/12/07 19:52:03 | 000,008,192 | RHS- | C] () – C:\BOOTSECT.BAK
[2011/12/07 19:52:02 | 000,383,562 | RHS- | C] () – C:\bootmgr
[2011/12/07 19:51:50 | 000,000,025 | RH– | C] () – C:\Windows\DELL_version
[2011/12/07 17:11:26 | 000,001,804 | —- | C] () – C:\Users\Sales\Desktop\BurnBox.lnk
[2011/12/07 16:33:47 | 002,034,224 | —- | C] () – C:\Users\Sales\Desktop\TeamViewerQS.exe
[2011/12/07 16:16:16 | 015,105,363 | —- | C] () – C:\Users\Sales\Desktop\Sentinel_HASP_Run-time_setup.zip
[2011/12/07 15:49:25 | 000,002,293 | —- | C] () – C:\Users\Public\Desktop\Zebra Setup Utilities.lnk
[2011/12/07 15:47:55 | 009,179,136 | —- | C] () – C:\Users\Sales\Desktop\ZD266312Certified
[2011/12/07 15:26:12 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2011/12/07 15:04:59 | 000,001,172 | —- | C] () – C:\Windows\ODBC.INI
[2011/12/07 14:03:46 | 000,001,109 | —- | C] () – C:\Users\Sales\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk
[2011/12/07 12:19:55 | 000,001,413 | —- | C] () – C:\Users\Sales\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/12/07 12:14:09 | 000,001,419 | —- | C] () – C:\Users\Sales\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011/12/07 12:13:50 | 000,000,290 | —- | C] () – C:\Users\Sales\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2011/12/07 12:13:50 | 000,000,272 | —- | C] () – C:\Users\Sales\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2011/12/07 11:55:57 | 000,001,345 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2011/12/07 11:55:47 | 000,001,326 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2011/12/07 11:54:39 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/12/07 11:54:39 | 000,000,000 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2011/08/05 14:35:30 | 000,001,056 | —- | C] () – C:\Windows\System32\EKaio2WiaCoInst.ini
[2010/12/09 14:51:08 | 000,016,384 | —- | C] () – C:\Windows\System32\GetHostIP.exe
[2010/12/09 10:58:20 | 000,180,224 | —- | C] () – C:\Windows\System32\nssckbi.dll
[2009/07/14 04:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/14 04:33:53 | 000,302,216 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/14 02:05:48 | 000,677,636 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/14 02:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/14 02:05:48 | 000,128,874 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/14 02:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/14 02:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/14 02:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/14 00:19:49 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2009/07/13 23:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 23:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 23:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/06/10 21:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat

========== LOP Check ==========

[2011/12/07 16:33:53 | 000,000,000 | —D | M] – C:\Users\Sales\AppData\Roaming\TeamViewer
[2011/12/08 14:03:20 | 000,000,000 | —D | M] – C:\Users\Sales\AppData\Roaming\Temp
[2009/07/14 04:53:46 | 000,004,580 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

NoodleTech

Post #2December 25, 2011, 5:14 PM UTC

Hi oldbloke,

My name is NoodleTech. I would be glad to assist you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
Please be aware that removing malware is not without risk and while unrecoverable damage to systems is rare, it can happen and may require a re-format and re-install of your operating system. Because of this it is a good idea to back-up anything important saved on your computer.
The fixes are specific to your problem and should only be used for the issues on this machine.
Do not delete anything unless instructed to.
DO NOT use tools such as ComboFix without supervision.
Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not mean that everything is clean.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
Failure to respond within 3 days will result in this topic being closed - If you need more time to complete the steps required, please let me know.

===================================================

The cookie may or not be related. A tidserv infection tends to affect the browser and redirect users to other sites. You may reboot your computer as that will do no harm.

===================================================

Please download aswMBR.exe and save it to your desktop.

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)

Click Scan

Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review.
Note - do NOT attempt any Fix yet.
You will also notice another file created on the desktop named MBR.dat.
Right click that file and select Send To>Compressed (zipped) file.
Attach that zipped file in your next reply as well.

===================================================

Please download TDSSKiller.zip

Extract it to your desktop
Double click TDSSKiller.exe
Press Start Scan.
- If Malicious objects are found, DO NOT cure them.
- Choose Skip then click on Continue.
Copy and paste the log in your next reply
- A copy of the log will be saved automatically to the root of the drive (typically C:\)

oldbloke

Post #3December 28, 2011, 12:37 PM UTC

thanks for looking in . here is the info you have requested. I will not reply again until 3rd jan, so post might time out. aswMBR version 0.9.9.1120 Copyright© 2011 AVAST Software Run date: 2011-12-28 12:27:21 —————————– 12:27:21.130 OS Version: Windows 6.1.7600 12:27:21.130 Number of processors: 2 586 0x170A 12:27:21.130 ComputerName: SALES-7-PC UserName: Sales 12:27:22.456 Initialize success 12:27:51.953 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 12:27:51.953 Disk 0 Vendor: SAMSUNG_HD161GJ 1AC01117 Size: 152587MB BusType: 3 12:27:51.953 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-3 12:27:51.953 Disk 1 Vendor: WDC_WD1600AAJS-00L7A0 01.03E01 Size: 152627MB BusType: 3 12:27:53.981 Disk 0 MBR read successfully 12:27:53.981 Disk 0 MBR scan 12:27:53.981 Disk 0 Windows 7 default MBR code 12:27:53.981 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 94 MB offset 63 12:27:53.996 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 750 MB offset 194560 12:27:53.996 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 151741 MB offset 1730560 12:27:54.028 Disk 0 Partition 4 00 17 Hidd HPFS/NTFS NTFS 1 MB offset 312496128 12:27:54.043 Disk 0 scanning sectors +312499984 12:27:54.074 Disk 0 scanning C:\Windows\system32\drivers 12:27:59.269 Service scanning 12:27:59.706 Service SysPlant C:\Windows\SYSTEM32\Drivers\SysPlant.sys **LOCKED** 32 12:27:59.737 Service WPS C:\Windows\system32\drivers\wpsdrvnt.sys **LOCKED** 32 12:27:59.737 Service WpsHelper C:\Windows\system32\drivers\WpsHelper.sys **LOCKED** 32 12:28:00.268 Modules scanning 12:28:05.462 Disk 0 trace - called modules: 12:28:05.478 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS halmacpi.dll intelide.sys PCIIDEX.SYS atapi.sys dxgkrnl.sys atikmdag.sys dxgmms1.sys 12:28:05.478 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86163198] 12:28:05.478 3 CLASSPNP.SYS[8b3b459e] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x85cbd908] 12:28:05.478 Scan finished successfully 12:28:23.231 Disk 0 MBR has been saved successfully to "C:\Users\Sales\Desktop\Ray\MBR.dat" 12:28:23.231 The log file has been saved successfully to "C:\Users\Sales\Desktop\Ray\aswMBR.txt" aswMBR version 0.9.9.1120 Copyright© 2011 AVAST Software Run date: 2011-12-28 12:30:28 —————————– 12:30:28.367 OS Version: Windows 6.1.7600 12:30:28.367 Number of processors: 2 586 0x170A 12:30:28.367 ComputerName: SALES-7-PC UserName: Sales 12:30:28.695 Initialize success 12:30:33.678 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 12:30:33.678 Disk 0 Vendor: SAMSUNG_HD161GJ 1AC01117 Size: 152587MB BusType: 3 12:30:33.678 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-3 12:30:33.694 Disk 1 Vendor: WDC_WD1600AAJS-00L7A0 01.03E01 Size: 152627MB BusType: 3 12:30:35.722 Disk 0 MBR read successfully 12:30:35.722 Disk 0 MBR scan 12:30:35.722 Disk 0 Windows 7 default MBR code 12:30:35.722 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 94 MB offset 63 12:30:35.737 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 750 MB offset 194560 12:30:35.753 Disk 0 Partition 3 80 (A) 07 HPFS/NTFS NTFS 151741 MB offset 1730560 12:30:35.784 Disk 0 Partition 4 00 17 Hidd HPFS/NTFS NTFS 1 MB offset 312496128 12:30:35.800 Disk 0 scanning sectors +312499984 12:30:35.831 Disk 0 scanning C:\Windows\system32\drivers 12:30:40.433 Service scanning 12:30:41.041 Service SysPlant C:\Windows\SYSTEM32\Drivers\SysPlant.sys **LOCKED** 32 12:30:41.073 Service WPS C:\Windows\system32\drivers\wpsdrvnt.sys **LOCKED** 32 12:30:41.073 Service WpsHelper C:\Windows\system32\drivers\WpsHelper.sys **LOCKED** 32 12:30:41.603 Modules scanning 12:30:46.221 Disk 0 trace - called modules: 12:30:46.236 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS halmacpi.dll intelide.sys PCIIDEX.SYS atapi.sys 12:30:46.252 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86163198] 12:30:46.252 3 CLASSPNP.SYS[8b3b459e] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x85cbd908] 12:30:46.252 Scan finished successfully 12:31:12.148 Disk 0 MBR has been saved successfully to "C:\Users\Sales\Desktop\Ray\MBR.dat" 12:31:12.164 The log file has been saved successfully to "C:\Users\Sales\Desktop\Ray\aswMBR.txt" 12:31:39.0208 2272 TDSS rootkit removing tool 2.6.25.0 Dec 23 2011 14:51:16 12:31:39.0317 2272 ============================================================ 12:31:39.0317 2272 Current date / time: 2011/12/28 12:31:39.0317 12:31:39.0317 2272 SystemInfo: 12:31:39.0317 2272 12:31:39.0317 2272 OS Version: 6.1.7600 ServicePack: 0.0 12:31:39.0317 2272 Product type: Workstation 12:31:39.0317 2272 ComputerName: SALES-7-PC 12:31:39.0317 2272 UserName: Sales 12:31:39.0317 2272 Windows directory: C:\Windows 12:31:39.0317 2272 System windows directory: C:\Windows 12:31:39.0317 2272 Processor architecture: Intel x86 12:31:39.0317 2272 Number of processors: 2 12:31:39.0317 2272 Page size: 0x1000 12:31:39.0317 2272 Boot type: Normal boot 12:31:39.0317 2272 ============================================================ 12:31:40.0128 2272 Initialize success 12:31:41.0485 1664 ============================================================ 12:31:41.0485 1664 Scan started 12:31:41.0485 1664 Mode: Manual; 12:31:41.0485 1664 ============================================================ 12:31:42.0234 1664 1394ohci (6d2aca41739bfe8cb86ee8e85f29697d) C:\Windows\system32\DRIVERS\1394ohci.sys 12:31:42.0234 1664 1394ohci - ok 12:31:42.0250 1664 ACPI (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys 12:31:42.0250 1664 ACPI - ok 12:31:42.0281 1664 AcpiPmi (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys 12:31:42.0281 1664 AcpiPmi - ok 12:31:42.0328 1664 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys 12:31:42.0328 1664 adp94xx - ok 12:31:42.0343 1664 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys 12:31:42.0343 1664 adpahci - ok 12:31:42.0359 1664 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys 12:31:42.0359 1664 adpu320 - ok 12:31:42.0406 1664 AFD (0db7a48388d54d154ebec120461a0fcd) C:\Windows\system32\drivers\afd.sys 12:31:42.0406 1664 AFD - ok 12:31:42.0421 1664 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys 12:31:42.0421 1664 agp440 - ok 12:31:42.0468 1664 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys 12:31:42.0468 1664 aic78xx - ok 12:31:42.0515 1664 aksfridge (a7f74629628b7f16734418121b61ca99) C:\Windows\system32\DRIVERS\aksfridge.sys 12:31:42.0515 1664 aksfridge - ok 12:31:42.0530 1664 akshasp (64fc197d24a2b240598f29ce0a6660c0) C:\Windows\system32\DRIVERS\akshasp.sys 12:31:42.0530 1664 akshasp - ok 12:31:42.0562 1664 akshhl (dfd3c25a2aab48668e14aef0316a0522) C:\Windows\system32\DRIVERS\akshhl.sys 12:31:42.0562 1664 akshhl - ok 12:31:42.0593 1664 aksusb (537180a396ebf3b5e9e6eb24e9673e03) C:\Windows\system32\DRIVERS\aksusb.sys 12:31:42.0593 1664 aksusb - ok 12:31:42.0655 1664 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys 12:31:42.0655 1664 aliide - ok 12:31:42.0671 1664 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys 12:31:42.0686 1664 amdagp - ok 12:31:42.0686 1664 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys 12:31:42.0686 1664 amdide - ok 12:31:42.0733 1664 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys 12:31:42.0733 1664 AmdK8 - ok 12:31:42.0858 1664 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys 12:31:42.0858 1664 AmdPPM - ok 12:31:42.0889 1664 amdsata (19ce906b4cdc11fc4fef5745f33a63b6) C:\Windows\system32\drivers\amdsata.sys 12:31:42.0889 1664 amdsata - ok 12:31:42.0920 1664 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys 12:31:42.0920 1664 amdsbs - ok 12:31:42.0952 1664 amdxata (869e67d66be326a5a9159fba8746fa70) C:\Windows\system32\drivers\amdxata.sys 12:31:42.0952 1664 amdxata - ok 12:31:42.0983 1664 AppID (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys 12:31:42.0983 1664 AppID - ok 12:31:42.0998 1664 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys 12:31:42.0998 1664 arc - ok 12:31:43.0014 1664 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys 12:31:43.0014 1664 arcsas - ok 12:31:43.0030 1664 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys 12:31:43.0030 1664 AsyncMac - ok 12:31:43.0061 1664 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys 12:31:43.0061 1664 atapi - ok 12:31:43.0154 1664 atikmdag (712d8a95e45b070114c5309ada7358ff) C:\Windows\system32\DRIVERS\atikmdag.sys 12:31:43.0170 1664 atikmdag - ok 12:31:43.0295 1664 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys 12:31:43.0310 1664 b06bdrv - ok 12:31:43.0326 1664 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys 12:31:43.0342 1664 b57nd60x - ok 12:31:43.0357 1664 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys 12:31:43.0357 1664 Beep - ok 12:31:43.0388 1664 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys 12:31:43.0388 1664 blbdrive - ok 12:31:43.0420 1664 bowser (9a5c671b7fbae4865149bb11f59b91b2) C:\Windows\system32\DRIVERS\bowser.sys 12:31:43.0420 1664 bowser - ok 12:31:43.0451 1664 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys 12:31:43.0451 1664 BrFiltLo - ok 12:31:43.0466 1664 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys 12:31:43.0466 1664 BrFiltUp - ok 12:31:43.0482 1664 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys 12:31:43.0482 1664 Brserid - ok 12:31:43.0498 1664 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys 12:31:43.0498 1664 BrSerWdm - ok 12:31:43.0513 1664 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys 12:31:43.0513 1664 BrUsbMdm - ok 12:31:43.0544 1664 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys 12:31:43.0544 1664 BrUsbSer - ok 12:31:43.0560 1664 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys 12:31:43.0560 1664 BTHMODEM - ok 12:31:43.0607 1664 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys 12:31:43.0607 1664 cdfs - ok 12:31:43.0638 1664 cdrom (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys 12:31:43.0638 1664 cdrom - ok 12:31:43.0669 1664 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys 12:31:43.0669 1664 circlass - ok 12:31:43.0700 1664 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys 12:31:43.0700 1664 CLFS - ok 12:31:43.0732 1664 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys 12:31:43.0732 1664 CmBatt - ok 12:31:43.0747 1664 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys 12:31:43.0747 1664 cmdide - ok 12:31:43.0763 1664 CNG (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys 12:31:43.0763 1664 CNG - ok 12:31:43.0778 1664 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys 12:31:43.0778 1664 Compbatt - ok 12:31:43.0810 1664 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys 12:31:43.0810 1664 CompositeBus - ok 12:31:43.0841 1664 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys 12:31:43.0841 1664 crcdisk - ok 12:31:43.0888 1664 CSC (27c9490bdd0ae48911ab8cf1932591ed) C:\Windows\system32\drivers\csc.sys 12:31:43.0888 1664 CSC - ok 12:31:43.0934 1664 DfsC (83d1ecea8faae75604c0fa49ac7ad996) C:\Windows\system32\Drivers\dfsc.sys 12:31:43.0934 1664 DfsC - ok 12:31:43.0966 1664 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys 12:31:43.0966 1664 discache - ok 12:31:43.0997 1664 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys 12:31:43.0997 1664 Disk - ok 12:31:44.0044 1664 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys 12:31:44.0044 1664 drmkaud - ok 12:31:44.0090 1664 DXGKrnl (1679a4669326cb1a67cc95658d273234) C:\Windows\System32\drivers\dxgkrnl.sys 12:31:44.0090 1664 DXGKrnl - ok 12:31:44.0153 1664 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys 12:31:44.0153 1664 ebdrv - ok 12:31:44.0246 1664 eeCtrl (75e8b69f28c813675b16db357f20720f) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 12:31:44.0246 1664 eeCtrl - ok 12:31:44.0371 1664 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys 12:31:44.0371 1664 elxstor - ok 12:31:44.0418 1664 EraserUtilRebootDrv (720b18d76de9e603b626dfcd6f1fca7c) C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 12:31:44.0418 1664 EraserUtilRebootDrv - ok 12:31:44.0434 1664 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys 12:31:44.0434 1664 ErrDev - ok 12:31:44.0465 1664 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys 12:31:44.0465 1664 exfat - ok 12:31:44.0465 1664 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys 12:31:44.0465 1664 fastfat - ok 12:31:44.0496 1664 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys 12:31:44.0496 1664 fdc - ok 12:31:44.0512 1664 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys 12:31:44.0512 1664 FileInfo - ok 12:31:44.0527 1664 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys 12:31:44.0527 1664 Filetrace - ok 12:31:44.0543 1664 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys 12:31:44.0543 1664 flpydisk - ok 12:31:44.0558 1664 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys 12:31:44.0558 1664 FltMgr - ok 12:31:44.0558 1664 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys 12:31:44.0558 1664 FsDepends - ok 12:31:44.0574 1664 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys 12:31:44.0574 1664 Fs_Rec - ok 12:31:44.0621 1664 fvevol (dafbd9fe39197495aed6d51f3b85b5d2) C:\Windows\system32\DRIVERS\fvevol.sys 12:31:44.0621 1664 fvevol - ok 12:31:44.0652 1664 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys 12:31:44.0652 1664 gagp30kx - ok 12:31:44.0714 1664 hardlock (506097d91e96aee4bad61800782e8fb6) C:\Windows\system32\drivers\hardlock.sys 12:31:44.0714 1664 hardlock - ok 12:31:44.0746 1664 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys 12:31:44.0746 1664 hcw85cir - ok 12:31:44.0824 1664 HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\Windows\system32\drivers\HdAudio.sys 12:31:44.0824 1664 HdAudAddService - ok 12:31:44.0839 1664 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys 12:31:44.0839 1664 HDAudBus - ok 12:31:44.0870 1664 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys 12:31:44.0870 1664 HidBatt - ok 12:31:44.0902 1664 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys 12:31:44.0902 1664 HidBth - ok 12:31:44.0948 1664 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys 12:31:44.0948 1664 HidIr - ok 12:31:44.0980 1664 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys 12:31:44.0980 1664 HidUsb - ok 12:31:44.0995 1664 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys 12:31:44.0995 1664 HpSAMD - ok 12:31:45.0026 1664 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys 12:31:45.0026 1664 HTTP - ok 12:31:45.0042 1664 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys 12:31:45.0042 1664 hwpolicy - ok 12:31:45.0058 1664 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys 12:31:45.0058 1664 i8042prt - ok 12:31:45.0073 1664 iaStorV (934af4d7c5f457b9f0743f4299b77b67) C:\Windows\system32\drivers\iaStorV.sys 12:31:45.0073 1664 iaStorV - ok 12:31:45.0104 1664 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys 12:31:45.0104 1664 iirsp - ok 12:31:45.0120 1664 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys 12:31:45.0120 1664 intelide - ok 12:31:45.0136 1664 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys 12:31:45.0151 1664 intelppm - ok 12:31:45.0167 1664 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys 12:31:45.0167 1664 IpFilterDriver - ok 12:31:45.0182 1664 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys 12:31:45.0182 1664 IPMIDRV - ok 12:31:45.0198 1664 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys 12:31:45.0198 1664 IPNAT - ok 12:31:45.0229 1664 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys 12:31:45.0229 1664 IRENUM - ok 12:31:45.0245 1664 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys 12:31:45.0245 1664 isapnp - ok 12:31:45.0260 1664 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys 12:31:45.0260 1664 iScsiPrt - ok 12:31:45.0307 1664 k57nd60x (c4c95805b85bce1eb9d20f4a02fc5f9b) C:\Windows\system32\DRIVERS\k57nd60x.sys 12:31:45.0307 1664 k57nd60x - ok 12:31:45.0338 1664 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys 12:31:45.0338 1664 kbdclass - ok 12:31:45.0370 1664 kbdhid (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys 12:31:45.0370 1664 kbdhid - ok 12:31:45.0385 1664 KSecDD (e36a061ec11b373826905b21be10948f) C:\Windows\system32\Drivers\ksecdd.sys 12:31:45.0385 1664 KSecDD - ok 12:31:45.0432 1664 KSecPkg (365c6154bbbc5377173f1ca7bfb6cc59) C:\Windows\system32\Drivers\ksecpkg.sys 12:31:45.0432 1664 KSecPkg - ok 12:31:45.0463 1664 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys 12:31:45.0463 1664 lltdio - ok 12:31:45.0479 1664 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys 12:31:45.0479 1664 LSI_FC - ok 12:31:45.0494 1664 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys 12:31:45.0494 1664 LSI_SAS - ok 12:31:45.0494 1664 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys 12:31:45.0494 1664 LSI_SAS2 - ok 12:31:45.0510 1664 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys 12:31:45.0510 1664 LSI_SCSI - ok 12:31:45.0526 1664 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys 12:31:45.0526 1664 luafv - ok 12:31:45.0541 1664 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys 12:31:45.0541 1664 megasas - ok 12:31:45.0557 1664 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys 12:31:45.0557 1664 MegaSR - ok 12:31:45.0588 1664 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys 12:31:45.0588 1664 Modem - ok 12:31:45.0604 1664 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys 12:31:45.0604 1664 monitor - ok 12:31:45.0619 1664 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys 12:31:45.0619 1664 mouclass - ok 12:31:45.0650 1664 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys 12:31:45.0650 1664 mouhid - ok 12:31:45.0650 1664 mountmgr (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys 12:31:45.0650 1664 mountmgr - ok 12:31:45.0666 1664 mpio (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys 12:31:45.0666 1664 mpio - ok 12:31:45.0682 1664 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys 12:31:45.0682 1664 mpsdrv - ok 12:31:45.0697 1664 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys 12:31:45.0697 1664 MRxDAV - ok 12:31:45.0744 1664 mrxsmb (ca7570e42522e24324a12161db14ec02) C:\Windows\system32\DRIVERS\mrxsmb.sys 12:31:45.0744 1664 mrxsmb - ok 12:31:45.0760 1664 mrxsmb10 (f965c3ab2b2ae5c378f4562486e35051) C:\Windows\system32\DRIVERS\mrxsmb10.sys 12:31:45.0760 1664 mrxsmb10 - ok 12:31:45.0775 1664 mrxsmb20 (25c38264a3c72594dd21d355d70d7a5d) C:\Windows\system32\DRIVERS\mrxsmb20.sys 12:31:45.0775 1664 mrxsmb20 - ok 12:31:45.0791 1664 msahci (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys 12:31:45.0791 1664 msahci - ok 12:31:45.0806 1664 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys 12:31:45.0806 1664 msdsm - ok 12:31:45.0822 1664 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys 12:31:45.0822 1664 Msfs - ok 12:31:45.0853 1664 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys 12:31:45.0853 1664 mshidkmdf - ok 12:31:45.0869 1664 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys 12:31:45.0869 1664 msisadrv - ok 12:31:45.0884 1664 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys 12:31:45.0884 1664 MSKSSRV - ok 12:31:45.0900 1664 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys 12:31:45.0900 1664 MSPCLOCK - ok 12:31:45.0916 1664 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys 12:31:45.0916 1664 MSPQM - ok 12:31:45.0931 1664 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys 12:31:45.0931 1664 MsRPC - ok 12:31:45.0947 1664 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys 12:31:45.0947 1664 mssmbios - ok 12:31:45.0978 1664 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys 12:31:45.0978 1664 MSTEE - ok 12:31:45.0994 1664 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys 12:31:45.0994 1664 MTConfig - ok 12:31:46.0009 1664 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys 12:31:46.0009 1664 Mup - ok 12:31:46.0040 1664 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys 12:31:46.0040 1664 NativeWifiP - ok 12:31:46.0165 1664 NAVENG (862f55824ac81295837b0ab63f91071f) C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20111222.032\NAVENG.SYS 12:31:46.0165 1664 NAVENG - ok 12:31:46.0196 1664 NAVEX15 (529d571b551cb9da44237389b936f1ae) C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20111222.032\NAVEX15.SYS 12:31:46.0196 1664 NAVEX15 - ok 12:31:46.0306 1664 NDIS (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers\ndis.sys 12:31:46.0306 1664 NDIS - ok 12:31:46.0337 1664 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys 12:31:46.0337 1664 NdisCap - ok 12:31:46.0368 1664 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys 12:31:46.0368 1664 NdisTapi - ok 12:31:46.0384 1664 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys 12:31:46.0384 1664 Ndisuio - ok 12:31:46.0399 1664 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys 12:31:46.0399 1664 NdisWan - ok 12:31:46.0415 1664 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys 12:31:46.0415 1664 NDProxy - ok 12:31:46.0446 1664 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys 12:31:46.0446 1664 NetBIOS - ok 12:31:46.0446 1664 NetBT (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys 12:31:46.0446 1664 NetBT - ok 12:31:46.0477 1664 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys 12:31:46.0477 1664 nfrd960 - ok 12:31:46.0493 1664 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys 12:31:46.0493 1664 Npfs - ok 12:31:46.0508 1664 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys 12:31:46.0508 1664 nsiproxy - ok 12:31:46.0571 1664 Ntfs (187002ce05693c306f43c873f821381f) C:\Windows\system32\drivers\Ntfs.sys 12:31:46.0571 1664 Ntfs - ok 12:31:46.0586 1664 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys 12:31:46.0586 1664 Null - ok 12:31:46.0633 1664 nvraid (f1b0bed906f97e16f6d0c3629d2f21c6) C:\Windows\system32\drivers\nvraid.sys 12:31:46.0633 1664 nvraid - ok 12:31:46.0649 1664 nvstor (4520b63899e867f354ee012d34e11536) C:\Windows\system32\drivers\nvstor.sys 12:31:46.0649 1664 nvstor - ok 12:31:46.0664 1664 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS\nv_agp.sys 12:31:46.0680 1664 nv_agp - ok 12:31:46.0696 1664 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys 12:31:46.0696 1664 ohci1394 - ok 12:31:46.0774 1664 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys 12:31:46.0774 1664 Parport - ok 12:31:46.0805 1664 partmgr (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys 12:31:46.0805 1664 partmgr - ok 12:31:46.0820 1664 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys 12:31:46.0820 1664 Parvdm - ok 12:31:46.0852 1664 pci (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys 12:31:46.0852 1664 pci - ok 12:31:46.0867 1664 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys 12:31:46.0867 1664 pciide - ok 12:31:46.0898 1664 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys 12:31:46.0898 1664 pcmcia - ok 12:31:46.0914 1664 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys 12:31:46.0914 1664 pcw - ok 12:31:46.0961 1664 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys 12:31:46.0961 1664 PEAUTH - ok 12:31:46.0992 1664 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys 12:31:46.0992 1664 PptpMiniport - ok 12:31:47.0023 1664 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys 12:31:47.0023 1664 Processor - ok 12:31:47.0054 1664 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys 12:31:47.0054 1664 Psched - ok 12:31:47.0086 1664 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys 12:31:47.0086 1664 ql2300 - ok 12:31:47.0101 1664 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys 12:31:47.0101 1664 ql40xx - ok 12:31:47.0117 1664 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys 12:31:47.0117 1664 QWAVEdrv - ok 12:31:47.0132 1664 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys 12:31:47.0132 1664 RasAcd - ok 12:31:47.0179 1664 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys 12:31:47.0179 1664 RasAgileVpn - ok 12:31:47.0179 1664 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys 12:31:47.0179 1664 Rasl2tp - ok 12:31:47.0195 1664 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys 12:31:47.0195 1664 RasPppoe - ok 12:31:47.0210 1664 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys 12:31:47.0210 1664 RasSstp - ok 12:31:47.0226 1664 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys 12:31:47.0226 1664 rdbss - ok 12:31:47.0242 1664 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys 12:31:47.0242 1664 rdpbus - ok 12:31:47.0257 1664 RDPCDD (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys 12:31:47.0257 1664 RDPCDD - ok 12:31:47.0304 1664 RDPDR (c5ff95883ffef704d50c40d21cfb3ab5) C:\Windows\system32\drivers\rdpdr.sys 12:31:47.0304 1664 RDPDR - ok 12:31:47.0320 1664 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys 12:31:47.0320 1664 RDPENCDD - ok 12:31:47.0335 1664 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys 12:31:47.0335 1664 RDPREFMP - ok 12:31:47.0366 1664 RDPWD (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys 12:31:47.0366 1664 RDPWD - ok 12:31:47.0366 1664 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys 12:31:47.0366 1664 rdyboost - ok 12:31:47.0398 1664 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys 12:31:47.0398 1664 rspndr - ok 12:31:47.0429 1664 s3cap (5423d8437051e89dd34749f242c98648) C:\Windows\system32\DRIVERS\vms3cap.sys 12:31:47.0429 1664 s3cap - ok 12:31:47.0460 1664 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys 12:31:47.0460 1664 sbp2port - ok 12:31:47.0476 1664 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys 12:31:47.0476 1664 scfilter - ok 12:31:47.0491 1664 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys 12:31:47.0491 1664 secdrv - ok 12:31:47.0538 1664 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys 12:31:47.0538 1664 Serenum - ok 12:31:47.0554 1664 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys 12:31:47.0554 1664 Serial - ok 12:31:47.0585 1664 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys 12:31:47.0585 1664 sermouse - ok 12:31:47.0616 1664 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys 12:31:47.0616 1664 sffdisk - ok 12:31:47.0647 1664 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys 12:31:47.0647 1664 sffp_mmc - ok 12:31:47.0663 1664 sffp_sd (4f1e5b0fe7c8050668dbfade8999aefb) C:\Windows\system32\DRIVERS\sffp_sd.sys 12:31:47.0663 1664 sffp_sd - ok 12:31:47.0694 1664 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys 12:31:47.0694 1664 sfloppy - ok 12:31:47.0725 1664 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys 12:31:47.0725 1664 sisagp - ok 12:31:47.0741 1664 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys 12:31:47.0741 1664 SiSRaid2 - ok 12:31:47.0756 1664 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys 12:31:47.0756 1664 SiSRaid4 - ok 12:31:47.0788 1664 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys 12:31:47.0788 1664 Smb - ok 12:31:47.0944 1664 SPBBCDrv (e87cf104f12c92401c4d33c50a3d5dc8) C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys 12:31:47.0944 1664 SPBBCDrv - ok 12:31:47.0959 1664 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys 12:31:47.0959 1664 spldr - ok 12:31:48.0006 1664 SRTSP (620bbcc5c4c4407447866793c36e1215) C:\Windows\system32\Drivers\SRTSP.SYS 12:31:48.0006 1664 SRTSP - ok 12:31:48.0022 1664 SRTSPL (995e15de499ca58445e39a2fba7d170e) C:\Windows\system32\Drivers\SRTSPL.SYS 12:31:48.0037 1664 SRTSPL - ok 12:31:48.0053 1664 SRTSPX (1b63f794f283b974a79084514df206a0) C:\Windows\system32\Drivers\SRTSPX.SYS 12:31:48.0053 1664 SRTSPX - ok 12:31:48.0084 1664 srv (c4a027b8c0bd3fc0699f41fa5e9e0c87) C:\Windows\system32\DRIVERS\srv.sys 12:31:48.0084 1664 srv - ok 12:31:48.0115 1664 srv2 (414bb592cad8a79649d01f9d94318fb3) C:\Windows\system32\DRIVERS\srv2.sys 12:31:48.0115 1664 srv2 - ok 12:31:48.0131 1664 srvnet (ff207d67700aa18242aaf985d3e7d8f4) C:\Windows\system32\DRIVERS\srvnet.sys 12:31:48.0131 1664 srvnet - ok 12:31:48.0193 1664 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys 12:31:48.0193 1664 stexstor - ok 12:31:48.0224 1664 StillCam (edb05bd63148796f23ea78506404a538) C:\Windows\system32\DRIVERS\serscan.sys 12:31:48.0224 1664 StillCam - ok 12:31:48.0271 1664 storflt (957e346ca948668f2496a6ccf6ff82cc) C:\Windows\system32\DRIVERS\vmstorfl.sys 12:31:48.0271 1664 storflt - ok 12:31:48.0287 1664 storvsc (d5751969dc3e4b88bf482ac8ec9fe019) C:\Windows\system32\DRIVERS\storvsc.sys 12:31:48.0287 1664 storvsc - ok 12:31:48.0302 1664 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys 12:31:48.0302 1664 swenum - ok 12:31:48.0349 1664 SymEvent (ab33c3b196197ca467cbdda717860dba) C:\Windows\system32\Drivers\SYMEVENT.SYS 12:31:48.0349 1664 SymEvent - ok 12:31:48.0380 1664 SYMREDRV (394b2368212114d538316812af60fddd) C:\Windows\System32\Drivers\SYMREDRV.SYS 12:31:48.0380 1664 SYMREDRV - ok 12:31:48.0396 1664 SYMTDI (d46676bb414c7531bdffe637a33f5033) C:\Windows\System32\Drivers\SYMTDI.SYS 12:31:48.0396 1664 SYMTDI - ok 12:31:48.0427 1664 SysPlant (c8f9eb4ac42740d036b0b9f0809b335b) C:\Windows\SYSTEM32\Drivers\SysPlant.sys 12:31:48.0427 1664 SysPlant - ok 12:31:48.0490 1664 Tcpip (56c198ac82efa622dd93e9e43575f79c) C:\Windows\system32\drivers\tcpip.sys 12:31:48.0490 1664 Tcpip - ok 12:31:48.0521 1664 TCPIP6 (56c198ac82efa622dd93e9e43575f79c) C:\Windows\system32\DRIVERS\tcpip.sys 12:31:48.0521 1664 TCPIP6 - ok 12:31:48.0552 1664 tcpipreg (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys 12:31:48.0552 1664 tcpipreg - ok 12:31:48.0583 1664 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys 12:31:48.0583 1664 TDPIPE - ok 12:31:48.0599 1664 TDTCP (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers\tdtcp.sys 12:31:48.0599 1664 TDTCP - ok 12:31:48.0614 1664 tdx (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys 12:31:48.0614 1664 tdx - ok 12:31:48.0661 1664 Teefer3 (8f9bf086fed2c7c076a7a4b8e8a24fe9) C:\Windows\system32\DRIVERS\Teefer3.sys 12:31:48.0661 1664 Teefer3 - ok 12:31:48.0677 1664 TermDD (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys 12:31:48.0677 1664 TermDD - ok 12:31:48.0692 1664 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys 12:31:48.0692 1664 tssecsrv - ok 12:31:48.0724 1664 tunnel (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys 12:31:48.0724 1664 tunnel - ok 12:31:48.0755 1664 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys 12:31:48.0755 1664 uagp35 - ok 12:31:48.0786 1664 udfs (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys 12:31:48.0786 1664 udfs - ok 12:31:48.0864 1664 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys 12:31:48.0864 1664 uliagpkx - ok 12:31:48.0895 1664 umbus (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys 12:31:48.0895 1664 umbus - ok 12:31:48.0911 1664 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys 12:31:48.0911 1664 UmPass - ok 12:31:48.0958 1664 usbccgp (c31ae588e403042632dc796cf09e30b0) C:\Windows\system32\drivers\usbccgp.sys 12:31:48.0958 1664 usbccgp - ok 12:31:48.0989 1664 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys 12:31:48.0989 1664 usbcir - ok 12:31:49.0020 1664 usbehci (e4c436d914768ce965d5e659ba7eebd8) C:\Windows\system32\DRIVERS\usbehci.sys 12:31:49.0036 1664 usbehci - ok 12:31:49.0051 1664 usbhub (bdcd7156ec37448f08633fd899823620) C:\Windows\system32\DRIVERS\usbhub.sys 12:31:49.0051 1664 usbhub - ok 12:31:49.0067 1664 usbohci (eb2d819a639015253c871cda09d91d58) C:\Windows\system32\drivers\usbohci.sys 12:31:49.0067 1664 usbohci - ok 12:31:49.0098 1664 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys 12:31:49.0098 1664 usbprint - ok 12:31:49.0129 1664 USBSTOR (1c4287739a93594e57e2a9e6a3ed7353) C:\Windows\system32\DRIVERS\USBSTOR.SYS 12:31:49.0129 1664 USBSTOR - ok 12:31:49.0160 1664 usbuhci (22480bf4e5a09192e5e30ba4dde79fa4) C:\Windows\system32\DRIVERS\usbuhci.sys 12:31:49.0160 1664 usbuhci - ok 12:31:49.0176 1664 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys 12:31:49.0176 1664 vdrvroot - ok 12:31:49.0192 1664 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys 12:31:49.0192 1664 vga - ok 12:31:49.0223 1664 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys 12:31:49.0223 1664 VgaSave - ok 12:31:49.0238 1664 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys 12:31:49.0238 1664 vhdmp - ok 12:31:49.0270 1664 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys 12:31:49.0270 1664 viaagp - ok 12:31:49.0301 1664 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys 12:31:49.0301 1664 ViaC7 - ok 12:31:49.0316 1664 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys 12:31:49.0316 1664 viaide - ok 12:31:49.0348 1664 vmbus (379b349f65f453d2a6e75ea6b7448e49) C:\Windows\system32\DRIVERS\vmbus.sys 12:31:49.0348 1664 vmbus - ok 12:31:49.0363 1664 VMBusHID (ec2bbab4b84d0738c6c83d2234dc36fe) C:\Windows\system32\DRIVERS\VMBusHID.sys 12:31:49.0363 1664 VMBusHID - ok 12:31:49.0379 1664 volmgr (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys 12:31:49.0379 1664 volmgr - ok 12:31:49.0394 1664 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys 12:31:49.0410 1664 volmgrx - ok 12:31:49.0410 1664 volsnap (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys 12:31:49.0410 1664 volsnap - ok 12:31:49.0441 1664 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys 12:31:49.0441 1664 vsmraid - ok 12:31:49.0457 1664 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys 12:31:49.0457 1664 vwifibus - ok 12:31:49.0472 1664 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys 12:31:49.0472 1664 WacomPen - ok 12:31:49.0504 1664 WANARP (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys 12:31:49.0504 1664 WANARP - ok 12:31:49.0504 1664 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys 12:31:49.0504 1664 Wanarpv6 - ok 12:31:49.0535 1664 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys 12:31:49.0535 1664 Wd - ok 12:31:49.0566 1664 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys 12:31:49.0566 1664 Wdf01000 - ok 12:31:49.0597 1664 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys 12:31:49.0597 1664 WfpLwf - ok 12:31:49.0613 1664 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys 12:31:49.0613 1664 WIMMount - ok 12:31:49.0628 1664 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys 12:31:49.0628 1664 WmiAcpi - ok 12:31:49.0675 1664 WPS (d81ef0d8716500a573cd82185ef3e42d) C:\Windows\system32\drivers\wpsdrvnt.sys 12:31:49.0675 1664 WPS - ok 12:31:49.0722 1664 WpsHelper (ff983a25ae6f7d3f87f26bf51f02a201) C:\Windows\system32\drivers\WpsHelper.sys 12:31:49.0722 1664 WpsHelper - ok 12:31:49.0738 1664 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys 12:31:49.0738 1664 ws2ifsl - ok 12:31:49.0753 1664 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys 12:31:49.0753 1664 WudfPf - ok 12:31:49.0784 1664 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys 12:31:49.0784 1664 WUDFRd - ok 12:31:49.0800 1664 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 12:31:49.0862 1664 \Device\Harddisk0\DR0 - ok 12:31:49.0862 1664 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR1 12:31:49.0862 1664 \Device\Harddisk1\DR1 - ok 12:31:49.0878 1664 Boot (0x1200) (f2dcc0a7527760865eebe5589732ed41) \Device\Harddisk0\DR0\Partition0 12:31:49.0878 1664 \Device\Harddisk0\DR0\Partition0 - ok 12:31:49.0878 1664 Boot (0x1200) (8692a282c28473a3ca9eadec6733164b) \Device\Harddisk0\DR0\Partition1 12:31:49.0878 1664 \Device\Harddisk0\DR0\Partition1 - ok 12:31:49.0878 1664 Boot (0x1200) (5dbdfeb1e18097074a2ade7ef4fd934c) \Device\Harddisk1\DR1\Partition0 12:31:49.0878 1664 \Device\Harddisk1\DR1\Partition0 - ok 12:31:49.0878 1664 ============================================================ 12:31:49.0878 1664 Scan finished 12:31:49.0878 1664 ============================================================ 12:31:49.0894 4892 Detected object count: 0 12:31:49.0894 4892 Actual detected object count: 0 12:31:53.0248 4572 Deinitialize success

Attachments:

📎MBRdat.zip

NoodleTech

Post #4December 28, 2011, 4:58 PM UTC

Hi oldbloke,

No problem.

Next, Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================

Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unsure how to do this, please refer to our sticky topic How to disable your security applications

====================================================

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

oldbloke

Post #5January 4, 2012, 11:19 AM UTC

Hi Noodletech,

oldbloke

Post #6January 4, 2012, 11:25 AM UTC

Oops! keyboard / chair interface error there. I tried running the combofix, it updated to latest, set a restore point and then seemed to do nothing. The HDD is quite large so we gave it time, but nothing happened, I have to hold the power button to shut it off as all else is locked out, including task manager. No txt file is created either. I disabled the symantec as suggested, and windows defender. Any ideas?

NoodleTech

Post #7January 4, 2012, 7:53 PM UTC

Hey oldbloke,

Can you please check to see if this file exists?: c:\qoobox\combofix-quarantined-files.txt

If not, try running ComboFix again.

oldbloke

Post #8January 5, 2012, 2:58 PM UTC

Hi, No file, and running again has the same result, should there be activity in the blue command window? I get the warning that it might take 10 mins or more, then just the flashing cursor. Thanks.

NoodleTech

Post #9January 6, 2012, 4:06 AM UTC

Hi oldbloke,

Looks like Symantec is still interfering with CF. Let's try running it in Safe Mode.

To boot into safe mode follow these steps:

Turn on or restart your computer
As the computer is booting, press and hold your F8 Key
This should bring up the Windows Advanced Options Menu
Use your arrow keys to move to Safe Mode and press your Enter Key

NoodleTech

Post #10January 10, 2012, 7:57 PM UTC

Do you still need help?

oldbloke

Post #11January 17, 2012, 9:45 AM UTC

Hi, Thanks for your patience, got to it again today. Started in SafeMode, stopped the symantec service as it detected it was still running, but still get the same results from the combofix. Starts, creates restore point (I assume this happens), then comes the warning this may take up to 10 minutes, then nothing. Should I expect activity in the command window? Thanks Ray

NoodleTech

Post #12January 18, 2012, 4:53 AM UTC last edited January 18, 2012, 4:53 AM UTC

Hi Ray,

No problem :). Yes, you should definitely expect activity in the command window.

Let's try this.

Click Start
Type the following in the search bar:
```
ComboFix /nombr
```
Click OK and follow all prompts.
Let me know if it runs successfully.

oldbloke

Post #13January 20, 2012, 2:06 PM UTC

Finally it ran, there were two symantec operations running that I could not close, no processes, or services running that I could see. Attached is the combofix.txt, also pasted below. thanks again for your time here. ComboFix 12-01-19.02 - Sales 20/01/2012 13:50:06.1.2 - x86 NETWORK Microsoft Windows 7 Professional 6.1.7600.0.1252.44.1033.18.3070.2536 [GMT 0:00] Running from: c:\users\[removed]\Desktop\Ray\ComboFix.exe Command switches used :: /nombr AV: Symantec Endpoint Protection *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} FW: Symantec Endpoint Protection *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} SP: Symantec Endpoint Protection *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Default\AppData\Roaming\DPInst.exe c:\users\Default\AppData\Roaming\gacutil.exe c:\users\Default\AppData\Roaming\PnPutil.exe . . ((((((((((((((((((((((((( Files Created from 2011-12-20 to 2012-01-20 ))))))))))))))))))))))))))))))) . . 2012-01-20 13:54 . 2012-01-20 13:54 ——– d—–w- c:\users\Sales\AppData\Local\temp 2012-01-20 13:54 . 2012-01-20 13:54 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-01-17 23:17 . 2011-11-17 05:48 134000 —-a-w- c:\windows\system32\drivers\ksecpkg.sys 2012-01-17 23:17 . 2011-11-17 05:48 67440 —-a-w- c:\windows\system32\drivers\ksecdd.sys 2012-01-17 23:17 . 2011-11-17 05:42 369352 —-a-w- c:\windows\system32\drivers\cng.sys 2012-01-17 23:17 . 2011-11-17 05:39 314368 —-a-w- c:\windows\system32\webio.dll 2012-01-17 23:17 . 2011-11-17 05:39 99840 —-a-w- c:\windows\system32\sspicli.dll 2012-01-17 23:17 . 2011-11-17 05:39 15360 —-a-w- c:\windows\system32\sspisrv.dll 2012-01-17 23:17 . 2011-11-17 05:39 224768 —-a-w- c:\windows\system32\schannel.dll 2012-01-17 23:17 . 2011-11-17 05:39 22016 —-a-w- c:\windows\system32\secur32.dll 2012-01-17 23:17 . 2011-11-17 05:38 1037312 —-a-w- c:\windows\system32\lsasrv.dll 2012-01-17 23:17 . 2011-11-17 05:36 22528 —-a-w- c:\windows\system32\lsass.exe 2012-01-11 01:32 . 2011-11-19 14:06 67072 —-a-w- c:\windows\system32\packager.dll 2012-01-11 01:32 . 2011-11-17 05:41 1288984 —-a-w- c:\windows\system32\ntdll.dll 2012-01-11 01:32 . 2011-10-26 04:28 1328640 —-a-w- c:\windows\system32\quartz.dll 2012-01-11 01:32 . 2011-10-26 04:28 514560 —-a-w- c:\windows\system32\qdvd.dll 2012-01-06 11:43 . 2012-01-06 11:43 ——– d—–w- c:\users\Default\AppData\Local\Eastman_Kodak_Company . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-12-10 10:22 . 2011-12-10 10:22 805376 —-a-w- c:\windows\system32\EKAiO2MON.dll 2011-12-10 10:22 . 2011-12-10 10:22 160256 —-a-w- c:\windows\system32\EKAiO2COI07.dll 2011-12-10 10:21 . 2011-12-10 10:21 123904 —-a-w- c:\windows\system32\EKaio2WiaCoInst.dll 2011-12-10 10:21 . 2011-12-10 10:21 10240 —-a-w- c:\windows\system32\EKaio2WiaCoInstRes.dll 2011-12-09 11:02 . 2011-12-09 11:02 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-12-08 13:44 . 2011-12-08 13:43 126584 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2011-12-07 13:28 . 2011-12-08 08:25 6823496 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7EE6DF66-0A93-404E-8429-9DED57F86598}\mpengine.dll 2011-12-07 13:28 . 2011-12-07 13:28 222080 ——w- c:\windows\system32\MpSigStub.exe 2011-11-24 04:23 . 2011-12-14 02:29 2340352 —-a-w- c:\windows\system32\win32k.sys 2011-11-05 04:35 . 2011-12-14 02:29 981504 —-a-w- c:\windows\system32\wininet.dll 2011-11-05 04:34 . 2011-12-14 02:29 44544 —-a-w- c:\windows\system32\licmgr10.dll 2011-11-05 04:30 . 2011-12-14 02:28 2048 —-a-w- c:\windows\system32\tzres.dll 2011-11-05 03:28 . 2011-12-14 02:29 386048 —-a-w- c:\windows\system32\html.iec 2011-11-05 02:55 . 2011-12-14 02:29 1638912 —-a-w- c:\windows\system32\mshtml.tlb 2011-10-26 04:42 . 2011-12-14 02:27 3901808 —-a-w- c:\windows\system32\ntoskrnl.exe 2011-10-26 04:42 . 2011-12-14 02:27 3957104 —-a-w- c:\windows\system32\ntkrnlpa.exe 2011-10-26 04:25 . 2011-12-14 02:27 38912 —-a-w- c:\windows\system32\csrsrv.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-12-08 39408] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2011-06-23 115624] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "NA1Messenger"="c:\ups\WSTD\UPSNA1Msgr.exe" [2010-12-09 24576] "EKAIO2StatusMonitor"="c:\windows\system32\spool\DRIVERS\W32X86\3\EKAiO2MUI.exe" [2011-12-10 2756608] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "KodakHomeCenter"="c:\program files\Kodak\AiO\Center\AiOHomeCenter.exe" [2011-12-12 2234288] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ UPS WorldShip Messaging Utility.lnk - c:\ups\WSTD\WSTDMessaging.exe [2010-12-9 422912] UPS WorldShip PLD Reminder Utility.lnk - c:\ups\WSTD\wstdPldReminder.exe [2010-12-9 34304] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0)

Attachments:

📎ComboFix.txt

NoodleTech

Post #14January 21, 2012, 7:20 PM UTC

Hey oldbloke,

How is your computer running now?

ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the [external image: Posted Image] button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
- Double click on the [external image: Posted Image] icon on your desktop.
Check [external image: Posted Image]
Click the [external image: Posted Image] button.
Accept any security warnings from your browser.
Check [external image: Posted Image]
Make sure that the option "Remove found threats" is Unchecked
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push [external image: Posted Image]
Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the [external image: Posted Image] button.
Push [external image: Posted Image]

NoodleTech

Post #15February 3, 2012, 1:06 AM UTC

Do you still need help?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

boot.tidserv [Closed]

✨ Ask AI

Ask AI