Spyware / Malware / Virus Removal

Browser hijacker has my computer Please help! [Solved]

46 min read

Looking for the outcome? Ask AI

patndoris

Post #46February 24, 2012, 12:08 AM UTC

My apologies, I thought I had corrected that in my instructions but I must have missed that spot

It needs to read: frst64.exe That is my fault. I am so very sorry I forgot the 64 in that instruction.

Susan09

Post #47February 24, 2012, 12:22 AM UTC

Only check the one box right? It is doing its thing now:)

Susan09

Post #48February 24, 2012, 12:25 AM UTC

Here it is:) Scan result of Farbar Recovery Scan Tool Version: 23-02-2012 01 Ran by [removed] at 2012-02-23 19:21:35 Running from F:\ Windows 7 Professional (X64) OS Language: English(US) The current controlset is ControlSet001 ========================== Registry ========================== HKLM-x32\…\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2011-11-12] (Apple Inc.) HKLM-x32\…\Run: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup [1497352 2011-02-21] (Intuit Inc. All rights reserved.) HKLM-x32\…\Run: [iolo Startup] "C:\Program Files (x86)\iolo\Common\Lib\ioloLManager.exe" [606904 2012-01-06] (iolo technologies, LLC) HKLM-x32\…\Run: [CenturyLinkTouchPointAgent] "C:\Program Files (x86)\CenturyLink\Desktop\CenturyLinkTouchPointAgent.exe" /autostart [46208 2011-12-02] (CenturyLink Inc) HKLM-x32\…\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [1675160 2011-11-22] (McAfee, Inc.) HKU\Default\…\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun [1475584 2010-11-20] (Microsoft Corporation) HKU\Default User\…\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun [1475584 2010-11-20] (Microsoft Corporation) HKU\Sue\…\Run: [1Y5U7AYUUGXZZU3VKSDKQNNZYV] C:\Fonts\6DFBBA775DC.exe /q [346624 2011-11-16] (Belkin Corporation) HKLM\…\RunOnce: [*Restore] C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation) HKLM\…\Winlogon: [Userinit] C:\Windows\system32\userinit.exe, [30720 2010-11-20] (Microsoft Corporation) HKLM-x32\…\Winlogon: [Userinit] C:\Windows\system32\userinit.exe, [26624 2010-11-20] (Microsoft Corporation) HKLM\…\Winlogon: [Shell] Explorer.exe [2871808 2011-02-24] (Microsoft Corporation) HKLM-x32\…\Winlogon: [Shell] Explorer.exe [2616320 2011-02-24] (Microsoft Corporation) Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\615\G2AWinLogon_x64.dll (Citrix Online, a division of Citrix Systems, Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Lsa: [Authentication Packages] msv1_0 Lsa: [Notification Packages] scecli ==================== Services ==================== 2 0007311329442634mcinstcleanup; C:\Users\Sue\AppData\Local\Temp\000731~1.EXE C:\PROGRA~2\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [1650 2012-02-16] () 3 Adobe Version Cue CS4; "C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe" -win32service [284016 2008-08-15] (Adobe Systems Incorporated) 3 AeLookupSvc; C:\Windows\System32\aelupsvc.dll [72192 2009-07-13] (Microsoft Corporation) 3 ALG; C:\Windows\System32\alg.exe [79360 2009-07-13] (Microsoft Corporation) 2 AMD External Events Utility; C:\Windows\System32\atiesrxx.exe [203264 2009-08-17] (AMD) 3 AppIDSvc; C:\Windows\System32\appidsvc.dll [32256 2009-07-13] (Microsoft Corporation) 3 Appinfo; C:\Windows\System32\appinfo.dll [70656 2010-11-20] (Microsoft Corporation) 2 Apple Mobile Device; "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe" [55144 2011-10-24] (Apple Inc.) 3 AppMgmt; C:\Windows\System32\appmgmts.dll [193536 2009-07-13] (Microsoft Corporation) 2 AudioEndpointBuilder; C:\Windows\System32\Audiosrv.dll [679424 2010-11-20] (Microsoft Corporation) 2 AudioSrv; C:\Windows\System32\Audiosrv.dll [679424 2010-11-20] (Microsoft Corporation) 3 AxInstSV; C:\Windows\System32\AxInstSV.dll [114688 2010-11-20] (Microsoft Corporation) 3 BDESVC; C:\Windows\System32\bdesvc.dll [100864 2009-07-13] (Microsoft Corporation) 2 BFE; C:\Windows\System32\bfe.dll [705024 2010-11-20] (Microsoft Corporation) 2 BITS; C:\Windows\System32\qmgr.dll [849920 2010-11-20] (Microsoft Corporation) 2 Bonjour Service; "C:\Program Files\Bonjour\mDNSResponder.exe" [462184 2011-08-30] (Apple Inc.) 3 Browser; C:\Windows\System32\browser.dll [136192 2010-11-20] (Microsoft Corporation) 3 bthserv; C:\Windows\System32\bthserv.dll [83968 2009-07-13] (Microsoft Corporation) 3 CertPropSvc; C:\Windows\System32\certprop.dll [80384 2010-11-20] (Microsoft Corporation) 4 clr_optimization_v2.0.50727_32; C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [66384 2009-06-10] (Microsoft Corporation) 4 clr_optimization_v2.0.50727_64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [89920 2009-06-10] (Microsoft Corporation) 2 clr_optimization_v4.0.30319_32; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [130384 2010-03-18] (Microsoft Corporation) 2 clr_optimization_v4.0.30319_64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [138576 2010-03-18] (Microsoft Corporation) 3 COMSysApp; C:\Windows\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} [9728 2009-07-13] (Microsoft Corporation) 2 CryptSvc; C:\Windows\System32\cryptsvc.dll [177152 2010-11-20] (Microsoft Corporation) 2 CscService; C:\Windows\System32\cscsvc.dll [692224 2010-11-20] (Microsoft Corporation) 2 DcomLaunch; C:\Windows\System32\rpcss.dll [512000 2010-11-20] (Microsoft Corporation) 3 defragsvc; C:\Windows\System32\defragsvc.dll [291328 2009-07-13] (Microsoft Corporation) 2 Dhcp; C:\Windows\System32\dhcpcore.dll [317952 2010-11-20] (Microsoft Corporation) 2 Dnscache; C:\Windows\System32\dnsrslvr.dll [183296 2011-03-02] (Microsoft Corporation) 3 dot3svc; C:\Windows\System32\dot3svc.dll [252416 2010-11-20] (Microsoft Corporation) 2 DPS; C:\Windows\System32\dps.dll [162816 2010-11-20] (Microsoft Corporation) 3 EapHost; C:\Windows\System32\eapsvc.dll [111104 2009-07-13] (Microsoft Corporation) 2 EFS; C:\Windows\System32\lsass.exe [31232 2011-11-16] (Microsoft Corporation) 3 ehRecvr; C:\Windows\ehome\ehRecvr.exe [696832 2010-11-20] (Microsoft Corporation) 3 ehSched; C:\Windows\ehome\ehsched.exe [127488 2009-07-13] (Microsoft Corporation) 2 eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [27136 2009-07-13] (Microsoft Corporation) 2 EventSystem; C:\Windows\System32\es.dll [402944 2009-07-13] (Microsoft Corporation) 3 Fax; C:\Windows\System32\fxssvc.exe [689152 2010-11-20] (Microsoft Corporation) 3 fdPHost; C:\Windows\System32\fdPHost.dll [16384 2009-07-13] (Microsoft Corporation) 3 FDResPub; C:\Windows\System32\fdrespub.dll [34816 2009-07-13] (Microsoft Corporation) 3 FLEXnet Licensing Service; "C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe" [655624 2011-07-16] (Acresso Software Inc.) 3 FLEXnet Licensing Service 64; "C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe" [1038088 2011-07-16] (Acresso Software Inc.) 2 FontCache; C:\Windows\System32\FntCache.dll [1139200 2011-02-19] (Microsoft Corporation) 3 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-04] (Microsoft Corporation) 3 GoToAssist; "C:\Program Files (x86)\Citrix\GoToAssist\615\g2aservice.exe" Start=service [13160 2011-10-02] (Citrix Online, a division of Citrix Systems, Inc.) 2 gpsvc; C:\Windows\System32\gpsvc.dll [777728 2010-11-20] (Microsoft Corporation) 3 hidserv; C:\Windows\System32\hidserv.dll [38912 2009-07-13] (Microsoft Corporation) 3 hkmsvc; C:\Windows\System32\kmsvc.dll [90624 2010-11-20] (Microsoft Corporation) 3 HomeGroupListener; C:\Windows\System32\ListSvc.dll [232448 2010-11-20] (Microsoft Corporation) 3 HomeGroupProvider; C:\Windows\System32\provsvc.dll [187904 2010-11-20] (Microsoft Corporation) 3 idsvc; "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe" [856400 2010-11-04] (Microsoft Corporation) 2 IKEEXT; C:\Windows\System32\ikeext.dll [853504 2010-11-20] (Microsoft Corporation) 2 ioloSystemService; "C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe" [722616 2012-01-06] (iolo technologies, LLC) 3 IPBusEnum; C:\Windows\System32\ipbusenum.dll [101888 2009-07-13] (Microsoft Corporation) 2 iphlpsvc; C:\Windows\System32\iphlpsvc.dll [569344 2010-11-20] (Microsoft Corporation) 3 iPod Service; "C:\Program Files\iPod\bin\iPodService.exe" [934760 2011-11-12] (Apple Inc.) 3 KeyIso; C:\Windows\System32\lsass.exe [31232 2011-11-16] (Microsoft Corporation) 3 KtmRm; C:\Windows\System32\msdtckrm.dll [368640 2009-07-13] (Microsoft Corporation) 2 LanmanServer; C:\Windows\System32\srvsvc.dll [236032 2010-11-20] (Microsoft Corporation) 2 LanmanWorkstation; C:\Windows\System32\wkssvc.dll [118784 2010-11-20] (Microsoft Corporation) 3 lltdsvc; C:\Windows\System32\lltdsvc.dll [300032 2009-07-13] (Microsoft Corporation) 2 lmhosts; C:\Windows\System32\lmhsvc.dll [23552 2009-07-13] (Microsoft Corporation) 2 McAfee SiteAdvisor Service; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.) 2 McMPFSvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.) 2 mcmscsvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.) 2 McNaiAnn; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.) 2 McNASvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.) 3 McODS; "C:\Program Files\McAfee\VirusScan\mcods.exe" [502032 2011-10-18] (McAfee, Inc.) 2 McProxy; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.) 2 McShield; "C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe" [199272 2011-12-06] (McAfee, Inc.) 4 Mcx2Svc; C:\Windows\System32\Mcx2Svc.dll [84992 2010-11-20] (Microsoft Corporation) 2 mfefire; "C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe" [208536 2011-12-06] (McAfee, Inc.) 2 mfevtp; "C:\Windows\system32\mfevtps.exe" [161168 2011-11-18] (McAfee, Inc.) 2 MMCSS; C:\Windows\System32\mmcss.dll [67584 2009-07-13] (Microsoft Corporation) 2 MpsSvc; C:\Windows\System32\mpssvc.dll [828416 2010-11-20] (Microsoft Corporation) 3 MSDTC; C:\Windows\System32\msdtc.exe [141824 2009-07-13] (Microsoft Corporation) 3 MSiSCSI; C:\Windows\System32\iscsiexe.dll [156672 2009-07-13] (Microsoft Corporation) 3 msiserver; C:\Windows\System32\msiexec.exe /V [128000 2010-11-20] (Microsoft Corporation) 2 MSK80Service; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [249936 2011-01-27] (McAfee, Inc.) 3 napagent; C:\Windows\System32\qagentRT.dll [476160 2010-11-20] (Microsoft Corporation) 3 Netlogon; C:\Windows\System32\lsass.exe [31232 2011-11-16] (Microsoft Corporation) 3 Netman; C:\Windows\System32\netman.dll [360448 2009-07-13] (Microsoft Corporation) 3 netprofm; C:\Windows\System32\netprofm.dll [459776 2009-07-13] (Microsoft Corporation) 4 NetTcpPortSharing; "C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe" [116560 2009-06-10] (Microsoft Corporation) 2 NlaSvc; C:\Windows\System32\nlasvc.dll [303616 2010-11-20] (Microsoft Corporation) 2 nsi; C:\Windows\System32\nsisvc.dll [25600 2009-07-13] (Microsoft Corporation) 3 odserv; "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" [440696 2011-07-20] (Microsoft Corporation) 3 ose; "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE" [145184 2006-10-26] (Microsoft Corporation) 3 p2pimsvc; C:\Windows\System32\pnrpsvc.dll [327168 2009-07-13] (Microsoft Corporation) 3 p2psvc; C:\Windows\System32\p2psvc.dll [438784 2009-07-13] (Microsoft Corporation) 2 PcaSvc; C:\Windows\System32\pcasvc.dll [186368 2009-07-13] (Microsoft Corporation) 3 PeerDistSvc; C:\Windows\System32\peerdistsvc.dll [1361920 2009-07-13] (Microsoft Corporation) 3 PerfHost; C:\Windows\SysWow64\perfhost.exe [20992 2009-07-13] (Microsoft Corporation) 3 pla; C:\Windows\System32\pla.dll [1389056 2010-11-20] (Microsoft Corporation) 2 PlugPlay; C:\Windows\System32\umpnpmgr.dll [404480 2011-05-24] (Microsoft Corporation) 3 PNRPAutoReg; C:\Windows\System32\pnrpauto.dll [25088 2009-07-13] (Microsoft Corporation) 3 PNRPsvc; C:\Windows\System32\pnrpsvc.dll [327168 2009-07-13] (Microsoft Corporation) 3 PolicyAgent; C:\Windows\System32\ipsecsvc.dll [501248 2010-11-20] (Microsoft Corporation) 2 Power; C:\Windows\System32\umpo.dll [163840 2009-07-13] (Microsoft Corporation) 2 ProfSvc; C:\Windows\System32\profsvc.dll [209920 2010-11-20] (Microsoft Corporation) 2 ProtectedStorage; C:\Windows\System32\lsass.exe [31232 2011-11-16] (Microsoft Corporation) 2 QBCFMonitorService; "C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe" [45056 2011-11-11] (Intuit) 3 QBFCService; "C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe" [61440 2009-07-23] (Intuit Inc.) 2 QDLService2kDell; "C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kDell.exe" [329976 2009-10-09] (QUALCOMM, Inc.) 3 QWAVE; C:\Windows\system32\qwave.dll [242688 2009-07-13] (Microsoft Corporation) 3 RasAuto; C:\Windows\System32\rasauto.dll [99328 2009-07-13] (Microsoft Corporation) 3 RasMan; C:\Windows\System32\rasmans.dll [344064 2010-11-20] (Microsoft Corporation) 4 RemoteAccess; C:\Windows\System32\mprdim.dll [97792 2009-07-13] (Microsoft Corporation) 3 RemoteRegistry; C:\Windows\System32\regsvc.dll [159232 2009-07-13] (Microsoft Corporation) 3 RoxMediaDB10; "C:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe" [1124848 2009-06-26] (Sonic Solutions) 2 RpcEptMapper; C:\Windows\System32\RpcEpMap.dll [67072 2009-07-13] (Microsoft Corporation) 3 RpcLocator; C:\Windows\System32\locator.exe [10240 2009-07-13] (Microsoft Corporation) 2 RpcSs; C:\Windows\System32\rpcss.dll [512000 2010-11-20] (Microsoft Corporation) 2 SAiAdmin; "C:\Windows\SysWOW64\SAiAdmin.exe" [65536 2007-08-27] (TODO: ) 2 SAiDownloaderVista; "C:\Windows\SysWOW64\SAiDownloaderVista.exe" [77824 2007-09-11] (TODO: ) 2 SAiLicSvr; "C:\Windows\SysWOW64\SAiLicSvr.exe" [86016 2007-12-19] (SA International) 2 SamSs; C:\Windows\System32\lsass.exe [31232 2011-11-16] (Microsoft Corporation) 3 SCardSvr; C:\Windows\System32\SCardSvr.dll [190976 2009-07-13] (Microsoft Corporation) 2 Schedule; C:\Windows\System32\schedsvc.dll [1110016 2010-11-20] (Microsoft Corporation) 3 SCPolicySvc; C:\Windows\System32\certprop.dll [80384 2010-11-20] (Microsoft Corporation) 3 SDRSVC; C:\Windows\System32\SDRSVC.dll [170496 2010-11-20] (Microsoft Corporation) 2 seclogon; C:\Windows\system32\seclogon.dll [30720 2010-11-20] (Microsoft Corporation) 2 SENS; C:\Windows\System32\sens.dll [64512 2009-07-13] (Microsoft Corporation) 3 SensrSvc; C:\Windows\System32\sensrsvc.dll [29184 2009-07-13] (Microsoft Corporation) 2 SentinelKeysServer; "C:\Program Files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe" [369952 2009-09-16] (SafeNet, Inc.) 3 SessionEnv; C:\Windows\System32\sessenv.dll [121856 2010-11-20] (Microsoft Corporation) 2 SharedAccess; C:\Windows\System32\ipnathlp.dll [359424 2009-07-13] (Microsoft Corporation) 2 ShellHWDetection; C:\Windows\System32\shsvcs.dll [370688 2010-11-20] (Microsoft Corporation) 3 SNMPTRAP; C:\Windows\System32\snmptrap.exe [14336 2009-07-13] (Microsoft Corporation) 3 Sound Blaster X-Fi MB Licensing Service; "C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe" [79360 2011-07-15] (Creative Labs) 2 Spooler; C:\Windows\System32\spoolsv.exe [559104 2010-11-20] (Microsoft Corporation) 2 sppsvc; C:\Windows\System32\sppsvc.exe [3524608 2010-11-20] (Microsoft Corporation) 3 sppuinotify; C:\Windows\System32\sppuinotify.dll [65536 2009-07-13] (Microsoft Corporation) 2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [995744 2012-01-18] (Enigma Software Group USA, LLC.) 3 SSDPSRV; C:\Windows\System32\ssdpsrv.dll [193024 2009-07-13] (Microsoft Corporation) 3 SstpSvc; C:\Windows\System32\sstpsvc.dll [75264 2009-07-13] (Microsoft Corporation) 2 stisvc; C:\Windows\System32\wiaservc.dll [580096 2010-11-20] (Microsoft Corporation) 3 stllssvr; "C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe" [74392 2009-04-30] (MicroVision Development, Inc.) 3 StorSvc; C:\Windows\System32\storsvc.dll [17920 2009-07-13] (Microsoft Corporation) 3 swprv; C:\Windows\System32\swprv.dll [524288 2009-07-13] (Microsoft Corporation) 2 SysMain; C:\Windows\System32\sysmain.dll [1743360 2010-11-20] (Microsoft Corporation) 3 TabletInputService; C:\Windows\System32\TabSvc.dll [92672 2010-11-20] (Microsoft Corporation) 3 TapiSrv; C:\Windows\System32\tapisrv.dll [316928 2010-11-20] (Microsoft Corporation) 3 TBS; C:\Windows\System32\tbssvc.dll [65536 2009-07-13] (Microsoft Corporation) 3 TermService; C:\Windows\System32\termsrv.dll [680960 2010-11-20] (Microsoft Corporation) 2 Themes; C:\Windows\System32\themeservice.dll [44544 2009-07-13] (Microsoft Corporation) 3 THREADORDER; C:\Windows\System32\mmcss.dll [67584 2009-07-13] (Microsoft Corporation) 2 TrkWks; C:\Windows\System32\trkwks.dll [119808 2009-07-13] (Microsoft Corporation) 3 TrustedInstaller; C:\Windows\servicing\TrustedInstaller.exe [194048 2010-11-20] (Microsoft Corporation) 3 UI0Detect; C:\Windows\System32\UI0Detect.exe [40960 2009-07-13] (Microsoft Corporation) 3 UmRdpService; C:\Windows\System32\umrdp.dll [214528 2010-11-20] (Microsoft Corporation) 3 upnphost; C:\Windows\System32\upnphost.dll [353792 2009-07-13] (Microsoft Corporation) 2 UxSms; C:\Windows\System32\uxsms.dll [38912 2009-07-13] (Microsoft Corporation) 3 VaultSvc; C:\Windows\System32\lsass.exe [31232 2011-11-16] (Microsoft Corporation) 3 vds; C:\Windows\System32\vds.exe [533504 2010-11-20] (Microsoft Corporation) 3 VSS; C:\Windows\System32\vssvc.exe [1600512 2010-11-20] (Microsoft Corporation) 3 W32Time; C:\Windows\System32\w32time.dll [381952 2009-07-13] (Microsoft Corporation) 3 WatAdminSvc; C:\Windows\System32\Wat\WatAdminSvc.exe [1255736 2011-07-15] (Microsoft Corporation) 3 wbengine; "C:\Windows\system32\wbengine.exe" [1504256 2010-11-20] (Microsoft Corporation) 3 WbioSrvc; C:\Windows\System32\wbiosrvc.dll [202240 2009-07-13] (Microsoft Corporation) 3 wcncsvc; C:\Windows\System32\wcncsvc.dll [367104 2010-11-20] (Microsoft Corporation) 3 WcsPlugInService; C:\Windows\System32\WcsPlugInService.dll [40960 2009-07-13] (Microsoft Corporation) 3 WdiServiceHost; C:\Windows\System32\wdi.dll [90624 2009-07-13] (Microsoft Corporation) 3 WdiSystemHost; C:\Windows\System32\wdi.dll [90624 2009-07-13] (Microsoft Corporation) 3 WebClient; C:\Windows\System32\webclnt.dll [258560 2010-11-20] (Microsoft Corporation) 3 Wecsvc; C:\Windows\System32\wecsvc.dll [237568 2009-07-13] (Microsoft Corporation) 3 wercplsupport; C:\Windows\System32\wercplsupport.dll [84480 2009-07-13] (Microsoft Corporation) 3 WerSvc; C:\Windows\System32\WerSvc.dll [76800 2009-07-13] (Microsoft Corporation) 3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation) 3 WinHttpAutoProxySvc; winhttp.dll [444416 2010-11-20] (Microsoft Corporation) 2 Winmgmt; C:\Windows\System32\wbem\WMIsvc.dll [242688 2009-07-13] (Microsoft Corporation) 3 WinRM; C:\Windows\System32\WsmSvc.dll [2018304 2010-11-20] (Microsoft Corporation) 2 Wlansvc; C:\Windows\System32\wlansvc.dll [886784 2009-07-13] (Microsoft Corporation) 3 wmiApSrv; C:\Windows\System32\wbem\WmiApSrv.exe [203264 2009-07-13] (Microsoft Corporation) 2 WMPNetworkSvc; "C:\Program Files\Windows Media Player\wmpnetwk.exe" [1525248 2010-11-20] (Microsoft Corporation) 3 WPCSvc; C:\Windows\System32\wpcsvc.dll [12288 2009-07-13] (Microsoft Corporation) 3 WPDBusEnum; C:\Windows\System32\wpdbusenum.dll [117248 2010-11-20] (Microsoft Corporation) 2 wscsvc; C:\Windows\System32\wscsvc.dll [97280 2009-07-13] (Microsoft Corporation) 2 WSearch; C:\Windows\System32\SearchIndexer.exe /Embedding [591872 2011-05-03] (Microsoft Corporation) 2 wuauserv; C:\Windows\System32\wuaueng.dll [2420736 2010-11-20] (Microsoft Corporation) 2 wudfsvc; C:\Windows\System32\WUDFSvc.dll [78848 2010-11-20] (Microsoft Corporation) 3 WwanSvc; C:\Windows\System32\wwansvc.dll [229888 2009-07-13] (Microsoft Corporation) ========================== Drivers =========================== 3 1394ohci; C:\Windows\System32\drivers\1394ohci.sys [229888 2010-11-20] (Microsoft Corporation) 0 ACPI; C:\Windows\System32\drivers\ACPI.sys [334208 2010-11-20] (Microsoft Corporation) 3 AcpiPmi; C:\Windows\System32\drivers\acpipmi.sys [12800 2010-11-20] (Microsoft Corporation) 2 adfs; C:\Windows\System32\Drivers\adfs.sys [88632 2008-06-27] (Adobe Systems, Inc.) 3 adp94xx; C:\Windows\System32\DRIVERS\adp94xx.sys [491088 2009-07-13] (Adaptec, Inc.) 3 adpahci; C:\Windows\System32\DRIVERS\adpahci.sys [339536 2009-07-13] (Adaptec, Inc.) 3 adpu320; C:\Windows\System32\DRIVERS\adpu320.sys [182864 2009-07-13] (Adaptec, Inc.) 1 AFD; C:\Windows\System32\drivers\afd.sys [498688 2011-12-27] (Microsoft Corporation) 3 agp440; C:\Windows\System32\drivers\agp440.sys [61008 2009-07-13] (Microsoft Corporation) 3 aliide; C:\Windows\System32\drivers\aliide.sys [15440 2009-07-13] (Acer Laboratories Inc.) 3 amdide; C:\Windows\System32\drivers\amdide.sys [15440 2009-07-13] (Microsoft Corporation) 3 AmdK8; C:\Windows\System32\DRIVERS\amdk8.sys [64512 2009-07-13] (Microsoft Corporation) 3 AmdPPM; C:\Windows\System32\DRIVERS\amdppm.sys [60928 2009-07-13] (Microsoft Corporation) 3 amdsata; C:\Windows\System32\drivers\amdsata.sys [107904 2011-03-10] (Advanced Micro Devices) 3 amdsbs; C:\Windows\System32\DRIVERS\amdsbs.sys [194128 2009-07-13] (AMD Technologies Inc.) 0 amdxata; C:\Windows\System32\drivers\amdxata.sys [27008 2011-03-10] (Advanced Micro Devices) 3 AppID; C:\Windows\System32\drivers\appid.sys [61440 2010-11-20] (Microsoft Corporation) 3 arc; C:\Windows\System32\DRIVERS\arc.sys [87632 2009-07-13] (Adaptec, Inc.) 3 arcsas; C:\Windows\System32\DRIVERS\arcsas.sys [97856 2009-07-13] (Adaptec, Inc.) 3 AsyncMac; C:\Windows\System32\DRIVERS\asyncmac.sys [23040 2009-07-13] (Microsoft Corporation) 0 atapi; C:\Windows\System32\drivers\atapi.sys [24128 2009-07-13] (Microsoft Corporation) 3 atikmdag; C:\Windows\System32\DRIVERS\atikmdag.sys [6037504 2009-08-17] (ATI Technologies Inc.) 3 b06bdrv; C:\Windows\System32\DRIVERS\bxvbda.sys [468480 2009-06-10] (Broadcom Corporation) 3 b57nd60a; C:\Windows\System32\DRIVERS\b57nd60a.sys [270848 2009-06-10] (Broadcom Corporation) 1 Beep; C:\Windows\System32\Drivers\Beep.sys [6656 2009-07-13] (Microsoft Corporation) 1 blbdrive; C:\Windows\System32\DRIVERS\blbdrive.sys [45056 2009-07-13] (Microsoft Corporation) 3 bowser; C:\Windows\System32\DRIVERS\bowser.sys [90624 2011-02-22] (Microsoft Corporation) 3 BrFiltLo; C:\Windows\System32\DRIVERS\BrFiltLo.sys [18432 2009-06-10] (Brother Industries, Ltd.) 3 BrFiltUp; C:\Windows\System32\DRIVERS\BrFiltUp.sys [8704 2009-06-10] (Brother Industries, Ltd.) 3 BridgeMP; C:\Windows\System32\DRIVERS\bridge.sys [95232 2009-07-13] (Microsoft Corporation) 3 Brserid; C:\Windows\System32\Drivers\Brserid.sys [286720 2009-07-13] (Brother Industries Ltd.) 3 BrSerWdm; C:\Windows\System32\Drivers\BrSerWdm.sys [47104 2009-06-10] (Brother Industries Ltd.) 3 BrUsbMdm; C:\Windows\System32\Drivers\BrUsbMdm.sys [14976 2009-06-10] (Brother Industries Ltd.) 3 BrUsbSer; C:\Windows\System32\Drivers\BrUsbSer.sys [14720 2009-06-10] (Brother Industries Ltd.) 3 BTHMODEM; C:\Windows\System32\DRIVERS\bthmodem.sys [72192 2009-07-13] (Microsoft Corporation) 4 cdfs; C:\Windows\System32\DRIVERS\cdfs.sys [92160 2009-07-13] (Microsoft Corporation) 1 cdrom; C:\Windows\System32\drivers\cdrom.sys [147456 2010-11-20] (Microsoft Corporation) 3 cfwids; C:\Windows\System32\drivers\cfwids.sys [65264 2011-10-15] (McAfee, Inc.) 3 circlass; C:\Windows\System32\DRIVERS\circlass.sys [45568 2009-07-13] (Microsoft Corporation) 0 CLFS; C:\Windows\System32\CLFS.sys [367696 2009-07-13] (Microsoft Corporation) 3 CmBatt; C:\Windows\System32\DRIVERS\CmBatt.sys [17664 2009-07-13] (Microsoft Corporation) 3 cmdide; C:\Windows\System32\drivers\cmdide.sys [17488 2009-07-13] (CMD Technology, Inc.) 0 CNG; C:\Windows\System32\Drivers\cng.sys [459232 2011-11-16] (Microsoft Corporation) 0 Compbatt; C:\Windows\System32\DRIVERS\compbatt.sys [21584 2009-07-13] (Microsoft Corporation) 3 CompositeBus; C:\Windows\System32\drivers\CompositeBus.sys [38912 2010-11-20] (Microsoft Corporation) 4 crcdisk; C:\Windows\System32\DRIVERS\crcdisk.sys [24144 2009-07-13] (Microsoft Corporation) 1 CSC; C:\Windows\System32\drivers\csc.sys [514560 2010-11-20] (Microsoft Corporation) 1 DfsC; C:\Windows\System32\Drivers\dfsc.sys [102400 2010-11-20] (Microsoft Corporation) 1 discache; C:\Windows\System32\drivers\discache.sys [40448 2009-07-13] (Microsoft Corporation) 0 Disk; C:\Windows\System32\DRIVERS\disk.sys [73280 2009-07-13] (Microsoft Corporation) 3 drmkaud; C:\Windows\System32\drivers\drmkaud.sys [5632 2009-07-13] (Microsoft Corporation) 3 DXGKrnl; C:\Windows\System32\drivers\dxgkrnl.sys [982912 2010-11-20] (Microsoft Corporation) 3 ebdrv; C:\Windows\System32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) 1 ElRawDisk; \??\C:\Windows\system32\drivers\ElRawDsk.sys [23464 2008-12-09] (EldoS Corporation) 3 elxstor; C:\Windows\System32\DRIVERS\elxstor.sys [530496 2009-07-13] (Emulex) 3 ErrDev; C:\Windows\System32\drivers\errdev.sys [9728 2009-07-13] (Microsoft Corporation) 3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] () 3 exfat; C:\Windows\System32\Drivers\exfat.sys [195072 2009-07-13] (Microsoft Corporation) 3 fastfat; C:\Windows\System32\Drivers\fastfat.sys [204800 2009-07-13] (Microsoft Corporation) 3 fdc; C:\Windows\System32\DRIVERS\fdc.sys [29696 2009-07-13] (Microsoft Corporation) 0 FileInfo; C:\Windows\System32\drivers\fileinfo.sys [70224 2009-07-13] (Microsoft Corporation) 3 Filetrace; C:\Windows\System32\drivers\filetrace.sys [34304 2009-07-13] (Microsoft Corporation) 3 flpydisk; C:\Windows\System32\DRIVERS\flpydisk.sys [24576 2009-07-13] (Microsoft Corporation) 0 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [289664 2010-11-20] (Microsoft Corporation) 3 FsDepends; C:\Windows\System32\drivers\FsDepends.sys [55376 2009-07-13] (Microsoft Corporation) 0 Fs_Rec; C:\Windows\System32\Drivers\Fs_Rec.sys [23104 2009-07-13] (Microsoft Corporation) 0 fvevol; C:\Windows\System32\DRIVERS\fvevol.sys [223248 2010-11-20] (Microsoft Corporation) 3 gagp30kx; C:\Windows\System32\DRIVERS\gagp30kx.sys [65088 2009-07-13] (Microsoft Corporation) 3 GEARAspiWDM; C:\Windows\System32\DRIVERS\GEARAspiWDM.sys [34152 2009-05-18] (GEAR Software Inc.) 3 hcw85cir; C:\Windows\System32\drivers\hcw85cir.sys [31232 2009-06-10] (Hauppauge Computer Works, Inc.) 3 HdAudAddService; C:\Windows\System32\drivers\HdAudio.sys [350208 2010-11-20] (Microsoft Corporation) 3 HDAudBus; C:\Windows\System32\drivers\HDAudBus.sys [122368 2010-11-20] (Microsoft Corporation) 3 HidBatt; C:\Windows\System32\DRIVERS\HidBatt.sys [26624 2009-07-13] (Microsoft Corporation) 3 HidBth; C:\Windows\System32\DRIVERS\hidbth.sys [100864 2009-07-13] (Microsoft Corporation) 3 HidIr; C:\Windows\System32\DRIVERS\hidir.sys [46592 2009-07-13] (Microsoft Corporation) 3 HidUsb; C:\Windows\System32\drivers\hidusb.sys [30208 2010-11-20] (Microsoft Corporation) 3 HpSAMD; C:\Windows\System32\drivers\HpSAMD.sys [78720 2010-11-20] (Hewlett-Packard Company) 3 HTTP; C:\Windows\System32\drivers\HTTP.sys [753664 2010-11-20] (Microsoft Corporation) 0 hwpolicy; C:\Windows\System32\drivers\hwpolicy.sys [14720 2010-11-20] (Microsoft Corporation) 3 i8042prt; C:\Windows\System32\drivers\i8042prt.sys [105472 2009-07-13] (Microsoft Corporation) 3 iaStorV; C:\Windows\System32\drivers\iaStorV.sys [410496 2011-03-10] (Intel Corporation) 3 iirsp; C:\Windows\System32\DRIVERS\iirsp.sys [44112 2009-07-13] (Intel Corp./ICP vortex GmbH) 3 intelide; C:\Windows\System32\drivers\intelide.sys [16960 2009-07-13] (Microsoft Corporation) 3 intelppm; C:\Windows\System32\DRIVERS\intelppm.sys [62464 2009-07-13] (Microsoft Corporation) 3 IpFilterDriver; C:\Windows\System32\DRIVERS\ipfltdrv.sys [82944 2010-11-20] (Microsoft Corporation) 3 IPMIDRV; C:\Windows\System32\drivers\IPMIDrv.sys [78848 2010-11-20] (Microsoft Corporation) 3 IPNAT; C:\Windows\System32\drivers\ipnat.sys [116224 2009-07-13] (Microsoft Corporation) 3 IRENUM; C:\Windows\System32\drivers\irenum.sys [17920 2009-07-13] (Microsoft Corporation) 3 isapnp; C:\Windows\System32\drivers\isapnp.sys [20544 2009-07-13] (Microsoft Corporation) 3 iScsiPrt; C:\Windows\System32\drivers\msiscsi.sys [273792 2010-11-20] (Microsoft Corporation) 3 itecir; C:\Windows\System32\DRIVERS\itecir.sys [69736 2010-07-13] (ITE Tech. Inc. ) 3 k57nd60a; C:\Windows\System32\DRIVERS\k57nd60a.sys [270848 2009-06-10] (Broadcom Corporation) 3 kbdclass; C:\Windows\System32\drivers\kbdclass.sys [50768 2009-07-13] (Microsoft Corporation) 3 kbdhid; C:\Windows\System32\drivers\kbdhid.sys [33280 2010-11-20] (Microsoft Corporation) 0 KSecDD; C:\Windows\System32\Drivers\ksecdd.sys [95600 2011-11-16] (Microsoft Corporation) 0 KSecPkg; C:\Windows\System32\Drivers\ksecpkg.sys [152432 2011-11-16] (Microsoft Corporation) 3 ksthunk; C:\Windows\System32\drivers\ksthunk.sys [20992 2009-07-13] (Microsoft Corporation) 2 lltdio; C:\Windows\System32\DRIVERS\lltdio.sys [60928 2009-07-13] (Microsoft Corporation) 3 LSI_FC; C:\Windows\System32\DRIVERS\lsi_fc.sys [114752 2009-07-13] (LSI Corporation) 3 LSI_SAS; C:\Windows\System32\DRIVERS\lsi_sas.sys [106560 2009-07-13] (LSI Corporation) 3 LSI_SAS2; C:\Windows\System32\DRIVERS\lsi_sas2.sys [65600 2009-07-13] (LSI Corporation) 3 LSI_SCSI; C:\Windows\System32\DRIVERS\lsi_scsi.sys [115776 2009-07-13] (LSI Corporation) 2 luafv; C:\Windows\System32\drivers\luafv.sys [113152 2009-07-13] (Microsoft Corporation) 3 megasas; C:\Windows\System32\DRIVERS\megasas.sys [35392 2009-07-13] (LSI Corporation) 3 MegaSR; C:\Windows\System32\DRIVERS\MegaSR.sys [284736 2009-07-13] (LSI Corporation, Inc.) 3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [160280 2011-10-15] (McAfee, Inc.) 3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [229528 2011-10-15] (McAfee, Inc.) 3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [481768 2011-10-15] (McAfee, Inc.) 0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [647080 2011-10-15] (McAfee, Inc.) 1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [75808 2011-10-15] (McAfee, Inc.) 3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [100912 2011-10-15] (McAfee, Inc.) 0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [284648 2011-10-15] (McAfee, Inc.) 3 Modem; C:\Windows\System32\drivers\modem.sys [40448 2009-07-13] (Microsoft Corporation) 3 monitor; C:\Windows\System32\DRIVERS\monitor.sys [30208 2009-07-13] (Microsoft Corporation) 3 mouclass; C:\Windows\System32\drivers\mouclass.sys [49216 2009-07-13] (Microsoft Corporation) 3 mouhid; C:\Windows\System32\DRIVERS\mouhid.sys [31232 2009-07-13] (Microsoft Corporation) 0 mountmgr; C:\Windows\System32\drivers\mountmgr.sys [94592 2010-11-20] (Microsoft Corporation) 3 mpio; C:\Windows\System32\drivers\mpio.sys [155008 2010-11-20] (Microsoft Corporation) 3 mpsdrv; C:\Windows\System32\drivers\mpsdrv.sys [77312 2009-07-13] (Microsoft Corporation) 3 MRxDAV; C:\Windows\System32\drivers\mrxdav.sys [140800 2010-11-20] (Microsoft Corporation) 3 mrxsmb; C:\Windows\System32\DRIVERS\mrxsmb.sys [158208 2011-04-26] (Microsoft Corporation) 3 mrxsmb10; C:\Windows\System32\DRIVERS\mrxsmb10.sys [288768 2011-07-08] (Microsoft Corporation) 3 mrxsmb20; C:\Windows\System32\DRIVERS\mrxsmb20.sys [128000 2011-04-26] (Microsoft Corporation) 0 msahci; C:\Windows\System32\drivers\msahci.sys [31104 2010-11-20] (Microsoft Corporation) 3 msdsm; C:\Windows\System32\drivers\msdsm.sys [140672 2010-11-20] (Microsoft Corporation) 1 Msfs; C:\Windows\System32\Drivers\Msfs.sys [26112 2009-07-13] (Microsoft Corporation) 3 mshidkmdf; C:\Windows\System32\drivers\mshidkmdf.sys [8192 2009-07-13] (Microsoft Corporation) 0 msisadrv; C:\Windows\System32\drivers\msisadrv.sys [15424 2009-07-13] (Microsoft Corporation) 3 MSKSSRV; C:\Windows\System32\drivers\MSKSSRV.sys [11136 2009-07-13] (Microsoft Corporation) 3 MSPCLOCK; C:\Windows\System32\drivers\MSPCLOCK.sys [7168 2009-07-13] (Microsoft Corporation) 3 MSPQM; C:\Windows\System32\drivers\MSPQM.sys [6784 2009-07-13] (Microsoft Corporation) 3 MsRPC; C:\Windows\System32\Drivers\MsRPC.sys [366976 2010-11-20] (Microsoft Corporation) 1 mssmbios; C:\Windows\System32\drivers\mssmbios.sys [32320 2009-07-13] (Microsoft Corporation) 3 MSTEE; C:\Windows\System32\drivers\MSTEE.sys [8064 2009-07-13] (Microsoft Corporation) 3 MTConfig; C:\Windows\System32\DRIVERS\MTConfig.sys [15360 2009-07-13] (Microsoft Corporation) 0 Mup; C:\Windows\System32\Drivers\mup.sys [60496 2009-07-13] (Microsoft Corporation) 3 NativeWifiP; C:\Windows\System32\DRIVERS\nwifi.sys [318976 2009-07-13] (Microsoft Corporation) 0 NDIS; C:\Windows\System32\drivers\ndis.sys [951680 2010-11-20] (Microsoft Corporation) 3 NdisCap; C:\Windows\System32\DRIVERS\ndiscap.sys [35328 2009-07-13] (Microsoft Corporation) 3 NdisTapi; C:\Windows\System32\DRIVERS\ndistapi.sys [24064 2009-07-13] (Microsoft Corporation) 3 Ndisuio; C:\Windows\System32\DRIVERS\ndisuio.sys [56832 2010-11-20] (Microsoft Corporation) 3 NdisWan; C:\Windows\System32\DRIVERS\ndiswan.sys [164352 2010-11-20] (Microsoft Corporation) 3 NDProxy; C:\Windows\System32\Drivers\NDProxy.sys [57856 2010-11-20] (Microsoft Corporation) 1 NetBIOS; C:\Windows\System32\DRIVERS\netbios.sys [44544 2009-07-13] (Microsoft Corporation) 1 NetBT; C:\Windows\System32\DRIVERS\netbt.sys [261632 2010-11-20] (Microsoft Corporation) 3 netw5v64; C:\Windows\System32\DRIVERS\netw5v64.sys [5434368 2009-06-10] (Intel Corporation) 3 nfrd960; C:\Windows\System32\DRIVERS\nfrd960.sys [51264 2009-07-13] (IBM Corporation) 1 Npfs; C:\Windows\System32\Drivers\Npfs.sys [44032 2009-07-13] (Microsoft Corporation) 1 nsiproxy; C:\Windows\System32\drivers\nsiproxy.sys [24576 2009-07-13] (Microsoft Corporation) 3 Ntfs; C:\Windows\System32\Drivers\Ntfs.sys [1659776 2011-03-10] (Microsoft Corporation) 1 Null; C:\Windows\System32\Drivers\Null.sys [6144 2009-07-13] (Microsoft Corporation) 3 nvraid; C:\Windows\System32\drivers\nvraid.sys [148352 2011-03-10] (NVIDIA Corporation) 3 nvstor; C:\Windows\System32\drivers\nvstor.sys [166272 2011-03-10] (NVIDIA Corporation) 3 nv_agp; C:\Windows\System32\drivers\nv_agp.sys [122960 2009-07-13] (Microsoft Corporation) 3 ohci1394; C:\Windows\System32\drivers\ohci1394.sys [72832 2009-07-13] (Microsoft Corporation) 3 Parport; C:\Windows\System32\DRIVERS\parport.sys [97280 2009-07-13] (Microsoft Corporation) 0 partmgr; C:\Windows\System32\drivers\partmgr.sys [75136 2010-11-20] (Microsoft Corporation) 0 pci; C:\Windows\System32\drivers\pci.sys [184704 2010-11-20] (Microsoft Corporation) 3 pciide; C:\Windows\System32\drivers\pciide.sys [12352 2009-07-13] (Microsoft Corporation) 3 pcmcia; C:\Windows\System32\DRIVERS\pcmcia.sys [220752 2009-07-13] (Microsoft Corporation) 0 pcw; C:\Windows\System32\drivers\pcw.sys [50768 2009-07-13] (Microsoft Corporation) 2 PEAUTH; C:\Windows\System32\drivers\peauth.sys [651264 2009-07-13] (Microsoft Corporation) 3 PptpMiniport; C:\Windows\System32\DRIVERS\raspptp.sys [111104 2010-11-20] (Microsoft Corporation) 3 Processor; C:\Windows\System32\DRIVERS\processr.sys [60416 2009-07-13] (Microsoft Corporation) 1 Psched; C:\Windows\System32\DRIVERS\pacer.sys [131584 2010-11-20] (Microsoft Corporation) 0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [55280 2009-05-19] (Sonic Solutions) 3 ql2300; C:\Windows\System32\DRIVERS\ql2300.sys [1524816 2009-07-13] (QLogic Corporation) 3 ql40xx; C:\Windows\System32\DRIVERS\ql40xx.sys [128592 2009-07-13] (QLogic Corporation) 3 QWAVEdrv; C:\Windows\System32\drivers\qwavedrv.sys [46592 2009-07-13] (Microsoft Corporation) 3 RasAcd; C:\Windows\System32\DRIVERS\rasacd.sys [14848 2009-07-13] (Microsoft Corporation) 3 RasAgileVpn; C:\Windows\System32\DRIVERS\AgileVpn.sys [60416 2009-07-13] (Microsoft Corporation) 3 Rasl2tp; C:\Windows\System32\DRIVERS\rasl2tp.sys [129536 2010-11-20] (Microsoft Corporation) 3 RasPppoe; C:\Windows\System32\DRIVERS\raspppoe.sys [92672 2009-07-13] (Microsoft Corporation) 3 RasSstp; C:\Windows\System32\DRIVERS\rassstp.sys [83968 2009-07-13] (Microsoft Corporation) 1 rdbss; C:\Windows\System32\DRIVERS\rdbss.sys [309248 2010-11-20] (Microsoft Corporation) 3 rdpbus; C:\Windows\System32\DRIVERS\rdpbus.sys [24064 2009-07-13] (Microsoft Corporation) 1 RDPCDD; C:\Windows\System32\DRIVERS\RDPCDD.sys [7680 2009-07-13] (Microsoft Corporation) 3 RDPDR; C:\Windows\System32\drivers\rdpdr.sys [165888 2010-11-20] (Microsoft Corporation) 1 RDPENCDD; C:\Windows\System32\drivers\rdpencdd.sys [7680 2009-07-13] (Microsoft Corporation) 1 RDPREFMP; C:\Windows\System32\drivers\rdprefmp.sys [8192 2009-07-13] (Microsoft Corporation) 3 RDPWD; C:\Windows\System32\Drivers\RDPWD.sys [210944 2010-11-20] (Microsoft Corporation) 0 rdyboost; C:\Windows\System32\drivers\rdyboost.sys [213888 2010-11-20] (Microsoft Corporation) 2 rimspci; C:\Windows\System32\DRIVERS\rimspe64.sys [60416 2009-07-02] (REDC) 2 risdpcie; C:\Windows\System32\DRIVERS\risdpe64.sys [80896 2009-07-01] (REDC) 2 rixdpcie; C:\Windows\System32\DRIVERS\rixdpe64.sys [55808 2009-07-04] (REDC) 2 rspndr; C:\Windows\System32\DRIVERS\rspndr.sys [76800 2009-07-13] (Microsoft Corporation) 3 s3cap; C:\Windows\System32\drivers\vms3cap.sys [6656 2010-11-20] (Microsoft Corporation) 3 sbp2port; C:\Windows\System32\drivers\sbp2port.sys [103808 2010-11-20] (Microsoft Corporation) 3 scfilter; C:\Windows\System32\DRIVERS\scfilter.sys [29696 2010-11-20] (Microsoft Corporation) 3 sdbus; C:\Windows\System32\drivers\sdbus.sys [109056 2010-11-20] (Microsoft Corporation) 2 secdrv; C:\Windows\System32\Drivers\secdrv.sys [23040 2009-06-10] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) 3 Serenum; C:\Windows\System32\DRIVERS\serenum.sys [23552 2009-07-13] (Microsoft Corporation) 3 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-13] (Microsoft Corporation) 3 sermouse; C:\Windows\System32\DRIVERS\sermouse.sys [26624 2009-07-13] (Microsoft Corporation) 3 sffdisk; C:\Windows\System32\drivers\sffdisk.sys [14336 2009-07-13] (Microsoft Corporation) 3 sffp_mmc; C:\Windows\System32\drivers\sffp_mmc.sys [13824 2009-07-13] (Microsoft Corporation) 3 sffp_sd; C:\Windows\System32\drivers\sffp_sd.sys [14336 2010-11-20] (Microsoft Corporation) 3 sfloppy; C:\Windows\System32\DRIVERS\sfloppy.sys [16896 2009-07-13] (Microsoft Corporation) 3 SiSRaid2; C:\Windows\System32\DRIVERS\SiSRaid2.sys [43584 2009-07-13] (Silicon Integrated Systems Corp.) 3 SiSRaid4; C:\Windows\System32\DRIVERS\sisraid4.sys [80464 2009-07-13] (Silicon Integrated Systems) 3 Smb; C:\Windows\System32\DRIVERS\smb.sys [93184 2009-07-13] (Microsoft Corporation) 3 SNTUSB64; C:\Windows\System32\DRIVERS\SNTUSB64.SYS [58792 2009-09-17] (SafeNet, Inc.) 0 spldr; C:\Windows\System32\Drivers\spldr.sys [19008 2009-07-13] (Microsoft Corporation) 3 srv; C:\Windows\System32\DRIVERS\srv.sys [467456 2011-04-28] (Microsoft Corporation) 3 srv2; C:\Windows\System32\DRIVERS\srv2.sys [410112 2011-04-28] (Microsoft Corporation) 3 srvnet; C:\Windows\System32\DRIVERS\srvnet.sys [168448 2011-04-28] (Microsoft Corporation) 3 stexstor; C:\Windows\System32\DRIVERS\stexstor.sys [24656 2009-07-13] (Promise Technology) 0 storflt; C:\Windows\System32\drivers\vmstorfl.sys [46464 2010-11-20] (Microsoft Corporation) 3 storvsc; C:\Windows\System32\drivers\storvsc.sys [34688 2010-11-20] (Microsoft Corporation) 3 swenum; C:\Windows\System32\drivers\swenum.sys [12496 2009-07-13] (Microsoft Corporation) 3 SynTP; C:\Windows\System32\DRIVERS\SynTP.sys [272432 2009-06-26] (Synaptics Incorporated) 0 Tcpip; C:\Windows\System32\drivers\tcpip.sys [1923952 2011-09-29] (Microsoft Corporation) 3 TCPIP6; C:\Windows\System32\DRIVERS\tcpip.sys [1923952 2011-09-29] (Microsoft Corporation) 2 tcpipreg; C:\Windows\System32\drivers\tcpipreg.sys [45056 2010-11-20] (Microsoft Corporation) 3 TDPIPE; C:\Windows\System32\drivers\tdpipe.sys [15872 2009-07-13] (Microsoft Corporation) 3 TDTCP; C:\Windows\System32\drivers\tdtcp.sys [23552 2009-07-13] (Microsoft Corporation) 1 tdx; C:\Windows\System32\DRIVERS\tdx.sys [119296 2010-11-20] (Microsoft Corporation) 1 TermDD; C:\Windows\System32\drivers\termdd.sys [63360 2010-11-20] (Microsoft Corporation) 3 tssecsrv; C:\Windows\System32\DRIVERS\tssecsrv.sys [39424 2010-11-20] (Microsoft Corporation) 3 TsUsbFlt; C:\Windows\System32\drivers\tsusbflt.sys [59392 2010-11-20] (Microsoft Corporation) 3 tunnel; C:\Windows\System32\DRIVERS\tunnel.sys [125440 2010-11-20] (Microsoft Corporation) 3 uagp35; C:\Windows\System32\DRIVERS\uagp35.sys [64080 2009-07-13] (Microsoft Corporation) 4 udfs; C:\Windows\System32\DRIVERS\udfs.sys [328192 2010-11-20] (Microsoft Corporation) 3 uliagpkx; C:\Windows\System32\drivers\uliagpkx.sys [64592 2009-07-13] (Microsoft Corporation) 3 umbus; C:\Windows\System32\drivers\umbus.sys [48640 2010-11-20] (Microsoft Corporation) 3 UmPass; C:\Windows\System32\DRIVERS\umpass.sys [9728 2009-07-13] (Microsoft Corporation) 3 usbccgp; C:\Windows\System32\DRIVERS\usbccgp.sys [98816 2011-03-24] (Microsoft Corporation) 3 usbcir; C:\Windows\System32\drivers\usbcir.sys [100352 2009-07-13] (Microsoft Corporation) 3 usbehci; C:\Windows\System32\drivers\usbehci.sys [52736 2011-03-24] (Microsoft Corporation) 3 usbhub; C:\Windows\System32\DRIVERS\usbhub.sys [343040 2011-03-24] (Microsoft Corporation) 3 usbohci; C:\Windows\System32\drivers\usbohci.sys [25600 2011-03-24] (Microsoft Corporation) 3 usbprint; C:\Windows\System32\DRIVERS\usbprint.sys [25088 2009-07-13] (Microsoft Corporation) 3 USBSTOR; C:\Windows\System32\DRIVERS\USBSTOR.SYS [91648 2011-03-10] (Microsoft Corporation) 3 usbuhci; C:\Windows\System32\drivers\usbuhci.sys [30720 2011-03-24] (Microsoft Corporation) 3 usbvideo; C:\Windows\System32\Drivers\usbvideo.sys [184960 2010-11-20] (Microsoft Corporation) 0 vdrvroot; C:\Windows\System32\drivers\vdrvroot.sys [36432 2009-07-13] (Microsoft Corporation) 3 vga; C:\Windows\System32\DRIVERS\vgapnp.sys [29184 2009-07-13] (Microsoft Corporation) 1 VgaSave; C:\Windows\System32\drivers\vga.sys [29184 2009-07-13] (Microsoft Corporation) 3 vhdmp; C:\Windows\System32\drivers\vhdmp.sys [215936 2010-11-20] (Microsoft Corporation) 3 viaide; C:\Windows\System32\drivers\viaide.sys [17488 2009-07-13] (VIA Technologies, Inc.) 0 vmbus; C:\Windows\System32\drivers\vmbus.sys [199552 2010-11-20] (Microsoft Corporation) 3 VMBusHID; C:\Windows\System32\drivers\VMBusHID.sys [21760 2010-11-20] (Microsoft Corporation) 0 volmgr; C:\Windows\System32\drivers\volmgr.sys [71552 2010-11-20] (Microsoft Corporation) 0 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [363392 2010-11-20] (Microsoft Corporation) 0 volsnap; C:\Windows\System32\drivers\volsnap.sys [295808 2010-11-20] (Microsoft Corporation) 3 vpcbus; C:\Windows\System32\DRIVERS\vpchbus.sys [194944 2010-11-20] (Microsoft Corporation) 1 vpcnfltr; C:\Windows\System32\DRIVERS\vpcnfltr.sys [59392 2010-11-20] (Microsoft Corporation) 3 vpcusb; C:\Windows\System32\DRIVERS\vpcusb.sys [95232 2010-11-20] (Microsoft Corporation) 1 vpcvmm; C:\Windows\System32\drivers\vpcvmm.sys [360832 2010-11-20] (Microsoft Corporation) 3 vsmraid; C:\Windows\System32\DRIVERS\vsmraid.sys [161872 2009-07-13] (VIA Technologies Inc.,Ltd) 3 vwifibus; C:\Windows\System32\drivers\vwifibus.sys [24576 2009-07-13] (Microsoft Corporation) 3 WacomPen; C:\Windows\System32\DRIVERS\wacompen.sys [27776 2009-07-13] (Microsoft Corporation) 3 WANARP; C:\Windows\System32\DRIVERS\wanarp.sys [88576 2010-11-20] (Microsoft Corporation) 1 Wanarpv6; C:\Windows\System32\DRIVERS\wanarp.sys [88576 2010-11-20] (Microsoft Corporation) 3 Wd; C:\Windows\System32\DRIVERS\wd.sys [21056 2009-07-13] (Microsoft Corporation) 3 WDC_SAM; C:\Windows\System32\DRIVERS\wdcsam64.sys [14464 2008-05-06] (Western Digital Technologies) 0 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [654928 2009-07-13] (Microsoft Corporation) 1 WfpLwf; C:\Windows\System32\DRIVERS\wfplwf.sys [12800 2009-07-13] (Microsoft Corporation) 3 WIMMount; C:\Windows\System32\drivers\wimmount.sys [22096 2009-07-13] (Microsoft Corporation) 3 WmiAcpi; C:\Windows\System32\drivers\wmiacpi.sys [14336 2009-07-13] (Microsoft Corporation) 1 ws2ifsl; C:\Windows\System32\drivers\ws2ifsl.sys [21504 2009-07-13] (Microsoft Corporation) 3 WudfPf; C:\Windows\System32\drivers\WudfPf.sys [112128 2010-11-20] (Microsoft Corporation) 3 WUDFRd; C:\Windows\System32\DRIVERS\WUDFRd.sys [172544 2010-11-20] (Microsoft Corporation) 3 catchme; \??\C:\ComboFix\catchme.sys [x] 3 mfeapfk01; [x] 3 mfeavfk01; [x] 3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0; \??\c:\program files\dell support center\pcdsrvc_x64.pkms [x] 1 RxFilter; C:\Windows\System32\DRIVERS\RxFilter.sys [x] ========================== Drivers MD5 ======================= C:\Windows\System32\drivers\1394ohci.sys ==> MD5 is legit C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit C:\Windows\System32\drivers\acpipmi.sys ==> MD5 is legit C:\Windows\System32\Drivers\adfs.sys 2F0683FD2DF1D92E891CACA14B45A8C1 C:\Windows\System32\DRIVERS\adp94xx.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\adpahci.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\adpu320.sys ==> MD5 is legit C:\Windows\System32\drivers\afd.sys 1C7857B62DE5994A75B054A9FD4C3825 C:\Windows\System32\drivers\agp440.sys ==> MD5 is legit C:\Windows\System32\drivers\aliide.sys ==> MD5 is legit C:\Windows\System32\drivers\amdide.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\amdk8.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\amdppm.sys ==> MD5 is legit C:\Windows\System32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49 C:\Windows\System32\DRIVERS\amdsbs.sys ==> MD5 is legit C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048 C:\Windows\System32\drivers\appid.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\arc.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\arcsas.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\atikmdag.sys 52BD95CAA9CAE8977FE043E9AD6D2D0E C:\Windows\System32\DRIVERS\bxvbda.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\BrFiltLo.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\BrFiltUp.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\bridge.sys 5C2F352A4E961D72518261257AAE204B C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\bthmodem.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit C:\Windows\System32\drivers\cdrom.sys ==> MD5 is legit C:\Windows\System32\drivers\cfwids.sys ED0263B2EB24F0F4E3898036FA1D28A1 C:\Windows\System32\DRIVERS\circlass.sys ==> MD5 is legit C:\Windows\System32\CLFS.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit C:\Windows\System32\drivers\cmdide.sys ==> MD5 is legit C:\Windows\System32\Drivers\cng.sys C4943B6C962E4B82197542447AD599F4 C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit C:\Windows\System32\drivers\CompositeBus.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\crcdisk.sys ==> MD5 is legit C:\Windows\System32\drivers\csc.sys ==> MD5 is legit C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit C:\Windows\System32\drivers\discache.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit C:\Windows\System32\drivers\dxgkrnl.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\evbda.sys ==> MD5 is legit C:\Windows\system32\drivers\ElRawDsk.sys D38A883309E04B9FBFFE1ACA60EA3BBF C:\Windows\System32\DRIVERS\elxstor.sys ==> MD5 is legit C:\Windows\System32\drivers\errdev.sys ==> MD5 is legit C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys DF96C3CD6AE15F6D0A6BCB70F9C1E88D C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\fdc.sys ==> MD5 is legit C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\flpydisk.sys ==> MD5 is legit C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit C:\Windows\System32\Drivers\Fs_Rec.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\fvevol.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\gagp30kx.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\GEARAspiWDM.sys ==> MD5 is legit C:\Windows\System32\drivers\hcw85cir.sys ==> MD5 is legit C:\Windows\System32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A C:\Windows\System32\drivers\HDAudBus.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\HidBatt.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\hidbth.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\hidir.sys ==> MD5 is legit C:\Windows\System32\drivers\hidusb.sys ==> MD5 is legit C:\Windows\System32\drivers\HpSAMD.sys ==> MD5 is legit C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit C:\Windows\System32\drivers\i8042prt.sys ==> MD5 is legit C:\Windows\System32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366 C:\Windows\System32\DRIVERS\iirsp.sys ==> MD5 is legit C:\Windows\System32\drivers\intelide.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit C:\Windows\System32\drivers\IPMIDrv.sys ==> MD5 is legit C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit C:\Windows\System32\drivers\isapnp.sys ==> MD5 is legit C:\Windows\System32\drivers\msiscsi.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\itecir.sys 8D990A44B4F2B68E2C56A3724EC3EB84 C:\Windows\System32\DRIVERS\k57nd60a.sys 7DBAFE10C1B777305C80BEA42FBDA710 C:\Windows\System32\drivers\kbdclass.sys ==> MD5 is legit C:\Windows\System32\drivers\kbdhid.sys ==> MD5 is legit C:\Windows\System32\Drivers\ksecdd.sys DA1E991A61CFDD755A589E206B97644B C:\Windows\System32\Drivers\ksecpkg.sys 7E33198D956943A4F11A5474C1E9106F C:\Windows\System32\drivers\ksthunk.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\lsi_fc.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\lsi_sas.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\lsi_sas2.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\lsi_scsi.sys ==> MD5 is legit C:\Windows\System32\drivers\luafv.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\megasas.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\MegaSR.sys ==> MD5 is legit C:\Windows\System32\drivers\mfeapfk.sys EF3ACFB7E3F82D5F7CDE9EF5F0A4E2E2 C:\Windows\System32\drivers\mfeavfk.sys E7A60BDB4365B561D896019B82FB7DD0 C:\Windows\System32\drivers\mfefirek.sys 670DFFE55E2F9AB99D9169C428BCECE9 C:\Windows\System32\drivers\mfehidk.sys 1892616B7F9291FD77C3FA0A5811FE9F C:\Windows\System32\DRIVERS\mfenlfk.sys 1721261C77F6E7A9E0CB51B7D9F31B60 C:\Windows\System32\drivers\mferkdet.sys 65776BD8029E409935B90DE30BF99526 C:\Windows\System32\drivers\mfewfpk.sys 4F17D8B85B903D96EF7033BB6EF50516 C:\Windows\System32\drivers\modem.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit C:\Windows\System32\drivers\mouclass.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit C:\Windows\System32\drivers\mpio.sys ==> MD5 is legit C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit C:\Windows\System32\drivers\mrxdav.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163 C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C C:\Windows\System32\drivers\msahci.sys ==> MD5 is legit C:\Windows\System32\drivers\msdsm.sys ==> MD5 is legit C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit C:\Windows\System32\drivers\mssmbios.sys ==> MD5 is legit C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\MTConfig.sys ==> MD5 is legit C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit C:\Windows\System32\drivers\ndis.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\netw5v64.sys 64428DFDAF6E88366CB51F45A79C5F69 C:\Windows\System32\DRIVERS\nfrd960.sys ==> MD5 is legit C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit C:\Windows\System32\Drivers\Ntfs.sys A2F74975097F52A00745F9637451FDD8 C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit C:\Windows\System32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD C:\Windows\System32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A C:\Windows\System32\drivers\nv_agp.sys ==> MD5 is legit C:\Windows\System32\drivers\ohci1394.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\parport.sys ==> MD5 is legit C:\Windows\System32\drivers\partmgr.sys ==> MD5 is legit C:\Windows\System32\drivers\pci.sys ==> MD5 is legit C:\Windows\System32\drivers\pciide.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\pcmcia.sys ==> MD5 is legit C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\processr.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit C:\Windows\System32\Drivers\PxHlpa64.sys AED797CCA02783296C68AA10D0CFF8A9 C:\Windows\System32\DRIVERS\ql2300.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\ql40xx.sys ==> MD5 is legit C:\Windows\System32\drivers\qwavedrv.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit C:\Windows\System32\Drivers\RDPWD.sys ==> MD5 is legit C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rimspe64.sys E20B1907FC72A3664ECE21E3C20FC63D C:\Windows\System32\DRIVERS\risdpe64.sys A6DA2B0C8F5BB3F9F5423CFF8D6A02D9 C:\Windows\System32\DRIVERS\rixdpe64.sys 6A1CD4674505E6791390A1AB71DA1FBE C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit C:\Windows\System32\drivers\vms3cap.sys ==> MD5 is legit C:\Windows\System32\drivers\sbp2port.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit C:\Windows\System32\drivers\sdbus.sys 111E0EBC0AD79CB0FA014B907B231CF0 C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\serenum.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\serial.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\sermouse.sys ==> MD5 is legit C:\Windows\System32\drivers\sffdisk.sys ==> MD5 is legit C:\Windows\System32\drivers\sffp_mmc.sys ==> MD5 is legit C:\Windows\System32\drivers\sffp_sd.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\sfloppy.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\SiSRaid2.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\sisraid4.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\SNTUSB64.SYS 2D5576C01C8A34AA614870E745FE8F19 C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28 C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3 C:\Windows\System32\DRIVERS\stexstor.sys ==> MD5 is legit C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit C:\Windows\System32\drivers\storvsc.sys ==> MD5 is legit C:\Windows\System32\drivers\swenum.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\SynTP.sys 1657B7442D5CE30533F5C4317716B468 C:\Windows\System32\drivers\tcpip.sys FC62769E7BFF2896035AEED399108162 C:\Windows\System32\DRIVERS\tcpip.sys FC62769E7BFF2896035AEED399108162 C:\Windows\System32\drivers\tcpipreg.sys ==> MD5 is legit C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit C:\Windows\System32\drivers\tdtcp.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit C:\Windows\System32\drivers\termdd.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\uagp35.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit C:\Windows\System32\drivers\uliagpkx.sys ==> MD5 is legit C:\Windows\System32\drivers\umbus.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\umpass.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C C:\Windows\System32\drivers\usbcir.sys ==> MD5 is legit C:\Windows\System32\drivers\usbehci.sys C025055FE7B87701EB042095DF1A2D7B C:\Windows\System32\DRIVERS\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24 C:\Windows\System32\drivers\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31 C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6 C:\Windows\System32\drivers\usbuhci.sys 62069A34518BCF9C1FD9E74B3F6DB7CD C:\Windows\System32\Drivers\usbvideo.sys 454800C2BC7F3927CE030141EE4F4C50 C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit C:\Windows\System32\drivers\vga.sys ==> MD5 is legit C:\Windows\System32\drivers\vhdmp.sys ==> MD5 is legit C:\Windows\System32\drivers\viaide.sys ==> MD5 is legit C:\Windows\System32\drivers\vmbus.sys ==> MD5 is legit C:\Windows\System32\drivers\VMBusHID.sys ==> MD5 is legit C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\vpchbus.sys B4A73CA4EF9A02B9738CEA9AD5FE5917 C:\Windows\System32\DRIVERS\vpcnfltr.sys E675FB2B48C54F09895482E2253B289C C:\Windows\System32\DRIVERS\vpcusb.sys 5FB42082B0D19A0268705F1DD343DF20 C:\Windows\System32\drivers\vpcvmm.sys 207B6539799CC1C112661A9B620DD233 C:\Windows\System32\DRIVERS\vsmraid.sys ==> MD5 is legit C:\Windows\System32\drivers\vwifibus.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\wacompen.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\wd.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\wdcsam64.sys ==> MD5 is legit C:\Windows\System32\drivers\Wdf01000.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit C:\Windows\System32\drivers\wmiacpi.sys ==> MD5 is legit C:\Windows\System32\drivers\ws2ifsl.sys ==> MD5 is legit C:\Windows\System32\drivers\WudfPf.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\WUDFRd.sys ==> MD5 is legit ========================== NetSvcs (Whitelisted) =========== ========================= Known DLLs ========================= [2009-07-13 16:00] - [2009-07-13 17:40] - 0607744 ____A (Microsoft Corporation) C:\Windows\System32\clbcatq.dll [2009-07-13 15:44] - [2009-07-13 17:15] - 0522240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\clbcatq.dll [2011-07-17 11:04] - [2010-11-20 05:27] - 2086912 ____A (Microsoft Corporation) C:\Windows\System32\ole32.dll [2011-07-17 11:04] - [2010-11-20 04:20] - 1414144 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll [2009-07-13 16:41] - [2009-07-13 17:40] - 0877056 ____A (Microsoft Corporation) C:\Windows\System32\advapi32.dll [2011-07-17 11:03] - [2010-11-20 04:18] - 0640512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll [2011-07-17 11:04] - [2010-11-20 05:25] - 0594432 ____A (Microsoft Corporation) C:\Windows\System32\COMDLG32.dll [2011-07-17 11:03] - [2010-11-20 04:18] - 0485888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\COMDLG32.dll [2011-07-17 11:03] - [2010-11-20 05:26] - 0403968 ____A (Microsoft Corporation) C:\Windows\System32\gdi32.dll [2011-07-17 11:02] - [2010-11-20 04:08] - 0311296 ____A (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll [2012-02-16 02:45] - [2011-12-13 22:59] - 2144256 ____A (Microsoft Corporation) C:\Windows\System32\IERTUTIL.dll [2012-02-16 02:45] - [2011-12-13 18:52] - 1792000 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IERTUTIL.dll [2011-07-17 10:59] - [2010-11-20 05:26] - 0076800 ____A (Microsoft Corporation) C:\Windows\System32\IMAGEHLP.dll [2011-07-17 10:59] - [2010-11-20 04:19] - 0155136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IMAGEHLP.dll [2009-07-13 15:38] - [2009-07-13 17:41] - 0167424 ____A (Microsoft Corporation) C:\Windows\System32\IMM32.dll [2011-07-17 10:59] - [2010-11-20 04:08] - 0119808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IMM32.dll [2011-08-10 15:49] - [2011-07-15 21:37] - 1162752 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll [2011-08-10 15:49] - [2011-07-15 20:24] - 1114112 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll [2009-07-13 15:38] - [2009-07-13 17:41] - 0041984 ____A (Microsoft Corporation) C:\Windows\System32\LPK.dll [2009-07-13 15:25] - [2009-07-13 17:11] - 0025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\LPK.dll [2009-07-13 15:40] - [2009-07-13 17:41] - 1067008 ____A (Microsoft Corporation) C:\Windows\System32\MSCTF.dll [2009-07-13 15:28] - [2009-07-13 17:15] - 0828928 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSCTF.dll [2012-02-15 17:35] - [2011-12-16 00:46] - 0634880 ____A (Microsoft Corporation) C:\Windows\System32\MSVCRT.dll [2012-02-15 17:35] - [2011-12-15 23:52] - 0690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MSVCRT.dll [2009-07-13 15:26] - [2009-07-13 17:31] - 0002560 ____A (Microsoft Corporation) C:\Windows\System32\NORMALIZ.dll [2009-07-13 15:15] - [2009-07-13 17:09] - 0002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\NORMALIZ.dll [2009-07-13 15:21] - [2009-07-13 17:41] - 0013824 ____A (Microsoft Corporation) C:\Windows\System32\NSI.dll [2009-07-13 15:12] - [2009-07-13 17:16] - 0008704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\NSI.dll [2011-10-13 04:23] - [2011-08-26 21:37] - 0861696 ____A (Microsoft Corporation) C:\Windows\System32\OLEAUT32.dll [2011-10-13 04:23] - [2011-08-26 20:26] - 0571904 ____A (Microsoft Corporation) C:\Windows\SysWOW64\OLEAUT32.dll [2009-07-13 15:26] - [2009-07-13 17:41] - 0009216 ____A (Microsoft Corporation) C:\Windows\System32\PSAPI.dll [2009-07-13 15:15] - [2009-07-13 17:16] - 0006144 ____A (Microsoft Corporation) C:\Windows\SysWOW64\PSAPI.dll [2011-07-17 11:04] - [2010-11-20 05:27] - 1219584 ____A (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll [2011-07-17 11:00] - [2010-11-20 04:08] - 0663040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll [2009-07-13 15:20] - [2009-07-13 17:41] - 0113664 ____A (Microsoft Corporation) C:\Windows\System32\sechost.dll [2009-07-13 15:11] - [2009-07-13 17:16] - 0092160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll [2011-07-17 11:04] - [2010-11-20 05:27] - 1900544 ____A (Microsoft Corporation) C:\Windows\System32\Setupapi.dll [2011-07-17 11:03] - [2010-11-20 04:21] - 1667584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\Setupapi.dll [2012-02-15 17:35] - [2012-01-04 02:44] - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\SHELL32.dll [2012-02-15 17:35] - [2012-01-04 00:59] - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SHELL32.dll [2011-07-17 11:04] - [2010-11-20 05:27] - 0448512 ____A (Microsoft Corporation) C:\Windows\System32\SHLWAPI.dll [2011-07-17 11:03] - [2010-11-20 04:21] - 0350208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SHLWAPI.dll [2012-02-16 02:45] - [2011-12-13 23:04] - 1345536 ____A (Microsoft Corporation) C:\Windows\System32\URLMON.dll [2012-02-16 02:45] - [2011-12-13 18:57] - 1103360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\URLMON.dll [2011-07-17 11:04] - [2010-11-20 05:27] - 1008128 ____A (Microsoft Corporation) C:\Windows\System32\user32.dll [2011-07-17 11:03] - [2010-11-20 04:08] - 0833024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll [2011-07-17 11:04] - [2010-11-20 05:27] - 0800256 ____A (Microsoft Corporation) C:\Windows\System32\USP10.dll [2011-07-17 11:03] - [2010-11-20 04:21] - 0626176 ____A (Microsoft Corporation) C:\Windows\SysWOW64\USP10.dll [2012-02-16 02:45] - [2011-12-13 23:04] - 1390080 ____A (Microsoft Corporation) C:\Windows\System32\WININET.dll [2012-02-16 02:45] - [2011-12-13 18:57] - 1127424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WININET.dll [2011-07-17 11:03] - [2010-11-20 05:27] - 0312832 ____A (Microsoft Corporation) C:\Windows\System32\WLDAP32.dll [2011-07-17 11:03] - [2010-11-20 04:21] - 0269824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WLDAP32.dll [2011-07-17 11:04] - [2010-11-20 05:27] - 0297984 ____A (Microsoft Corporation) C:\Windows\System32\WS2_32.dll [2011-07-17 11:02] - [2010-11-20 04:21] - 0206848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WS2_32.dll [2009-07-13 15:27] - [2009-07-13 17:40] - 0504320 ____A (Microsoft Corporation) C:\Windows\System32\DifxApi.dll [2009-07-13 15:16] - [2009-07-13 17:15] - 0315904 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DifxApi.dll ========================= Bamital & volsnap Check ============ C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe [2011-07-15 13:32] - [2011-02-24 21:30] - 2616320 ____A (Microsoft Corporation) 8B88EBBB05A0E56B7DCC708498C02B3E C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ========================= Memory info ====================== Percentage of memory in use: 12% Total physical RAM: 8180.5 MB Available physical RAM: 7129.42 MB Total Pagefile: 8178.65 MB Available Pagefile: 7116.2 MB Total Virtual: 8192 MB Available Virtual: 8191.9 MB ======================= Partitions ========================= 1 Drive c: () (Fixed) (Total:596.07 GB) (Free:364.95 GB) NTFS 3 Drive f: (My Book) (Fixed) (Total:465.65 GB) (Free:262.89 GB) FAT32 4 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS 5 Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] Disk ### Status Size Free Dyn Gpt ——– ————- ——- ——- — — Disk 0 Online 596 GB 0 B Disk 1 Online 465 GB 1024 KB Partitions of Disk 0: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 Primary 100 MB 1024 KB Partition 2 Primary 596 GB 101 MB Disk: 0 Partition 1 Type : 07 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 1 Y System Rese NTFS Partition 100 MB Healthy Disk: 0 Partition 2 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 2 C NTFS Partition 596 GB Healthy Partitions of Disk 1: =============== Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 Primary 465 GB 31 KB Disk: 1 Partition 1 Type : 0C Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 3 F My Book FAT32 Partition 465 GB Healthy ========================================================== TDL4: custom:26000022 ========================================================== Last Boot: 2012-02-21 08:10 ======================= End Of Log ==========================

patndoris

Post #49February 24, 2012, 12:27 AM UTC

Yes just the one check box. Let's hope the log sheds some light on what the boot issue is. Just one bad file can keep the system from behaving properly. You are doing great through all of this!

patndoris

Post #50February 24, 2012, 12:28 AM UTC

Great job Sue! Now, please give me a little time to take a look at this - as you can see it's a pretty lengthy log - so there's a lot for me to look at to try and find what might be going on. I'll be back to you just as soon as I can, I promise.

Susan09

Post #51February 24, 2012, 12:35 AM UTC

no problem:) take your time and I think you have done great! I'm not worried….I have faith:) Thank you so much!!!!

patndoris

Post #52February 24, 2012, 4:13 AM UTC

OK here we go Sue! The quickest way to do this is going to be to open notepad on your husband's computer to create this file, and to save it to the external hard drive. Then plug the external hard drive back into your computer.

Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the external hard drive as fixlist.txt

HKU\Sue\…\Run: [1Y5U7AYUUGXZZU3VKSDKQNNZYV] C:\Fonts\6DFBBA775DC.exe /q [346624 2011-11-16] (Belkin Corporation)
C:\Fonts\6DFBBA775DC.exe
TDL4: custom:26000022

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Make sure your external drive is plugged into the computer.

Restart your computer and tap F8 to bring up the Advanced Menu, then click Repair your computer

Follow the prompt to enter keyboard input method, and then the prompt to enter a password. If the machine does not have a password, simply click Enter.

In the next menu, use the arrow keys on the keyboard to highlight Command Prompt and press Enter.

To run the tool again, type in the following and press Enter:

F:\frst64.exe

When the tool opens, click the Fix button just once and wait for the tool to complete.

Restart the machine. If Windows boots now, disable any active protection programs and please run ComboFix.exe again. Allow the tool to update if prompted.
(If for any reason you don't have the program on the machine as a result of the restore attempts - here is the link again.)

Post the C:\ComboFix.txt when it has completed.

Hopefully, you still have TDSSKiller on your desktop (from before the failed restore attempts) but if not, I'll include the full instructions.

Please read carefully and follow these steps. There is a difference between what you see in one of the images below and what I need you to do.
We are only creating a log - I do NOT want you to "cure" or try to fix anything in this step. It is very important that you don't choose Cure when presented with that option.

Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop.
Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.

🖼Click to load external image (Posted Image)
If an infected file is detected, the default action will be Cure but I want you to choose SKIP instead , click on Continue.

🖼Click to load external image (Posted Image)
If a suspicious file is detected, the default action will be Skip, click on Continue.

🖼Click to load external image (Posted Image)
It may ask you to reboot the computer to complete the process. Click on Reboot Now.

🖼Click to load external image (Posted Image)
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

=============================================

If Windows still will not boot, please post the contents of the Fixlog.txt located on your external drive. (same place where frst64.exe is located)

Susan09

Post #53February 24, 2012, 12:16 PM UTC

First, you are Brilliant! I was never so happy to see my computer wake up in my life!!! Thank you for your continued perserverance!!!The good news…I was able to even get to this site on it and downloaded combofix. I ran it and the logfile is below but ever since combofix it will not allow me to open most of the files on the desktop or get back to this site or use explorer. The message keeps popping up that (Illegal operation attempted on registry key that has been marked for deletion). So I am going to wait right here and get your direction for go ahead because I do not want to delete anything. Here is the file : ************ ComboFix 12-02-24.01 - Sue 02/24/2012 6:36.3.8 - x64 Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8180.6433 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} FW: McAfee Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . E:\Autorun.inf . . ((((((((((((((((((((((((( Files Created from 2012-01-24 to 2012-02-24 ))))))))))))))))))))))))))))))) . . 2012-02-24 11:45 . 2012-02-24 11:45 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-02-24 03:20 . 2012-02-24 03:22 ——– d—–w- C:\FRST 2012-02-21 03:26 . 2012-02-21 03:26 ——– d—–w- c:\program files (x86)\ESET 2012-02-17 01:51 . 2012-02-17 01:52 ——– d—–w- c:\program files (x86)\SpywareBlaster 2012-02-17 01:35 . 2011-10-15 17:16 10248 —-a-w- c:\windows\system32\drivers\mfeclnk.sys 2012-02-17 01:35 . 2012-02-24 00:52 ——– d—–w- c:\program files (x86)\Common Files\McAfee 2012-02-17 01:34 . 2011-10-15 17:16 75808 —-a-w- c:\windows\system32\drivers\mfenlfk.sys 2012-02-17 01:34 . 2011-10-15 17:16 65264 —-a-w- c:\windows\system32\drivers\cfwids.sys 2012-02-17 01:34 . 2011-10-15 17:16 481768 —-a-w- c:\windows\system32\drivers\mfefirek.sys 2012-02-17 01:34 . 2011-10-15 17:16 284648 —-a-w- c:\windows\system32\drivers\mfewfpk.sys 2012-02-17 01:34 . 2011-10-15 17:16 229528 —-a-w- c:\windows\system32\drivers\mfeavfk.sys 2012-02-17 01:34 . 2011-10-15 17:16 100912 —-a-w- c:\windows\system32\drivers\mferkdet.sys 2012-02-17 01:33 . 2012-02-17 01:36 ——– d—–w- c:\program files\Common Files\McAfee 2012-02-17 01:33 . 2012-02-17 01:40 ——– d—–w- c:\program files\McAfee 2012-02-17 01:33 . 2012-02-24 00:51 ——– d—–w- c:\program files (x86)\McAfee 2012-02-17 01:04 . 2011-11-18 21:36 161168 —-a-w- c:\windows\system32\mfevtps.exe 2012-02-16 11:04 . 2012-02-16 11:04 ——– d-sh–w- c:\windows\SysWow64\%APPDATA% 2012-02-16 10:46 . 2012-02-16 10:46 ——– d—–w- C:\f3973abe5b5704946d557e1e 2012-02-16 01:35 . 2012-01-04 10:44 509952 —-a-w- c:\windows\system32\ntshrui.dll 2012-02-16 01:35 . 2012-01-04 08:58 442880 —-a-w- c:\windows\SysWow64\ntshrui.dll 2012-02-16 01:35 . 2011-12-30 06:26 515584 —-a-w- c:\windows\system32\timedate.cpl 2012-02-16 01:35 . 2011-12-30 05:27 478720 —-a-w- c:\windows\SysWow64\timedate.cpl 2012-02-16 01:35 . 2012-01-14 04:06 3145728 —-a-w- c:\windows\system32\win32k.sys 2012-02-16 01:35 . 2011-12-28 03:59 498688 —-a-w- c:\windows\system32\drivers\afd.sys 2012-02-16 01:35 . 2011-12-16 08:46 634880 —-a-w- c:\windows\system32\msvcrt.dll 2012-02-16 01:35 . 2011-12-16 07:52 690688 —-a-w- c:\windows\SysWow64\msvcrt.dll 2012-02-14 11:24 . 2012-02-14 11:24 ——– d—–w- c:\programdata\CenturyLink 2012-02-14 11:24 . 2012-02-14 11:24 ——– d—–w- c:\program files (x86)\Qwest 2012-02-14 11:23 . 2012-02-14 11:23 ——– d—–w- c:\program files (x86)\CenturyLink 2012-02-14 02:31 . 2012-02-14 02:31 ——– d—–w- c:\users\Sue\AppData\Roaming\Dell 2012-02-14 02:30 . 2012-02-14 02:31 ——– d—–w- c:\program files\Dell Support Center 2012-02-14 02:16 . 2012-02-14 02:16 ——– d—–w- c:\users\Sue\AppData\Roaming\PCDr 2012-02-09 22:14 . 2012-02-11 12:25 ——– d—–w- c:\programdata\Spybot - Search & Destroy 2012-02-09 04:37 . 2012-02-09 04:37 ——– d—–w- c:\users\Sue\AppData\Roaming\Malwarebytes 2012-02-09 04:37 . 2012-02-09 04:37 ——– d—–w- c:\programdata\Malwarebytes 2012-02-05 18:18 . 2012-02-05 18:18 110080 —-a-w- c:\users\Sue\AppData\Roaming\Microsoft\Installer\{5B210B8A-B66E-4702-B44D-0D6F388D29EB}\IconF7A21AF7.exe 2012-02-05 18:18 . 2012-02-05 18:18 110080 —-a-w- c:\users\Sue\AppData\Roaming\Microsoft\Installer\{5B210B8A-B66E-4702-B44D-0D6F388D29EB}\IconD7F16134.exe 2012-02-05 18:18 . 2012-02-05 18:18 110080 —-a-w- c:\users\Sue\AppData\Roaming\Microsoft\Installer\{5B210B8A-B66E-4702-B44D-0D6F388D29EB}\Icon1226A4C5.exe 2012-02-05 18:18 . 2012-02-05 18:19 ——– d—–w- C:\sh4ldr 2012-02-05 18:18 . 2012-02-05 18:18 ——– d—–w- c:\program files\Enigma Software Group 2012-02-05 18:18 . 2012-02-05 18:18 ——– d—–w- c:\windows\5B210B8AB66E4702B44D0D6F388D29EB.TMP 2012-02-05 18:18 . 2012-02-05 18:18 ——– d—–w- c:\program files (x86)\Common Files\Wise Installation Wizard 2012-02-05 17:35 . 2012-01-29 21:44 174008 —-a-w- c:\program files (x86)\2pres.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-02-08 18:20 . 2011-08-03 17:29 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-01-06 16:51 . 2011-12-06 20:47 45568 —-a-w- c:\windows\system32\iolobtdfg.exe 2012-01-06 16:51 . 2011-12-06 20:47 14848 —-a-w- c:\windows\system32\smrgdf.exe 2012-01-06 16:29 . 2011-12-06 20:47 2141832 —-a-w- c:\windows\system32\Incinerator64.dll 2012-01-06 16:29 . 2011-12-06 20:47 2083464 —-a-w- c:\windows\SysWow64\Incinerator32.dll 2011-12-06 20:44 . 2011-12-06 20:44 74703 —-a-w- c:\windows\SysWow64\mfc45.dll . . ((((((((((((((((((((((((((((( SnapShot@2012-02-16_15.28.22 ))))))))))))))))))))))))))))))))))))))))) . + 2011-07-16 00:04 . 2012-02-24 11:48 49204 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-02-24 11:48 36424 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2011-07-15 20:56 . 2012-02-24 11:48 16894 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3270653034-3299824299-49919293-1000_UserData.bin - 2011-08-15 02:15 . 2011-08-14 22:01 67584 c:\windows\system32\LogFiles\Srt\bootstat.dat + 2011-08-15 02:15 . 2012-02-23 03:31 67584 c:\windows\system32\LogFiles\Srt\bootstat.dat + 2009-07-14 05:30 . 2012-02-17 01:35 86016 c:\windows\system32\DriverStore\infpub.dat - 2009-07-14 05:30 . 2012-02-16 12:23 86016 c:\windows\system32\DriverStore\infpub.dat + 2012-02-17 01:34 . 2011-10-15 17:16 75808 c:\windows\system32\DriverStore\FileRepository\mfenlfk.inf_amd64_neutral_acec8c424d80b3f4\mfenlfk.sys - 2011-07-15 22:53 . 2012-02-16 13:02 49152 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-07-15 22:53 . 2012-02-24 11:38 49152 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2011-07-15 22:53 . 2012-02-24 11:38 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2011-07-15 22:53 . 2012-02-16 13:02 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-02-24 11:38 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-02-16 13:02 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2012-02-24 11:46 . 2012-02-24 11:46 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-02-16 15:24 . 2012-02-16 15:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-02-24 11:46 . 2012-02-24 11:46 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2012-02-16 15:24 . 2012-02-16 15:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2011-07-16 13:06 . 2012-02-22 16:31 287338 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin + 2009-07-14 05:30 . 2012-02-17 01:35 143360 c:\windows\system32\DriverStore\infstrng.dat - 2009-07-14 05:30 . 2012-02-16 12:23 143360 c:\windows\system32\DriverStore\infstrng.dat + 2009-07-14 05:30 . 2012-02-17 01:35 143360 c:\windows\system32\DriverStore\infstor.dat - 2009-07-14 05:30 . 2012-02-16 12:23 143360 c:\windows\system32\DriverStore\infstor.dat + 2011-10-15 17:16 . 2011-10-15 17:16 647080 c:\windows\system32\drivers\mfehidk.sys + 2011-10-15 17:16 . 2011-10-15 17:16 160280 c:\windows\system32\drivers\mfeapfk.sys + 2009-07-14 05:38 . 2012-02-24 00:52 262144 c:\windows\system32\config\systemprofile\ntuser.dat - 2009-07-14 05:38 . 2011-09-16 01:18 262144 c:\windows\system32\config\systemprofile\ntuser.dat + 2009-07-14 05:12 . 2012-02-24 11:38 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat - 2009-07-14 05:12 . 2012-02-16 11:55 262144 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2009-07-14 04:46 . 2012-02-18 23:33 105184 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat - 2009-07-14 05:01 . 2012-02-16 15:23 596896 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2012-02-24 11:45 596896 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2011-07-16 21:22 . 2012-02-24 11:45 30814564 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3270653034-3299824299-49919293-1000-8192.dat - 2011-07-16 21:22 . 2012-02-16 15:23 11718971 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3270653034-3299824299-49919293-1000-12288.dat + 2011-07-16 21:22 . 2012-02-17 02:47 11718971 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3270653034-3299824299-49919293-1000-12288.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-11-13 421736] "Intuit SyncManager"="c:\program files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2011-02-22 1497352] "iolo Startup"="c:\program files (x86)\iolo\Common\Lib\ioloLManager.exe" [2012-01-06 606904] "CenturyLinkTouchPointAgent"="c:\program files (x86)\CenturyLink\Desktop\CenturyLinkTouchPointAgent.exe" [2011-12-02 46208] "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-11-22 1675160] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ QuickBooks Update Agent.lnk - c:\program files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2011-11-11 1155432] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016] R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [2011-03-02 13088] R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2011-07-16 1038088] R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x] R3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2012-02-01 25072] R3 RoxMediaDB10;RoxMediaDB10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-06-26 1124848] R3 SNTUSB64;SafeNet USB SuperPro/UltraPro/HardwareKey;c:\windows\system32\DRIVERS\SNTUSB64.SYS [x] R3 Sound Blaster X-Fi MB Licensing Service;Sound Blaster X-Fi MB Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [2011-07-15 79360] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [x] S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x] S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\ElRawDsk.sys [x] S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x] S2 ioloSystemService;iolo System Service;c:\program files (x86)\iolo\Common\Lib\ioloServiceManager.exe [2012-01-06 722616] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936] S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936] S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936] S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-12-06 208536] S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x] S2 QDLService2kDell;Qualcomm Gobi 2000 Download Service (Dell);c:\program files (x86)\QUALCOMM\QDLService2k\QDLService2kDell.exe [2009-10-10 329976] S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe64.sys [x] S2 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe64.sys [x] S2 rixdpcie;rixdpcie;c:\windows\system32\DRIVERS\rixdpe64.sys [x] S2 SAiAdmin;SAiAdmin;c:\windows\SysWOW64\SAiAdmin.exe [2007-08-27 65536] S2 SAiDownloaderVista;SAiDownloaderVista;c:\windows\SysWOW64\SAiDownloaderVista.exe [2007-09-11 77824] S2 SAiLicSvr;SAiLicSvr;c:\windows\SysWOW64\SAiLicSvr.exe [2007-12-19 86016] S2 SentinelKeysServer;Sentinel Keys Server;c:\program files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [2009-09-17 369952] S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [x] S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [x] S3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x] S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x] S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x] . . — Other Services/Drivers In Memory — . *Deregistered* - mfeavfk01 . . ——— x86-64 ———– . . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://yahoo.com/ uInternet Settings,ProxyOverride = *.local DPF: {682C59F5-478C-4421-9070-AD170D143B77} - hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd86.cab . . ——- File Associations ——- . JSEFile=NOTEPAD.EXE %1 . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0] "ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{47833539-D0C5-4125-9FA8-0819E2EAAC93}"=hex:51,66,7a,6c,4c,1d,38,12,57,36,90, 43,f7,9e,4b,04,e0,be,4b,59,e7,b4,e8,87 "{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064}"=hex:51,66,7a,6c,4c,1d,38,12,26,bd,a8, 0a,e6,f4,22,0e,f1,4c,12,2a,bb,94,a4,70 "{472734EA-242A-422B-ADF8-83D1E48CC825}"=hex:51,66,7a,6c,4c,1d,38,12,84,37,34, 43,18,6a,45,07,d2,ee,c0,91,e1,d2,8c,31 "{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,38,12,df,c1,0b, 27,57,07,ba,54,e4,0e,43,d0,22,fb,89,5b "{0F83EFF0-B27F-E984-1167-FFD3E0834D32}"=hex:51,66,7a,6c,4c,1d,38,12,9e,ec,90, 0b,4d,fc,ea,ac,6e,71,bc,93,e5,dd,09,26 "{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc, 1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7 "{2A0F3D1B-0909-4FF4-B272-609CCE6054E7}"=hex:51,66,7a,6c,4c,1d,38,12,75,3e,1c, 2e,3b,47,9a,0a,cd,64,23,dc,cb,3e,10,f3 "{7DB2D5A0-7241-4E79-B68D-6309F01C5231}"=hex:51,66,7a,6c,4c,1d,38,12,ce,d6,a1, 79,73,3c,17,0b,c9,9b,20,49,f5,42,16,25 "{8A86D350-37AB-410A-8531-7D1363F317B3}"=hex:51,66,7a,6c,4c,1d,38,12,3e,d0,95, 8e,99,79,64,04,fa,27,3e,53,66,ad,53,a7 "{8AB82496-045B-C914-E18D-D73A97F7A8D3}"=hex:51,66,7a,6c,4c,1d,38,12,f8,27,ab, 8e,69,4a,7a,8c,9e,9b,94,7a,92,a9,ec,c7 "{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,38,12,36,ee,4b, ae,ef,4f,ff,08,fc,25,8c,50,52,2a,37,e3 "{AE7CD045-E861-484F-8273-0445EE161910}"=hex:51,66,7a,6c,4c,1d,38,12,2b,d3,6f, aa,53,a6,21,0d,fd,65,47,05,eb,48,5d,04 "{B164E929-A1B6-4A06-B104-2CD0E90A88FF}"=hex:51,66,7a,6c,4c,1d,38,12,47,ea,77, b5,84,ef,68,0f,ce,12,6f,90,ec,54,cc,eb "{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}"=hex:51,66,7a,6c,4c,1d,38,12,92,9a,85, b0,57,58,7a,01,de,dd,87,e2,a1,ff,7a,f8 "{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db, df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd "{F429AFC8-F367-F9B4-6DFA-2530E987E7F8}"=hex:51,66,7a,6c,4c,1d,38,12,a6,ac,3a, f0,55,bd,da,bc,12,ec,66,70,ec,d9,a3,ec "{F4971EE7-DAA0-4053-9964-665D8EE6A077}"=hex:51,66,7a,6c,4c,1d,38,12,89,1d,84, f0,92,94,3d,05,e6,72,25,1d,8b,b8,e4,63 "{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}"=hex:51,66,7a,6c,4c,1d,38,12,70,05,61, f9,ec,d1,23,0d,da,9c,48,eb,44,0f,8e,cc "{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16, fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17 "{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9, b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (LocalSystem) "Timestamp"=hex:88,98,e8,5f,d8,ca,cc,01 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}] @Denied: (A) (Everyone) "Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane\0] "Key"="ActionsPane" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe c:\windows\SysWOW64\rundll32.exe . ************************************************************************** . Completion time: 2012-02-24 06:54:43 - machine was rebooted ComboFix-quarantined-files.txt 2012-02-24 11:54 ComboFix2.txt 2012-02-16 15:50 . Pre-Run: 396,631,207,936 bytes free Post-Run: 396,343,902,208 bytes free . - - End Of File - - E5B8E11E394B5F1BF4454E993AAB70FB

Susan09

Post #54February 24, 2012, 12:31 PM UTC

I do have system mechanic on my computer…not sure if it will run and I don't want to screw up anything but it does something with the registry so if we have lost something maybe it has a backup??? I will not open it without you because it may alter something, but I checked and most of my programs are listed for deletion upon trying to open.

patndoris

Post #55February 24, 2012, 12:35 PM UTC

*Wink* I did have input from some of my contemporaries which was quite helpful with these last set of instructions, but I'm very glad we have you booted up and running. Please do NOT run any other tools than those in the instructions I'm giving you. I appreciate your willingness to try an help but it can confuse things more. Just reboot the system again. It's not unusual to see those errors after running Combofix and a reboot again usually fixes those errors you are seeing. If they continue please let me know, otherwise go ahead with the TDSSKiller instructions to produce a log only but remember NOT to cure anything, I just want to see if we are still dealing with any infection there. I'm so glad things are looking up (and with no loss of data yay!!) (I do need to analyze the Combofix log but I'm at work right now so that will be later this afternoon I'm afraid).

Susan09

Post #56February 24, 2012, 12:38 PM UTC

No problem…I will check later on this afternoon then:) Have a great day!!!!

Susan09

Post #57February 24, 2012, 12:40 PM UTC

You were right…upon rebooting explorer opens

On to the tddskiller!

Susan09

Post #58February 24, 2012, 12:56 PM UTC

I ran the program…It said no threats found:) I tried to copy and paste the report but it will not work with right click? The version of the program does not look exactly like yours …it is a newer version I guess but same thing. Is ther another way to copy and paste that report?

patndoris

Post #59February 24, 2012, 1:07 PM UTC

No, but if it was clear that's fine that's what I really need to know. That's what I want to hear!

I'll just double check that Combofix when I get home, but I have a very good feeling that we may have gotten it all this time. Have a nice day Sue…..you can relax a bit more today

Susan09

Post #60February 24, 2012, 1:10 PM UTC

Got it:) control +c 07:44:49.0495 5308 TDSS rootkit removing tool [removed] Feb 22 2012 16:54:49 07:44:50.0135 5308 ============================================================ 07:44:50.0135 5308 Current date / time: 2012/02/24 07:44:50.0135 07:44:50.0135 5308 SystemInfo: 07:44:50.0135 5308 07:44:50.0135 5308 OS Version: 6.1.7601 ServicePack: 1.0 07:44:50.0135 5308 Product type: Workstation 07:44:50.0135 5308 ComputerName: SUE-PC 07:44:50.0135 5308 UserName: Sue 07:44:50.0135 5308 Windows directory: C:\Windows 07:44:50.0135 5308 System windows directory: C:\Windows 07:44:50.0135 5308 Running under WOW64 07:44:50.0135 5308 Processor architecture: Intel x64 07:44:50.0135 5308 Number of processors: 8 07:44:50.0135 5308 Page size: 0x1000 07:44:50.0135 5308 Boot type: Normal boot 07:44:50.0135 5308 ============================================================ 07:44:51.0367 5308 Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 07:44:51.0383 5308 \Device\Harddisk0\DR0: 07:44:51.0383 5308 MBR used 07:44:51.0383 5308 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000 07:44:51.0383 5308 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x4A825000 07:44:51.0399 5308 Initialize success 07:44:51.0399 5308 ============================================================ 07:44:54.0768 3520 ============================================================ 07:44:54.0768 3520 Scan started 07:44:54.0768 3520 Mode: Manual; 07:44:54.0768 3520 ============================================================ 07:44:56.0547 3520 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys 07:44:56.0562 3520 1394ohci - ok 07:44:56.0687 3520 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys 07:44:56.0703 3520 ACPI - ok 07:44:56.0796 3520 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys 07:44:56.0796 3520 AcpiPmi - ok 07:44:56.0905 3520 adfs (2f0683fd2df1d92e891caca14b45a8c1) C:\Windows\system32\drivers\adfs.sys 07:44:56.0905 3520 adfs - ok 07:44:57.0061 3520 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 07:44:57.0061 3520 adp94xx - ok 07:44:57.0186 3520 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 07:44:57.0186 3520 adpahci - ok 07:44:57.0358 3520 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 07:44:57.0358 3520 adpu320 - ok 07:44:57.0514 3520 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys 07:44:57.0529 3520 AFD - ok 07:44:57.0623 3520 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys 07:44:57.0623 3520 agp440 - ok 07:44:57.0701 3520 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys 07:44:57.0701 3520 aliide - ok 07:44:57.0779 3520 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys 07:44:57.0779 3520 amdide - ok 07:44:57.0857 3520 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 07:44:57.0857 3520 AmdK8 - ok 07:44:57.0966 3520 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 07:44:57.0966 3520 AmdPPM - ok 07:44:58.0060 3520 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys 07:44:58.0060 3520 amdsata - ok 07:44:58.0153 3520 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 07:44:58.0153 3520 amdsbs - ok 07:44:58.0247 3520 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys 07:44:58.0247 3520 amdxata - ok 07:44:58.0434 3520 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys 07:44:58.0450 3520 AppID - ok 07:44:58.0559 3520 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 07:44:58.0559 3520 arc - ok 07:44:58.0684 3520 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 07:44:58.0684 3520 arcsas - ok 07:44:58.0793 3520 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 07:44:58.0793 3520 AsyncMac - ok 07:44:59.0011 3520 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys 07:44:59.0011 3520 atapi - ok 07:44:59.0433 3520 atikmdag (52bd95caa9cae8977fe043e9ad6d2d0e) C:\Windows\system32\DRIVERS\atikmdag.sys 07:44:59.0557 3520 atikmdag - ok 07:44:59.0745 3520 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 07:44:59.0760 3520 b06bdrv - ok 07:44:59.0885 3520 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 07:44:59.0885 3520 b57nd60a - ok 07:44:59.0979 3520 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 07:44:59.0979 3520 Beep - ok 07:45:00.0119 3520 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 07:45:00.0119 3520 blbdrive - ok 07:45:00.0259 3520 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys 07:45:00.0259 3520 bowser - ok 07:45:00.0353 3520 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 07:45:00.0353 3520 BrFiltLo - ok 07:45:00.0447 3520 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 07:45:00.0447 3520 BrFiltUp - ok 07:45:00.0571 3520 BridgeMP (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys 07:45:00.0587 3520 BridgeMP - ok 07:45:00.0759 3520 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 07:45:00.0759 3520 Brserid - ok 07:45:00.0852 3520 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 07:45:00.0852 3520 BrSerWdm - ok 07:45:00.0946 3520 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 07:45:00.0946 3520 BrUsbMdm - ok 07:45:01.0024 3520 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 07:45:01.0024 3520 BrUsbSer - ok 07:45:01.0149 3520 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 07:45:01.0149 3520 BTHMODEM - ok 07:45:01.0211 3520 catchme - ok 07:45:01.0351 3520 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 07:45:01.0351 3520 cdfs - ok 07:45:01.0476 3520 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys 07:45:01.0476 3520 cdrom - ok 07:45:01.0617 3520 cfwids (ed0263b2eb24f0f4e3898036fa1d28a1) C:\Windows\system32\drivers\cfwids.sys 07:45:01.0617 3520 cfwids - ok 07:45:01.0741 3520 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 07:45:01.0741 3520 circlass - ok 07:45:01.0866 3520 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 07:45:01.0866 3520 CLFS - ok 07:45:02.0022 3520 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 07:45:02.0022 3520 CmBatt - ok 07:45:02.0085 3520 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys 07:45:02.0085 3520 cmdide - ok 07:45:02.0225 3520 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys 07:45:02.0225 3520 CNG - ok 07:45:02.0303 3520 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 07:45:02.0303 3520 Compbatt - ok 07:45:02.0459 3520 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys 07:45:02.0459 3520 CompositeBus - ok 07:45:02.0584 3520 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 07:45:02.0584 3520 crcdisk - ok 07:45:02.0709 3520 CSC (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys 07:45:02.0724 3520 CSC - ok 07:45:02.0865 3520 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys 07:45:02.0880 3520 DfsC - ok 07:45:02.0974 3520 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 07:45:02.0989 3520 discache - ok 07:45:03.0083 3520 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 07:45:03.0083 3520 Disk - ok 07:45:03.0192 3520 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 07:45:03.0192 3520 drmkaud - ok 07:45:03.0379 3520 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys 07:45:03.0379 3520 DXGKrnl - ok 07:45:03.0645 3520 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 07:45:03.0738 3520 ebdrv - ok 07:45:03.0925 3520 ElRawDisk (d38a883309e04b9fbffe1aca60ea3bbf) C:\Windows\system32\drivers\ElRawDsk.sys 07:45:03.0925 3520 ElRawDisk - ok 07:45:04.0066 3520 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 07:45:04.0081 3520 elxstor - ok 07:45:04.0175 3520 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys 07:45:04.0175 3520 ErrDev - ok 07:45:04.0237 3520 esgiguard (df96c3cd6ae15f6d0a6bcb70f9c1e88d) C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys 07:45:04.0253 3520 esgiguard - ok 07:45:04.0378 3520 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 07:45:04.0378 3520 exfat - ok 07:45:04.0487 3520 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 07:45:04.0487 3520 fastfat - ok 07:45:04.0565 3520 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 07:45:04.0565 3520 fdc - ok 07:45:04.0690 3520 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 07:45:04.0705 3520 FileInfo - ok 07:45:04.0846 3520 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 07:45:04.0846 3520 Filetrace - ok 07:45:04.0955 3520 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 07:45:04.0955 3520 flpydisk - ok 07:45:05.0080 3520 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys 07:45:05.0095 3520 FltMgr - ok 07:45:05.0251 3520 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 07:45:05.0251 3520 FsDepends - ok 07:45:05.0361 3520 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys 07:45:05.0361 3520 Fs_Rec - ok 07:45:05.0485 3520 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys 07:45:05.0485 3520 fvevol - ok 07:45:05.0610 3520 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 07:45:05.0610 3520 gagp30kx - ok 07:45:05.0735 3520 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 07:45:05.0735 3520 GEARAspiWDM - ok 07:45:05.0860 3520 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 07:45:05.0875 3520 hcw85cir - ok 07:45:05.0985 3520 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys 07:45:05.0985 3520 HdAudAddService - ok 07:45:06.0094 3520 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys 07:45:06.0094 3520 HDAudBus - ok 07:45:06.0203 3520 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 07:45:06.0203 3520 HidBatt - ok 07:45:06.0312 3520 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 07:45:06.0312 3520 HidBth - ok 07:45:06.0453 3520 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 07:45:06.0453 3520 HidIr - ok 07:45:06.0609 3520 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys 07:45:06.0609 3520 HidUsb - ok 07:45:06.0749 3520 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys 07:45:06.0749 3520 HpSAMD - ok 07:45:07.0014 3520 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys 07:45:07.0030 3520 HTTP - ok 07:45:07.0139 3520 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys 07:45:07.0139 3520 hwpolicy - ok 07:45:07.0264 3520 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys 07:45:07.0264 3520 i8042prt - ok 07:45:07.0420 3520 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys 07:45:07.0435 3520 iaStorV - ok 07:45:07.0560 3520 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 07:45:07.0560 3520 iirsp - ok 07:45:07.0669 3520 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys 07:45:07.0669 3520 intelide - ok 07:45:07.0763 3520 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 07:45:07.0763 3520 intelppm - ok 07:45:07.0919 3520 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys 07:45:07.0919 3520 IpFilterDriver - ok 07:45:08.0044 3520 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys 07:45:08.0059 3520 IPMIDRV - ok 07:45:08.0153 3520 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 07:45:08.0153 3520 IPNAT - ok 07:45:08.0325 3520 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 07:45:08.0325 3520 IRENUM - ok 07:45:08.0481 3520 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys 07:45:08.0481 3520 isapnp - ok 07:45:08.0621 3520 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys 07:45:08.0621 3520 iScsiPrt - ok 07:45:08.0699 3520 itecir (8d990a44b4f2b68e2c56a3724ec3eb84) C:\Windows\system32\DRIVERS\itecir.sys 07:45:08.0699 3520 itecir - ok 07:45:08.0855 3520 k57nd60a (7dbafe10c1b777305c80bea42fbda710) C:\Windows\system32\DRIVERS\k57nd60a.sys 07:45:08.0871 3520 k57nd60a - ok 07:45:08.0980 3520 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys 07:45:08.0980 3520 kbdclass - ok 07:45:09.0167 3520 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys 07:45:09.0167 3520 kbdhid - ok 07:45:09.0307 3520 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys 07:45:09.0307 3520 KSecDD - ok 07:45:09.0417 3520 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys 07:45:09.0432 3520 KSecPkg - ok 07:45:09.0526 3520 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 07:45:09.0526 3520 ksthunk - ok 07:45:09.0697 3520 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 07:45:09.0697 3520 lltdio - ok 07:45:09.0838 3520 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 07:45:09.0838 3520 LSI_FC - ok 07:45:09.0931 3520 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 07:45:09.0931 3520 LSI_SAS - ok 07:45:10.0025 3520 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 07:45:10.0025 3520 LSI_SAS2 - ok 07:45:10.0165 3520 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 07:45:10.0165 3520 LSI_SCSI - ok 07:45:10.0275 3520 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 07:45:10.0275 3520 luafv - ok 07:45:10.0524 3520 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 07:45:10.0524 3520 megasas - ok 07:45:10.0633 3520 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 07:45:10.0633 3520 MegaSR - ok 07:45:10.0758 3520 mfeapfk (ef3acfb7e3f82d5f7cde9ef5f0a4e2e2) C:\Windows\system32\drivers\mfeapfk.sys 07:45:10.0758 3520 mfeapfk - ok 07:45:10.0930 3520 mfeavfk (e7a60bdb4365b561d896019b82fb7dd0) C:\Windows\system32\drivers\mfeavfk.sys 07:45:10.0930 3520 mfeavfk - ok 07:45:11.0086 3520 mfeavfk01 - ok 07:45:11.0226 3520 mfefirek (670dffe55e2f9ab99d9169c428bcece9) C:\Windows\system32\drivers\mfefirek.sys 07:45:11.0242 3520 mfefirek - ok 07:45:11.0382 3520 mfehidk (1892616b7f9291fd77c3fa0a5811fe9f) C:\Windows\system32\drivers\mfehidk.sys 07:45:11.0398 3520 mfehidk - ok 07:45:11.0538 3520 mfenlfk (1721261c77f6e7a9e0cb51b7d9f31b60) C:\Windows\system32\DRIVERS\mfenlfk.sys 07:45:11.0538 3520 mfenlfk - ok 07:45:11.0679 3520 mferkdet (65776bd8029e409935b90de30bf99526) C:\Windows\system32\drivers\mferkdet.sys 07:45:11.0694 3520 mferkdet - ok 07:45:11.0850 3520 mfewfpk (4f17d8b85b903d96ef7033bb6ef50516) C:\Windows\system32\drivers\mfewfpk.sys 07:45:11.0850 3520 mfewfpk - ok 07:45:11.0975 3520 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 07:45:11.0975 3520 Modem - ok 07:45:12.0115 3520 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 07:45:12.0115 3520 monitor - ok 07:45:12.0381 3520 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys 07:45:12.0381 3520 mouclass - ok 07:45:12.0552 3520 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 07:45:12.0552 3520 mouhid - ok 07:45:12.0646 3520 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys 07:45:12.0646 3520 mountmgr - ok 07:45:12.0755 3520 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys 07:45:12.0755 3520 mpio - ok 07:45:12.0864 3520 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 07:45:12.0864 3520 mpsdrv - ok 07:45:13.0005 3520 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys 07:45:13.0020 3520 MRxDAV - ok 07:45:13.0129 3520 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys 07:45:13.0129 3520 mrxsmb - ok 07:45:13.0285 3520 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys 07:45:13.0301 3520 mrxsmb10 - ok 07:45:13.0410 3520 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 07:45:13.0410 3520 mrxsmb20 - ok 07:45:13.0582 3520 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys 07:45:13.0582 3520 msahci - ok 07:45:13.0769 3520 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys 07:45:13.0769 3520 msdsm - ok 07:45:13.0909 3520 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 07:45:13.0909 3520 Msfs - ok 07:45:14.0019 3520 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 07:45:14.0019 3520 mshidkmdf - ok 07:45:14.0128 3520 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys 07:45:14.0128 3520 msisadrv - ok 07:45:14.0393 3520 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 07:45:14.0393 3520 MSKSSRV - ok 07:45:14.0533 3520 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 07:45:14.0533 3520 MSPCLOCK - ok 07:45:14.0643 3520 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 07:45:14.0643 3520 MSPQM - ok 07:45:14.0767 3520 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys 07:45:14.0783 3520 MsRPC - ok 07:45:14.0892 3520 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys 07:45:14.0892 3520 mssmbios - ok 07:45:15.0048 3520 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 07:45:15.0048 3520 MSTEE - ok 07:45:15.0189 3520 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 07:45:15.0189 3520 MTConfig - ok 07:45:15.0313 3520 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 07:45:15.0313 3520 Mup - ok 07:45:15.0485 3520 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 07:45:15.0501 3520 NativeWifiP - ok 07:45:15.0641 3520 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys 07:45:15.0641 3520 NDIS - ok 07:45:15.0969 3520 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 07:45:15.0969 3520 NdisCap - ok 07:45:16.0078 3520 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 07:45:16.0078 3520 NdisTapi - ok 07:45:16.0187 3520 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys 07:45:16.0187 3520 Ndisuio - ok 07:45:16.0281 3520 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys 07:45:16.0296 3520 NdisWan - ok 07:45:16.0390 3520 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys 07:45:16.0390 3520 NDProxy - ok 07:45:16.0483 3520 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 07:45:16.0483 3520 NetBIOS - ok 07:45:16.0702 3520 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys 07:45:16.0702 3520 NetBT - ok 07:45:17.0185 3520 netw5v64 (64428dfdaf6e88366cb51f45a79c5f69) C:\Windows\system32\DRIVERS\netw5v64.sys 07:45:17.0310 3520 netw5v64 - ok 07:45:17.0497 3520 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 07:45:17.0497 3520 nfrd960 - ok 07:45:17.0622 3520 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 07:45:17.0622 3520 Npfs - ok 07:45:17.0716 3520 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 07:45:17.0716 3520 nsiproxy - ok 07:45:17.0950 3520 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys 07:45:17.0981 3520 Ntfs - ok 07:45:18.0090 3520 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 07:45:18.0090 3520 Null - ok 07:45:18.0231 3520 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys 07:45:18.0231 3520 nvraid - ok 07:45:18.0324 3520 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys 07:45:18.0324 3520 nvstor - ok 07:45:18.0465 3520 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys 07:45:18.0465 3520 nv_agp - ok 07:45:18.0574 3520 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys 07:45:18.0574 3520 ohci1394 - ok 07:45:18.0699 3520 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 07:45:18.0699 3520 Parport - ok 07:45:18.0808 3520 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys 07:45:18.0808 3520 partmgr - ok 07:45:18.0933 3520 PCDSRVC{1E208CE0-FB7451FF-06020101}_0 (7317a0b550f7ac0223b7070897670476) c:\program files\dell support center\pcdsrvc_x64.pkms 07:45:18.0933 3520 PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - ok 07:45:19.0042 3520 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys 07:45:19.0042 3520 pci - ok 07:45:19.0151 3520 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys 07:45:19.0151 3520 pciide - ok 07:45:19.0245 3520 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 07:45:19.0245 3520 pcmcia - ok 07:45:19.0338 3520 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 07:45:19.0338 3520 pcw - ok 07:45:19.0479 3520 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 07:45:19.0494 3520 PEAUTH - ok 07:45:19.0635 3520 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys 07:45:19.0635 3520 PptpMiniport - ok 07:45:19.0728 3520 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 07:45:19.0728 3520 Processor - ok 07:45:19.0822 3520 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys 07:45:19.0837 3520 Psched - ok 07:45:19.0915 3520 PxHlpa64 (aed797cca02783296c68aa10d0cff8a9) C:\Windows\system32\Drivers\PxHlpa64.sys 07:45:19.0915 3520 PxHlpa64 - ok 07:45:20.0134 3520 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 07:45:20.0181 3520 ql2300 - ok 07:45:20.0352 3520 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 07:45:20.0352 3520 ql40xx - ok 07:45:20.0461 3520 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 07:45:20.0461 3520 QWAVEdrv - ok 07:45:20.0664 3520 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 07:45:20.0664 3520 RasAcd - ok 07:45:20.0773 3520 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 07:45:20.0789 3520 RasAgileVpn - ok 07:45:20.0883 3520 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys 07:45:20.0883 3520 Rasl2tp - ok 07:45:20.0992 3520 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 07:45:20.0992 3520 RasPppoe - ok 07:45:21.0132 3520 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 07:45:21.0132 3520 RasSstp - ok 07:45:21.0273 3520 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys 07:45:21.0288 3520 rdbss - ok 07:45:21.0429 3520 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 07:45:21.0429 3520 rdpbus - ok 07:45:21.0538 3520 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 07:45:21.0538 3520 RDPCDD - ok 07:45:21.0709 3520 RDPDR (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys 07:45:21.0709 3520 RDPDR - ok 07:45:21.0819 3520 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 07:45:21.0819 3520 RDPENCDD - ok 07:45:21.0943 3520 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 07:45:21.0943 3520 RDPREFMP - ok 07:45:22.0068 3520 RDPWD (15b66c206b5cb095bab980553f38ed23) C:\Windows\system32\drivers\RDPWD.sys 07:45:22.0068 3520 RDPWD - ok 07:45:22.0177 3520 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys 07:45:22.0177 3520 rdyboost - ok 07:45:22.0302 3520 rimspci (e20b1907fc72a3664ece21e3c20fc63d) C:\Windows\system32\DRIVERS\rimspe64.sys 07:45:22.0302 3520 rimspci - ok 07:45:22.0458 3520 risdpcie (a6da2b0c8f5bb3f9f5423cff8d6a02d9) C:\Windows\system32\DRIVERS\risdpe64.sys 07:45:22.0458 3520 risdpcie - ok 07:45:22.0567 3520 rixdpcie (6a1cd4674505e6791390a1ab71da1fbe) C:\Windows\system32\DRIVERS\rixdpe64.sys 07:45:22.0567 3520 rixdpcie - ok 07:45:22.0786 3520 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 07:45:22.0786 3520 rspndr - ok 07:45:22.0879 3520 RxFilter - ok 07:45:23.0004 3520 s3cap (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys 07:45:23.0004 3520 s3cap - ok 07:45:23.0176 3520 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys 07:45:23.0176 3520 sbp2port - ok 07:45:23.0301 3520 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys 07:45:23.0301 3520 scfilter - ok 07:45:23.0394 3520 sdbus (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\drivers\sdbus.sys 07:45:23.0394 3520 sdbus - ok 07:45:23.0503 3520 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 07:45:23.0503 3520 secdrv - ok 07:45:23.0628 3520 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 07:45:23.0628 3520 Serenum - ok 07:45:23.0722 3520 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 07:45:23.0722 3520 Serial - ok 07:45:23.0831 3520 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 07:45:23.0831 3520 sermouse - ok 07:45:23.0925 3520 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys 07:45:23.0925 3520 sffdisk - ok 07:45:24.0034 3520 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys 07:45:24.0034 3520 sffp_mmc - ok 07:45:24.0159 3520 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys 07:45:24.0159 3520 sffp_sd - ok 07:45:24.0268 3520 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 07:45:24.0283 3520 sfloppy - ok 07:45:24.0455 3520 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 07:45:24.0455 3520 SiSRaid2 - ok 07:45:24.0580 3520 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 07:45:24.0580 3520 SiSRaid4 - ok 07:45:24.0673 3520 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 07:45:24.0689 3520 Smb - ok 07:45:24.0845 3520 SNTUSB64 (2d5576c01c8a34aa614870e745fe8f19) C:\Windows\system32\DRIVERS\SNTUSB64.SYS 07:45:24.0845 3520 SNTUSB64 - ok 07:45:24.0985 3520 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 07:45:24.0985 3520 spldr - ok 07:45:25.0126 3520 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys 07:45:25.0141 3520 srv - ok 07:45:25.0219 3520 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys 07:45:25.0235 3520 srv2 - ok 07:45:25.0313 3520 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys 07:45:25.0329 3520 srvnet - ok07:45:25.0407 3520 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 07:45:25.0407 3520 stexstor - ok 07:45:25.0500 3520 storflt (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys 07:45:25.0500 3520 storflt - ok 07:45:25.0578 3520 storvsc (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys 07:45:25.0578 3520 storvsc - ok 07:45:25.0656 3520 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys 07:45:25.0672 3520 swenum - ok 07:45:25.0781 3520 SynTP (1657b7442d5ce30533f5c4317716b468) C:\Windows\system32\DRIVERS\SynTP.sys 07:45:25.0781 3520 SynTP - ok 07:45:25.0921 3520 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys 07:45:25.0953 3520 Tcpip - ok 07:45:26.0062 3520 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys 07:45:26.0077 3520 TCPIP6 - ok 07:45:26.0202 3520 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys 07:45:26.0202 3520 tcpipreg - ok 07:45:26.0343 3520 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 07:45:26.0343 3520 TDPIPE - ok 07:45:26.0499 3520 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys 07:45:26.0499 3520 TDTCP - ok 07:45:26.0623 3520 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys 07:45:26.0623 3520 tdx - ok 07:45:26.0701 3520 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys 07:45:26.0717 3520 TermDD - ok 07:45:26.0842 3520 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys 07:45:26.0842 3520 tssecsrv - ok 07:45:26.0951 3520 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys 07:45:26.0951 3520 TsUsbFlt - ok 07:45:27.0107 3520 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys 07:45:27.0107 3520 tunnel - ok 07:45:27.0279 3520 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 07:45:27.0279 3520 uagp35 - ok 07:45:27.0419 3520 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys 07:45:27.0419 3520 udfs - ok 07:45:27.0575 3520 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys 07:45:27.0575 3520 uliagpkx - ok 07:45:27.0669 3520 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys 07:45:27.0669 3520 umbus - ok 07:45:27.0825 3520 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 07:45:27.0825 3520 UmPass - ok 07:45:28.0012 3520 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys 07:45:28.0012 3520 usbccgp - ok 07:45:28.0137 3520 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys 07:45:28.0137 3520 usbcir - ok 07:45:28.0230 3520 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys 07:45:28.0230 3520 usbehci - ok 07:45:28.0371 3520 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys 07:45:28.0371 3520 usbhub - ok 07:45:28.0464 3520 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys 07:45:28.0464 3520 usbohci - ok 07:45:28.0605 3520 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 07:45:28.0605 3520 usbprint - ok 07:45:28.0683 3520 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS 07:45:28.0698 3520 USBSTOR - ok 07:45:28.0792 3520 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys 07:45:28.0792 3520 usbuhci - ok 07:45:28.0901 3520 usbvideo (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\System32\Drivers\usbvideo.sys 07:45:28.0901 3520 usbvideo - ok 07:45:29.0026 3520 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys 07:45:29.0026 3520 vdrvroot - ok 07:45:29.0213 3520 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 07:45:29.0213 3520 vga - ok 07:45:29.0307 3520 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 07:45:29.0322 3520 VgaSave - ok 07:45:29.0400 3520 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys 07:45:29.0416 3520 vhdmp - ok 07:45:29.0525 3520 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys 07:45:29.0525 3520 viaide - ok 07:45:29.0728 3520 vmbus (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys 07:45:29.0728 3520 vmbus - ok 07:45:29.0853 3520 VMBusHID (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys 07:45:29.0853 3520 VMBusHID - ok 07:45:30.0024 3520 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys 07:45:30.0024 3520 volmgr - ok 07:45:30.0180 3520 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys 07:45:30.0180 3520 volmgrx - ok 07:45:30.0289 3520 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys 07:45:30.0289 3520 volsnap - ok 07:45:30.0383 3520 vpcbus (b4a73ca4ef9a02b9738cea9ad5fe5917) C:\Windows\system32\DRIVERS\vpchbus.sys 07:45:30.0399 3520 vpcbus - ok 07:45:30.0539 3520 vpcnfltr (e675fb2b48c54f09895482e2253b289c) C:\Windows\system32\DRIVERS\vpcnfltr.sys 07:45:30.0539 3520 vpcnfltr - ok 07:45:30.0664 3520 vpcusb (5fb42082b0d19a0268705f1dd343df20) C:\Windows\system32\DRIVERS\vpcusb.sys 07:45:30.0664 3520 vpcusb - ok 07:45:30.0789 3520 vpcvmm (207b6539799cc1c112661a9b620dd233) C:\Windows\system32\drivers\vpcvmm.sys 07:45:30.0804 3520 vpcvmm - ok 07:45:30.0991 3520 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 07:45:30.0991 3520 vsmraid - ok 07:45:31.0085 3520 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys 07:45:31.0085 3520 vwifibus - ok 07:45:31.0241 3520 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 07:45:31.0241 3520 WacomPen - ok 07:45:31.0350 3520 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 07:45:31.0350 3520 WANARP - ok 07:45:31.0350 3520 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 07:45:31.0350 3520 Wanarpv6 - ok 07:45:31.0569 3520 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 07:45:31.0569 3520 Wd - ok 07:45:31.0709 3520 WDC_SAM (a3d04ebf5227886029b4532f20d026f7) C:\Windows\system32\DRIVERS\wdcsam64.sys 07:45:31.0709 3520 WDC_SAM - ok 07:45:31.0803 3520 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 07:45:31.0818 3520 Wdf01000 - ok 07:45:32.0005 3520 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 07:45:32.0005 3520 WfpLwf - ok 07:45:32.0115 3520 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 07:45:32.0115 3520 WIMMount - ok 07:45:32.0271 3520 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys 07:45:32.0271 3520 WmiAcpi - ok 07:45:32.0473 3520 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 07:45:32.0489 3520 ws2ifsl - ok 07:45:32.0614 3520 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys 07:45:32.0614 3520 WudfPf - ok 07:45:32.0739 3520 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys 07:45:32.0739 3520 WUDFRd - ok 07:45:32.0754 3520 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 07:45:32.0817 3520 \Device\Harddisk0\DR0 - ok 07:45:32.0817 3520 Boot (0x1200) (b69dd65ca2fbadfdb16c95a2d777d94b) \Device\Harddisk0\DR0\Partition0 07:45:32.0817 3520 \Device\Harddisk0\DR0\Partition0 - ok 07:45:32.0832 3520 Boot (0x1200) (2a8466e9b5cf850421e377c973652aa2) \Device\Harddisk0\DR0\Partition1 07:45:32.0832 3520 \Device\Harddisk0\DR0\Partition1 - ok 07:45:32.0832 3520 ============================================================ 07:45:32.0832 3520 Scan finished 07:45:32.0832 3520 ============================================================ 07:45:32.0848 5104 Detected object count: 0 07:45:32.0848 5104 Actual detected object count: 0

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Browser hijacker has my computer Please help! [Solved]

✨ Ask AI

Ask AI