What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

System-Check.com VIRUS in Windows 7 [Solved]

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello!! I've been reading your other posts about system check Virus in Windows XP… Is there any difference if I want to remove the System-Check with your previous methods?
Post #2
:welcome:

Hello Wendy,

First we need to see some reports


Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]





Download DDS from one of the links below to your desktop

Link 1
Link 2

  • Double click the tool to run it.
  • A black Screen will open, just read the contents and do nothing.
  • When the tool finishes, it will open 2 reports, DDS.txt and attach.txt
  • Copy/Paste the contents of 'DDS.txt' into your post.
  • 'attach.txt' should be zipped using Windows native zip utility and attached to your post. Compress and uncompress files (zip files)
Post #3
hello Ken! Thank you so much for your quick response… This is what I got.

First on the aswMBR.exe file, this poped up! when I saved the log


aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software
Run date: 2012-01-08 00:44:40
—————————–
00:44:40.092 OS Version: Windows 6.1.7600
00:44:40.093 Number of processors: 2 586 0x1C0A
00:44:40.126 ComputerName: WENLOLZ-HP UserName: Wenlolz
00:45:08.621 Initialize success
00:45:42.996 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
00:45:43.006 Disk 0 Vendor: WDC_WD25 01.0 Size: 238475MB BusType: 3
00:45:43.036 Disk 0 MBR read successfully
00:45:43.046 Disk 0 MBR scan
00:45:43.056 Disk 0 unknown MBR code
00:45:43.086 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 199 MB offset 2048
00:45:43.216 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 219641 MB offset 409600
00:45:43.256 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 18530 MB offset 450234368
00:45:43.286 Disk 0 Partition 4 00 0C FAT32 LBA MSDOS5.0 103 MB offset 488183808
00:45:43.346 Disk 0 scanning sectors +488395120
00:45:43.456 Disk 0 scanning C:\Windows\system32\drivers
00:46:07.625 Service scanning
00:46:11.510 Service MpKsl7a2558d4 c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{60B7A626-3990-4296-B632-9CFF6FD67662}\MpKsl7a2558d4.sys **LOCKED** 32
00:46:12.260 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32
00:46:14.092 Modules scanning
00:47:52.128 Disk 0 trace - called modules:
00:47:52.178 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll
00:47:52.202 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86133030]
00:47:52.219 3 CLASSPNP.SYS[870d459e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x84663028]
00:47:52.245 Scan finished successfully
00:48:00.010 Disk 0 MBR has been saved successfully to "E:\MBR.dat"
00:48:01.099 The log file has been saved successfully to "E:\aswMBR_wenlolz_computer.txt"


aswMBR version 0.9.9.1297 Copyright© 2011 AVAST Software
Run date: 2012-01-08 00:44:40
—————————–
00:44:40.092 OS Version: Windows 6.1.7600
00:44:40.093 Number of processors: 2 586 0x1C0A
00:44:40.126 ComputerName: WENLOLZ-HP UserName: Wenlolz
00:45:08.621 Initialize success
00:45:42.996 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
00:45:43.006 Disk 0 Vendor: WDC_WD25 01.0 Size: 238475MB BusType: 3
00:45:43.036 Disk 0 MBR read successfully
00:45:43.046 Disk 0 MBR scan
00:45:43.056 Disk 0 unknown MBR code
00:45:43.086 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 199 MB offset 2048
00:45:43.216 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 219641 MB offset 409600
00:45:43.256 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 18530 MB offset 450234368
00:45:43.286 Disk 0 Partition 4 00 0C FAT32 LBA MSDOS5.0 103 MB offset 488183808
00:45:43.346 Disk 0 scanning sectors +488395120
00:45:43.456 Disk 0 scanning C:\Windows\system32\drivers
00:46:07.625 Service scanning
00:46:11.510 Service MpKsl7a2558d4 c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{60B7A626-3990-4296-B632-9CFF6FD67662}\MpKsl7a2558d4.sys **LOCKED** 32
00:46:12.260 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32
00:46:14.092 Modules scanning
00:47:52.128 Disk 0 trace - called modules:
00:47:52.178 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll
00:47:52.202 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86133030]
00:47:52.219 3 CLASSPNP.SYS[870d459e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x84663028]
00:47:52.245 Scan finished successfully
00:48:00.010 Disk 0 MBR has been saved successfully to "E:\MBR.dat"
00:48:01.099 The log file has been saved successfully to "E:\aswMBR_wenlolz_computer.txt"
00:50:31.440 Disk 0 MBR has been saved successfully to "E:\MBR.dat"
00:50:31.829 The log file has been saved successfully to "E:\aswMBR_wenlolz_computer.txt"


Then on the DDS.txt showed me this text


DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.7600.16385
Run by [removed] at 0:54:15 on 2012-01-08
Microsoft Windows 7 Starter 6.1.7600.0.1252.1.1033.18.1012.64 [GMT -6:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\IDT\WDM\aestsrv.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\SwSetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
C:\SRN Micro\SOLOCFG.EXE
C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe
C:\Program Files\Roxio\RoxioNow Player\RNowSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Hewlett-Packard\HP CloudDrive\zumodrive.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\ProgramData\gocBcScmNJwBeCF.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\ProgramData\s7fCG5ml5lXoa3.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\iPod\bin\iPodService.exe
c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Hewlett-Packard\Shared\hpCaslNotification.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\taskeng.exe
C:\Users\Wenlolz\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Wenlolz\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Wenlolz\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Wenlolz\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Wenlolz\AppData\Local\Google\Chrome\Application\chrome.exe
E:\aswMBR.exe
C:\Users\Wenlolz\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyOverride = *.local
uWindows: Load=c:\users\wenlolz\locals~1\temp\vlhgisxdde.cmd
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\18.6.0.29\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\18.6.0.29\ips\IPSBHO.DLL
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\6.0.2282.0\npwinext.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\18.6.0.29\coIEPlg.dll
TB: @c:\program files\msn toolbar\platform\6.0.2282.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\6.0.2282.0\npwinext.dll
uRun: [Google Update] "c:\users\wenlolz\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [ZumoDrive] c:\program files\hewlett-packard\hp clouddrive\ZumoLauncher.lnk
uRun: [FileHunter Check for updates] c:\users\wenlolz\appdata\roaming\filehunter\update.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [gocBcScmNJwBeCF.exe] c:\programdata\gocBcScmNJwBeCF.exe
uRun: [uEwKkQfYkoLVFj.exe] c:\programdata\uEwKkQfYkoLVFj.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun: [IAStorIcon] c:\program files\intel\intel® rapid storage technology\IAStorIcon.exe
mRun: [AmIcoSinglun] c:\program files\amicosinglun\AmIcoSinglun.exe
mRun: [SysTrayApp] c:\program files\idt\wdm\sttray.exe
mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
mRun: [HP Quick Launch] c:\program files\hewlett-packard\hp quick launch\HPMSGSVC.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [HPWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\delayedappstarter.exe 120 c:\program files\hewlett-packard\hp wireless assistant\HPWA_Main.exe /hidden
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SoloScan] c:\srnmic~1\SOLOSCAN.EXE /V
mRun: [SoloSentry] c:\srnmic~1\SOLOSENT.EXE
mRun: [SoloSchedule] c:\srnmic~1\SOLOCFG.EXE
mRun: [SoloSysCheck] c:\srnmic~1\SYSCHECK.COM
StartupFolder: c:\users\wenlolz\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\wenlolz\appdata\roaming\dropbox\bin\Dropbox.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xportar; a Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - {BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEEE} - c:\program files\evernote\evernote3.5\enbar.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces\{6585D09A-F540-4E34-A122-36C9FE15629C} : DhcpNameServer = [removed] [removed]
TCP: Interfaces\{6585D09A-F540-4E34-A122-36C9FE15629C}\34241323 : DhcpNameServer = [removed] [removed]
TCP: Interfaces\{6585D09A-F540-4E34-A122-36C9FE15629C}\3425357445C4F43414C4 : DhcpNameServer = [removed] [removed]
TCP: Interfaces\{6585D09A-F540-4E34-A122-36C9FE15629C}\54351425455402449474944514C4 : DhcpNameServer = 192.168.1.100
TCP: Interfaces\{6585D09A-F540-4E34-A122-36C9FE15629C}\76164756771697 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{6585D09A-F540-4E34-A122-36C9FE15629C}\7616C696C656F6 : DhcpNameServer = 10.0.0.4 10.1.0.1
TCP: Interfaces\{93C45B8C-B848-41F3-9F86-8B8222B590A7} : DhcpNameServer = 192.168.96.2
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: igfxcui - igfxdev.dll
mASetup: {4FB2407C-C8E4-BBC8-BB1C-FCCB2EF5914B} - c:\program files\hewlett-packard\hp media suite\home\HPMediaSuite.exe "/installer"
mASetup: {4FB2AA7C-C8E4-BBC8-BB1C-FAAB2EF5914B} - c:\windows\system32\wscript.exe "c:\program files\hewlett-packard\hp media suite\home\PinItem.vbs"
.
============= SERVICES / DRIVERS ===============
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nis\1206000.01d\symds.sys [2011-5-9 340088]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1206000.01d\symefa.sys [2011-5-9 744568]
R1 BHDrvx86;BHDrvx86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\bashdefs\20110518.001\BHDrvx86.sys [2011-5-18 802936]
R1 DVMIO;DeviceVM IO Service;c:\windows\system32\drivers\dvmio.sys [2009-11-11 18136]
R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\ipsdefs\20110603.003\IDSvix86.sys [2011-6-4 353912]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165648]
R1 MpKsl7a2558d4;MpKsl7a2558d4;c:\programdata\microsoft\microsoft antimalware\definition updates\{60b7a626-3990-4296-b632-9cff6fd67662}\MpKsl7a2558d4.sys [2012-1-6 29904]
R1 MpKsldf38f2a8;MpKsldf38f2a8;c:\programdata\microsoft\microsoft antimalware\definition updates\{60b7a626-3990-4296-b632-9cff6fd67662}\MpKsldf38f2a8.sys [2012-1-6 29904]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nis\1206000.01d\ironx86.sys [2011-5-9 136312]
R1 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\nis\1206000.01d\symnets.sys [2011-5-9 299640]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
R2 AESTFilters;Andrea ST Filters Service;c:\program files\idt\wdm\AEstSrv.exe [2011-2-19 81920]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\swsetup\hpqwmm\quickweb\qw.sys\config\DVMExportService.exe [2010-9-28 338208]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.sys [2010-6-17 27136]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 65024]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2011-2-19 275048]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2009-7-13 311296]
.
=============== Created Last 30 ================
.
2012-01-08 06:41:18 ——– d—–w- c:\users\wenlolz\appdata\local\{0D143E5C-7E63-4F1B-A5A3-5885C1D4F9F0}
2012-01-06 15:28:04 ——– d–h–w- c:\users\wenlolz\appdata\local\{E9E2D482-C4DA-45EC-8811-9785179B6946}
2012-01-06 15:27:12 29904 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{60b7a626-3990-4296-b632-9cff6fd67662}\MpKsl7a2558d4.sys
2012-01-06 14:37:12 ——– d–h–w- c:\users\wenlolz\appdata\local\{CA49655A-C653-47ED-A273-BE32E9B241F0}
2012-01-06 14:36:56 ——– d–h–w- c:\users\wenlolz\appdata\local\{84C0DAB0-1F88-4F1C-8B35-96423408D747}
2012-01-06 14:35:42 29904 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{60b7a626-3990-4296-b632-9cff6fd67662}\MpKsldf38f2a8.sys
2012-01-06 14:34:08 38 —-a-w- c:\windows\SOLOSCAN.BAT
2012-01-06 14:33:14 ——– d–h–w- C:\SRN Micro
2012-01-06 14:31:15 ——– d–h–w- c:\users\wenlolz\appdata\local\{606CD75D-BB0C-4CFB-AEB2-7F54EB764837}
2012-01-06 14:13:33 ——– d–h–w- c:\users\wenlolz\appdata\local\{0608E53E-9327-472C-9D43-CCFF02623285}
2012-01-06 14:13:17 ——– d–h–w- c:\users\wenlolz\appdata\local\{D59F0035-EC35-4496-9767-4AEE68033CAB}
2012-01-06 12:54:48 ——– d–h–w- c:\users\wenlolz\appdata\local\{8B2E9376-75D6-49C3-A7B4-8F54E744097D}
2012-01-06 12:54:28 ——– d–h–w- c:\users\wenlolz\appdata\local\{F956B57F-08D1-461D-800C-945776492C6B}
2012-01-06 12:47:56 359126 —ha-w- c:\programdata\s7fCG5ml5lXoa3.exe
2012-01-06 12:45:19 446166 –sha-w- c:\programdata\gocBcScmNJwBeCF.exe
2012-01-06 12:16:31 ——– d–h–w- c:\users\wenlolz\appdata\local\{B429ADE0-E25D-45E1-88E7-31D7FCEA0013}
2012-01-06 12:16:19 ——– d–h–w- c:\users\wenlolz\appdata\local\{09F4044C-6B02-4ED7-9C1F-23CB3C71C0CE}
2012-01-06 12:02:55 ——– d–h–w- c:\users\wenlolz\appdata\local\{359C0898-2684-474B-A9F9-74F28BCDEAD9}
2012-01-06 12:02:41 ——– d–h–w- c:\users\wenlolz\appdata\local\{51CCFA0B-32C6-4175-8DA1-2332FE9F3B01}
2012-01-06 12:01:22 56200 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{60b7a626-3990-4296-b632-9cff6fd67662}\offreg.dll
2012-01-05 16:46:17 6823496 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{60b7a626-3990-4296-b632-9cff6fd67662}\mpengine.dll
2012-01-05 16:31:37 ——– d–h–w- c:\users\wenlolz\appdata\local\{1C4069DB-A0E1-42AA-907F-476C233246E7}
2012-01-05 16:31:26 ——– d–h–w- c:\users\wenlolz\appdata\local\{D0A36AB5-F92A-4577-B83F-7E455DA4C91E}
2012-01-04 15:36:06 ——– d–h–w- c:\users\wenlolz\appdata\local\{D775EF0E-2F28-4C11-8A70-1272ABD6D913}
2012-01-04 15:35:38 ——– d–h–w- c:\users\wenlolz\appdata\local\{0067E7C3-EADC-4203-B901-80BC885F2419}
2012-01-02 22:28:25 ——– d–h–w- c:\users\wenlolz\appdata\local\{8EE21784-7C28-4C2D-BDE4-BF87DAA63A83}
2012-01-02 22:28:07 ——– d–h–w- c:\users\wenlolz\appdata\local\{BCA8EEAC-9051-400D-B5B5-F3D5449FEC6D}
2011-12-31 20:12:07 26600 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-12-31 20:12:07 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2011-12-31 20:09:23 ——– d—–w- c:\program files\iPod
2011-12-31 20:08:59 ——– d—–w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2011-12-31 20:08:59 ——– d—–w- c:\program files\iTunes
2011-12-31 18:40:08 ——– d—–w- c:\program files\Bonjour
2011-12-31 17:34:57 ——– d–h–w- c:\users\wenlolz\appdata\local\{DB24FCB2-842E-44BB-A9B2-15E62D88E865}
2011-12-31 17:34:42 ——– d–h–w- c:\users\wenlolz\appdata\local\{5AC97715-1147-4E4B-B471-CE73BA00047C}
2011-12-31 14:04:15 ——– d–h–w- c:\users\wenlolz\appdata\local\{23AD9A85-A10D-4B41-AC9F-C107218A1F43}
2011-12-31 14:03:42 ——– d–h–w- c:\users\wenlolz\appdata\local\{3D0BE425-2E3A-4157-A868-D3F23531303A}
2011-12-31 03:36:16 ——– d–h–w- c:\users\wenlolz\appdata\local\{D75D2540-B25B-40E0-8F3D-6F78B87A72EB}
2011-12-31 03:35:50 ——– d–h–w- c:\users\wenlolz\appdata\local\{3631B95E-F7D5-493A-B221-FA1E33E8F507}
2011-12-27 06:57:10 ——– d–h–w- c:\users\wenlolz\appdata\local\{56163DC4-4015-4107-90C9-2FFE7C47513F}
2011-12-27 06:56:13 ——– d–h–w- c:\users\wenlolz\appdata\local\{1EE2092E-6966-4010-A519-7FCA2B96FF45}
2011-12-26 07:32:41 ——– d–h–w- c:\users\wenlolz\appdata\local\{A4535D94-008D-4186-A623-F32B0B52C5FE}
2011-12-26 07:32:27 ——– d–h–w- c:\users\wenlolz\appdata\local\{F1426878-5FF2-433C-9F4C-F2E53472DAAB}
2011-12-25 17:45:27 ——– d–h–w- c:\users\wenlolz\appdata\local\{4A9CAA7B-AA84-4A31-BA5A-FAE2D5A26156}
2011-12-25 17:44:59 ——– d–h–w- c:\users\wenlolz\appdata\local\{D4D01154-1570-4AD4-A20A-AF92017F964B}
2011-12-23 14:29:56 ——– d–h–w- c:\users\wenlolz\appdata\local\{0A414239-61C1-46BC-8D3B-6C5594819231}
2011-12-23 14:29:41 ——– d–h–w- c:\users\wenlolz\appdata\local\{53317239-7005-48A3-AB4E-6C9CFC5A5130}
2011-12-23 06:46:02 ——– d–h–w- c:\users\wenlolz\appdata\local\{95FCF3AF-B886-490B-8443-083766A1B694}
2011-12-23 06:45:32 ——– d–h–w- c:\users\wenlolz\appdata\local\{80AE5CD0-E26D-49D4-A4B3-54F9A8AD4990}
2011-12-22 05:53:11 ——– d–h–w- c:\users\wenlolz\appdata\local\{06FA2D79-E415-43B4-9B59-9BA346C85357}
2011-12-22 05:53:01 ——– d–h–w- c:\users\wenlolz\appdata\local\{A4315E74-9A18-435D-948A-BCEFDA236B5C}
2011-12-22 03:56:17 ——– d–h–w- c:\users\wenlolz\appdata\local\{0F764621-B5F6-40D2-AD23-470135F85693}
2011-12-22 03:56:00 ——– d–h–w- c:\users\wenlolz\appdata\local\{0238F559-483A-4791-98F0-15033751F7FE}
2011-12-21 18:26:05 ——– d–h–w- c:\users\wenlolz\appdata\local\{736747E4-2821-437F-9190-3FB604823058}
2011-12-21 18:25:53 ——– d–h–w- c:\users\wenlolz\appdata\local\{D07F311D-3791-4228-92B3-2E967FD20962}
2011-12-21 06:11:15 ——– d–h–w- c:\users\wenlolz\appdata\local\{4811EFCC-FF30-45B4-AEBD-C8187EA2C6D7}
2011-12-21 06:11:00 ——– d–h–w- c:\users\wenlolz\appdata\local\{EAB41811-9301-48EC-982E-1A18644EED5D}
2011-12-21 05:26:16 ——– d–h–w- c:\users\wenlolz\appdata\local\{34D5A788-90E8-4C5D-BF17-4670282D316D}
2011-12-21 05:26:04 ——– d–h–w- c:\users\wenlolz\appdata\local\{0AD29361-FC81-4152-94CA-C20CE8455D31}
2011-12-21 01:13:02 ——– d–h–w- c:\users\wenlolz\appdata\local\{B1269D7C-764F-43DD-AEEB-264F1126C511}
2011-12-21 01:12:40 ——– d–h–w- c:\users\wenlolz\appdata\local\{49B69337-5784-405F-8C5D-B4F88CB3CDEA}
2011-12-19 05:27:39 ——– d–h–w- c:\users\wenlolz\appdata\local\{D495F104-ECB6-4313-A410-08BA11D04AC6}
2011-12-19 05:27:24 ——– d–h–w- c:\users\wenlolz\appdata\local\{BD41B58D-3925-47C4-83A3-27F5AE998248}
2011-12-19 04:44:48 ——– d–h–w- c:\users\wenlolz\appdata\local\{6EFB7F7F-9B13-4F65-AE37-95B080BAA11C}
2011-12-19 04:44:35 ——– d–h–w- c:\users\wenlolz\appdata\local\{3F4F5F63-A68B-49BD-B20F-4C4FFB4CFAE0}
2011-12-19 03:43:44 ——– d–h–w- c:\users\wenlolz\appdata\roaming\GetRightToGo
2011-12-17 12:53:43 ——– d–h–w- c:\users\wenlolz\appdata\local\{ABA0BD46-7CC9-486E-A1EF-0834CA0D9C12}
2011-12-17 12:53:28 ——– d–h–w- c:\users\wenlolz\appdata\local\{D61929A2-DE35-4006-9244-1B04B22DF9E9}
2011-12-16 17:20:39 ——– d–h–w- c:\users\wenlolz\appdata\local\{2DAC533B-5D54-403C-8D78-C6EEF306876D}
2011-12-16 17:20:23 ——– d–h–w- c:\users\wenlolz\appdata\local\{D2B4EBC5-D989-491D-9915-A2CC936BB0CB}
2011-12-16 15:18:21 ——– d–h–w- c:\users\wenlolz\appdata\local\{78B7C505-ED1E-4380-87D9-0DF3E3CEFB9D}
2011-12-16 15:18:07 ——– d–h–w- c:\users\wenlolz\appdata\local\{771F7F84-420F-48F9-BCEA-BB5C0E1EB3AD}
2011-12-16 04:29:59 ——– d–h–w- c:\users\wenlolz\appdata\local\{2B361CDF-DC6A-459D-B037-8D154FE084D1}
2011-12-16 04:29:46 ——– d–h–w- c:\users\wenlolz\appdata\local\{4A4E809E-7EB6-4ACF-9ADD-5E238543A8B6}
2011-12-16 00:37:40 534528 —-a-w- c:\windows\system32\EncDec.dll
2011-12-16 00:37:35 38912 —-a-w- c:\windows\system32\csrsrv.dll
2011-12-16 00:37:24 3901808 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-12-16 00:37:23 3957104 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-16 00:07:03 ——– d–h–w- c:\users\wenlolz\appdata\local\{BB5A54ED-C050-4033-BF15-4BD2E9A9BFDD}
2011-12-16 00:06:47 ——– d–h–w- c:\users\wenlolz\appdata\local\{EB075CCA-88BD-4155-BFC3-9404AF32A071}
2011-12-15 01:15:11 ——– d–h–w- c:\users\wenlolz\appdata\local\{431B5376-28CF-40BB-B588-0A695A598BF3}
2011-12-14 02:11:14 ——– d–h–w- c:\users\wenlolz\appdata\local\{BD63D04C-F508-43AF-8AC6-D8DFA5D6AD57}
2011-12-13 18:00:13 ——– d–h–w- c:\users\wenlolz\appdata\local\{D413C6DE-BB93-43DC-A099-FD18477D233E}
2011-12-13 17:59:59 ——– d–h–w- c:\users\wenlolz\appdata\local\{9ECAF28F-F2C7-4AAC-8628-281C2A65CA44}
2011-12-13 17:31:57 ——– d–h–w- c:\users\wenlolz\appdata\local\{B44EDA14-73CF-4EE2-B58B-E217C5787E90}
2011-12-13 17:31:40 ——– d–h–w- c:\users\wenlolz\appdata\local\{6F5828EC-FF0D-405E-80F8-ABA1F9B11D48}
2011-12-12 23:52:48 ——– d–h–w- c:\users\wenlolz\appdata\local\{58AC4492-210D-4297-99B3-E72D88EFBD35}
2011-12-12 23:52:36 ——– d–h–w- c:\users\wenlolz\appdata\local\{91B55570-7BDF-423C-97D5-E624D3520856}
2011-12-12 23:38:33 ——– d–h–w- c:\users\wenlolz\appdata\local\{E6FA7644-A29E-4C98-A959-5E9E9AC84A43}
2011-12-12 23:38:15 ——– d–h–w- c:\users\wenlolz\appdata\local\{436BE7C8-267B-4BD3-9156-965A385D4925}
2011-12-12 20:50:11 ——– d–h–w- c:\users\wenlolz\appdata\local\{EC379B83-4F34-4B86-997A-1BDF172FE6BD}
2011-12-12 20:49:58 ——– d–h–w- c:\users\wenlolz\appdata\local\{A195640A-1C8F-4FB0-B7B0-26C66970C0DB}
2011-12-11 05:02:06 ——– d–h–w- c:\users\wenlolz\appdata\local\{A0CD3BB6-2B4C-4673-BB6B-7B958078B9E9}
2011-12-11 05:01:42 ——– d–h–w- c:\users\wenlolz\appdata\local\{AC832E20-25E9-47E0-A6BB-BDB63315B6C6}
2011-12-10 14:00:32 ——– d–h–w- c:\users\wenlolz\appdata\local\{C9ACF6B2-BF82-4753-88E0-96D94AFD8AED}
2011-12-10 14:00:14 ——– d–h–w- c:\users\wenlolz\appdata\local\{9EE776D5-2DCB-456B-B0B3-152BE0639867}
2011-12-09 18:05:35 ——– d–h–w- c:\users\wenlolz\appdata\local\{2FC7B9FA-4A5F-4EEA-AAA1-AF860583D9FC}
2011-12-09 18:05:14 ——– d–h–w- c:\users\wenlolz\appdata\local\{86D15E3D-C816-4496-A986-13F8F1521F3E}
.
==================== Find3M ====================
.
2011-11-24 04:23:31 2340352 —-a-w- c:\windows\system32\win32k.sys
2011-11-05 04:35:50 981504 —-a-w- c:\windows\system32\wininet.dll
2011-11-05 04:34:15 44544 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-05 04:30:11 2048 —-a-w- c:\windows\system32\tzres.dll
2011-11-05 03:28:41 386048 —-a-w- c:\windows\system32\html.iec
2011-11-05 02:55:38 1638912 —-a-w- c:\windows\system32\mshtml.tlb
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7600
.
CreateFile("\\.\PHYSICALDRIVE0"): The process cannot access the file because it is being used by another process.
device: opened successfully
user: error reading MBR
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll Ntfs.sys fltmgr.sys ntdll.dll
c:\windows\system32\drivers\iaStor.sys Intel Corporation Intel Rapid Storage Technology driver
1 ntkrnlpa!IofCallDriver[0x81C85458] -> \Device\Harddisk0\DR0[0x86133030]
3 CLASSPNP[0x870D459E] -> ntkrnlpa!IofCallDriver[0x81C85458] -> \Device\Ide\IAAStorageDevice-0[0x84663028]
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; PUSH CS; POP DS; PUSH CS; POP ES; PUSHAD ; MOV [0x7e00], DL; MOV BYTE [0x7e04], 0x1e; MOV AH, 0x48; MOV SI, 0x7e04; INT 0x13; MOV AL, 0x50; JB 0x196; SUB WORD [0x413], 0x14; }
user != kernel MBR !!!
copy of MBR has been found in sector 2 !
.
============= FINISH: 0:58:26.40 ===============





THANK YOU AGAIN!! :notworthy:
Post #4
Hi,

Lots of bad stuff in those logs, lets do this


Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • See this Link for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #5
GOD BLESS YOU!! MY PC IS FIXED!!! :D

here's the ComboFix, report. . .



ComboFix 12-01-09.03 - Wenlolz 01/09/2012 14:19:22.1.2 - x86
Microsoft Windows 7 Starter 6.1.7600.0.1252.1.1033.18.1012.403 [GMT -6:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\~2nrDJaDxiBd2EX
c:\programdata\~2nrDJaDxiBd2EXr
c:\programdata\~s7fCG5ml5lXoa3
c:\programdata\~s7fCG5ml5lXoa3r
c:\programdata\2nrDJaDxiBd2EX
c:\programdata\2nrDJaDxiBd2EX.exe
c:\programdata\s7fCG5ml5lXoa3
c:\programdata\uEwKkQfYkoLVFj.exe
C:\Thumbs.db
c:\users\Wenlolz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check\System Check.lnk
c:\users\Wenlolz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check\Uninstall System Check.lnk
c:\users\Wenlolz\videos\subfixer.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-12-09 to 2012-01-09 )))))))))))))))))))))))))))))))
.
.
2012-01-09 21:16 . 2012-01-09 21:17 ——– d—–w- c:\users\Wenlolz\AppData\Local\temp
2012-01-09 21:16 . 2012-01-09 21:16 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-01-09 19:39 . 2012-01-09 19:39 56200 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{574B12B3-6CA9-4D26-ACC5-705EC4D09662}\offreg.dll
2012-01-09 19:39 . 2011-11-21 10:47 6823496 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{574B12B3-6CA9-4D26-ACC5-705EC4D09662}\mpengine.dll
2012-01-06 14:34 . 2012-01-06 14:34 38 —-a-w- c:\windows\SOLOSCAN.BAT
2012-01-06 14:33 . 2012-01-09 20:22 ——– d—–w- C:\SRN Micro
2011-12-31 20:12 . 2009-05-18 19:17 26600 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-12-31 20:12 . 2008-04-17 18:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2011-12-31 20:12 . 2011-12-31 20:12 ——– dc—-w- c:\windows\system32\DRVSTORE
2011-12-31 20:09 . 2011-12-31 20:09 ——– d—–w- c:\program files\iPod
2011-12-31 20:08 . 2011-12-31 20:12 ——– d—–w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2011-12-31 20:08 . 2011-12-31 20:12 ——– d—–w- c:\program files\iTunes
2011-12-31 18:40 . 2011-12-31 18:40 ——– d—–w- c:\program files\Bonjour
2011-12-19 03:43 . 2011-12-19 03:44 ——– d–h–w- c:\users\Wenlolz\AppData\Roaming\GetRightToGo
2011-12-16 00:37 . 2011-10-15 05:48 534528 —-a-w- c:\windows\system32\EncDec.dll
2011-12-16 00:37 . 2011-10-26 04:25 38912 —-a-w- c:\windows\system32\csrsrv.dll
2011-12-16 00:37 . 2011-10-26 04:42 3901808 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-12-16 00:37 . 2011-10-26 04:42 3957104 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-13 18:45 . 2011-12-13 18:46 ——– d–h–w- c:\users\Wenlolz\AppData\Roaming\CyberLink
2011-12-13 18:44 . 2011-12-13 18:46 ——– d–h–w- c:\users\Public\CyberLink
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-21 10:47 . 2011-06-07 03:13 6823496 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-10-11 22:06 . 2011-10-11 22:07 703824 ——w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E08E603A-4B46-422D-AC3F-B37DAEEDFFC3}\gapaengine.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]
@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"
[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]
2010-09-23 04:53 754176 —-a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]
@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"
[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]
2010-09-23 04:53 754176 —-a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]
@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"
[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]
2010-09-23 04:53 754176 —-a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]
@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"
[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]
2010-09-23 04:53 754176 —-a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]
@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"
[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]
2010-09-23 04:53 754176 —-a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —ha-w- c:\users\Wenlolz\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —ha-w- c:\users\Wenlolz\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —ha-w- c:\users\Wenlolz\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZumoDrive"="c:\program files\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk" [2011-02-19 2038]
"FileHunter Check for updates"="c:\users\Wenlolz\AppData\Roaming\FileHunter\update.exe" [2011-07-17 810096]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-23 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-23 150552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-09-17 1897768]
"IAStorIcon"="c:\program files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-06-08 284696]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2010-06-17 237568]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-08-03 495708]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]
"HP Quick Launch"="c:\program files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-08-24 584760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-07-21 8192]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"SoloScan"="c:\srnmic~1\SOLOSCAN.EXE" [2011-11-30 348160]
"SoloSentry"="c:\srnmic~1\SOLOSENT.EXE" [2011-09-12 77824]
"SoloSchedule"="c:\srnmic~1\SOLOCFG.EXE" [2011-09-12 303104]
"SoloSysCheck"="c:\srnmic~1\SYSCHECK.COM" [2011-12-26 237568]
.
c:\users\Wenlolz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Wenlolz\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Media Suite.lnk - c:\program files\Hewlett-Packard\HP Media Suite\Home\ArcStart.exe [2010-4-1 91648]
Snapfish PictureMover.lnk - c:\program files\PictureMover\Bin\PictureMover.exe [2010-9-28 1040952]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
R1 MpKsl0031121b;MpKsl0031121b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{111655F9-B4FD-48F8-A2C3-63A33EB2A747}\MpKsl0031121b.sys [x]
R1 MpKsl0185b1bb;MpKsl0185b1bb;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{26B0377A-70B5-4445-8195-D2E915128C96}\MpKsl0185b1bb.sys [x]
R1 MpKsl01bdcfd7;MpKsl01bdcfd7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2B6A34BB-2237-4884-915F-C68843FB2FBE}\MpKsl01bdcfd7.sys [x]
R1 MpKsl023963a8;MpKsl023963a8;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{111655F9-B4FD-48F8-A2C3-63A33EB2A747}\MpKsl023963a8.sys [x]
R1 MpKsl029007cb;MpKsl029007cb;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8BA21FA7-0563-4431-981A-6C036A4B56C7}\MpKsl029007cb.sys [x]
R1 MpKsl02d56483;MpKsl02d56483;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9DB062DF-1605-457A-A789-663A73AE53E4}\MpKsl02d56483.sys [x]
R1 MpKsl034b20b9;MpKsl034b20b9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B1A2D534-E7A3-4DBB-8B4B-412CA32076D2}\MpKsl034b20b9.sys [x]
R1 MpKsl04633048;MpKsl04633048;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{121452B2-0319-4B87-BBE3-8E979A422307}\MpKsl04633048.sys [x]
R1 MpKsl0476fde4;MpKsl0476fde4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0B0700FF-C1DA-44E3-96F3-3D94E45BD49F}\MpKsl0476fde4.sys [x]
R1 MpKsl051ee77e;MpKsl051ee77e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9DB062DF-1605-457A-A789-663A73AE53E4}\MpKsl051ee77e.sys [x]
R1 MpKsl066ef587;MpKsl066ef587;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4A63E7D4-20BC-44FA-9CB9-7CC89721724E}\MpKsl066ef587.sys [x]
R1 MpKsl072e127b;MpKsl072e127b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4DC627B8-1BA6-475E-B340-4768BB1E6D0A}\MpKsl072e127b.sys [x]
R1 MpKsl07cebf15;MpKsl07cebf15;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7941E70B-327A-42DC-8C1C-B014CC70C17B}\MpKsl07cebf15.sys [x]
R1 MpKsl0866f879;MpKsl0866f879;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9DB062DF-1605-457A-A789-663A73AE53E4}\MpKsl0866f879.sys [x]
R1 MpKsl08e5092e;MpKsl08e5092e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E1D38A61-0D5D-4405-8FB3-8C52800FC7DB}\MpKsl08e5092e.sys [x]
R1 MpKsl0925ce65;MpKsl0925ce65;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2B6A34BB-2237-4884-915F-C68843FB2FBE}\MpKsl0925ce65.sys [x]
R1 MpKsl0993e435;MpKsl0993e435;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DDD2EE58-8621-48B2-B808-41001E9EE401}\MpKsl0993e435.sys [x]
R1 MpKsl0ad7e09f;MpKsl0ad7e09f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{68487B88-E8ED-47AA-B47A-B37AF1064C4B}\MpKsl0ad7e09f.sys [x]
R1 MpKsl0b0edb03;MpKsl0b0edb03;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{66CB348B-883A-4E3E-ABFD-50AC964974CB}\MpKsl0b0edb03.sys [x]
R1 MpKsl0b42ca8f;MpKsl0b42ca8f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8BA21FA7-0563-4431-981A-6C036A4B56C7}\MpKsl0b42ca8f.sys [x]
R1 MpKsl0b9dda36;MpKsl0b9dda36;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1E809A9C-2000-46FE-A89C-CC8BE7B1D623}\MpKsl0b9dda36.sys [x]
R1 MpKsl0c855bb6;MpKsl0c855bb6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4EBB084D-AA25-4404-8865-B8E6BFF26A46}\MpKsl0c855bb6.sys [x]
R1 MpKsl0cbfe3f5;MpKsl0cbfe3f5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A77CBB78-3C01-4ABF-8830-136CE6B70C87}\MpKsl0cbfe3f5.sys [x]
R1 MpKsl0ce741d7;MpKsl0ce741d7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2139CBD7-79FE-4527-8F50-B5761FDE6066}\MpKsl0ce741d7.sys [x]
R1 MpKsl0dbf44b2;MpKsl0dbf44b2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5457ECC8-B501-4076-B92D-034432319482}\MpKsl0dbf44b2.sys [x]
R1 MpKsl100ffa55;MpKsl100ffa55;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{01D9BF52-384A-43A3-83F4-E410CC4FC282}\MpKsl100ffa55.sys [x]
R1 MpKsl10132256;MpKsl10132256;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F882BF0A-34BA-4533-AF75-3FDE7DD65E18}\MpKsl10132256.sys [x]
R1 MpKsl107e9e12;MpKsl107e9e12;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CE168D61-6148-4DBC-BBFD-4C097E481D3E}\MpKsl107e9e12.sys [x]
R1 MpKsl10a72dda;MpKsl10a72dda;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E895EB34-CA23-4A52-86A7-75AA10EFBE3D}\MpKsl10a72dda.sys [x]
R1 MpKsl11abe087;MpKsl11abe087;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9A9770FE-6DFD-49B3-BD01-CAA35A7D77EC}\MpKsl11abe087.sys [x]
R1 MpKsl140c0bcb;MpKsl140c0bcb;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D46D8E00-8189-453C-A23F-8CBA8CC9290C}\MpKsl140c0bcb.sys [x]
R1 MpKsl1492c2af;MpKsl1492c2af;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{75768A97-C860-4287-9A22-BC8B593153AA}\MpKsl1492c2af.sys [x]
R1 MpKsl172b1dfb;MpKsl172b1dfb;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FD884002-F3B0-4951-BF18-39C2BAEF5B74}\MpKsl172b1dfb.sys [x]
R1 MpKsl180d1d92;MpKsl180d1d92;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1CE45BDE-6990-4CCF-8C09-72F6027A928D}\MpKsl180d1d92.sys [x]
R1 MpKsl19c46774;MpKsl19c46774;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0538DB4B-6418-41B3-A617-6336E28D8694}\MpKsl19c46774.sys [x]
R1 MpKsl1abab538;MpKsl1abab538;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F413A7A3-023D-4988-9331-0810F281D721}\MpKsl1abab538.sys [x]
R1 MpKsl1ac16993;MpKsl1ac16993;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2E06B307-98F3-47CC-9488-5DB47AB9A67E}\MpKsl1ac16993.sys [x]
R1 MpKsl1d54a7e6;MpKsl1d54a7e6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FDEA2146-2C79-4128-B791-ED4BAA3B3013}\MpKsl1d54a7e6.sys [x]
R1 MpKsl1d891865;MpKsl1d891865;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FD884002-F3B0-4951-BF18-39C2BAEF5B74}\MpKsl1d891865.sys [x]
R1 MpKsl1de51c7f;MpKsl1de51c7f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{121452B2-0319-4B87-BBE3-8E979A422307}\MpKsl1de51c7f.sys [x]
R1 MpKsl1e8b2dca;MpKsl1e8b2dca;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B1A2D534-E7A3-4DBB-8B4B-412CA32076D2}\MpKsl1e8b2dca.sys [x]
R1 MpKsl1ecb323f;MpKsl1ecb323f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8BA21FA7-0563-4431-981A-6C036A4B56C7}\MpKsl1ecb323f.sys [x]
R1 MpKsl1f474758;MpKsl1f474758;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6911F909-484F-436F-958A-B038352198BA}\MpKsl1f474758.sys [x]
R1 MpKsl20baab05;MpKsl20baab05;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6BF42DC2-F696-45EB-909A-5ADE8A5A562C}\MpKsl20baab05.sys [x]
R1 MpKsl22d7726e;MpKsl22d7726e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2B6A34BB-2237-4884-915F-C68843FB2FBE}\MpKsl22d7726e.sys [x]
R1 MpKsl22e5e6cf;MpKsl22e5e6cf;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BBECBFB0-2227-45D7-BFC8-7191AF55CD09}\MpKsl22e5e6cf.sys [x]
R1 MpKsl237a4c53;MpKsl237a4c53;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B21C117E-42FC-430E-A89E-C82EBD3950D3}\MpKsl237a4c53.sys [x]
R1 MpKsl243f38a2;MpKsl243f38a2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4F796577-B874-4AB6-BBA6-E32E40DEA328}\MpKsl243f38a2.sys [x]
R1 MpKsl254f88ad;MpKsl254f88ad;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{803E02AB-1C90-409B-B724-78AD5741A9F2}\MpKsl254f88ad.sys [x]
R1 MpKsl283535b0;MpKsl283535b0;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1B75CE16-1729-4A4C-9A95-4B95B714ABB6}\MpKsl283535b0.sys [x]
R1 MpKsl28687610;MpKsl28687610;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{74430533-C01E-41ED-A911-5C3A188E8C3B}\MpKsl28687610.sys [x]
R1 MpKsl2df8d1ab;MpKsl2df8d1ab;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9DB062DF-1605-457A-A789-663A73AE53E4}\MpKsl2df8d1ab.sys [x]
R1 MpKsl313539f1;MpKsl313539f1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D7D4B1E4-8ACE-4696-B4C3-A5998FD1C51A}\MpKsl313539f1.sys [x]
R1 MpKsl324cdc9e;MpKsl324cdc9e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9D48FBC3-4B81-4C65-B406-A1BDA74E58DD}\MpKsl324cdc9e.sys [x]
R1 MpKsl32fdf582;MpKsl32fdf582;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{91328393-37E0-4F3A-9494-F20358799C8B}\MpKsl32fdf582.sys [x]
R1 MpKsl33ebdcf9;MpKsl33ebdcf9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{393C442C-92EF-4462-94DA-94DCD86AF1A0}\MpKsl33ebdcf9.sys [x]
R1 MpKsl349a24b7;MpKsl349a24b7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9BFF5C01-803B-469F-9249-9E4A38768874}\MpKsl349a24b7.sys [x]
R1 MpKsl35afde42;MpKsl35afde42;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4EBB084D-AA25-4404-8865-B8E6BFF26A46}\MpKsl35afde42.sys [x]
R1 MpKsl36439dcc;MpKsl36439dcc;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BBECBFB0-2227-45D7-BFC8-7191AF55CD09}\MpKsl36439dcc.sys [x]
R1 MpKsl36af816d;MpKsl36af816d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{10E7531F-C989-4637-BB3D-756DB7CDFCC3}\MpKsl36af816d.sys [x]
R1 MpKsl37b30265;MpKsl37b30265;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{111655F9-B4FD-48F8-A2C3-63A33EB2A747}\MpKsl37b30265.sys [x]
R1 MpKsl3b09db12;MpKsl3b09db12;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BED83FB2-91B4-424E-A814-13A6CC529C1E}\MpKsl3b09db12.sys [x]
R1 MpKsl3cb7d508;MpKsl3cb7d508;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BA88FB9C-BC4C-4C86-92BA-6A1F9ADF7249}\MpKsl3cb7d508.sys [x]
R1 MpKsl3d2e7201;MpKsl3d2e7201;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{393C442C-92EF-4462-94DA-94DCD86AF1A0}\MpKsl3d2e7201.sys [x]
R1 MpKsl3d3c8457;MpKsl3d3c8457;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E28E1706-35CA-478D-AE49-27040EE06751}\MpKsl3d3c8457.sys [x]
R1 MpKsl3d623d87;MpKsl3d623d87;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{98FB3D49-6DC2-4532-86CE-F88459A18B2D}\MpKsl3d623d87.sys [x]
R1 MpKsl3d6f376b;MpKsl3d6f376b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{22895E26-AEA6-4B74-847B-366C2E48E582}\MpKsl3d6f376b.sys [x]
R1 MpKsl3ef5d92d;MpKsl3ef5d92d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8FA712EF-8F3B-4DB1-88DB-27DA2DEF408D}\MpKsl3ef5d92d.sys [x]
R1 MpKsl4027771d;MpKsl4027771d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B88EF94B-D0A9-45F0-8265-462C8A76E053}\MpKsl4027771d.sys [x]
R1 MpKsl405eac41;MpKsl405eac41;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{10CC4F61-717D-47C1-8B59-A4589749807D}\MpKsl405eac41.sys [x]
R1 MpKsl4086b3d6;MpKsl4086b3d6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{25DD8835-E610-442C-82EB-B13C7A6400E7}\MpKsl4086b3d6.sys [x]
R1 MpKsl410c7812;MpKsl410c7812;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0C20721C-377B-4C46-8E0E-DB6AAE3DDF9F}\MpKsl410c7812.sys [x]
R1 MpKsl41620d31;MpKsl41620d31;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4DC627B8-1BA6-475E-B340-4768BB1E6D0A}\MpKsl41620d31.sys [x]
R1 MpKsl42a5a0c9;MpKsl42a5a0c9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4BE2EF0E-6866-439D-8333-20CE4B4B4C72}\MpKsl42a5a0c9.sys [x]
R1 MpKsl42a68999;MpKsl42a68999;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{111655F9-B4FD-48F8-A2C3-63A33EB2A747}\MpKsl42a68999.sys [x]
R1 MpKsl431e7cc0;MpKsl431e7cc0;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FC02B426-F3BB-4563-A174-1A72618D24F2}\MpKsl431e7cc0.sys [x]
R1 MpKsl43d498a8;MpKsl43d498a8;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C5DF2F2A-204D-40A4-9E05-BB601D265AC4}\MpKsl43d498a8.sys [x]
R1 MpKsl442f2415;MpKsl442f2415;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9A9770FE-6DFD-49B3-BD01-CAA35A7D77EC}\MpKsl442f2415.sys [x]
R1 MpKsl44b32f04;MpKsl44b32f04;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FD884002-F3B0-4951-BF18-39C2BAEF5B74}\MpKsl44b32f04.sys [x]
R1 MpKsl454922e7;MpKsl454922e7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6911F909-484F-436F-958A-B038352198BA}\MpKsl454922e7.sys [x]
R1 MpKsl457ca732;MpKsl457ca732;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CDE671D0-EFCA-4E49-BAD4-AFA014C2AEDB}\MpKsl457ca732.sys [x]
R1 MpKsl46751b0c;MpKsl46751b0c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{91328393-37E0-4F3A-9494-F20358799C8B}\MpKsl46751b0c.sys [x]
R1 MpKsl46dc69ec;MpKsl46dc69ec;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2E06B307-98F3-47CC-9488-5DB47AB9A67E}\MpKsl46dc69ec.sys [x]
R1 MpKsl47071e8a;MpKsl47071e8a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{038F4341-5B3F-4D6F-92A9-A41F763908AE}\MpKsl47071e8a.sys [x]
R1 MpKsl484f7da4;MpKsl484f7da4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1B75CE16-1729-4A4C-9A95-4B95B714ABB6}\MpKsl484f7da4.sys [x]
R1 MpKsl4a42d035;MpKsl4a42d035;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4A63E7D4-20BC-44FA-9CB9-7CC89721724E}\MpKsl4a42d035.sys [x]
R1 MpKsl4a7c83d2;MpKsl4a7c83d2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CE168D61-6148-4DBC-BBFD-4C097E481D3E}\MpKsl4a7c83d2.sys [x]
R1 MpKsl4af70f2b;MpKsl4af70f2b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{39E8428A-0E89-4821-8533-0A7D99FC44BB}\MpKsl4af70f2b.sys [x]
R1 MpKsl4b5e8fbb;MpKsl4b5e8fbb;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{01D9BF52-384A-43A3-83F4-E410CC4FC282}\MpKsl4b5e8fbb.sys [x]
R1 MpKsl4c4adbff;MpKsl4c4adbff;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{01D9BF52-384A-43A3-83F4-E410CC4FC282}\MpKsl4c4adbff.sys [x]
R1 MpKsl4e32cfd5;MpKsl4e32cfd5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DFD48FDB-12DF-47C7-B091-C3911E300209}\MpKsl4e32cfd5.sys [x]
R1 MpKsl4e9c25c2;MpKsl4e9c25c2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B1A2D534-E7A3-4DBB-8B4B-412CA32076D2}\MpKsl4e9c25c2.sys [x]
R1 MpKsl4f50090b;MpKsl4f50090b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{26B0377A-70B5-4445-8195-D2E915128C96}\MpKsl4f50090b.sys [x]
R1 MpKsl515fe867;MpKsl515fe867;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FD884002-F3B0-4951-BF18-39C2BAEF5B74}\MpKsl515fe867.sys [x]
R1 MpKsl51653863;MpKsl51653863;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{53A626D3-BE29-4326-9F92-291F41F05B51}\MpKsl51653863.sys [x]
R1 MpKsl52845bf5;MpKsl52845bf5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1E809A9C-2000-46FE-A89C-CC8BE7B1D623}\MpKsl52845bf5.sys [x]
R1 MpKsl53070b77;MpKsl53070b77;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{74430533-C01E-41ED-A911-5C3A188E8C3B}\MpKsl53070b77.sys [x]
R1 MpKsl53208710;MpKsl53208710;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{74430533-C01E-41ED-A911-5C3A188E8C3B}\MpKsl53208710.sys [x]
R1 MpKsl533a48b0;MpKsl533a48b0;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2E06B307-98F3-47CC-9488-5DB47AB9A67E}\MpKsl533a48b0.sys [x]
R1 MpKsl53c34d77;MpKsl53c34d77;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CDE671D0-EFCA-4E49-BAD4-AFA014C2AEDB}\MpKsl53c34d77.sys [x]
R1 MpKsl5401da1a;MpKsl5401da1a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1B75CE16-1729-4A4C-9A95-4B95B714ABB6}\MpKsl5401da1a.sys [x]
R1 MpKsl54636418;MpKsl54636418;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{88892A83-B289-445C-B9C5-F8D067D9092E}\MpKsl54636418.sys [x]
R1 MpKsl54d7faf5;MpKsl54d7faf5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5B9B40BC-686B-4A12-BD69-8203BAE36B97}\MpKsl54d7faf5.sys [x]
R1 MpKsl554445af;MpKsl554445af;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2E06B307-98F3-47CC-9488-5DB47AB9A67E}\MpKsl554445af.sys [x]
R1 MpKsl55e1b174;MpKsl55e1b174;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{74430533-C01E-41ED-A911-5C3A188E8C3B}\MpKsl55e1b174.sys [x]
R1 MpKsl56b0ce3c;MpKsl56b0ce3c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CDE671D0-EFCA-4E49-BAD4-AFA014C2AEDB}\MpKsl56b0ce3c.sys [x]
R1 MpKsl56bbcf41;MpKsl56bbcf41;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5B9B40BC-686B-4A12-BD69-8203BAE36B97}\MpKsl56bbcf41.sys [x]
R1 MpKsl5742fb6d;MpKsl5742fb6d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E526DA19-CA31-4AB7-88EA-58AD42777257}\MpKsl5742fb6d.sys [x]
R1 MpKsl576848f4;MpKsl576848f4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C5DF2F2A-204D-40A4-9E05-BB601D265AC4}\MpKsl576848f4.sys [x]
R1 MpKsl57fdcff6;MpKsl57fdcff6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{86B0FBDF-0FF9-46B1-AFF4-F9E0B519B317}\MpKsl57fdcff6.sys [x]
R1 MpKsl582ca589;MpKsl582ca589;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{803E02AB-1C90-409B-B724-78AD5741A9F2}\MpKsl582ca589.sys [x]
R1 MpKsl59d0d152;MpKsl59d0d152;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{99150D57-DFE0-44A5-B676-8664948E741E}\MpKsl59d0d152.sys [x]
R1 MpKsl5b79fff9;MpKsl5b79fff9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9D48FBC3-4B81-4C65-B406-A1BDA74E58DD}\MpKsl5b79fff9.sys [x]
R1 MpKsl5bbdcd5a;MpKsl5bbdcd5a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0B0700FF-C1DA-44E3-96F3-3D94E45BD49F}\MpKsl5bbdcd5a.sys [x]
R1 MpKsl5dc036a9;MpKsl5dc036a9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E82CC4C-DAB5-4935-8B00-4B8236F81DA3}\MpKsl5dc036a9.sys [x]
R1 MpKsl5deae540;MpKsl5deae540;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5457ECC8-B501-4076-B92D-034432319482}\MpKsl5deae540.sys [x]
R1 MpKsl5df28dc8;MpKsl5df28dc8;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BA88FB9C-BC4C-4C86-92BA-6A1F9ADF7249}\MpKsl5df28dc8.sys [x]
R1 MpKsl6056cebc;MpKsl6056cebc;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6143CBA8-AE4C-4C89-BF49-9A8C48562028}\MpKsl6056cebc.sys [x]
R1 MpKsl61c1c647;MpKsl61c1c647;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{457B1345-1E99-4DDA-B89C-B25AE48F9B28}\MpKsl61c1c647.sys [x]
R1 MpKsl62b1aa73;MpKsl62b1aa73;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{111655F9-B4FD-48F8-A2C3-63A33EB2A747}\MpKsl62b1aa73.sys [x]
R1 MpKsl62d55d59;MpKsl62d55d59;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{10E7531F-C989-4637-BB3D-756DB7CDFCC3}\MpKsl62d55d59.sys [x]
R1 MpKsl6332d83d;MpKsl6332d83d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9A9770FE-6DFD-49B3-BD01-CAA35A7D77EC}\MpKsl6332d83d.sys [x]
R1 MpKsl643b73c7;MpKsl643b73c7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{01D9BF52-384A-43A3-83F4-E410CC4FC282}\MpKsl643b73c7.sys [x]
R1 MpKsl655d5abc;MpKsl655d5abc;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{86B0FBDF-0FF9-46B1-AFF4-F9E0B519B317}\MpKsl655d5abc.sys [x]
R1 MpKsl664d49bb;MpKsl664d49bb;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{75768A97-C860-4287-9A22-BC8B593153AA}\MpKsl664d49bb.sys [x]
R1 MpKsl69cfd7ab;MpKsl69cfd7ab;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C5DF2F2A-204D-40A4-9E05-BB601D265AC4}\MpKsl69cfd7ab.sys [x]
R1 MpKsl6a78d17a;MpKsl6a78d17a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9A9770FE-6DFD-49B3-BD01-CAA35A7D77EC}\MpKsl6a78d17a.sys [x]
R1 MpKsl6d9bd6b8;MpKsl6d9bd6b8;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A7438B22-868A-46AF-9923-07636B2F99BC}\MpKsl6d9bd6b8.sys [x]
R1 MpKsl6da81fa6;MpKsl6da81fa6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B17D32C0-C9B0-4B1B-BDF1-601329CECDDD}\MpKsl6da81fa6.sys [x]
R1 MpKsl6dc79e70;MpKsl6dc79e70;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B4A3E22B-3572-4BA5-9D56-B402CB683FB4}\MpKsl6dc79e70.sys [x]
R1 MpKsl6e6628fe;MpKsl6e6628fe;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{267D9EAA-17B9-4C01-940D-7639CF9B3B1C}\MpKsl6e6628fe.sys [x]
R1 MpKsl6e861f68;MpKsl6e861f68;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B17D32C0-C9B0-4B1B-BDF1-601329CECDDD}\MpKsl6e861f68.sys [x]
R1 MpKsl72efad58;MpKsl72efad58;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{43A597F9-FE6E-4478-874A-FF1AFD2664F8}\MpKsl72efad58.sys [x]
R1 MpKsl731d4282;MpKsl731d4282;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{15474323-85D5-4CAA-B2AD-5731A8911CE7}\MpKsl731d4282.sys [x]
R1 MpKsl73e12c28;MpKsl73e12c28;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1B75CE16-1729-4A4C-9A95-4B95B714ABB6}\MpKsl73e12c28.sys [x]
R1 MpKsl76eb7773;MpKsl76eb7773;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{99150D57-DFE0-44A5-B676-8664948E741E}\MpKsl76eb7773.sys [x]
R1 MpKsl77bc2211;MpKsl77bc2211;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B4A3E22B-3572-4BA5-9D56-B402CB683FB4}\MpKsl77bc2211.sys [x]
R1 MpKsl77c2ed45;MpKsl77c2ed45;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{84345D62-6146-4565-80C5-0F34001FB160}\MpKsl77c2ed45.sys [x]
R1 MpKsl77e9cd3a;MpKsl77e9cd3a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{75768A97-C860-4287-9A22-BC8B593153AA}\MpKsl77e9cd3a.sys [x]
R1 MpKsl783d175c;MpKsl783d175c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8FA712EF-8F3B-4DB1-88DB-27DA2DEF408D}\MpKsl783d175c.sys [x]
R1 MpKsl7a1efd97;MpKsl7a1efd97;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7941E70B-327A-42DC-8C1C-B014CC70C17B}\MpKsl7a1efd97.sys [x]
R1 MpKsl7af40752;MpKsl7af40752;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7941E70B-327A-42DC-8C1C-B014CC70C17B}\MpKsl7af40752.sys [x]
R1 MpKsl7b5ca2ca;MpKsl7b5ca2ca;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7D34012E-9582-4549-8242-3909F27F27A7}\MpKsl7b5ca2ca.sys [x]
R1 MpKsl7da8516e;MpKsl7da8516e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2B6A34BB-2237-4884-915F-C68843FB2FBE}\MpKsl7da8516e.sys [x]
R1 MpKsl80f2b49b;MpKsl80f2b49b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{038F4341-5B3F-4D6F-92A9-A41F763908AE}\MpKsl80f2b49b.sys [x]
R1 MpKsl81a5dd32;MpKsl81a5dd32;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1DDF49B8-D08A-428D-BEB8-E3C43037654C}\MpKsl81a5dd32.sys [x]
R1 MpKsl83613c0d;MpKsl83613c0d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D0D0696C-F883-4DAB-9607-1A7715AB676C}\MpKsl83613c0d.sys [x]
R1 MpKsl853ae270;MpKsl853ae270;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A00387A3-466D-463A-9EEE-9CB26815B3CA}\MpKsl853ae270.sys [x]
R1 MpKsl882d470b;MpKsl882d470b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2A6D8031-06CB-4516-AE28-97058104E7D3}\MpKsl882d470b.sys [x]
R1 MpKsl891aae99;MpKsl891aae99;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B1A2D534-E7A3-4DBB-8B4B-412CA32076D2}\MpKsl891aae99.sys [x]
R1 MpKsl8a0cd4ad;MpKsl8a0cd4ad;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{93BFF5CD-0CF4-4665-95DC-10E529E74373}\MpKsl8a0cd4ad.sys [x]
R1 MpKsl8b1a82da;MpKsl8b1a82da;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4F3EBF83-0F82-4D0D-8815-40DB1AE360F1}\MpKsl8b1a82da.sys [x]
R1 MpKsl8e9cd971;MpKsl8e9cd971;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{111655F9-B4FD-48F8-A2C3-63A33EB2A747}\MpKsl8e9cd971.sys [x]
R1 MpKsl932ba34c;MpKsl932ba34c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8BA21FA7-0563-4431-981A-6C036A4B56C7}\MpKsl932ba34c.sys [x]
R1 MpKsl947b31ba;MpKsl947b31ba;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{66CB348B-883A-4E3E-ABFD-50AC964974CB}\MpKsl947b31ba.sys [x]
R1 MpKsl94b54175;MpKsl94b54175;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{77545403-4334-4C65-83B2-10189178293E}\MpKsl94b54175.sys [x]
R1 MpKsl95ab29c4;MpKsl95ab29c4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{489115CE-ED86-47B5-A1C6-FD78794CF2D2}\MpKsl95ab29c4.sys [x]
R1 MpKsl966dac1f;MpKsl966dac1f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EC4F844F-3611-4108-A4C6-A93D7ECEC7EE}\MpKsl966dac1f.sys [x]
R1 MpKsl995dfe91;MpKsl995dfe91;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5457ECC8-B501-4076-B92D-034432319482}\MpKsl995dfe91.sys [x]
R1 MpKsl9996ba48;MpKsl9996ba48;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FD884002-F3B0-4951-BF18-39C2BAEF5B74}\MpKsl9996ba48.sys [x]
R1 MpKsl99e3dbfc;MpKsl99e3dbfc;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3559DA41-63DE-4450-BB27-95558C0691AD}\MpKsl99e3dbfc.sys [x]
R1 MpKsl9ccc7492;MpKsl9ccc7492;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{111655F9-B4FD-48F8-A2C3-63A33EB2A747}\MpKsl9ccc7492.sys [x]
R1 MpKsl9ddc6dbe;MpKsl9ddc6dbe;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BA88FB9C-BC4C-4C86-92BA-6A1F9ADF7249}\MpKsl9ddc6dbe.sys [x]
R1 MpKsla009677b;MpKsla009677b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{22895E26-AEA6-4B74-847B-366C2E48E582}\MpKsla009677b.sys [x]
R1 MpKsla093adc8;MpKsla093adc8;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BA88FB9C-BC4C-4C86-92BA-6A1F9ADF7249}\MpKsla093adc8.sys [x]
R1 MpKsla2e29345;MpKsla2e29345;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{55B9EA6B-EB22-4440-A963-5AE784AA3B7C}\MpKsla2e29345.sys [x]
R1 MpKsla327d9e6;MpKsla327d9e6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DFD48FDB-12DF-47C7-B091-C3911E300209}\MpKsla327d9e6.sys [x]
R1 MpKsla4644466;MpKsla4644466;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{99150D57-DFE0-44A5-B676-8664948E741E}\MpKsla4644466.sys [x]
R1 MpKsla59cad84;MpKsla59cad84;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F413A7A3-023D-4988-9331-0810F281D721}\MpKsla59cad84.sys [x]
R1 MpKsla68de019;MpKsla68de019;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1CE45BDE-6990-4CCF-8C09-72F6027A928D}\MpKsla68de019.sys [x]
R1 MpKsla708dca8;MpKsla708dca8;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1DDF49B8-D08A-428D-BEB8-E3C43037654C}\MpKsla708dca8.sys [x]
R1 MpKsla7560cf9;MpKsla7560cf9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{42F5F131-99F2-4A9B-9596-09ABB56D260D}\MpKsla7560cf9.sys [x]
R1 MpKsla9b87dba;MpKsla9b87dba;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E1D38A61-0D5D-4405-8FB3-8C52800FC7DB}\MpKsla9b87dba.sys [x]
R1 MpKslaac9a839;MpKslaac9a839;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A7438B22-868A-46AF-9923-07636B2F99BC}\MpKslaac9a839.sys [x]
R1 MpKslb16a0056;MpKslb16a0056;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B21C117E-42FC-430E-A89E-C82EBD3950D3}\MpKslb16a0056.sys [x]
R1 MpKslb23274e7;MpKslb23274e7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9D962545-20BE-4170-989A-055CFDF44C46}\MpKslb23274e7.sys [x]
R1 MpKslb2fa2e0d;MpKslb2fa2e0d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DF00736F-114A-4508-9274-8688A88F138E}\MpKslb2fa2e0d.sys [x]
R1 MpKslb3087727;MpKslb3087727;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{26B0377A-70B5-4445-8195-D2E915128C96}\MpKslb3087727.sys [x]
R1 MpKslb4c6d122;MpKslb4c6d122;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{55B9EA6B-EB22-4440-A963-5AE784AA3B7C}\MpKslb4c6d122.sys [x]
R1 MpKslba6d8b3c;MpKslba6d8b3c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BBECBFB0-2227-45D7-BFC8-7191AF55CD09}\MpKslba6d8b3c.sys [x]
R1 MpKslbb885e4b;MpKslbb885e4b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{10029E7F-DEB2-4E2B-AB99-8E5443C63CEB}\MpKslbb885e4b.sys [x]
R1 MpKslbc713abf;MpKslbc713abf;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0E56C6C2-0CB6-493E-8865-529640A4B453}\MpKslbc713abf.sys [x]
R1 MpKslbcf10767;MpKslbcf10767;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4A63E7D4-20BC-44FA-9CB9-7CC89721724E}\MpKslbcf10767.sys [x]
R1 MpKslbdf97c04;MpKslbdf97c04;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{10E7531F-C989-4637-BB3D-756DB7CDFCC3}\MpKslbdf97c04.sys [x]
R1 MpKslbeb542de;MpKslbeb542de;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FC02B426-F3BB-4563-A174-1A72618D24F2}\MpKslbeb542de.sys [x]
R1 MpKslbec85128;MpKslbec85128;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{038F4341-5B3F-4D6F-92A9-A41F763908AE}\MpKslbec85128.sys [x]
R1 MpKslc01143f1;MpKslc01143f1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4F796577-B874-4AB6-BBA6-E32E40DEA328}\MpKslc01143f1.sys [x]
R1 MpKslc05f38bf;MpKslc05f38bf;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{393C442C-92EF-4462-94DA-94DCD86AF1A0}\MpKslc05f38bf.sys [x]
R1 MpKslc082d9e2;MpKslc082d9e2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0E56C6C2-0CB6-493E-8865-529640A4B453}\MpKslc082d9e2.sys [x]
R1 MpKslc11b5fa3;MpKslc11b5fa3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A7438B22-868A-46AF-9923-07636B2F99BC}\MpKslc11b5fa3.sys [x]
R1 MpKslc16febcd;MpKslc16febcd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E9B35516-9764-48E4-B8FD-65EFFCFA2301}\MpKslc16febcd.sys [x]
R1 MpKslc1924523;MpKslc1924523;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EEA7AA48-4788-4C6E-86F5-C7A778125EEA}\MpKslc1924523.sys [x]
R1 MpKslc1a8f1ca;MpKslc1a8f1ca;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{88892A83-B289-445C-B9C5-F8D067D9092E}\MpKslc1a8f1ca.sys [x]
R1 MpKslc337a62f;MpKslc337a62f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FDEA2146-2C79-4128-B791-ED4BAA3B3013}\MpKslc337a62f.sys [x]
R1 MpKslc35b994f;MpKslc35b994f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5C42C6E4-DA8C-44E6-8F65-2CF6B17BD914}\MpKslc35b994f.sys [x]
R1 MpKslc441fd07;MpKslc441fd07;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C344AC0D-39AF-4DD7-9929-12A7AB54F6EC}\MpKslc441fd07.sys [x]
R1 MpKslc6e7af0c;MpKslc6e7af0c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C43DE320-7F2B-4C63-89FA-0925096A8852}\MpKslc6e7af0c.sys [x]
R1 MpKslc7d2dd16;MpKslc7d2dd16;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B17D32C0-C9B0-4B1B-BDF1-601329CECDDD}\MpKslc7d2dd16.sys [x]
R1 MpKslc92b9300;MpKslc92b9300;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5C42C6E4-DA8C-44E6-8F65-2CF6B17BD914}\MpKslc92b9300.sys [x]
R1 MpKslca84c9c8;MpKslca84c9c8;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{25DD8835-E610-442C-82EB-B13C7A6400E7}\MpKslca84c9c8.sys [x]
R1 MpKslca957c75;MpKslca957c75;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CDE671D0-EFCA-4E49-BAD4-AFA014C2AEDB}\MpKslca957c75.sys [x]
R1 MpKsld053f5f3;MpKsld053f5f3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7941E70B-327A-42DC-8C1C-B014CC70C17B}\MpKsld053f5f3.sys [x]
R1 MpKsld055a50c;MpKsld055a50c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{121452B2-0319-4B87-BBE3-8E979A422307}\MpKsld055a50c.sys [x]
R1 MpKsld1b7f58e;MpKsld1b7f58e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C6F7C1CC-3FB3-4D56-967C-FE18D0E167C4}\MpKsld1b7f58e.sys [x]
R1 MpKsld241927f;MpKsld241927f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B38508D6-5C6F-4805-9E5A-1198231F905F}\MpKsld241927f.sys [x]
R1 MpKsld244aee2;MpKsld244aee2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{63A4EBD3-8151-4A29-838B-4A5D2C720839}\MpKsld244aee2.sys [x]
R1 MpKsld27ff031;MpKsld27ff031;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{26B0377A-70B5-4445-8195-D2E915128C96}\MpKsld27ff031.sys [x]
R1 MpKsld40b7b8e;MpKsld40b7b8e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{75FBE207-FEC0-4D92-A1FF-22C9137AE618}\MpKsld40b7b8e.sys [x]
R1 MpKsld4a55ce4;MpKsld4a55ce4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CDE671D0-EFCA-4E49-BAD4-AFA014C2AEDB}\MpKsld4a55ce4.sys [x]
R1 MpKsld5e11c08;MpKsld5e11c08;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9A9770FE-6DFD-49B3-BD01-CAA35A7D77EC}\MpKsld5e11c08.sys [x]
R1 MpKsld636d3e0;MpKsld636d3e0;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9D48FBC3-4B81-4C65-B406-A1BDA74E58DD}\MpKsld636d3e0.sys [x]
R1 MpKsld719f571;MpKsld719f571;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{53A626D3-BE29-4326-9F92-291F41F05B51}\MpKsld719f571.sys [x]
R1 MpKsld73b447d;MpKsld73b447d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C5DF2F2A-204D-40A4-9E05-BB601D265AC4}\MpKsld73b447d.sys [x]
R1 MpKsld7495f8d;MpKsld7495f8d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BBECBFB0-2227-45D7-BFC8-7191AF55CD09}\MpKsld7495f8d.sys [x]
R1 MpKsld8eea14a;MpKsld8eea14a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{93BFF5CD-0CF4-4665-95DC-10E529E74373}\MpKsld8eea14a.sys [x]
R1 MpKsld9c4d173;MpKsld9c4d173;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{88510A8B-D967-4496-9E54-A76A0E8DE215}\MpKsld9c4d173.sys [x]
R1 MpKsldaa7fdc9;MpKsldaa7fdc9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{10029E7F-DEB2-4E2B-AB99-8E5443C63CEB}\MpKsldaa7fdc9.sys [x]
R1 MpKsldb5830c0;MpKsldb5830c0;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{98FB3D49-6DC2-4532-86CE-F88459A18B2D}\MpKsldb5830c0.sys [x]
R1 MpKsldbdb3193;MpKsldbdb3193;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0B0700FF-C1DA-44E3-96F3-3D94E45BD49F}\MpKsldbdb3193.sys [x]
R1 MpKsldc997bf1;MpKsldc997bf1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{489115CE-ED86-47B5-A1C6-FD78794CF2D2}\MpKsldc997bf1.sys [x]
R1 MpKslddc14667;MpKslddc14667;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FDEA2146-2C79-4128-B791-ED4BAA3B3013}\MpKslddc14667.sys [x]
R1 MpKslde8813d3;MpKslde8813d3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{63A4EBD3-8151-4A29-838B-4A5D2C720839}\MpKslde8813d3.sys [x]
R1 MpKsldee1120f;MpKsldee1120f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8BA21FA7-0563-4431-981A-6C036A4B56C7}\MpKsldee1120f.sys [x]
R1 MpKsldf03a971;MpKsldf03a971;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C6F7C1CC-3FB3-4D56-967C-FE18D0E167C4}\MpKsldf03a971.sys [x]
R1 MpKsldf532a84;MpKsldf532a84;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8BA21FA7-0563-4431-981A-6C036A4B56C7}\MpKsldf532a84.sys [x]
R1 MpKsldfc9f6b6;MpKsldfc9f6b6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{86B0FBDF-0FF9-46B1-AFF4-F9E0B519B317}\MpKsldfc9f6b6.sys [x]
R1 MpKsle06a662f;MpKsle06a662f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BBECBFB0-2227-45D7-BFC8-7191AF55CD09}\MpKsle06a662f.sys [x]
R1 MpKsle080a38c;MpKsle080a38c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A00387A3-466D-463A-9EEE-9CB26815B3CA}\MpKsle080a38c.sys [x]
R1 MpKsle11bd1aa;MpKsle11bd1aa;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{455331AE-A5C0-4533-A20E-87DE15411178}\MpKsle11bd1aa.sys [x]
R1 MpKsle46680f9;MpKsle46680f9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8BA21FA7-0563-4431-981A-6C036A4B56C7}\MpKsle46680f9.sys [x]
R1 MpKsle49b58b5;MpKsle49b58b5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{66CB348B-883A-4E3E-ABFD-50AC964974CB}\MpKsle49b58b5.sys [x]
R1 MpKsle541aab5;MpKsle541aab5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BC94423E-C2C9-4B24-AC61-F1C59D7C6E84}\MpKsle541aab5.sys [x]
R1 MpKsle69e8fa0;MpKsle69e8fa0;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E526DA19-CA31-4AB7-88EA-58AD42777257}\MpKsle69e8fa0.sys [x]
R1 MpKsle70249c7;MpKsle70249c7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D91DFB43-A037-42AD-8248-0480A62022D2}\MpKsle70249c7.sys [x]
R1 MpKsle883510b;MpKsle883510b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3CE02021-3A2D-4063-8C7C-A16BB2E9B22C}\MpKsle883510b.sys [x]
R1 MpKsle8c0504c;MpKsle8c0504c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FBEE7A3D-CE6B-4189-AABA-684A77A52E9D}\MpKsle8c0504c.sys [x]
R1 MpKsle91a07f7;MpKsle91a07f7;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6BF42DC2-F696-45EB-909A-5ADE8A5A562C}\MpKsle91a07f7.sys [x]
R1 MpKsleb115f2b;MpKsleb115f2b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D46D8E00-8189-453C-A23F-8CBA8CC9290C}\MpKsleb115f2b.sys [x]
R1 MpKsleb1c668f;MpKsleb1c668f;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{86B0FBDF-0FF9-46B1-AFF4-F9E0B519B317}\MpKsleb1c668f.sys [x]
R1 MpKslebaccc3c;MpKslebaccc3c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4F796577-B874-4AB6-BBA6-E32E40DEA328}\MpKslebaccc3c.sys [x]
R1 MpKslec10e6c9;MpKslec10e6c9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A8825C6C-C043-4E7B-A28A-1A823402BF6B}\MpKslec10e6c9.sys [x]
R1 MpKslec5350e0;MpKslec5350e0;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DFD48FDB-12DF-47C7-B091-C3911E300209}\MpKslec5350e0.sys [x]
R1 MpKslec95e282;MpKslec95e282;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0C20721C-377B-4C46-8E0E-DB6AAE3DDF9F}\MpKslec95e282.sys [x]
R1 MpKsled135f2e;MpKsled135f2e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FC02B426-F3BB-4563-A174-1A72618D24F2}\MpKsled135f2e.sys [x]
R1 MpKslee56b6de;MpKslee56b6de;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BB593869-0FDA-41D7-B783-B48FE92C03C0}\MpKslee56b6de.sys [x]
R1 MpKslee7cd19b;MpKslee7cd19b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C6F7C1CC-3FB3-4D56-967C-FE18D0E167C4}\MpKslee7cd19b.sys [x]
R1 MpKslf21ce46b;MpKslf21ce46b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B4A3E22B-3572-4BA5-9D56-B402CB683FB4}\MpKslf21ce46b.sys [x]
R1 MpKslf3204d37;MpKslf3204d37;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{10029E7F-DEB2-4E2B-AB99-8E5443C63CEB}\MpKslf3204d37.sys [x]
R1 MpKslf331d64c;MpKslf331d64c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{393C442C-92EF-4462-94DA-94DCD86AF1A0}\MpKslf331d64c.sys [x]
R1 MpKslf37b2c10;MpKslf37b2c10;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D46D8E00-8189-453C-A23F-8CBA8CC9290C}\MpKslf37b2c10.sys [x]
R1 MpKslf3a60bbd;MpKslf3a60bbd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{10CC4F61-717D-47C1-8B59-A4589749807D}\MpKslf3a60bbd.sys [x]
R1 MpKslf99ef8d0;MpKslf99ef8d0;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6BF42DC2-F696-45EB-909A-5ADE8A5A562C}\MpKslf99ef8d0.sys [x]
R1 MpKslfa63989b;MpKslfa63989b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CDE671D0-EFCA-4E49-BAD4-AFA014C2AEDB}\MpKslfa63989b.sys [x]
R1 MpKslfaa66c9b;MpKslfaa66c9b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E895EB34-CA23-4A52-86A7-75AA10EFBE3D}\MpKslfaa66c9b.sys [x]
R1 MpKslfb54ebbe;MpKslfb54ebbe;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3CE02021-3A2D-4063-8C7C-A16BB2E9B22C}\MpKslfb54ebbe.sys [x]
R1 MpKslfe560624;MpKslfe560624;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E82CC4C-DAB5-4935-8B00-4B8236F81DA3}\MpKslfe560624.sys [x]
R1 MpKslfe72dfbf;MpKslfe72dfbf;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{26B0377A-70B5-4445-8195-D2E915128C96}\MpKslfe72dfbf.sys [x]
R1 MpKslfecb6e93;MpKslfecb6e93;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{994325A0-952F-459E-8DAF-D7448835A5E4}\MpKslfecb6e93.sys [x]
R1 MpKslff9cbc3e;MpKslff9cbc3e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4F796577-B874-4AB6-BBA6-E32E40DEA328}\MpKslff9cbc3e.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1206000.01D\SYMDS.SYS [2011-01-27 340088]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1206000.01D\SYMEFA.SYS [2011-03-15 744568]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110518.001\BHDrvx86.sys [2011-04-15 802936]
S1 DVMIO;DeviceVM IO Service;c:\windows\system32\DRIVERS\dvmio.sys [2009-11-11 18136]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110603.003\IDSvix86.sys [2011-03-14 353912]
S1 MpKslfd5b7a7a;MpKslfd5b7a7a;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{19A487E7-BBCE-460B-9E22-CD163B369CFB}\MpKslfd5b7a7a.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1206000.01D\Ironx86.SYS [2011-01-27 136312]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NIS\1206000.01D\SYMNETS.SYS [2011-07-08 299640]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\aestsrv.exe [2010-08-03 81920]
S2 DvmMDES;DeviceVM Meta Data Export Service;c:\swsetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe [2010-09-29 338208]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-06-21 85560]
S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-07-21 103992]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-08-06 210488]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-28 94264]
S2 HPWMISVC;HPWMISVC;c:\program files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-08-24 26680]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-06-08 13336]
S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe [2011-04-17 130008]
S2 RoxioNow Service;RoxioNow Service;c:\program files\Roxio\RoxioNow Player\RNowSvc.exe [2010-09-11 399344]
S3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2010-06-17 27136]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2010-06-24 275048]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4FB2407C-C8E4-BBC8-BB1C-FCCB2EF5914B}]
2010-09-03 19:14 715840 —-a-w- c:\program files\Hewlett-Packard\HP Media Suite\Home\HPMediaSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{4FB2AA7C-C8E4-BBC8-BB1C-FAAB2EF5914B}]
2009-07-14 01:14 141824 —-a-w- c:\windows\System32\wscript.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1412795182-3067718058-3615629429-1000Core.job
- c:\users\Wenlolz\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-06 04:14]
.
2012-01-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1412795182-3067718058-3615629429-1000UA.job
- c:\users\Wenlolz\AppData\Local\Google\Update\GoogleUpdate.exe [2011-04-06 04:14]
.
2012-01-05 c:\windows\Tasks\HPCeeScheduleForWenlolz.job
- c:\program files\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = *.local
IE: E&xportar; a Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = [removed] [removed]
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226} - c:\program files\InstallShield Installation Information\{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.6.0.29\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-01-09 15:50:34
ComboFix-quarantined-files.txt 2012-01-09 21:50
.
Pre-Run: 146,922,254,336 bytes free
Post-Run: 147,089,690,624 bytes free
.
- - End Of File - - 412EA7D220E58143F523A343614FEDFF
Post #6
Hi Wendy,

Things are looking better but we have a saying THAT THE ABSENCE OF SYMPTOMS DOES NOT NECESSARILY GUARANTEE A CLEAN COMPUTER.


So lets run a few more scans and make sure its all gone.

Please download Malwarebytes from Here or Here

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the report please







ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]
Please make sure you include the following items in your next post:
The log that was produced after running ESET Online Scanner.
Post #7
OK… HERE IT GOES

MALWAREBYTES ANTI-MALWARE

Malwarebytes Anti-Malware (Trial) 1.60.0.1800
www.malwarebytes.org

Database version: v2012.01.10.02

Windows 7 x86 NTFS
Internet Explorer 8.0.7600.16385
Wenlolz :: WENLOLZ-HP [administrator]

Protection: Enabled

1/9/2012 10:06:59 PM
mbam-log-2012-01-09 (22-06-59).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 177223
Time elapsed: 9 minute(s), 54 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileHunter (PUP.FileHunter) -> No action taken.

Registry Values Detected: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|FileHunter Check for updates (PUP.FileHunter) -> Data: C:\Users\Wenlolz\AppData\Roaming\FileHunter\update.exe -> No action taken.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 6
C:\Users\Wenlolz\AppData\Roaming\FileHunter (PUP.FileHunter) -> No action taken.
C:\Users\Wenlolz\AppData\Roaming\FileHunter\downloads (PUP.FileHunter) -> No action taken.
C:\Users\Wenlolz\AppData\Roaming\FileHunter\downloads\Digicel FlipBook Pro HD 6.7 (Portable){H33T}{raththaran} (PUP.FileHunter) -> No action taken.
C:\Users\Wenlolz\AppData\Roaming\FileHunter\downloads\Digicel FlipBook Pro HD 6.7 (Portable){H33T}{raththaran}\FlipBook 6 (PUP.FileHunter) -> No action taken.
C:\Users\Wenlolz\AppData\Roaming\FileHunter\downloads\Digicel FlipBook ProHD 6.74 Software + Patch (PUP.FileHunter) -> No action taken.
C:\Users\Wenlolz\AppData\Roaming\FileHunter\metafiles (PUP.FileHunter) -> No action taken.

Files Detected: 10
C:\Users\Wenlolz\AppData\Roaming\FileHunter\pumpa.state (PUP.FileHunter) -> No action taken.
C:\Users\Wenlolz\AppData\Roaming\FileHunter\FileHunter.exe (PUP.FileHunter) -> No action taken.
C:\Users\Wenlolz\AppData\Roaming\FileHunter\pumpa.exe (PUP.FileHunter) -> No action taken.
C:\Users\Wenlolz\AppData\Roaming\FileHunter\uninstall.exe (PUP.FileHunter) -> No action taken.
C:\Users\Wenlolz\AppData\Roaming\FileHunter\update.exe (PUP.FileHunter) -> No action taken.
C:\Users\Wenlolz\AppData\Roaming\FileHunter\version (PUP.FileHunter) -> No action taken.
C:\Users\Wenlolz\AppData\Roaming\FileHunter\downloads\Digicel FlipBook ProHD 6.74 Software + Patch\Digicel FlipBook ProHD 6.74 Software + Patch.rar (PUP.FileHunter) -> No action taken.
C:\Users\Wenlolz\AppData\Roaming\FileHunter\downloads\Digicel FlipBook ProHD 6.74 Software + Patch\Torrent downloaded from AhaShare.com.txt (PUP.FileHunter) -> No action taken.
C:\Users\Wenlolz\AppData\Roaming\FileHunter\downloads\Digicel FlipBook ProHD 6.74 Software + Patch\Torrent downloaded from Demonoid.com.txt (PUP.FileHunter) -> No action taken.
C:\Users\Wenlolz\AppData\Roaming\FileHunter\downloads\Digicel FlipBook ProHD 6.74 Software + Patch\tracked_by_h33t_com.txt (PUP.FileHunter) -> No action taken.

(end)



the ESET ONLINE SCANNER is still scanning.. I'll include it in my next post
Post #8
Wendy,

You had Malwarebytes set to TAKE NO ACTION, you need to run it again and this time REMOVE WHATEVER IT FINDS. by making sure that all is checked and then click on Remove Selected.


After your finished with ESET, run this quick scan, it wont take long

Download CKScanner
  • Important - Save it to your desktop.
  • Doubleclick CKScanner.exe and click Search For Files.
  • After a very short time, when the cursor hourglass disappears, click Save List To File.
  • A message box will verify the file saved.
  • Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.
Post #9
here's the last report, that ESET did. C:\Users\Wenlolz\AppData\Roaming\FileHunter\FileHunter.exe Win32/Adware.WinPump.T application C:\Users\Wenlolz\AppData\Roaming\FileHunter\update.exe Win32/Adware.WinPump.T application
Post #13 last edited
Here's the CKScanner Report

CKScanner - Additional Security Risks - These are not necessarily bad
c:\users\wenlolz\appdata\local\crashdumps\keygen.exe.3168.dmp
c:\users\wenlolz\appdata\local\microsoft\windows\wer\reportarchive\appcrash_keygen.exe_82dbc9718ea032a24d86878bcfc449716bae34a6_0ec1c0d0\report.wer
scanner sequence 3.AA.11.OAAPBG
—– EOF —–
Post #14
Wendy,

Let me explain exactly how you infected your computer. You used FileHunter to download and install software illegally on your system 100% of illegal software that is cracked or keygens are infected, do the math, why would a site let you download and install expensive programs for free. None of the malware removal forums including us to not support the use of illegal software except for there removal, if I was to continue helping you it could be construed in the eyes of the law as aiding and abetting a crime ( and this is a crime , basically its stolen software )

It looks like Malwarebytes may have removed it, I am referring to Digicel FlipBook Pro HD 6.7 I would like to make sure that its completely removed, if you do not agree then this thread will be closed and no further help will be offered .

If you agree to further removal of Digicel FlipBook Pro HD 6.7, then run this scanner and post the log please

OTL by OldTimer
  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Click the "Scan All Users" checkbox.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
Post #15
Well Digicel Flipbook,,, I don't use it anymore, because it was illegal, and other thing, I can't use it on my netbook… but the keygen was left on my computer… I will download what you told me to download, thank you!! :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI