rootkit.boot.pihar.b won't go away [Solved]

ok first i ran combofix and this is its log ComboFix 12-04-26.01 - Jeffrey 04/26/2012 22:41:47.3.8 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.8183.6508 [GMT -4:00] Running from: c:\users\[removed]\Downloads\ComboFix.exe AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\aHelTFbukWq.exe c:\windows\svchost.exe . . ((((((((((((((((((((((((( Files Created from 2012-03-27 to 2012-04-27 ))))))))))))))))))))))))))))))) . . 2012-04-27 02:44 . 2012-04-27 02:44 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-04-26 20:15 . 2012-04-26 20:15 ——– d—–w- c:\program files (x86)\ESET 2012-04-26 20:07 . 2012-04-26 20:07 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-04-26 20:07 . 2012-04-26 20:07 ——– d—–w- c:\programdata\Malwarebytes 2012-04-26 20:07 . 2012-04-04 19:56 24904 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-04-26 18:36 . 2012-04-26 18:37 ——– d—–w- c:\program files (x86)\ERUNT 2012-04-26 16:24 . 2012-04-26 16:24 ——– d—–w- c:\windows\Sun 2012-04-26 15:53 . 2012-04-27 02:26 ——– d—–w- C:\TDSSKiller_Quarantine 2012-04-26 14:54 . 2008-07-31 14:41 68616 —-a-w- c:\windows\SysWow64\XAPOFX1_1.dll 2012-04-26 14:54 . 2008-07-31 14:40 509448 —-a-w- c:\windows\SysWow64\XAudio2_2.dll 2012-04-26 14:54 . 2008-07-12 12:18 467984 —-a-w- c:\windows\SysWow64\d3dx10_39.dll 2012-04-26 14:54 . 2008-07-12 12:18 3851784 —-a-w- c:\windows\SysWow64\D3DX9_39.dll 2012-04-26 14:54 . 2008-07-12 12:18 1493528 —-a-w- c:\windows\SysWow64\D3DCompiler_39.dll 2012-04-26 14:52 . 2012-04-26 14:52 ——– d—–w- C:\Riot Games 2012-04-26 10:43 . 2012-04-26 18:36 ——– d—–w- c:\programdata\PMB Files 2012-04-26 10:36 . 2012-04-26 10:36 ——– d—–w- c:\program files (x86)\Mozilla Maintenance Service 2012-04-26 10:29 . 2012-04-26 10:29 ——– d—–w- c:\program files (x86)\Common Files\McAfee 2012-04-26 10:29 . 2012-02-22 17:29 10248 —-a-w- c:\windows\system32\drivers\mfeclnk.sys 2012-04-26 10:29 . 2012-02-22 17:29 75936 —-a-w- c:\windows\system32\drivers\mfenlfk.sys 2012-04-26 10:29 . 2012-02-22 17:29 65264 —-a-w- c:\windows\system32\drivers\cfwids.sys 2012-04-26 10:29 . 2012-02-22 17:29 487296 —-a-w- c:\windows\system32\drivers\mfefirek.sys 2012-04-26 10:29 . 2012-02-22 17:29 289664 —-a-w- c:\windows\system32\drivers\mfewfpk.sys 2012-04-26 10:29 . 2012-02-22 17:29 229528 —-a-w- c:\windows\system32\drivers\mfeavfk.sys 2012-04-26 10:29 . 2012-02-22 17:29 100912 —-a-w- c:\windows\system32\drivers\mferkdet.sys 2012-04-26 10:29 . 2012-04-26 10:29 ——– d—–w- c:\program files\Common Files\McAfee 2012-04-26 10:29 . 2012-04-26 10:30 ——– d—–w- c:\program files\McAfee 2012-04-26 10:29 . 2012-04-26 15:54 ——– d—–w- c:\program files (x86)\McAfee 2012-04-26 10:13 . 2012-03-20 17:11 162192 —-a-w- c:\windows\system32\mfevtps.exe 2012-04-26 10:13 . 2012-04-26 13:29 ——– d—–w- c:\programdata\McAfee 2012-04-26 10:08 . 2012-04-26 10:08 ——– d—–w- c:\program files (x86)\Compact Wireless-G USB Adapter Wireless Network Monitor 2012-04-26 10:08 . 2001-09-05 08:18 77824 —-a-w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll 2012-04-26 10:08 . 2001-09-05 08:18 225280 ——w- c:\program files (x86)\Common Files\InstallShield\IScript\iscript.dll 2012-04-26 10:08 . 2001-09-05 08:14 176128 ——w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll 2012-04-26 10:08 . 2001-09-05 08:13 32768 ——w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll 2012-04-26 10:02 . 2012-04-26 10:04 ——– d—–w- c:\users\Jeffrey 2012-04-26 09:45 . 2012-04-18 08:03 8917360 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2E70F480-88C1-4FEF-A7D6-4A31B65AAC75}\mpengine.dll 2012-04-26 09:45 . 2012-02-23 15:18 279656 ——w- c:\windows\system32\MpSigStub.exe 2012-04-26 09:12 . 2012-02-15 06:27 1031680 —-a-w- c:\windows\system32\rdpcore.dll 2012-04-26 09:12 . 2012-02-15 05:44 826368 —-a-w- c:\windows\SysWow64\rdpcore.dll 2012-04-26 09:12 . 2012-02-15 04:47 204800 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-04-26 09:12 . 2012-02-15 04:46 23552 —-a-w- c:\windows\system32\drivers\tdtcp.sys 2012-04-26 09:12 . 2012-01-25 06:27 76288 —-a-w- c:\windows\system32\rdpwsx.dll 2012-04-26 09:12 . 2012-01-25 06:27 149504 —-a-w- c:\windows\system32\rdpcorekmts.dll 2012-04-26 09:12 . 2012-01-25 06:20 9216 —-a-w- c:\windows\system32\rdrmemptylst.exe 2012-04-26 09:12 . 2010-01-09 07:19 139264 —-a-w- c:\windows\system32\cabview.dll 2012-04-26 09:12 . 2010-01-09 06:52 132608 —-a-w- c:\windows\SysWow64\cabview.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-02-22 17:29 . 2012-02-22 17:29 647208 —-a-w- c:\windows\system32\drivers\mfehidk.sys 2012-02-22 17:29 . 2012-02-22 17:29 160792 —-a-w- c:\windows\system32\drivers\mfeapfk.sys . . ((((((((((((((((((((((((((((( SnapShot@2012-04-26_19.26.30 ))))))))))))))))))))))))))))))))))))))))) . - 2012-04-26 10:05 . 2012-04-26 19:10 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2012-04-26 10:05 . 2012-04-27 02:28 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2012-04-26 19:32 . 2012-04-26 19:27 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\index.dat + 2012-04-26 09:11 . 2012-04-27 02:28 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012012042620120427\index.dat - 2012-04-26 09:11 . 2012-04-26 19:10 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012012042620120427\index.dat + 2012-04-26 09:09 . 2012-04-27 02:28 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat - 2012-04-26 09:09 . 2012-04-26 19:10 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat + 2009-10-26 23:35 . 2012-04-27 02:29 26444 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-04-27 02:29 24472 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin - 2012-04-26 09:58 . 2012-04-26 19:03 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2012-04-26 09:58 . 2012-04-27 02:27 32768 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2012-04-26 09:58 . 2012-04-26 19:03 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2012-04-26 09:58 . 2012-04-27 02:27 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-07-14 04:54 . 2012-04-27 02:27 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-07-14 04:54 . 2012-04-26 19:03 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2012-04-26 09:58 . 2012-04-27 02:45 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2012-04-26 09:58 . 2012-04-26 19:26 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2012-04-26 10:09 . 2012-04-27 02:45 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat - 2012-04-26 10:09 . 2012-04-26 19:26 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat - 2012-04-26 10:09 . 2012-04-26 19:26 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\History\History.IE5\index.dat + 2012-04-26 10:09 . 2012-04-27 02:45 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\History\History.IE5\index.dat + 2012-04-26 10:09 . 2012-04-27 02:45 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies\index.dat - 2012-04-26 10:09 . 2012-04-26 19:26 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies\index.dat - 2012-04-26 09:58 . 2012-04-26 19:26 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2012-04-26 09:58 . 2012-04-27 02:45 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2012-04-26 09:58 . 2012-04-26 19:26 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2012-04-26 09:58 . 2012-04-27 02:45 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2012-04-26 12:03 . 2012-04-27 02:30 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat - 2012-04-26 12:03 . 2012-04-26 19:12 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2012-04-26 12:03 . 2012-04-27 02:30 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2012-04-26 12:03 . 2012-04-26 19:12 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2012-04-26 09:19 . 2012-04-27 02:29 4478 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1896610987-2083587572-4140636840-1000_UserData.bin + 2012-04-27 02:45 . 2012-04-27 02:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-04-27 02:45 . 2012-04-27 02:45 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2012-04-26 19:26 . 2012-04-26 19:26 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat - 2009-07-14 04:54 . 2012-04-26 19:26 212992 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2012-04-27 02:45 212992 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-07-14 04:54 . 2012-04-27 02:45 917504 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2012-04-26 14:22 . 2012-04-27 01:08 100520 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin + 2009-07-14 02:36 . 2012-04-27 02:34 615122 c:\windows\system32\perfh009.dat - 2009-07-14 02:36 . 2012-04-26 19:10 615122 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2012-04-27 02:34 103496 c:\windows\system32\perfc009.dat - 2009-07-14 02:36 . 2012-04-26 19:10 103496 c:\windows\system32\perfc009.dat + 2009-07-14 05:01 . 2012-04-27 02:44 328644 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2009-07-14 05:01 . 2012-04-26 19:25 328644 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat - 2012-04-26 15:53 . 2012-04-26 19:25 328644 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1896610987-2083587572-4140636840-1000-8192.dat + 2012-04-26 15:53 . 2012-04-27 02:44 328644 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1896610987-2083587572-4140636840-1000-8192.dat + 2009-07-14 04:54 . 2012-04-27 02:45 4947968 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 04:54 . 2012-04-26 19:26 4947968 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-07-14 02:34 . 2012-04-26 19:16 9699328 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT + 2009-07-14 02:34 . 2012-04-27 02:40 9699328 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT . – Snapshot reset to current date – . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files (x86)\Java\jre6\bin\jusched.exe" [2009-10-26 148888] "ShwiconXP9106"="c:\program files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe" [2009-07-17 237568] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-25 140520] "DellComms"="c:\program files (x86)\Dell\DellComms\bin\sprtcmd.exe" [2009-05-05 206064] "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2012-03-22 1675160] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408] . c:\users\Jeffrey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192] ERUNT AutoBackup.lnk - c:\program files (x86)\ERUNT\AUTOBACK.EXE [2005-10-20 38912] . c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408] R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936] R2 SessionLauncher;SessionLauncher;c:\users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe [x] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-04-21 129976] R3 RoxMediaDB10;RoxMediaDB10;c:\program files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2009-06-26 1124848] S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x] S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-03-31 92160] S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-12-18 155648] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936] S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936] S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2012-03-20 210584] S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x] S2 sprtsvc_DellComms;SupportSoft Sprocket Service (DellComms);c:\program files (x86)\Dell\DellComms\bin\sprtsvc.exe [2009-05-05 206064] S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [x] S3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x] S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x] S3 netr7364;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr7364.sys [x] . . — Other Services/Drivers In Memory — . *Deregistered* - mfeavfk01 . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-05-23 7833120] "Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [BU] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-26 16327712] "Broadcom Wireless Manager UI"="c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.exe" [2009-07-17 4968960] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\users\Jeffrey\AppData\Roaming\Mozilla\Firefox\Profiles\olkt1xwk.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - prefs.js: network.proxy.type - 0 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-aHelTFbukWq.exe - c:\programdata\aHelTFbukWq.exe . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}] @Denied: (A 2) (Everyone) @="IFlashBroker2" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\windows\SysWOW64\rundll32.exe c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\\.\globalroot\systemroot\svchost.exe . ************************************************************************** . Completion time: 2012-04-26 22:47:35 - machine was rebooted ComboFix-quarantined-files.txt 2012-04-27 02:47 ComboFix2.txt 2012-04-26 19:50 ComboFix3.txt 2012-04-26 19:28 . Pre-Run: 947,960,958,976 bytes free Post-Run: 947,928,489,984 bytes free . - - End Of File - - CD8313A71620041933F230E01048DA4C and then i ran tdsskiller and this is its log 22:48:35.0270 2816 TDSS rootkit removing tool [removed] Apr 24 2012 18:43:43 22:48:36.0222 2816 ============================================================ 22:48:36.0222 2816 Current date / time: 2012/04/26 22:48:36.0222 22:48:36.0222 2816 SystemInfo: 22:48:36.0222 2816 22:48:36.0222 2816 OS Version: 6.1.7600 ServicePack: 0.0 22:48:36.0222 2816 Product type: Workstation 22:48:36.0222 2816 ComputerName: JEFFREY-PC 22:48:36.0222 2816 UserName: Jeffrey 22:48:36.0222 2816 Windows directory: C:\Windows 22:48:36.0222 2816 System windows directory: C:\Windows 22:48:36.0222 2816 Running under WOW64 22:48:36.0222 2816 Processor architecture: Intel x64 22:48:36.0222 2816 Number of processors: 8 22:48:36.0222 2816 Page size: 0x1000 22:48:36.0222 2816 Boot type: Normal boot 22:48:36.0222 2816 ============================================================ 22:48:39.0139 2816 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 22:48:39.0155 2816 ============================================================ 22:48:39.0155 2816 \Device\Harddisk0\DR0: 22:48:39.0155 2816 MBR partitions: 22:48:39.0155 2816 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x14000, BlocksNum 0x1D4C000 22:48:39.0155 2816 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1D60000, BlocksNum 0x729A65B0 22:48:39.0155 2816 ============================================================ 22:48:39.0201 2816 C: <-> \Device\Harddisk0\DR0\Partition1 22:48:39.0201 2816 ============================================================ 22:48:39.0201 2816 Initialize success 22:48:39.0201 2816 ============================================================ 22:48:40.0418 1688 ============================================================ 22:48:40.0418 1688 Scan started 22:48:40.0418 1688 Mode: Manual; 22:48:40.0418 1688 ============================================================ 22:48:41.0791 1688 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys 22:48:41.0791 1688 1394ohci - ok 22:48:41.0822 1688 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys 22:48:41.0822 1688 ACPI - ok 22:48:41.0838 1688 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys 22:48:41.0838 1688 AcpiPmi - ok 22:48:41.0900 1688 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 22:48:41.0916 1688 adp94xx - ok 22:48:41.0931 1688 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 22:48:41.0947 1688 adpahci - ok 22:48:41.0947 1688 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 22:48:41.0963 1688 adpu320 - ok 22:48:42.0009 1688 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll 22:48:42.0009 1688 AeLookupSvc - ok 22:48:42.0243 1688 AERTFilters (3ac22a3dfa8a050e35f0e3cd99d0cdf2) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe 22:48:42.0259 1688 AERTFilters - ok 22:48:42.0306 1688 AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys 22:48:42.0306 1688 AFD - ok 22:48:42.0321 1688 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys 22:48:42.0321 1688 agp440 - ok 22:48:42.0337 1688 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe 22:48:42.0353 1688 ALG - ok 22:48:42.0353 1688 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys 22:48:42.0353 1688 aliide - ok 22:48:42.0353 1688 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys 22:48:42.0353 1688 amdide - ok 22:48:42.0368 1688 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 22:48:42.0368 1688 AmdK8 - ok 22:48:42.0368 1688 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 22:48:42.0368 1688 AmdPPM - ok 22:48:42.0384 1688 amdsata (7a4b413614c055935567cf88a9734d38) C:\Windows\system32\DRIVERS\amdsata.sys 22:48:42.0384 1688 amdsata - ok 22:48:42.0399 1688 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 22:48:42.0399 1688 amdsbs - ok 22:48:42.0399 1688 amdxata (b4ad0cacbab298671dd6f6ef7e20679d) C:\Windows\system32\DRIVERS\amdxata.sys 22:48:42.0399 1688 amdxata - ok 22:48:42.0415 1688 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys 22:48:42.0415 1688 AppID - ok 22:48:42.0431 1688 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll 22:48:42.0431 1688 AppIDSvc - ok 22:48:42.0431 1688 Appinfo (d065be66822847b7f127d1f90158376e) C:\Windows\System32\appinfo.dll 22:48:42.0431 1688 Appinfo - ok 22:48:42.0462 1688 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 22:48:42.0462 1688 arc - ok 22:48:42.0462 1688 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 22:48:42.0477 1688 arcsas - ok 22:48:42.0477 1688 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 22:48:42.0477 1688 AsyncMac - ok 22:48:42.0477 1688 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys 22:48:42.0477 1688 atapi - ok 22:48:42.0540 1688 AudioEndpointBuilder (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll 22:48:42.0540 1688 AudioEndpointBuilder - ok 22:48:42.0555 1688 AudioSrv (07721a77180edd4d39ccb865bf63c7fd) C:\Windows\System32\Audiosrv.dll 22:48:42.0555 1688 AudioSrv - ok 22:48:42.0571 1688 AxInstSV (b20b5fa5ca050e9926e4d1db81501b32) C:\Windows\System32\AxInstSV.dll 22:48:42.0571 1688 AxInstSV - ok 22:48:42.0665 1688 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 22:48:42.0680 1688 b06bdrv - ok 22:48:42.0727 1688 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 22:48:42.0743 1688 b57nd60a - ok 22:48:42.0774 1688 BCM42RLY (e001dd475a7c27ebe5a0db45c11bad71) C:\Windows\system32\drivers\BCM42RLY.sys 22:48:42.0774 1688 BCM42RLY - ok 22:48:43.0086 1688 BCM43XX (37394d3553e220fb732c21e217e1bd8b) C:\Windows\system32\DRIVERS\bcmwl664.sys 22:48:43.0101 1688 BCM43XX - ok 22:48:43.0320 1688 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll 22:48:43.0320 1688 BDESVC - ok 22:48:43.0367 1688 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 22:48:43.0367 1688 Beep - ok 22:48:43.0523 1688 BFE (4992c609a6315671463e30f6512bc022) C:\Windows\System32\bfe.dll 22:48:43.0538 1688 BFE - ok 22:48:43.0616 1688 BITS (7f0c323fe3da28aa4aa1bda3f575707f) C:\Windows\system32\qmgr.dll 22:48:43.0632 1688 BITS - ok 22:48:43.0647 1688 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 22:48:43.0663 1688 blbdrive - ok 22:48:43.0663 1688 bowser (91ce0d3dc57dd377e690a2d324022b08) C:\Windows\system32\DRIVERS\bowser.sys 22:48:43.0679 1688 bowser - ok 22:48:43.0679 1688 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 22:48:43.0694 1688 BrFiltLo - ok 22:48:43.0694 1688 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 22:48:43.0694 1688 BrFiltUp - ok 22:48:43.0710 1688 BridgeMP (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys 22:48:43.0725 1688 BridgeMP - ok 22:48:43.0741 1688 Browser (94fbc06f294d58d02361918418f996e3) C:\Windows\System32\browser.dll 22:48:43.0741 1688 Browser - ok 22:48:43.0772 1688 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 22:48:43.0772 1688 Brserid - ok 22:48:43.0772 1688 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 22:48:43.0788 1688 BrSerWdm - ok 22:48:43.0788 1688 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 22:48:43.0788 1688 BrUsbMdm - ok 22:48:43.0788 1688 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 22:48:43.0788 1688 BrUsbSer - ok 22:48:43.0803 1688 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 22:48:43.0803 1688 BTHMODEM - ok 22:48:43.0819 1688 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll 22:48:43.0819 1688 bthserv - ok 22:48:43.0850 1688 catchme - ok 22:48:43.0850 1688 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 22:48:43.0866 1688 cdfs - ok 22:48:43.0897 1688 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys 22:48:43.0897 1688 cdrom - ok 22:48:43.0928 1688 CertPropSvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll 22:48:43.0928 1688 CertPropSvc - ok 22:48:44.0084 1688 cfwids (274ce03459896006f7a5069266e0469e) C:\Windows\system32\drivers\cfwids.sys 22:48:44.0100 1688 cfwids - ok 22:48:44.0100 1688 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 22:48:44.0100 1688 circlass - ok 22:48:44.0162 1688 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 22:48:44.0178 1688 CLFS - ok 22:48:44.0225 1688 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 22:48:44.0225 1688 clr_optimization_v2.0.50727_32 - ok 22:48:44.0271 1688 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 22:48:44.0271 1688 clr_optimization_v2.0.50727_64 - ok 22:48:44.0271 1688 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 22:48:44.0271 1688 CmBatt - ok 22:48:44.0271 1688 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys 22:48:44.0271 1688 cmdide - ok 22:48:44.0303 1688 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys 22:48:44.0303 1688 CNG - ok 22:48:44.0318 1688 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 22:48:44.0318 1688 Compbatt - ok 22:48:44.0334 1688 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys 22:48:44.0334 1688 CompositeBus - ok 22:48:44.0349 1688 COMSysApp - ok 22:48:44.0349 1688 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 22:48:44.0349 1688 crcdisk - ok 22:48:44.0381 1688 CryptSvc (8c57411b66282c01533cb776f98ad384) C:\Windows\system32\cryptsvc.dll 22:48:44.0381 1688 CryptSvc - ok 22:48:44.0459 1688 DcomLaunch (7266972e86890e2b30c0c322e906b027) C:\Windows\system32\rpcss.dll 22:48:44.0459 1688 DcomLaunch - ok 22:48:44.0521 1688 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll 22:48:44.0521 1688 defragsvc - ok 22:48:44.0537 1688 DfsC (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys 22:48:44.0537 1688 DfsC - ok 22:48:44.0599 1688 Dhcp (ce3b9562d997f69b330d181a8875960f) C:\Windows\system32\dhcpcore.dll 22:48:44.0615 1688 Dhcp - ok 22:48:44.0615 1688 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 22:48:44.0615 1688 discache - ok 22:48:44.0646 1688 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 22:48:44.0646 1688 Disk - ok 22:48:44.0661 1688 Dnscache (676108c4e3aa6f6b34633748bd0bebd9) C:\Windows\System32\dnsrslvr.dll 22:48:44.0661 1688 Dnscache - ok 22:48:44.0771 1688 DockLoginService (0840abbbdf438691ee65a20040635cbe) C:\Program Files\Dell\DellDock\DockLogin.exe 22:48:44.0786 1688 DockLoginService - ok 22:48:44.0817 1688 dot3svc (14452acdb09b70964c8c21bf80a13acb) C:\Windows\System32\dot3svc.dll 22:48:44.0817 1688 dot3svc - ok 22:48:44.0833 1688 DPS (8c2ba6bea949ee6e68385f5692bafb94) C:\Windows\system32\dps.dll 22:48:44.0833 1688 DPS - ok 22:48:44.0849 1688 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 22:48:44.0849 1688 drmkaud - ok 22:48:44.0927 1688 DXGKrnl (7cb7d2b73813ce05c7bc0f5f95d27cec) C:\Windows\System32\drivers\dxgkrnl.sys 22:48:44.0942 1688 DXGKrnl - ok 22:48:44.0973 1688 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll 22:48:44.0973 1688 EapHost - ok 22:48:45.0270 1688 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 22:48:45.0301 1688 ebdrv - ok 22:48:45.0457 1688 EFS (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\System32\lsass.exe 22:48:45.0457 1688 EFS - ok 22:48:45.0566 1688 ehRecvr (b91d81b3b54a54ccafc03733dbc2e29e) C:\Windows\ehome\ehRecvr.exe 22:48:45.0566 1688 ehRecvr - ok 22:48:45.0582 1688 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe 22:48:45.0597 1688 ehSched - ok 22:48:45.0675 1688 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 22:48:45.0675 1688 elxstor - ok 22:48:45.0675 1688 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys 22:48:45.0675 1688 ErrDev - ok 22:48:45.0769 1688 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll 22:48:45.0769 1688 EventSystem - ok 22:48:45.0816 1688 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 22:48:45.0816 1688 exfat - ok 22:48:45.0925 1688 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 22:48:45.0925 1688 fastfat - ok 22:48:46.0019 1688 Fax (d607b2f1bee3992aa6c2c92c0a2f0855) C:\Windows\system32\fxssvc.exe 22:48:46.0034 1688 Fax - ok 22:48:46.0034 1688 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 22:48:46.0050 1688 fdc - ok 22:48:46.0050 1688 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll 22:48:46.0065 1688 fdPHost - ok 22:48:46.0081 1688 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll 22:48:46.0081 1688 FDResPub - ok 22:48:46.0081 1688 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 22:48:46.0081 1688 FileInfo - ok 22:48:46.0097 1688 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 22:48:46.0097 1688 Filetrace - ok 22:48:46.0112 1688 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 22:48:46.0112 1688 flpydisk - ok 22:48:46.0128 1688 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys 22:48:46.0128 1688 FltMgr - ok 22:48:46.0221 1688 FontCache (8ac4cb4ea61e41009fae9ae7b2b5da3a) C:\Windows\system32\FntCache.dll 22:48:46.0237 1688 FontCache - ok 22:48:46.0315 1688 FontCache3.0.0.0 (8d89e3131c27fdd6932189cb785e1b7a) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 22:48:46.0315 1688 FontCache3.0.0.0 - ok 22:48:46.0362 1688 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 22:48:46.0362 1688 FsDepends - ok 22:48:46.0377 1688 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys 22:48:46.0377 1688 Fs_Rec - ok 22:48:46.0393 1688 fvevol (b8b2a6e1558f8f5de5ce431c5b2c7b09) C:\Windows\system32\DRIVERS\fvevol.sys 22:48:46.0393 1688 fvevol - ok 22:48:46.0440 1688 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 22:48:46.0440 1688 gagp30kx - ok 22:48:46.0518 1688 gpsvc (fe5ab4525bc2ec68b9119a6e5d40128b) C:\Windows\System32\gpsvc.dll 22:48:46.0533 1688 gpsvc - ok 22:48:46.0580 1688 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 22:48:46.0580 1688 hcw85cir - ok 22:48:46.0627 1688 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys 22:48:46.0627 1688 HDAudBus - ok 22:48:46.0658 1688 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 22:48:46.0658 1688 HidBatt - ok 22:48:46.0674 1688 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 22:48:46.0674 1688 HidBth - ok 22:48:46.0689 1688 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 22:48:46.0689 1688 HidIr - ok 22:48:46.0689 1688 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\System32\hidserv.dll 22:48:46.0705 1688 hidserv - ok 22:48:46.0721 1688 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys 22:48:46.0721 1688 HidUsb - ok 22:48:46.0736 1688 hkmsvc (efa58ede58dd74388ffd04cb32681518) C:\Windows\system32\kmsvc.dll 22:48:46.0736 1688 hkmsvc - ok 22:48:46.0767 1688 HomeGroupListener (046b2673767ca626e2cfb7fdf735e9e8) C:\Windows\system32\ListSvc.dll 22:48:46.0767 1688 HomeGroupListener - ok 22:48:46.0814 1688 HomeGroupProvider (06a7422224d9865a5613710a089987df) C:\Windows\system32\provsvc.dll 22:48:46.0814 1688 HomeGroupProvider - ok 22:48:46.0830 1688 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys 22:48:46.0830 1688 HpSAMD - ok 22:48:46.0877 1688 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys 22:48:46.0892 1688 HTTP - ok 22:48:46.0908 1688 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys 22:48:46.0908 1688 hwpolicy - ok 22:48:46.0923 1688 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys 22:48:46.0923 1688 i8042prt - ok 22:48:47.0001 1688 iaStor (1d004cb1da6323b1f55caef7f94b61d9) C:\Windows\system32\DRIVERS\iaStor.sys 22:48:47.0017 1688 iaStor - ok 22:48:47.0064 1688 iaStorV (d83efb6fd45df9d55e9a1afc63640d50) C:\Windows\system32\DRIVERS\iaStorV.sys 22:48:47.0064 1688 iaStorV - ok 22:48:47.0251 1688 idsvc (2f2be70d3e02b6fa877921ab9516d43c) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 22:48:47.0251 1688 idsvc - ok 22:48:47.0267 1688 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 22:48:47.0267 1688 iirsp - ok 22:48:47.0360 1688 IKEEXT (c5b4683680df085b57bc53e5ef34861f) C:\Windows\System32\ikeext.dll 22:48:47.0360 1688 IKEEXT - ok 22:48:47.0501 1688 IntcAzAudAddService (d42d651676883181400e22957a7e0b1e) C:\Windows\system32\drivers\RTKVHD64.sys 22:48:47.0516 1688 IntcAzAudAddService - ok 22:48:47.0688 1688 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys 22:48:47.0688 1688 intelide - ok 22:48:47.0703 1688 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 22:48:47.0703 1688 intelppm - ok 22:48:47.0813 1688 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll 22:48:47.0813 1688 IPBusEnum - ok 22:48:47.0844 1688 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys 22:48:47.0844 1688 IpFilterDriver - ok 22:48:47.0922 1688 iphlpsvc (f8e058d17363ec580e4b7232778b6cb5) C:\Windows\System32\iphlpsvc.dll 22:48:47.0922 1688 iphlpsvc - ok 22:48:47.0937 1688 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys 22:48:47.0937 1688 IPMIDRV - ok 22:48:47.0937 1688 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 22:48:47.0937 1688 IPNAT - ok 22:48:47.0953 1688 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 22:48:47.0953 1688 IRENUM - ok 22:48:47.0953 1688 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys 22:48:47.0969 1688 isapnp - ok 22:48:48.0000 1688 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys 22:48:48.0000 1688 iScsiPrt - ok 22:48:48.0047 1688 k57nd60a (249ee2d26cb1530f3bede0ac8b9e3099) C:\Windows\system32\DRIVERS\k57nd60a.sys 22:48:48.0062 1688 k57nd60a - ok 22:48:48.0062 1688 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys 22:48:48.0062 1688 kbdclass - ok 22:48:48.0078 1688 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys 22:48:48.0078 1688 kbdhid - ok 22:48:48.0093 1688 KeyIso (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe 22:48:48.0093 1688 KeyIso - ok 22:48:48.0109 1688 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys 22:48:48.0109 1688 KSecDD - ok 22:48:48.0125 1688 KSecPkg (bbe1bf6d9b661c354d4857d5fadb943b) C:\Windows\system32\Drivers\ksecpkg.sys 22:48:48.0125 1688 KSecPkg - ok 22:48:48.0125 1688 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 22:48:48.0125 1688 ksthunk - ok 22:48:48.0187 1688 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll 22:48:48.0187 1688 KtmRm - ok 22:48:48.0249 1688 LanmanServer (c926920b8978de6acfe9e15c709e9b57) C:\Windows\System32\srvsvc.dll 22:48:48.0265 1688 LanmanServer - ok 22:48:48.0312 1688 LanmanWorkstation (27026eac8818e8a6c00a1cad2f11d29a) C:\Windows\System32\wkssvc.dll 22:48:48.0312 1688 LanmanWorkstation - ok 22:48:48.0343 1688 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 22:48:48.0343 1688 lltdio - ok 22:48:48.0405 1688 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll 22:48:48.0405 1688 lltdsvc - ok 22:48:48.0421 1688 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll 22:48:48.0421 1688 lmhosts - ok 22:48:48.0452 1688 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 22:48:48.0452 1688 LSI_FC - ok 22:48:48.0468 1688 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 22:48:48.0483 1688 LSI_SAS - ok 22:48:48.0499 1688 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 22:48:48.0499 1688 LSI_SAS2 - ok 22:48:48.0515 1688 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 22:48:48.0515 1688 LSI_SCSI - ok 22:48:48.0530 1688 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 22:48:48.0530 1688 luafv - ok 22:48:48.0577 1688 MBAMProtector (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys 22:48:48.0577 1688 MBAMProtector - ok 22:48:48.0686 1688 MBAMService (ba400ed640bca1eae5c727ae17c10207) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe 22:48:48.0702 1688 MBAMService - ok 22:48:48.0780 1688 McAfee SiteAdvisor Service (acb01bf1a905356ab7f978c7fe852209) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe 22:48:48.0780 1688 McAfee SiteAdvisor Service - ok 22:48:48.0780 1688 McMPFSvc (acb01bf1a905356ab7f978c7fe852209) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe 22:48:48.0780 1688 McMPFSvc - ok 22:48:48.0795 1688 mcmscsvc (acb01bf1a905356ab7f978c7fe852209) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe 22:48:48.0795 1688 mcmscsvc - ok 22:48:48.0795 1688 McNaiAnn (acb01bf1a905356ab7f978c7fe852209) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe 22:48:48.0795 1688 McNaiAnn - ok 22:48:48.0811 1688 McNASvc (acb01bf1a905356ab7f978c7fe852209) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe 22:48:48.0811 1688 McNASvc - ok 22:48:48.0889 1688 McODS (dd01bf24dd6bf70a90549f9a7bb2d1eb) C:\Program Files\McAfee\VirusScan\mcods.exe 22:48:48.0889 1688 McODS - ok 22:48:48.0905 1688 McProxy (acb01bf1a905356ab7f978c7fe852209) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe 22:48:48.0905 1688 McProxy - ok 22:48:48.0951 1688 McShield (e998e3b12101288d716558466cbf6ae1) C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe 22:48:48.0951 1688 McShield - ok 22:48:49.0139 1688 Mcx2Svc (f84c8f1000bc11e3b7b23cbd3baff111) C:\Windows\system32\Mcx2Svc.dll 22:48:49.0139 1688 Mcx2Svc - ok 22:48:49.0185 1688 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 22:48:49.0185 1688 megasas - ok 22:48:49.0217 1688 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 22:48:49.0217 1688 MegaSR - ok 22:48:49.0263 1688 mfeapfk (01884cb7655c8908b43ff5e364fe6fd2) C:\Windows\system32\drivers\mfeapfk.sys 22:48:49.0279 1688 mfeapfk - ok 22:48:49.0326 1688 mfeavfk (dab9a9cdfb04e4d68924492aa043019d) C:\Windows\system32\drivers\mfeavfk.sys 22:48:49.0326 1688 mfeavfk - ok 22:48:49.0341 1688 mfeavfk01 - ok 22:48:49.0357 1688 mfefire (b26782c3d6045b4464017d7926877560) C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe 22:48:49.0357 1688 mfefire - ok 22:48:49.0404 1688 mfefirek (ce9a3680675c0907ade16404ca967b49) C:\Windows\system32\drivers\mfefirek.sys 22:48:49.0419 1688 mfefirek - ok 22:48:49.0482 1688 mfehidk (60cf67458dd29cd17e77f2327b1a9a54) C:\Windows\system32\drivers\mfehidk.sys 22:48:49.0482 1688 mfehidk - ok 22:48:49.0513 1688 mfenlfk (a8129cfb919347f8533c934b365e9202) C:\Windows\system32\DRIVERS\mfenlfk.sys 22:48:49.0513 1688 mfenlfk - ok 22:48:49.0544 1688 mferkdet (5041fa2bd2b3a2693b015771bfbf6dca) C:\Windows\system32\drivers\mferkdet.sys 22:48:49.0544 1688 mferkdet - ok 22:48:49.0591 1688 mfevtp (723a5eb6cef7f408c3d0f15a82a6bff8) C:\Windows\system32\mfevtps.exe 22:48:49.0591 1688 mfevtp - ok 22:48:49.0622 1688 mfewfpk (919c56db14a0e1e2ab6da5d2821dc26e) C:\Windows\system32\drivers\mfewfpk.sys 22:48:49.0638 1688 mfewfpk - ok 22:48:49.0669 1688 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 22:48:49.0669 1688 MMCSS - ok 22:48:49.0747 1688 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 22:48:49.0747 1688 Modem - ok 22:48:49.0763 1688 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 22:48:49.0763 1688 monitor - ok 22:48:49.0778 1688 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys 22:48:49.0778 1688 mouclass - ok 22:48:49.0794 1688 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 22:48:49.0794 1688 mouhid - ok 22:48:49.0825 1688 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys 22:48:49.0825 1688 mountmgr - ok 22:48:49.0887 1688 MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 22:48:49.0887 1688 MozillaMaintenance - ok 22:48:49.0919 1688 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys 22:48:49.0919 1688 mpio - ok 22:48:49.0934 1688 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 22:48:49.0950 1688 mpsdrv - ok 22:48:49.0997 1688 MpsSvc (aecab449567d1846dad63ece49e893e3) C:\Windows\system32\mpssvc.dll 22:48:50.0012 1688 MpsSvc - ok 22:48:50.0028 1688 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys 22:48:50.0028 1688 MRxDAV - ok 22:48:50.0043 1688 mrxsmb (cfdcd8ca87c2a657debc150ac35b5e08) C:\Windows\system32\DRIVERS\mrxsmb.sys 22:48:50.0043 1688 mrxsmb - ok 22:48:50.0059 1688 mrxsmb10 (1bee517b220b7f024f411aec1571dd5a) C:\Windows\system32\DRIVERS\mrxsmb10.sys 22:48:50.0059 1688 mrxsmb10 - ok 22:48:50.0090 1688 mrxsmb20 (6b2d5fef385828b6e485c1c90afb8195) C:\Windows\system32\DRIVERS\mrxsmb20.sys 22:48:50.0090 1688 mrxsmb20 - ok 22:48:50.0090 1688 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys 22:48:50.0090 1688 msahci - ok 22:48:50.0106 1688 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys 22:48:50.0121 1688 msdsm - ok 22:48:50.0137 1688 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe 22:48:50.0137 1688 MSDTC - ok 22:48:50.0137 1688 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 22:48:50.0137 1688 Msfs - ok 22:48:50.0137 1688 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 22:48:50.0137 1688 mshidkmdf - ok 22:48:50.0153 1688 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys 22:48:50.0153 1688 msisadrv - ok 22:48:50.0215 1688 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll 22:48:50.0215 1688 MSiSCSI - ok 22:48:50.0215 1688 msiserver - ok 22:48:50.0231 1688 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 22:48:50.0231 1688 MSKSSRV - ok 22:48:50.0231 1688 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 22:48:50.0231 1688 MSPCLOCK - ok 22:48:50.0231 1688 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 22:48:50.0231 1688 MSPQM - ok 22:48:50.0262 1688 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys 22:48:50.0262 1688 MsRPC - ok 22:48:50.0262 1688 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys 22:48:50.0262 1688 mssmbios - ok 22:48:50.0262 1688 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 22:48:50.0262 1688 MSTEE - ok 22:48:50.0262 1688 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 22:48:50.0277 1688 MTConfig - ok 22:48:50.0277 1688 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 22:48:50.0277 1688 Mup - ok 22:48:50.0324 1688 napagent (4987e079a4530fa737a128be54b63b12) C:\Windows\system32\qagentRT.dll 22:48:50.0324 1688 napagent - ok 22:48:50.0355 1688 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 22:48:50.0355 1688 NativeWifiP - ok 22:48:50.0433 1688 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys 22:48:50.0433 1688 NDIS - ok 22:48:50.0465 1688 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 22:48:50.0465 1688 NdisCap - ok 22:48:50.0465 1688 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 22:48:50.0465 1688 NdisTapi - ok 22:48:50.0465 1688 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys 22:48:50.0465 1688 Ndisuio - ok 22:48:50.0480 1688 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys 22:48:50.0480 1688 NdisWan - ok 22:48:50.0496 1688 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys 22:48:50.0496 1688 NDProxy - ok 22:48:50.0496 1688 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 22:48:50.0496 1688 NetBIOS - ok 22:48:50.0511 1688 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys 22:48:50.0511 1688 NetBT - ok 22:48:50.0527 1688 Netlogon (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe 22:48:50.0527 1688 Netlogon - ok 22:48:50.0589 1688 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll 22:48:50.0589 1688 Netman - ok 22:48:50.0621 1688 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll 22:48:50.0636 1688 netprofm - ok 22:48:50.0714 1688 netr7364 (81b8d0c1ce44a7fdbd596b693783950c) C:\Windows\system32\DRIVERS\netr7364.sys 22:48:50.0730 1688 netr7364 - ok 22:48:50.0808 1688 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 22:48:50.0808 1688 NetTcpPortSharing - ok 22:48:50.0823 1688 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 22:48:50.0823 1688 nfrd960 - ok 22:48:50.0839 1688 NlaSvc (d9a0ce66046d6efa0c61baa885cba0a8) C:\Windows\System32\nlasvc.dll 22:48:50.0855 1688 NlaSvc - ok 22:48:50.0855 1688 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 22:48:50.0855 1688 Npfs - ok 22:48:50.0870 1688 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll 22:48:50.0870 1688 nsi - ok 22:48:50.0870 1688 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 22:48:50.0886 1688 nsiproxy - ok 22:48:50.0979 1688 Ntfs (356698a13c4630d5b31c37378d469196) C:\Windows\system32\drivers\Ntfs.sys 22:48:50.0995 1688 Ntfs - ok 22:48:51.0120 1688 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 22:48:51.0120 1688 Null - ok 22:48:51.0791 1688 nvlddmkm (51bd7ef17f0b525994ad5b3748c8288b) C:\Windows\system32\DRIVERS\nvlddmkm.sys 22:48:51.0822 1688 nvlddmkm - ok 22:48:51.0947 1688 nvraid (3e38712941e9bb4ddbee00affe3fed3d) C:\Windows\system32\DRIVERS\nvraid.sys 22:48:51.0947 1688 nvraid - ok 22:48:51.0962 1688 nvstor (477dc4d6deb99be37084c9ac6d013da1) C:\Windows\system32\DRIVERS\nvstor.sys 22:48:51.0962 1688 nvstor - ok 22:48:52.0025 1688 nvsvc (fce8537bf5d504680212d536a3bfe5e2) C:\Windows\system32\nvvsvc.exe 22:48:52.0025 1688 nvsvc - ok 22:48:52.0040 1688 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys 22:48:52.0040 1688 nv_agp - ok 22:48:52.0056 1688 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys 22:48:52.0056 1688 ohci1394 - ok 22:48:52.0103 1688 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 22:48:52.0103 1688 p2pimsvc - ok 22:48:52.0134 1688 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll 22:48:52.0149 1688 p2psvc - ok 22:48:52.0149 1688 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 22:48:52.0149 1688 Parport - ok 22:48:52.0181 1688 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys 22:48:52.0181 1688 partmgr - ok 22:48:52.0196 1688 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll 22:48:52.0196 1688 PcaSvc - ok 22:48:52.0227 1688 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys 22:48:52.0227 1688 pci - ok 22:48:52.0227 1688 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys 22:48:52.0227 1688 pciide - ok 22:48:52.0243 1688 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 22:48:52.0259 1688 pcmcia - ok 22:48:52.0259 1688 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 22:48:52.0259 1688 pcw - ok 22:48:52.0305 1688 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 22:48:52.0321 1688 PEAUTH - ok 22:48:52.0415 1688 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe 22:48:52.0415 1688 PerfHost - ok 22:48:52.0524 1688 pla (557e9a86f65f0de18c9b6751dfe9d3f1) C:\Windows\system32\pla.dll 22:48:52.0555 1688 pla - ok 22:48:52.0617 1688 PlugPlay (23157d583244400e1d7fbaee2e4b31b7) C:\Windows\system32\umpnpmgr.dll 22:48:52.0617 1688 PlugPlay - ok 22:48:52.0617 1688 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll 22:48:52.0617 1688 PNRPAutoReg - ok 22:48:52.0633 1688 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 22:48:52.0649 1688 PNRPsvc - ok 22:48:52.0695 1688 PolicyAgent (166eb40d1f5b47e615de3d0fffe5f243) C:\Windows\System32\ipsecsvc.dll 22:48:52.0695 1688 PolicyAgent - ok 22:48:52.0711 1688 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll 22:48:52.0711 1688 Power - ok 22:48:52.0773 1688 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys 22:48:52.0773 1688 PptpMiniport - ok 22:48:52.0789 1688 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 22:48:52.0789 1688 Processor - ok 22:48:52.0820 1688 ProfSvc (f381975e1f4346de875cb07339ce8d3a) C:\Windows\system32\profsvc.dll 22:48:52.0820 1688 ProfSvc - ok 22:48:52.0836 1688 ProtectedStorage (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe 22:48:52.0836 1688 ProtectedStorage - ok 22:48:52.0867 1688 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys 22:48:52.0867 1688 Psched - ok 22:48:52.0883 1688 PxHlpa64 (4712cc14e720ecccc0aa16949d18aaf1) C:\Windows\system32\Drivers\PxHlpa64.sys 22:48:52.0883 1688 PxHlpa64 - ok 22:48:53.0007 1688 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 22:48:53.0023 1688 ql2300 - ok 22:48:53.0132 1688 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 22:48:53.0132 1688 ql40xx - ok 22:48:53.0163 1688 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll 22:48:53.0179 1688 QWAVE - ok 22:48:53.0179 1688 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 22:48:53.0179 1688 QWAVEdrv - ok 22:48:53.0195 1688 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 22:48:53.0195 1688 RasAcd - ok 22:48:53.0241 1688 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 22:48:53.0257 1688 RasAgileVpn - ok 22:48:53.0257 1688 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll 22:48:53.0257 1688 RasAuto - ok 22:48:53.0273 1688 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys 22:48:53.0273 1688 Rasl2tp - ok 22:48:53.0304 1688 RasMan (47394ed3d16d053f5906efe5ab51cc83) C:\Windows\System32\rasmans.dll 22:48:53.0304 1688 RasMan - ok 22:48:53.0304 1688 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 22:48:53.0319 1688 RasPppoe - ok 22:48:53.0319 1688 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 22:48:53.0319 1688 RasSstp - ok 22:48:53.0335 1688 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys 22:48:53.0335 1688 rdbss - ok 22:48:53.0351 1688 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 22:48:53.0351 1688 rdpbus - ok 22:48:53.0382 1688 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 22:48:53.0382 1688 RDPCDD - ok 22:48:53.0382 1688 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 22:48:53.0382 1688 RDPENCDD - ok 22:48:53.0382 1688 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 22:48:53.0397 1688 RDPREFMP - ok 22:48:53.0429 1688 RDPWD (074ac702d8b8b660b0e1371555995386) C:\Windows\system32\drivers\RDPWD.sys 22:48:53.0429 1688 RDPWD - ok 22:48:53.0444 1688 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys 22:48:53.0444 1688 rdyboost - ok 22:48:53.0460 1688 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll 22:48:53.0460 1688 RemoteAccess - ok 22:48:53.0475 1688 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll 22:48:53.0491 1688 RemoteRegistry - ok 22:48:53.0663 1688 RoxMediaDB10 (05fc44d32a144925eae45570029fd6e1) c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe 22:48:53.0678 1688 RoxMediaDB10 - ok 22:48:53.0694 1688 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll 22:48:53.0694 1688 RpcEptMapper - ok 22:48:53.0725 1688 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe 22:48:53.0725 1688 RpcLocator - ok 22:48:53.0772 1688 RpcSs (7266972e86890e2b30c0c322e906b027) C:\Windows\System32\rpcss.dll 22:48:53.0772 1688 RpcSs - ok 22:48:53.0819 1688 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 22:48:53.0819 1688 rspndr - ok 22:48:53.0834 1688 RxFilter - ok 22:48:53.0850 1688 SamSs (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe 22:48:53.0850 1688 SamSs - ok 22:48:53.0865 1688 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys 22:48:53.0865 1688 sbp2port - ok 22:48:53.0881 1688 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll 22:48:53.0897 1688 SCardSvr - ok 22:48:53.0897 1688 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys 22:48:53.0897 1688 scfilter - ok 22:48:53.0943 1688 Schedule (ec56b171f85c7e855e7b0588ac503eea) C:\Windows\system32\schedsvc.dll 22:48:53.0959 1688 Schedule - ok 22:48:53.0975 1688 SCPolicySvc (312e2f82af11e79906898ac3e3d58a1f) C:\Windows\System32\certprop.dll 22:48:53.0975 1688 SCPolicySvc - ok 22:48:53.0990 1688 SDRSVC (765a27c3279ce11d14cb9e4f5869fca5) C:\Windows\System32\SDRSVC.dll 22:48:53.0990 1688 SDRSVC - ok 22:48:54.0084 1688 SeaPort (d358e077a0a05d9b12da22d137ee8464) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 22:48:54.0084 1688 SeaPort - ok 22:48:54.0099 1688 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 22:48:54.0099 1688 secdrv - ok 22:48:54.0115 1688 seclogon (463b386ebc70f98da5dff85f7e654346) C:\Windows\system32\seclogon.dll 22:48:54.0115 1688 seclogon - ok 22:48:54.0131 1688 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\system32\sens.dll 22:48:54.0131 1688 SENS - ok 22:48:54.0146 1688 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll 22:48:54.0146 1688 SensrSvc - ok 22:48:54.0162 1688 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 22:48:54.0162 1688 Serenum - ok 22:48:54.0177 1688 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 22:48:54.0177 1688 Serial - ok 22:48:54.0209 1688 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 22:48:54.0209 1688 sermouse - ok 22:48:54.0240 1688 SessionEnv (c3bc61ce47ff6f4e88ab8a3b429a36af) C:\Windows\system32\sessenv.dll 22:48:54.0240 1688 SessionEnv - ok 22:48:54.0271 1688 SessionLauncher - ok 22:48:54.0287 1688 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys 22:48:54.0287 1688 sffdisk - ok 22:48:54.0287 1688 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys 22:48:54.0287 1688 sffp_mmc - ok 22:48:54.0302 1688 sffp_sd (5588b8c6193eb1522490c122eb94dffa) C:\Windows\system32\DRIVERS\sffp_sd.sys 22:48:54.0302 1688 sffp_sd - ok 22:48:54.0302 1688 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 22:48:54.0302 1688 sfloppy - ok 22:48:54.0365 1688 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll 22:48:54.0380 1688 SharedAccess - ok 22:48:54.0411 1688 ShellHWDetection (0298ac45d0efffb2db4baa7dd186e7bf) C:\Windows\System32\shsvcs.dll 22:48:54.0427 1688 ShellHWDetection - ok 22:48:54.0427 1688 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 22:48:54.0427 1688 SiSRaid2 - ok 22:48:54.0443 1688 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 22:48:54.0443 1688 SiSRaid4 - ok 22:48:54.0458 1688 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 22:48:54.0458 1688 Smb - ok 22:48:54.0474 1688 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe 22:48:54.0474 1688 SNMPTRAP - ok 22:48:54.0474 1688 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 22:48:54.0474 1688 spldr - ok 22:48:54.0505 1688 Spooler (89e8550c5862999fcf482ea562b0e98e) C:\Windows\System32\spoolsv.exe 22:48:54.0505 1688 Spooler - ok 22:48:54.0677 1688 sppsvc (913d843498553a1bc8f8dbad6358e49f) C:\Windows\system32\sppsvc.exe 22:48:54.0708 1688 sppsvc - ok 22:48:54.0833 1688 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll 22:48:54.0833 1688 sppuinotify - ok 22:48:54.0942 1688 sprtsvc_DellComms (d630b6f2e8379b6f10dc16e82a426552) C:\Program Files (x86)\Dell\DellComms\bin\sprtsvc.exe 22:48:54.0942 1688 sprtsvc_DellComms - ok 22:48:54.0989 1688 srv (ec8f67289105bf270498095f14963464) C:\Windows\system32\DRIVERS\srv.sys 22:48:54.0989 1688 srv - ok 22:48:55.0020 1688 srv2 (f773d2ed090b7baa1c1a034f3ca476c8) C:\Windows\system32\DRIVERS\srv2.sys 22:48:55.0035 1688 srv2 - ok 22:48:55.0051 1688 srvnet (26e84d3649019c3244622e654dfcd75b) C:\Windows\system32\DRIVERS\srvnet.sys 22:48:55.0051 1688 srvnet - ok 22:48:55.0082 1688 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll 22:48:55.0082 1688 SSDPSRV - ok 22:48:55.0098 1688 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll 22:48:55.0098 1688 SstpSvc - ok 22:48:55.0113 1688 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 22:48:55.0113 1688 stexstor - ok 22:48:55.0176 1688 stisvc (52d0e33b681bd0f33fdc08812fee4f7d) C:\Windows\System32\wiaservc.dll 22:48:55.0176 1688 stisvc - ok 22:48:55.0269 1688 stllssvr (ff5eb78af7dfb68c2fb363537aaf753e) c:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe 22:48:55.0269 1688 stllssvr - ok 22:48:55.0285 1688 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys 22:48:55.0285 1688 swenum - ok 22:48:55.0316 1688 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll 22:48:55.0332 1688 swprv - ok 22:48:55.0441 1688 SysMain (3c1284516a62078fb68f768de4f1a7be) C:\Windows\system32\sysmain.dll 22:48:55.0457 1688 SysMain - ok 22:48:55.0581 1688 TabletInputService (238935c3cf2854886dc7cbb2a0e2cc66) C:\Windows\System32\TabSvc.dll 22:48:55.0581 1688 TabletInputService - ok 22:48:55.0613 1688 TapiSrv (884264ac597b690c5707c89723bb8e7b) C:\Windows\System32\tapisrv.dll 22:48:55.0628 1688 TapiSrv - ok 22:48:55.0628 1688 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll 22:48:55.0644 1688 TBS - ok 22:48:55.0769 1688 Tcpip (912107716bab424c7870e8e6af5e07e1) C:\Windows\system32\drivers\tcpip.sys 22:48:55.0769 1688 Tcpip - ok 22:48:55.0878 1688 TCPIP6 (912107716bab424c7870e8e6af5e07e1) C:\Windows\system32\DRIVERS\tcpip.sys 22:48:55.0893 1688 TCPIP6 - ok 22:48:55.0925 1688 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys 22:48:55.0925 1688 tcpipreg - ok 22:48:55.0940 1688 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 22:48:55.0940 1688 TDPIPE - ok 22:48:55.0971 1688 TDTCP (7518f7bcfd4b308abc9192bacaf6c970) C:\Windows\system32\drivers\tdtcp.sys 22:48:55.0971 1688 TDTCP - ok 22:48:55.0987 1688 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys 22:48:55.0987 1688 tdx - ok 22:48:55.0987 1688 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys 22:48:55.0987 1688 TermDD - ok 22:48:56.0049 1688 TermService (0f05ec2887bfe197ad82a13287d2f404) C:\Windows\System32\termsrv.dll 22:48:56.0065 1688 TermService - ok 22:48:56.0081 1688 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll 22:48:56.0081 1688 Themes - ok 22:48:56.0112 1688 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 22:48:56.0112 1688 THREADORDER - ok 22:48:56.0127 1688 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll 22:48:56.0143 1688 TrkWks - ok 22:48:56.0205 1688 TrustedInstaller (840f7fb849f5887a49ba18c13b2da920) C:\Windows\servicing\TrustedInstaller.exe 22:48:56.0205 1688 TrustedInstaller - ok 22:48:56.0205 1688 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys 22:48:56.0221 1688 tssecsrv - ok 22:48:56.0221 1688 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys 22:48:56.0237 1688 tunnel - ok 22:48:56.0252 1688 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 22:48:56.0252 1688 uagp35 - ok 22:48:56.0268 1688 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys 22:48:56.0283 1688 udfs - ok 22:48:56.0299 1688 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe 22:48:56.0315 1688 UI0Detect - ok 22:48:56.0330 1688 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys 22:48:56.0330 1688 uliagpkx - ok 22:48:56.0330 1688 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys 22:48:56.0330 1688 umbus - ok 22:48:56.0330 1688 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 22:48:56.0330 1688 UmPass - ok 22:48:56.0377 1688 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll 22:48:56.0377 1688 upnphost - ok 22:48:56.0377 1688 usbccgp (b26afb54a534d634523c4fb66765b026) C:\Windows\system32\DRIVERS\usbccgp.sys 22:48:56.0377 1688 usbccgp - ok 22:48:56.0393 1688 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys 22:48:56.0393 1688 usbcir - ok 22:48:56.0393 1688 usbehci (2ea4aff7be7eb4632e3aa8595b0803b5) C:\Windows\system32\DRIVERS\usbehci.sys 22:48:56.0393 1688 usbehci - ok 22:48:56.0424 1688 usbhub (4c9042b8df86c1e8e6240c218b99b39b) C:\Windows\system32\DRIVERS\usbhub.sys 22:48:56.0424 1688 usbhub - ok 22:48:56.0424 1688 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys 22:48:56.0424 1688 usbohci - ok 22:48:56.0439 1688 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 22:48:56.0439 1688 usbprint - ok 22:48:56.0455 1688 USBSTOR (080d3820da6c046be82fc8b45a893e83) C:\Windows\system32\DRIVERS\USBSTOR.SYS 22:48:56.0455 1688 USBSTOR - ok 22:48:56.0471 1688 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys 22:48:56.0471 1688 usbuhci - ok 22:48:56.0471 1688 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll 22:48:56.0486 1688 UxSms - ok 22:48:56.0486 1688 VaultSvc (0793f40b9b8a1bdd266296409dbd91ea) C:\Windows\system32\lsass.exe 22:48:56.0486 1688 VaultSvc - ok 22:48:56.0502 1688 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys 22:48:56.0502 1688 vdrvroot - ok 22:48:56.0549 1688 vds (44d73e0bbc1d3c8981304ba15135c2f2) C:\Windows\System32\vds.exe 22:48:56.0549 1688 vds - ok 22:48:56.0549 1688 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 22:48:56.0549 1688 vga - ok 22:48:56.0564 1688 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 22:48:56.0564 1688 VgaSave - ok 22:48:56.0580 1688 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys 22:48:56.0580 1688 vhdmp - ok 22:48:56.0580 1688 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys 22:48:56.0580 1688 viaide - ok 22:48:56.0580 1688 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys 22:48:56.0580 1688 volmgr - ok 22:48:56.0611 1688 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys 22:48:56.0611 1688 volmgrx - ok 22:48:56.0627 1688 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys 22:48:56.0627 1688 volsnap - ok 22:48:56.0642 1688 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 22:48:56.0642 1688 vsmraid - ok 22:48:56.0751 1688 VSS (787898bf9fb6d7bd87a36e2d95c899ba) C:\Windows\system32\vssvc.exe 22:48:56.0783 1688 VSS - ok 22:48:56.0907 1688 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys 22:48:56.0907 1688 vwifibus - ok 22:48:56.0939 1688 vwififlt (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys 22:48:56.0939 1688 vwififlt - ok 22:48:56.0985 1688 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll 22:48:56.0985 1688 W32Time - ok 22:48:56.0985 1688 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 22:48:56.0985 1688 WacomPen - ok 22:48:57.0001 1688 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys 22:48:57.0001 1688 WANARP - ok 22:48:57.0001 1688 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys 22:48:57.0001 1688 Wanarpv6 - ok 22:48:57.0063 1688 wbengine (5ab1bb85bd8b5089cc5d64200dedae68) C:\Windows\system32\wbengine.exe 22:48:57.0079 1688 wbengine - ok 22:48:57.0157 1688 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll 22:48:57.0157 1688 WbioSrvc - ok 22:48:57.0188 1688 wcncsvc (8321c2ca3b62b61b293cda3451984468) C:\Windows\System32\wcncsvc.dll 22:48:57.0188 1688 wcncsvc - ok 22:48:57.0188 1688 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll 22:48:57.0188 1688 WcsPlugInService - ok 22:48:57.0204 1688 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 22:48:57.0204 1688 Wd - ok 22:48:57.0235 1688 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 22:48:57.0235 1688 Wdf01000 - ok 22:48:57.0251 1688 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 22:48:57.0251 1688 WdiServiceHost - ok 22:48:57.0266 1688 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 22:48:57.0266 1688 WdiSystemHost - ok 22:48:57.0282 1688 WebClient (8a438cbb8c032a0c798b0c642ffbe572) C:\Windows\System32\webclnt.dll 22:48:57.0282 1688 WebClient - ok 22:48:57.0313 1688 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll 22:48:57.0313 1688 Wecsvc - ok 22:48:57.0329 1688 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll 22:48:57.0329 1688 wercplsupport - ok 22:48:57.0360 1688 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll 22:48:57.0360 1688 WerSvc - ok 22:48:57.0375 1688 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 22:48:57.0375 1688 WfpLwf - ok 22:48:57.0375 1688 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 22:48:57.0375 1688 WIMMount - ok 22:48:57.0422 1688 WinDefend - ok 22:48:57.0422 1688 WinHttpAutoProxySvc - ok 22:48:57.0500 1688 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll 22:48:57.0500 1688 Winmgmt - ok 22:48:57.0625 1688 WinRM (41fbb751936b387f9179e7f03a74fe29) C:\Windows\system32\WsmSvc.dll 22:48:57.0641 1688 WinRM - ok 22:48:57.0812 1688 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll 22:48:57.0812 1688 Wlansvc - ok 22:48:57.0890 1688 wltrysvc (13b0a570e1ae451c92da550085d72cf3) C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE 22:48:57.0890 1688 wltrysvc - ok 22:48:57.0922 1688 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys 22:48:57.0922 1688 WmiAcpi - ok 22:48:57.0984 1688 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe 22:48:57.0984 1688 wmiApSrv - ok 22:48:58.0015 1688 WMPNetworkSvc - ok 22:48:58.0046 1688 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll 22:48:58.0046 1688 WPCSvc - ok 22:48:58.0078 1688 WPDBusEnum (2e57ddf2880a7e52e76f41c7e96d327b) C:\Windows\system32\wpdbusenum.dll 22:48:58.0078 1688 WPDBusEnum - ok 22:48:58.0078 1688 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 22:48:58.0078 1688 ws2ifsl - ok 22:48:58.0093 1688 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\system32\wscsvc.dll 22:48:58.0093 1688 wscsvc - ok 22:48:58.0109 1688 WSearch - ok 22:48:58.0265 1688 wuauserv (38340204a2d0228f1e87740fc5e554a7) C:\Windows\system32\wuaueng.dll 22:48:58.0296 1688 wuauserv - ok 22:48:58.0421 1688 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys 22:48:58.0421 1688 WudfPf - ok 22:48:58.0436 1688 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys 22:48:58.0436 1688 WUDFRd - ok 22:48:58.0468 1688 wudfsvc (b551d6637aa0e132c18ac6e504f7b79b) C:\Windows\System32\WUDFSvc.dll 22:48:58.0468 1688 wudfsvc - ok 22:48:58.0499 1688 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll 22:48:58.0499 1688 WwanSvc - ok 22:48:58.0546 1688 MBR (0x1B8) (faf3db026c90f586e5993588661e2612) \Device\Harddisk0\DR0 22:48:58.0577 1688 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected 22:48:58.0577 1688 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0) 22:48:58.0608 1688 Boot (0x1200) (a5c682221bb3be9ca89446427c662f59) \Device\Harddisk0\DR0\Partition0 22:48:58.0608 1688 \Device\Harddisk0\DR0\Partition0 - ok 22:48:58.0608 1688 Boot (0x1200) (2173d9f00b8f5ffc95b7fde2a9e0227f) \Device\Harddisk0\DR0\Partition1 22:48:58.0624 1688 \Device\Harddisk0\DR0\Partition1 - ok 22:48:58.0624 1688 ============================================================ 22:48:58.0624 1688 Scan finished 22:48:58.0624 1688 ============================================================ 22:48:58.0624 4892 Detected object count: 1 22:48:58.0624 4892 Actual detected object count: 1 22:49:01.0151 4892 \Device\Harddisk0\DR0\# - copied to quarantine 22:49:01.0151 4892 \Device\Harddisk0\DR0 - copied to quarantine 22:49:01.0182 4892 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine 22:49:01.0198 4892 \Device\Harddisk0\DR0\TDLFS\phx.dll - copied to quarantine 22:49:01.0198 4892 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine 22:49:01.0198 4892 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine 22:49:01.0229 4892 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine 22:49:01.0229 4892 \Device\Harddisk0\DR0\TDLFS\phdx - copied to quarantine 22:49:01.0229 4892 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine 22:49:01.0244 4892 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine 22:49:01.0244 4892 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine 22:49:01.0244 4892 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine 22:49:01.0244 4892 \Device\Harddisk0\DR0\TDLFS\phlx - copied to quarantine 22:49:01.0244 4892 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine 22:49:01.0260 4892 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - will be cured on reboot 22:49:01.0260 4892 \Device\Harddisk0\DR0 - ok 22:49:01.0276 4892 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Cure 22:49:03.0241 2668 Deinitialize success

ok here are the two new logs. first malwarebytes Malwarebytes Anti-Malware (Trial) 1.61.0.1400 www.malwarebytes.org Database version: v2012.04.27.03 Windows 7 x64 NTFS (Safe Mode/Networking) Internet Explorer 8.0.7600.16385 Jeffrey :: JEFFREY-PC [administrator] Protection: Disabled 4/27/2012 8:04:35 AM mbam-log-2012-04-27 (08-04-35).txt Scan type: Full scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 300990 Time elapsed: 10 minute(s), 38 second(s) Memory Processes Detected: 1 C:\Windows\svchost.exe (Trojan.Agent) -> 1972 -> Delete on reboot. Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 3 C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot. C:\Users\Jeffrey\Desktop\uSeRiNiT.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully. C:\Users\Jeffrey\Desktop\WiNlOgOn.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully. (end) now eset C:\Qoobox\Quarantine\C\ProgramData\aHelTFbukWq.exe.vir a variant of Win32/Kryptik.AEUX trojan C:\Qoobox\Quarantine\C\ProgramData\XkFcjVGVgWJhiQK.exe.vir a variant of Win32/Kryptik.AEUQ trojan C:\TDSSKiller_Quarantine\26.04.2012_22.26.25\mbr0000\tdlfs0000\tsk0000.dta Win32/Olmarik.AWO trojan C:\TDSSKiller_Quarantine\26.04.2012_22.26.25\mbr0000\tdlfs0000\tsk0001.dta Win64/Olmarik.AD trojan C:\TDSSKiller_Quarantine\26.04.2012_22.26.25\mbr0000\tdlfs0000\tsk0002.dta Win32/Olmarik.AYH trojan C:\TDSSKiller_Quarantine\26.04.2012_22.26.25\mbr0000\tdlfs0000\tsk0003.dta Win64/Olmarik.AG trojan C:\TDSSKiller_Quarantine\26.04.2012_22.26.25\mbr0000\tdlfs0000\tsk0004.dta a variant of Win32/Rootkit.Kryptik.KS trojan C:\TDSSKiller_Quarantine\26.04.2012_22.26.25\mbr0000\tdlfs0000\tsk0005.dta Win64/Olmarik.AF trojan C:\TDSSKiller_Quarantine\26.04.2012_22.26.25\mbr0000\tdlfs0000\tsk0009.dta Win32/Olmarik.AWO trojan C:\TDSSKiller_Quarantine\26.04.2012_22.26.25\mbr0000\tdlfs0000\tsk0010.dta Win64/Olmarik.X trojan C:\TDSSKiller_Quarantine\26.04.2012_22.48.36\mbr0000\tdlfs0000\tsk0000.dta Win32/Olmarik.AWO trojan C:\TDSSKiller_Quarantine\26.04.2012_22.48.36\mbr0000\tdlfs0000\tsk0001.dta Win64/Olmarik.AD trojan C:\TDSSKiller_Quarantine\26.04.2012_22.48.36\mbr0000\tdlfs0000\tsk0002.dta Win32/Olmarik.AYH trojan C:\TDSSKiller_Quarantine\26.04.2012_22.48.36\mbr0000\tdlfs0000\tsk0003.dta Win64/Olmarik.AG trojan C:\TDSSKiller_Quarantine\26.04.2012_22.48.36\mbr0000\tdlfs0000\tsk0004.dta a variant of Win32/Rootkit.Kryptik.KS trojan C:\TDSSKiller_Quarantine\26.04.2012_22.48.36\mbr0000\tdlfs0000\tsk0005.dta Win64/Olmarik.AF trojan C:\TDSSKiller_Quarantine\26.04.2012_22.48.36\mbr0000\tdlfs0000\tsk0009.dta Win32/Olmarik.AWO trojan C:\TDSSKiller_Quarantine\26.04.2012_22.48.36\mbr0000\tdlfs0000\tsk0010.dta Win64/Olmarik.X trojan also i'm still in safemode with networking

Ok now while still in Safe Mode with Networking hit it again with TDSSKiller.