What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

System Scan virus -- says harddrive, ram failed [Solved]

70 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46
ComboFix 12-03-22.01 - Administrator 03/24/2012 13:59:30.2.2 - x86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.697 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Guest\Application Data\.#
c:\documents and settings\Shannon\Application Data\.#
c:\documents and settings\Shannon\Application Data\.#\MBX@220@3841A0.###
c:\documents and settings\Shannon\Application Data\.#\MBX@220@3841D0.###
c:\documents and settings\Shannon\Application Data\.#\MBX@220@384200.###
c:\documents and settings\Shannon\Application Data\.#\MBX@9B0@3841A0.###
c:\documents and settings\Shannon\Application Data\.#\MBX@9B0@3841D0.###
c:\documents and settings\Shannon\Application Data\.#\MBX@9B0@384200.###
c:\documents and settings\Shannon\Start Menu\Programs\System Check
.
.
((((((((((((((((((((((((( Files Created from 2012-02-24 to 2012-03-24 )))))))))))))))))))))))))))))))
.
.
2012-03-23 20:26 . 2012-03-23 20:26 4443082 ——r- c:\program files\ComboFix.exe
2012-03-22 03:57 . 2012-03-22 03:57 ——– d—–w- C:\_OTL
2012-03-18 05:28 . 2012-03-18 05:28 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2012-03-17 04:33 . 2012-03-17 04:33 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2012-03-14 22:22 . 2012-03-14 22:22 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2012-03-13 06:15 . 2012-03-13 06:17 ——– dc—-w- c:\windows\ie8
2012-03-13 05:59 . 2012-03-13 05:59 ——– d—–w- c:\documents and settings\Shannon\Local Settings\Application Data\Mozilla
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-11 02:39 . 2009-12-26 13:21 499712 —-a-w- c:\windows\system32\msvcp71.dll
2012-02-11 02:39 . 2009-12-26 13:21 348160 —-a-w- c:\windows\system32\msvcr71.dll
2012-01-12 16:53 . 2009-03-11 12:53 1859968 —-a-w- c:\windows\system32\win32k.sys
2012-01-11 19:06 . 2012-02-22 05:02 3072 ——w- c:\windows\system32\iacenc.dll
2012-02-16 14:40 . 2012-03-13 05:59 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-03-23_20.51.23 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-03-11 12:53 . 2012-03-24 21:01 68412 c:\windows\system32\perfc009.dat
- 2009-03-11 12:53 . 2012-03-23 20:37 68412 c:\windows\system32\perfc009.dat
+ 2012-03-24 20:27 . 2012-03-24 20:27 22016 c:\windows\Installer\19ba3.msi
+ 2009-03-11 12:53 . 2012-03-24 21:01 434126 c:\windows\system32\perfh009.dat
- 2009-03-11 12:53 . 2012-03-23 20:37 434126 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-02-05 1430824]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-07-06 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-08-19 421736]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^Documents and Settings^Shannon^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\Shannon\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-12-26 05:37 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Adobe\\Acrobat.com\\Acrobat.com.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
R3 L1c;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller;c:\windows\system32\drivers\l1c51x86.sys [3/3/2009 8:03 PM 38912]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [3/16/2011 10:01 PM 136360]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/17/2010 10:43 PM 136176]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [3/11/2009 10:56 PM 1684736]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [11/17/2010 10:43 PM 136176]
S3 M3000Srv;USB2.0 UVC WebCam Driver;c:\windows\system32\drivers\M3000KNT.sys [5/11/2009 9:41 AM 145408]
S3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTS5121.sys –> c:\windows\system32\Drivers\RTS5121.sys [?]
S3 Rts516xIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys –> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2012-03-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-18 05:43]
.
2012-03-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-11-18 05:43]
.
2012-02-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1602489464-951796526-1614765859-1006Core.job
- c:\documents and settings\Shannon\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-10-25 18:05]
.
2012-02-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1602489464-951796526-1614765859-1006UA.job
- c:\documents and settings\Shannon\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-10-25 18:05]
.
2012-02-22 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1602489464-951796526-1614765859-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-31 01:45]
.
2012-02-22 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1602489464-951796526-1614765859-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2012-01-31 01:45]
.
.
——- Supplementary Scan ——-
.
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath -
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-03-24 14:06
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1602489464-951796526-1614765859-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,84,ea,06,5b,6b,29,da,46,81,9b,61,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,84,ea,06,5b,6b,29,da,46,81,9b,61,\
.
Completion time: 2012-03-24 14:09:21
ComboFix-quarantined-files.txt 2012-03-24 21:09
ComboFix2.txt 2012-03-23 20:53
.
Pre-Run: 133,447,106,560 bytes free
Post-Run: 133,430,919,168 bytes free
.
- - End Of File - - A77379605584146C9E353D2F71B8C46D
Post #47
Hi Shannon

Try this logging in as Administrator.

Restore Accessories Program Files Menu

Download this file
  • extract (unzip) the tool, double-click on it to run and ensure that the following check boxes are checked:


    Accessories
    Accessability
    Communication
    Entertainment
    System Tools

  • make sure that under “Destination”, All Users is selected
  • click on the Restore button
==========================================

Restore Admin Tools Program Files Menu

Download this

  • extract (unzip) the tool, double-click on it to run and click on Restore Administrative Tools Items
  • click on the Restore button
Please let me know if there is any change.

Our clocks go forward tonight and family stuff is a bit hectic at the weekends so thank you for your understanding but I'll reply as soon as I can.

Satchfan
Post #49 last edited
Hi Shannon

Admin Tools and Accessories appear to all be restored

:thumbup: some good news then.

Start as Administrator, (in safe mode if necessary).

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1
Download Mirror #2
  • double-click SystemLook.exe to run it.
  • copy the content of the following codebox into the main textfield:

    :reg 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer

  • click the Look button to start the scan.
  • when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

=============================================

Pardon me for being pedantic but it is a bit difficult keeping up with the situation. So to clarify:

As Administrator
  • you can’t log in in normal mode, only safe mode
  • you can see programs in the start menu but the ones with arrows have no content
  • Internet Explorer icon is now back
  • black desktop and no icons on it

As Shannon
  • you can log in normally, (without the need of safe mode)
  • the only programs in the start menu are the rogue System Check and Uninstall System Check
  • your desktop is normal with icons on it.
Can you also let me know what you were logged in as when you tried to run Rogue Killer

Thanks

Satchfan
Post #50

Hi Shannon

=============================================

Pardon me for being pedantic but it is a bit difficult keeping up with the situation.

I'm so sorry for not being clear. It's confusing to me, so my explanations are probably confusing.

So to clarify:

As Administrator

  • you can’t log in in normal mode, only safe mode.

    CORRECT
  • you can see programs in the start menu but the ones with arrows have no content

    NO. The only programs in the start menu are Internet Explorer, Outlook Express and Remote Assistance. All of the program titles with arrows have no content EXCEPT Accessories, which appears to be full of normal content and Acer GameZone, which also appears to have normal content, but when I try to click on one of the games, I get a message that says; "Problem with Shortcut. The drive or network connection that the shortcut refers to is unavailable.".
  • Internet Explorer icon is now back

    CORRECT.
  • black desktop and no icons on it

    NO. The desktop is black, but it has all of the icons for the programs you have asked me to download and all of the text boxes. It also has "Internet Explorer" icon, "Windows XP Tips - Ramesh," "My Bluetooth Places," and "Recycle Bin"

As Shannon
  • you can log in normally, (without the need of safe mode)

    CORRECT
  • the only programs in the start menu are the rogue System Check and Uninstall System Check

    NO. The Rogue System Check and Uninstall System Check are gone. Accessories is back, with what appears to be all of the content. Acer GameZone looks the same as it does in Safe Networking logged on as Administrator. Malwarebytes appears to be back (it appears as a shortcut, and when I hover over the arrot, it appears to link to the program. I say "appears" because I don't want to run it without your instruction. But after the arror, it offers Tools (wiht another arrow), Malwarebytes AntiMalware with the proper icon, Malwarebytes AntiMalware Help, and Uninstall Malwarebytes. Also, Internet Explorer is there, Remote Assistance and Windows Media Player.
  • your desktop is normal with icons on it.

    NO. The desktop is completely black with no icons on it. I've tried downloading the programs you told me to run while logged in normally as Shannon, and when I save them to the desktop, they do not appear. I do have progrms in the tray at the bottom right side of my screen: windows updates are ready to be installed, network cable is disconnected, wireless is connected, volume, Avira is enabled again (even though I disabled it and never re-enabled it, plug, and Synaptics Pointing Device icon.

Can you also let me know what you were logged in as when you tried to run Rogue Killer

I'm sure I ran that while in Safe Networking Mode logged in as Administrator, because that is the only place I can see/access any of the programs you have asked me to download.

Thanks

Satchfan

Post #51
Clarification: Malwarebytes is not "back." I did have to re-install it from your link. But it does show up on the desktop when I'm in Safe Networking logged in as Administrator, and it appears in the Start/Programs menu while logged in normally as Shannon.
Post #52
Here is the SystemLook log: SystemLook 30.07.11 by jpshortstuff Log created at 21:55 on 25/03/2012 by Administrator Administrator - Elevation successful No Context: CODE:reg No Context: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer No Context: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer -= EOF =-
Post #53
Thanks for the explanation – it’s a bit clearer now.

I don't know why SystemLook didn't work but we’ll tackle that and how to get your stsrt menu back when the rest is sorted out. Let’s try to get the Admin back running normally.

Log in as Administrator. If any of these won’t run, try running RKill and then retry.

Run OTL
  • double click on the icon to run it.
  • copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoActiveDesktopChanges"=hex:00,00,00,00
"NoActiveDesktop"=dword:00000000
"NoSaveSettings"=dword:00000000
"ClassicShell"=dword:00000000
"NoThemesTab"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispAppearancePage"=dword:00000000
"NoColorChoice"=dword:00000000
"NoSizeChoice"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoDispCPL"=dword:00000000
"NoVisualStyleChoice"=dword:00000000
"NoDispSettingsPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoVisualStyleChoice"=dword:00000000
"NoSizeChoice"=dword:00000000
"SetVisualStyle"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoChangingWallPaper"=dword:00000000

:Commands
[purity]
[Reboot]

  • click the Run Fix button at the top
  • let the program run unhindered, reboot when it is done
  • post a new OTL log (don't check the boxes beside LOP Check or Purity this time)
================================================

Run Malwarebytes-Anti-Malware

Launch Malwarebytes' Anti-Malware
[*]if an update is found, it will download and install the latest version.

[*]once the program has loaded, select Perform quick scan, then click Scan.

[*]when the scan is complete, click OK, then Show Results to view the results.

[*]be sure that everything is checked, and click Remove Selected.

[*]when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)

[*]the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.

[*]copy and paste the contents of that report in your next reply and exit MBAM. NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

================================================

Run TDSSKiller

You may need to run RKill before running this.

Please download TDSSKiller.zip
  • extract it to your desktop
  • right click TDSSKiller.exe and rename it to anything you like but keep the .exe at the end
  • double click TDSSKiller.exe
  • press Start Scan


    only if Malicious objects are found then ensure Cure is selected. Do not change it to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly

  • click Continue > Reboot now
  • copy and paste the log in your next reply
  • a copy of the log will be saved automatically to the root of the drive (typically C:\) called TDSSKiller_*** (*** denotes version & date)
================================================

Can you also now log in as Shannon, open Windows Explorer, (Windows key+E), and in the left window, click on Desktop. See if any of the programs I asked you to save to the desktop can be seen here.

Logs to include in the next post:

OTL fix log
New OTL log
Mbam.txt
TDSSK log

Thanks

Satchfan
Post #54
Sorry I didn't do these fixes yesterday. It was not a good day for me. :) I ran the OTL fix and it rebooted, but when I pushed F8 to make it come up in Safe Networking mode, it did not come back up in OTL, nor did it give me a log. It also did not post a log on my desktop. Then I ran it again and let it boot up by itself into normal mode, but it still did not come back up in OTL and did not give me a log. I will run Malwarebytes now.
Post #55 last edited
Sorry to hear you had a bad day - hope today is better for you. :)

Try opening Windows Explorer and looking for the log there. The OTL fix log can be found at C:\_OTL\MovedFiles. The file name will consist of numbers that reflect the date and time the fix was run. It will be something like 27032012_111009.log.

It will be later when I next reply a I have to leave for a couple of hours.

Satchfan
Post #56
OK, i will look for the OTL logs. Here is the Malwarebytes log: Malwarebytes Anti-Malware 1.60.1.1000 www.malwarebytes.org Database version: v2012.03.27.04 Windows XP Service Pack 3 x86 NTFS (Safe Mode/Networking) Internet Explorer 8.0.6001.18702 Administrator :: ACER-330BB84976 [administrator] 3/27/2012 9:36:37 AM mbam-log-2012-03-27 (09-36-37).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 215334 Time elapsed: 3 minute(s), 43 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)
Post #57
Found it! Here is the OTL log: ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\"NoActiveDesktopChanges"|hex:00,00,00,00 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\"NoActiveDesktop"|dword:00000000 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\"NoSaveSettings"|dword:00000000 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\"ClassicShell"|dword:00000000 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\"NoThemesTab"|dword:00000000 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\"NoDispAppearancePage"|dword:00000000 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\"NoColorChoice"|dword:00000000 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\"NoSizeChoice"|dword:00000000 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\"NoDispBackgroundPage"|dword:00000000 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\"NoDispScrSavPage"|dword:00000000 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\"NoDispCPL"|dword:00000000 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\"NoVisualStyleChoice"|dword:00000000 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\"NoDispSettingsPage"|dword:00000000 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\"NoDispScrSavPage"|dword:00000000 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\"NoVisualStyleChoice"|dword:00000000 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\"NoSizeChoice"|dword:00000000 /E : value set successfully! Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\SetVisualStyle not found. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\\"NoChangingWallPaper"|dword:00000000 /E : value set successfully! ========== COMMANDS ========== OTL by OldTimer - Version 3.2.39.1 log created on 03272012_091421
Post #58
Here is the TDSSKiller log: 09:50:35.0171 1300 TDSS rootkit removing tool [removed] Mar 26 2012 13:40:18 09:50:35.0734 1300 ============================================================ 09:50:35.0734 1300 Current date / time: 2012/03/27 09:50:35.0734 09:50:35.0734 1300 SystemInfo: 09:50:35.0734 1300 09:50:35.0734 1300 OS Version: 5.1.2600 ServicePack: 3.0 09:50:35.0734 1300 Product type: Workstation 09:50:35.0734 1300 ComputerName: ACER-330BB84976 09:50:35.0734 1300 UserName: Administrator 09:50:35.0734 1300 Windows directory: C:\WINDOWS 09:50:35.0734 1300 System windows directory: C:\WINDOWS 09:50:35.0734 1300 Processor architecture: Intel x86 09:50:35.0734 1300 Number of processors: 2 09:50:35.0734 1300 Page size: 0x1000 09:50:35.0734 1300 Boot type: Safe boot with network 09:50:35.0734 1300 ============================================================ 09:50:36.0609 1300 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050 09:50:36.0609 1300 \Device\Harddisk0\DR0: 09:50:36.0609 1300 MBR used 09:50:36.0609 1300 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0xE01000, BlocksNum 0x11C18000 09:50:36.0656 1300 Initialize success 09:50:36.0656 1300 ============================================================ 09:51:12.0031 1760 ============================================================ 09:51:12.0031 1760 Scan started 09:51:12.0031 1760 Mode: Manual; 09:51:12.0031 1760 ============================================================ 09:51:13.0625 1760 Abiosdsk - ok 09:51:13.0687 1760 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS 09:51:13.0687 1760 abp480n5 - ok 09:51:13.0750 1760 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 09:51:13.0750 1760 ACPI - ok 09:51:13.0765 1760 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys 09:51:13.0765 1760 ACPIEC - ok 09:51:13.0828 1760 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys 09:51:13.0828 1760 adpu160m - ok 09:51:14.0046 1760 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 09:51:14.0046 1760 aec - ok 09:51:14.0109 1760 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys 09:51:14.0125 1760 AFD - ok 09:51:14.0156 1760 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys 09:51:14.0156 1760 agp440 - ok 09:51:14.0203 1760 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys 09:51:14.0203 1760 agpCPQ - ok 09:51:14.0375 1760 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys 09:51:14.0375 1760 Aha154x - ok 09:51:14.0406 1760 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys 09:51:14.0406 1760 aic78u2 - ok 09:51:14.0453 1760 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys 09:51:14.0453 1760 aic78xx - ok 09:51:14.0500 1760 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll 09:51:14.0500 1760 Alerter - ok 09:51:14.0671 1760 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe 09:51:14.0671 1760 ALG - ok 09:51:14.0750 1760 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys 09:51:14.0750 1760 AliIde - ok 09:51:14.0812 1760 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys 09:51:14.0812 1760 alim1541 - ok 09:51:14.0921 1760 Ambfilt (f6af59d6eee5e1c304f7f73706ad11d8) C:\WINDOWS\system32\drivers\Ambfilt.sys 09:51:14.0953 1760 Ambfilt - ok 09:51:15.0140 1760 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys 09:51:15.0140 1760 amdagp - ok 09:51:15.0187 1760 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys 09:51:15.0187 1760 amsint - ok 09:51:15.0343 1760 AntiVirSchedulerService (b4837fe56d76b2e9ea90e5365cf6a2be) C:\Program Files\Avira\AntiVir Desktop\sched.exe 09:51:15.0359 1760 AntiVirSchedulerService - ok 09:51:15.0421 1760 AntiVirService (df5a3016052755c910a206058b4a1729) C:\Program Files\Avira\AntiVir Desktop\avguard.exe 09:51:15.0437 1760 AntiVirService - ok 09:51:15.0625 1760 Apple Mobile Device (20f6f19fe9e753f2780dc2fa083ad597) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 09:51:15.0625 1760 Apple Mobile Device - ok 09:51:15.0750 1760 AppMgmt - ok 09:51:15.0875 1760 AR5416 (2b7b6a3305fc34a543d34013c14d02a2) C:\WINDOWS\system32\DRIVERS\athw.sys 09:51:15.0906 1760 AR5416 - ok 09:51:16.0109 1760 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys 09:51:16.0109 1760 asc - ok 09:51:16.0156 1760 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys 09:51:16.0156 1760 asc3350p - ok 09:51:16.0187 1760 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys 09:51:16.0187 1760 asc3550 - ok 09:51:16.0296 1760 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 09:51:16.0296 1760 aspnet_state - ok 09:51:16.0500 1760 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 09:51:16.0500 1760 AsyncMac - ok 09:51:16.0562 1760 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 09:51:16.0562 1760 atapi - ok 09:51:16.0578 1760 Atdisk - ok 09:51:16.0671 1760 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 09:51:16.0671 1760 Atmarpc - ok 09:51:16.0765 1760 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll 09:51:16.0765 1760 AudioSrv - ok 09:51:16.0906 1760 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 09:51:16.0906 1760 audstub - ok 09:51:17.0062 1760 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys 09:51:17.0062 1760 avgio - ok 09:51:17.0125 1760 avgntflt (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys 09:51:17.0125 1760 avgntflt - ok 09:51:17.0156 1760 avipbb (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys 09:51:17.0156 1760 avipbb - ok 09:51:17.0328 1760 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 09:51:17.0328 1760 Beep - ok 09:51:17.0406 1760 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll 09:51:17.0406 1760 BITS - ok 09:51:17.0578 1760 Bonjour Service (1c87705ccb2f60172b0fc86b5d82f00d) C:\Program Files\Bonjour\mDNSResponder.exe 09:51:17.0593 1760 Bonjour Service - ok 09:51:17.0750 1760 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll 09:51:17.0750 1760 Browser - ok 09:51:17.0875 1760 btaudio (142986d4da016d4de0d93b51d1ddfbde) C:\WINDOWS\system32\drivers\btaudio.sys 09:51:17.0890 1760 btaudio - ok 09:51:17.0937 1760 BTDriver (58a49bd10e08d3d4333a60dedcb1ced8) C:\WINDOWS\system32\DRIVERS\btport.sys 09:51:17.0937 1760 BTDriver - ok 09:51:18.0015 1760 BTKRNL (6d23a08a656e1c230d697d1a0d63c491) C:\WINDOWS\system32\DRIVERS\btkrnl.sys 09:51:18.0031 1760 BTKRNL - ok 09:51:18.0156 1760 btwdins (7a77628a0cb57a55ce1b8e6e205613b4) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe 09:51:18.0171 1760 btwdins - ok 09:51:18.0328 1760 BTWDNDIS (80f61de965c116051614ac2f04222ff7) C:\WINDOWS\system32\DRIVERS\btwdndis.sys 09:51:18.0328 1760 BTWDNDIS - ok 09:51:18.0359 1760 btwhid (e48668b4a6a5cf68b33aecad18ee8e1e) C:\WINDOWS\system32\DRIVERS\btwhid.sys 09:51:18.0375 1760 btwhid - ok 09:51:18.0390 1760 BTWUSB (ad7f4b81a3f8d330dd8382b7cf4df341) C:\WINDOWS\system32\Drivers\btwusb.sys 09:51:18.0390 1760 BTWUSB - ok 09:51:18.0546 1760 catchme - ok 09:51:18.0593 1760 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys 09:51:18.0593 1760 cbidf - ok 09:51:18.0687 1760 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 09:51:18.0703 1760 cbidf2k - ok 09:51:18.0750 1760 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 09:51:18.0750 1760 CCDECODE - ok 09:51:18.0765 1760 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys 09:51:18.0765 1760 cd20xrnt - ok 09:51:18.0828 1760 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 09:51:18.0828 1760 Cdaudio - ok 09:51:18.0890 1760 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 09:51:18.0890 1760 Cdfs - ok 09:51:19.0015 1760 Cdrom (4b0a100eaf5c49ef3cca8c641431eacc) C:\WINDOWS\system32\DRIVERS\cdrom.sys 09:51:19.0015 1760 Cdrom - ok 09:51:19.0031 1760 Changer - ok 09:51:19.0093 1760 cisvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe 09:51:19.0093 1760 cisvc - ok 09:51:19.0203 1760 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe 09:51:19.0203 1760 ClipSrv - ok 09:51:19.0234 1760 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 09:51:19.0234 1760 clr_optimization_v2.0.50727_32 - ok 09:51:19.0328 1760 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys 09:51:19.0328 1760 CmBatt - ok 09:51:19.0484 1760 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys 09:51:19.0484 1760 CmdIde - ok 09:51:19.0531 1760 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys 09:51:19.0531 1760 Compbatt - ok 09:51:19.0546 1760 COMSysApp - ok 09:51:19.0609 1760 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys 09:51:19.0609 1760 Cpqarray - ok 09:51:19.0656 1760 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll 09:51:19.0656 1760 CryptSvc - ok 09:51:19.0828 1760 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys 09:51:19.0828 1760 dac2w2k - ok 09:51:19.0843 1760 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys 09:51:19.0843 1760 dac960nt - ok 09:51:19.0921 1760 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll 09:51:19.0937 1760 DcomLaunch - ok 09:51:20.0078 1760 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll 09:51:20.0078 1760 Dhcp - ok 09:51:20.0187 1760 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 09:51:20.0187 1760 Disk - ok 09:51:20.0234 1760 DKbFltr (08d30af92c270f2e76787c81589dbad6) C:\WINDOWS\system32\DRIVERS\DKbFltr.sys 09:51:20.0250 1760 DKbFltr - ok 09:51:20.0250 1760 dmadmin - ok 09:51:20.0328 1760 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 09:51:20.0343 1760 dmboot - ok 09:51:20.0468 1760 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 09:51:20.0468 1760 dmio - ok 09:51:20.0500 1760 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 09:51:20.0515 1760 dmload - ok 09:51:20.0546 1760 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll 09:51:20.0546 1760 dmserver - ok 09:51:20.0656 1760 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 09:51:20.0656 1760 DMusic - ok 09:51:20.0718 1760 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll 09:51:20.0718 1760 Dnscache - ok 09:51:20.0828 1760 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll 09:51:20.0828 1760 Dot3svc - ok 09:51:20.0921 1760 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys 09:51:20.0921 1760 dpti2o - ok 09:51:21.0000 1760 DritekPortIO (5c918d413f5837e67a85775c9873775e) C:\PROGRA~1\LAUNCH~1\DPortIO.sys 09:51:21.0015 1760 DritekPortIO - ok 09:51:21.0171 1760 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 09:51:21.0171 1760 drmkaud - ok 09:51:21.0234 1760 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll 09:51:21.0234 1760 EapHost - ok 09:51:21.0343 1760 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll 09:51:21.0343 1760 ERSvc - ok 09:51:21.0406 1760 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 09:51:21.0406 1760 Eventlog - ok 09:51:21.0546 1760 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll 09:51:21.0546 1760 EventSystem - ok 09:51:21.0656 1760 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 09:51:21.0656 1760 Fastfat - ok 09:51:21.0718 1760 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 09:51:21.0718 1760 FastUserSwitchingCompatibility - ok 09:51:21.0875 1760 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys 09:51:21.0875 1760 Fdc - ok 09:51:21.0890 1760 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 09:51:21.0906 1760 Fips - ok 09:51:21.0921 1760 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys 09:51:21.0921 1760 Flpydisk - ok 09:51:21.0953 1760 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys 09:51:21.0953 1760 FltMgr - ok 09:51:22.0062 1760 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 09:51:22.0062 1760 FontCache3.0.0.0 - ok 09:51:22.0218 1760 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 09:51:22.0218 1760 Fs_Rec - ok 09:51:22.0265 1760 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 09:51:22.0265 1760 Ftdisk - ok 09:51:22.0296 1760 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 09:51:22.0312 1760 GEARAspiWDM - ok 09:51:22.0359 1760 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 09:51:22.0359 1760 Gpc - ok 09:51:22.0515 1760 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe 09:51:22.0515 1760 gupdate - ok 09:51:22.0531 1760 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe 09:51:22.0531 1760 gupdatem - ok 09:51:22.0609 1760 gusvc (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 09:51:22.0609 1760 gusvc - ok 09:51:22.0765 1760 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 09:51:22.0765 1760 HDAudBus - ok 09:51:22.0828 1760 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 09:51:22.0828 1760 helpsvc - ok 09:51:22.0890 1760 HidServ (deb04da35cc871b6d309b77e1443c796) C:\WINDOWS\System32\hidserv.dll 09:51:22.0890 1760 HidServ - ok 09:51:23.0062 1760 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 09:51:23.0062 1760 HidUsb - ok 09:51:23.0125 1760 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll 09:51:23.0125 1760 hkmsvc - ok 09:51:23.0265 1760 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys 09:51:23.0265 1760 hpn - ok 09:51:23.0359 1760 HPZid412 (9f1d80908658eb7f1bf70809e0b51470) C:\WINDOWS\system32\DRIVERS\HPZid412.sys 09:51:23.0359 1760 HPZid412 - ok 09:51:23.0375 1760 HPZipr12 (f7e3e9d50f9cd3de28085a8fdaa0a1c3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 09:51:23.0375 1760 HPZipr12 - ok 09:51:23.0421 1760 HPZius12 (cf1b7951b4ec8d13f3c93b74bb2b461b) C:\WINDOWS\system32\DRIVERS\HPZius12.sys 09:51:23.0421 1760 HPZius12 - ok 09:51:23.0484 1760 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 09:51:23.0484 1760 HTTP - ok 09:51:23.0609 1760 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll 09:51:23.0609 1760 HTTPFilter - ok 09:51:23.0671 1760 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys 09:51:23.0687 1760 i2omgmt - ok 09:51:23.0718 1760 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys 09:51:23.0718 1760 i2omp - ok 09:51:23.0765 1760 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 09:51:23.0781 1760 i8042prt - ok 09:51:23.0937 1760 IAANTMON (cb686f44bf955ea02520710a56874fa4) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe 09:51:23.0953 1760 IAANTMON - ok 09:51:24.0343 1760 ialm (48846b31be5a4fa662ccfde7a1ba86b9) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 09:51:24.0421 1760 ialm - ok 09:51:24.0593 1760 iaStor (db0cc620b27a928d968c1a1e9cd9cb87) C:\WINDOWS\system32\drivers\iaStor.sys 09:51:24.0593 1760 iaStor - ok 09:51:24.0734 1760 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe 09:51:24.0750 1760 IDriverT - ok 09:51:24.0890 1760 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 09:51:24.0906 1760 idsvc - ok 09:51:25.0062 1760 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 09:51:25.0062 1760 Imapi - ok 09:51:25.0140 1760 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe 09:51:25.0140 1760 ImapiService - ok 09:51:25.0312 1760 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys 09:51:25.0312 1760 ini910u - ok 09:51:25.0328 1760 int15.sys - ok 09:51:25.0578 1760 IntcAzAudAddService (cb1113029fae50c685198eabd9885161) C:\WINDOWS\system32\drivers\RtkHDAud.sys 09:51:25.0640 1760 IntcAzAudAddService - ok 09:51:25.0843 1760 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys 09:51:25.0859 1760 IntelIde - ok 09:51:25.0906 1760 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys 09:51:25.0906 1760 intelppm - ok 09:51:25.0953 1760 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 09:51:25.0953 1760 Ip6Fw - ok 09:51:25.0984 1760 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 09:51:25.0984 1760 IpFilterDriver - ok 09:51:26.0125 1760 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 09:51:26.0125 1760 IpInIp - ok 09:51:26.0156 1760 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 09:51:26.0156 1760 IpNat - ok 09:51:26.0281 1760 iPod Service (f62c69376a95795fe7cdb1c778edaca4) C:\Program Files\iPod\bin\iPodService.exe 09:51:26.0296 1760 iPod Service - ok 09:51:26.0453 1760 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 09:51:26.0453 1760 IPSec - ok 09:51:26.0500 1760 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 09:51:26.0500 1760 IRENUM - ok 09:51:26.0562 1760 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 09:51:26.0562 1760 isapnp - ok 09:51:26.0593 1760 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 09:51:26.0593 1760 Kbdclass - ok 09:51:26.0765 1760 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 09:51:26.0765 1760 kbdhid - ok 09:51:26.0812 1760 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 09:51:26.0828 1760 kmixer - ok 09:51:26.0890 1760 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 09:51:26.0890 1760 KSecDD - ok 09:51:26.0937 1760 L1c (6c8658587e91ea25b0fd2e71781ad228) C:\WINDOWS\system32\DRIVERS\l1c51x86.sys 09:51:26.0953 1760 L1c - ok 09:51:27.0015 1760 LanmanServer (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll 09:51:27.0015 1760 LanmanServer - ok 09:51:27.0171 1760 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll 09:51:27.0187 1760 lanmanworkstation - ok 09:51:27.0203 1760 lbrtfdc - ok 09:51:27.0281 1760 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll 09:51:27.0296 1760 LmHosts - ok 09:51:27.0421 1760 LPDSVC (32933b07fc16d9f778bee12545fa1b1a) C:\WINDOWS\system32\tcpsvcs.exe 09:51:27.0437 1760 LPDSVC - ok 09:51:27.0484 1760 M3000Srv (b47da7eb985a6676623f378642e417b6) C:\WINDOWS\system32\Drivers\M3000KNT.sys 09:51:27.0484 1760 M3000Srv - ok 09:51:27.0515 1760 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll 09:51:27.0515 1760 Messenger - ok 09:51:27.0593 1760 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 09:51:27.0593 1760 mnmdd - ok 09:51:27.0734 1760 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe 09:51:27.0734 1760 mnmsrvc - ok 09:51:27.0781 1760 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 09:51:27.0781 1760 Modem - ok 09:51:27.0859 1760 Monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\Monfilt.sys 09:51:27.0875 1760 Monfilt - ok 09:51:28.0031 1760 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 09:51:28.0031 1760 Mouclass - ok 09:51:28.0093 1760 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 09:51:28.0093 1760 mouhid - ok 09:51:28.0156 1760 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 09:51:28.0156 1760 MountMgr - ok 09:51:28.0187 1760 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys 09:51:28.0203 1760 mraid35x - ok 09:51:28.0218 1760 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 09:51:28.0218 1760 MRxDAV - ok 09:51:28.0281 1760 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 09:51:28.0296 1760 MRxSmb - ok 09:51:28.0453 1760 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe 09:51:28.0453 1760 MSDTC - ok 09:51:28.0500 1760 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 09:51:28.0500 1760 Msfs - ok 09:51:28.0531 1760 MSIServer - ok 09:51:28.0562 1760 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 09:51:28.0578 1760 MSKSSRV - ok 09:51:28.0578 1760 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 09:51:28.0593 1760 MSPCLOCK - ok 09:51:28.0609 1760 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 09:51:28.0609 1760 MSPQM - ok 09:51:28.0671 1760 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 09:51:28.0671 1760 mssmbios - ok 09:51:28.0703 1760 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys 09:51:28.0703 1760 MSTEE - ok 09:51:28.0875 1760 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys 09:51:28.0875 1760 Mup - ok 09:51:28.0906 1760 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 09:51:28.0921 1760 NABTSFEC - ok 09:51:28.0968 1760 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll 09:51:28.0984 1760 napagent - ok 09:51:29.0156 1760 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 09:51:29.0156 1760 NDIS - ok 09:51:29.0203 1760 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys 09:51:29.0203 1760 NdisIP - ok 09:51:29.0250 1760 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 09:51:29.0250 1760 NdisTapi - ok 09:51:29.0312 1760 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 09:51:29.0312 1760 Ndisuio - ok 09:51:29.0453 1760 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 09:51:29.0453 1760 NdisWan - ok 09:51:29.0500 1760 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys 09:51:29.0500 1760 NDProxy - ok 09:51:29.0531 1760 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 09:51:29.0531 1760 NetBIOS - ok 09:51:29.0546 1760 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 09:51:29.0562 1760 NetBT - ok 09:51:29.0625 1760 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 09:51:29.0625 1760 NetDDE - ok 09:51:29.0640 1760 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 09:51:29.0656 1760 NetDDEdsdm - ok 09:51:29.0812 1760 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 09:51:29.0812 1760 Netlogon - ok 09:51:29.0843 1760 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll 09:51:29.0843 1760 Netman - ok 09:51:29.0968 1760 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 09:51:29.0984 1760 NetTcpPortSharing - ok 09:51:30.0078 1760 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll 09:51:30.0078 1760 Nla - ok 09:51:30.0250 1760 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 09:51:30.0250 1760 Npfs - ok 09:51:30.0328 1760 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 09:51:30.0328 1760 Ntfs - ok 09:51:30.0500 1760 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 09:51:30.0500 1760 NtLmSsp - ok 09:51:30.0578 1760 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll 09:51:30.0578 1760 NtmsSvc - ok 09:51:30.0734 1760 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 09:51:30.0734 1760 Null - ok 09:51:30.0765 1760 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 09:51:30.0781 1760 NwlnkFlt - ok 09:51:30.0812 1760 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 09:51:30.0812 1760 NwlnkFwd - ok 09:51:31.0000 1760 odserv (e54aa592a65f317390eee386a8821692) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 09:51:31.0015 1760 odserv - ok 09:51:31.0031 1760 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 09:51:31.0046 1760 ose - ok 09:51:31.0234 1760 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys 09:51:31.0234 1760 Parport - ok 09:51:31.0281 1760 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 09:51:31.0281 1760 PartMgr - ok 09:51:31.0328 1760 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 09:51:31.0328 1760 ParVdm - ok 09:51:31.0343 1760 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 09:51:31.0359 1760 PCI - ok 09:51:31.0375 1760 PCIDump - ok 09:51:31.0390 1760 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 09:51:31.0406 1760 PCIIde - ok 09:51:31.0437 1760 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 09:51:31.0437 1760 Pcmcia - ok 09:51:31.0546 1760 PDCOMP - ok 09:51:31.0578 1760 PDFRAME - ok 09:51:31.0593 1760 PDRELI - ok 09:51:31.0625 1760 PDRFRAME - ok 09:51:31.0671 1760 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys 09:51:31.0671 1760 perc2 - ok 09:51:31.0812 1760 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys 09:51:31.0812 1760 perc2hib - ok 09:51:31.0906 1760 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 09:51:31.0906 1760 PlugPlay - ok 09:51:32.0062 1760 Pml Driver HPZ12 (9d84376931440f3679beef2a414fa493) C:\WINDOWS\system32\HPZipm12.exe 09:51:32.0062 1760 Pml Driver HPZ12 - ok 09:51:32.0140 1760 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 09:51:32.0140 1760 PolicyAgent - ok 09:51:32.0312 1760 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 09:51:32.0312 1760 PptpMiniport - ok 09:51:32.0390 1760 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 09:51:32.0390 1760 ProtectedStorage - ok 09:51:32.0562 1760 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 09:51:32.0562 1760 PSched - ok 09:51:32.0578 1760 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 09:51:32.0578 1760 Ptilink - ok 09:51:32.0625 1760 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys 09:51:32.0625 1760 ql1080 - ok 09:51:32.0656 1760 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys 09:51:32.0656 1760 Ql10wnt - ok 09:51:32.0687 1760 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys 09:51:32.0687 1760 ql12160 - ok 09:51:32.0843 1760 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys 09:51:32.0843 1760 ql1240 - ok 09:51:32.0890 1760 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys 09:51:32.0890 1760 ql1280 - ok 09:51:32.0921 1760 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 09:51:32.0921 1760 RasAcd - ok 09:51:32.0984 1760 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll 09:51:32.0984 1760 RasAuto - ok 09:51:33.0171 1760 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 09:51:33.0171 1760 Rasl2tp - ok 09:51:33.0234 1760 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll 09:51:33.0234 1760 RasMan - ok 09:51:33.0250 1760 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 09:51:33.0265 1760 RasPppoe - ok 09:51:33.0296 1760 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 09:51:33.0296 1760 Raspti - ok 09:51:33.0328 1760 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 09:51:33.0328 1760 Rdbss - ok 09:51:33.0359 1760 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 09:51:33.0359 1760 RDPCDD - ok 09:51:33.0421 1760 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 09:51:33.0437 1760 rdpdr - ok 09:51:33.0609 1760 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys 09:51:33.0609 1760 RDPWD - ok 09:51:33.0656 1760 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe 09:51:33.0656 1760 RDSessMgr - ok 09:51:33.0781 1760 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 09:51:33.0781 1760 redbook - ok 09:51:33.0828 1760 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll 09:51:33.0828 1760 RemoteAccess - ok 09:51:33.0953 1760 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe 09:51:33.0953 1760 RpcLocator - ok 09:51:34.0031 1760 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\System32\rpcss.dll 09:51:34.0046 1760 RpcSs - ok 09:51:34.0156 1760 RSUSBSTOR - ok 09:51:34.0234 1760 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe 09:51:34.0234 1760 RSVP - ok 09:51:34.0312 1760 Rts516xIR - ok 09:51:34.0375 1760 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 09:51:34.0375 1760 SamSs - ok 09:51:34.0453 1760 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe 09:51:34.0453 1760 SCardSvr - ok 09:51:34.0531 1760 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll 09:51:34.0546 1760 Schedule - ok 09:51:34.0671 1760 SeaPort (ca7e42e0b8d117165ed553a7d681352a) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 09:51:34.0687 1760 SeaPort - ok 09:51:34.0750 1760 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 09:51:34.0750 1760 Secdrv - ok 09:51:34.0859 1760 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll 09:51:34.0859 1760 seclogon - ok 09:51:34.0875 1760 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll 09:51:34.0875 1760 SENS - ok 09:51:34.0937 1760 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys 09:51:34.0937 1760 Serial - ok 09:51:35.0062 1760 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 09:51:35.0062 1760 Sfloppy - ok 09:51:35.0140 1760 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll 09:51:35.0156 1760 SharedAccess - ok 09:51:35.0265 1760 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 09:51:35.0265 1760 ShellHWDetection - ok 09:51:35.0296 1760 Simbad - ok 09:51:35.0375 1760 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys 09:51:35.0375 1760 sisagp - ok 09:51:35.0421 1760 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys 09:51:35.0421 1760 SLIP - ok 09:51:35.0515 1760 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys 09:51:35.0515 1760 Sparrow - ok 09:51:35.0609 1760 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 09:51:35.0609 1760 splitter - ok 09:51:35.0671 1760 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe 09:51:35.0671 1760 Spooler - ok 09:51:35.0843 1760 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 09:51:35.0843 1760 sr - ok 09:51:35.0906 1760 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll 09:51:35.0921 1760 srservice - ok 09:51:36.0093 1760 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys 09:51:36.0109 1760 Srv - ok 09:51:36.0156 1760 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll 09:51:36.0171 1760 SSDPSRV - ok 09:51:36.0343 1760 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys 09:51:36.0343 1760 ssmdrv - ok 09:51:36.0421 1760 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll 09:51:36.0421 1760 stisvc - ok 09:51:36.0578 1760 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys 09:51:36.0578 1760 streamip - ok 09:51:36.0625 1760 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 09:51:36.0640 1760 swenum - ok 09:51:36.0687 1760 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 09:51:36.0687 1760 swmidi - ok 09:51:36.0703 1760 SwPrv - ok 09:51:36.0750 1760 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys 09:51:36.0750 1760 symc810 - ok 09:51:36.0890 1760 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys 09:51:36.0890 1760 symc8xx - ok 09:51:36.0921 1760 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys 09:51:36.0921 1760 sym_hi - ok 09:51:36.0953 1760 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys 09:51:36.0953 1760 sym_u3 - ok 09:51:37.0015 1760 SynTP (5c3e900f41426a372de60675afc8aa07) C:\WINDOWS\system32\DRIVERS\SynTP.sys 09:51:37.0015 1760 SynTP - ok 09:51:37.0078 1760 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 09:51:37.0078 1760 sysaudio - ok 09:51:37.0234 1760 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe 09:51:37.0234 1760 SysmonLog - ok 09:51:37.0281 1760 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll 09:51:37.0296 1760 TapiSrv - ok 09:51:37.0375 1760 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 09:51:37.0375 1760 Tcpip - ok 09:51:37.0437 1760 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 09:51:37.0437 1760 TDPIPE - ok 09:51:37.0562 1760 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 09:51:37.0562 1760 TDTCP - ok 09:51:37.0609 1760 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 09:51:37.0609 1760 TermDD - ok 09:51:37.0671 1760 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll 09:51:37.0687 1760 TermService - ok 09:51:37.0843 1760 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 09:51:37.0859 1760 Themes - ok 09:51:37.0937 1760 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys 09:51:37.0937 1760 TosIde - ok 09:51:37.0953 1760 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll 09:51:37.0953 1760 TrkWks - ok 09:51:38.0000 1760 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 09:51:38.0000 1760 Udfs - ok 09:51:38.0046 1760 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys 09:51:38.0046 1760 ultra - ok 09:51:38.0218 1760 UMWdf (c81b8635dee0d3ef5f64b3dd643023a5) C:\WINDOWS\system32\wdfmgr.exe 09:51:38.0218 1760 UMWdf - ok 09:51:38.0328 1760 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 09:51:38.0328 1760 Update - ok 09:51:38.0390 1760 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll 09:51:38.0390 1760 upnphost - ok 09:51:38.0531 1760 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe 09:51:38.0531 1760 UPS - ok 09:51:38.0593 1760 USBAAPL (83cafcb53201bbac04d822f32438e244) C:\WINDOWS\system32\Drivers\usbaapl.sys 09:51:38.0609 1760 USBAAPL - ok 09:51:38.0656 1760 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 09:51:38.0671 1760 usbccgp - ok 09:51:38.0687 1760 USBCCID - ok 09:51:38.0765 1760 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 09:51:38.0765 1760 usbehci - ok 09:51:38.0875 1760 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 09:51:38.0890 1760 usbhub - ok 09:51:38.0937 1760 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys 09:51:38.0937 1760 usbprint - ok 09:51:38.0984 1760 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 09:51:38.0984 1760 usbscan - ok 09:51:39.0031 1760 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 09:51:39.0031 1760 USBSTOR - ok 09:51:39.0171 1760 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 09:51:39.0171 1760 usbuhci - ok 09:51:39.0218 1760 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys 09:51:39.0218 1760 usbvideo - ok 09:51:39.0265 1760 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 09:51:39.0265 1760 VgaSave - ok 09:51:39.0312 1760 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys 09:51:39.0312 1760 viaagp - ok 09:51:39.0453 1760 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys 09:51:39.0453 1760 ViaIde - ok 09:51:39.0500 1760 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 09:51:39.0515 1760 VolSnap - ok 09:51:39.0578 1760 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe 09:51:39.0593 1760 VSS - ok 09:51:39.0718 1760 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll 09:51:39.0734 1760 W32Time - ok 09:51:39.0812 1760 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 09:51:39.0812 1760 Wanarp - ok 09:51:39.0859 1760 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\Drivers\wdf01000.sys 09:51:39.0859 1760 Wdf01000 - ok 09:51:39.0875 1760 WDICA - ok 09:51:39.0906 1760 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 09:51:39.0906 1760 wdmaud - ok 09:51:40.0062 1760 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll 09:51:40.0078 1760 WebClient - ok 09:51:40.0187 1760 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll 09:51:40.0187 1760 winmgmt - ok 09:51:40.0406 1760 wlidsvc (5144ae67d60ec653f97ddf3feed29e77) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 09:51:40.0484 1760 wlidsvc - ok 09:51:40.0625 1760 WmdmPmSN (a477391b7a8b0a0daabadb17cf533a4b) C:\WINDOWS\system32\MsPMSNSv.dll 09:51:40.0625 1760 WmdmPmSN - ok 09:51:40.0718 1760 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys 09:51:40.0718 1760 WmiAcpi - ok 09:51:40.0828 1760 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe 09:51:40.0828 1760 WmiApSrv - ok 09:51:40.0953 1760 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys 09:51:40.0968 1760 WS2IFSL - ok 09:51:41.0015 1760 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll 09:51:41.0015 1760 wscsvc - ok 09:51:41.0171 1760 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 09:51:41.0171 1760 WSTCODEC - ok 09:51:41.0218 1760 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll 09:51:41.0218 1760 wuauserv - ok 09:51:41.0375 1760 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll 09:51:41.0390 1760 WZCSVC - ok 09:51:41.0437 1760 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll 09:51:41.0437 1760 xmlprov - ok 09:51:41.0500 1760 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0 09:51:41.0562 1760 \Device\Harddisk0\DR0 - ok 09:51:41.0562 1760 Boot (0x1200) (288151139fabcac55ae201a4cdfb924b) \Device\Harddisk0\DR0\Partition0 09:51:41.0578 1760 \Device\Harddisk0\DR0\Partition0 - ok 09:51:41.0578 1760 ============================================================ 09:51:41.0578 1760 Scan finished 09:51:41.0578 1760 ============================================================ 09:51:41.0625 1564 Detected object count: 0 09:51:41.0625 1564 Actual detected object count: 0 09:52:09.0203 1716 Deinitialize success
Post #60
Hi Shannon

Please log in as Administrator fo all these instructions.

There is a bad file in your Windows Installer folder that we need to get rid of.

There is also an entry that wasn’t fixed properly with the last ComboFix “fix”. For this to work, you need to be able to see ComboFix on your desktop. Can you tell me if that is possible.

Meanwhile please do the following:

Launch Notepad (Start>All Programs>Accessories), and copy/paste all the Quoted REGEDIT below to it. Don't forget to include REGEDIT4.
  • Save in: Desktop
  • File Name: fixme.reg
  • Save as Type: All files
  • Click: Save

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDesktop"=dword:00000000


On the desktop, doubleclick fixme.reg and allow it to run. Let it merge

Reboot

====================================

Delete a file

Remember to be log in as Administrator

This file is bad and needs to be removed:

c:\windows\Installer\19ba3.msi

To remove it:
  • click Start, Run and type installer in the box
  • scroll down to find 19ba3.msi
  • right-click on it and choose Delete
====================================

Next

Again using Start, Run type in this command:

regsvr32 /i shell32.dll

Also please describe how your computer is behaving at the moment and if you can see ComboFix on your desktop.

Thanks

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI