What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Smart Fortress Infection [Solved]

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
:pullhair: I was infected with Smart Fortress. I used Malware bytes to clean it but now I have other issues.

Most of my shortcuts have disapeared. I also can not access any files through the start program unless I right click and choose "open windows explorer". Computer boots up slow and sometimes windows will not start. Also, getting several "missing .dll files"


I have attached the hijack this log.

Any help will be greatly appreciated.


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:57:10 PM, on 4/27/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Lexmark 2600 Series\lxdnmon.exe
C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe
C:\Program Files (x86)\Lexmark 2600 Series\lxdnMsdMon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\ytbb.exe
C:\Users\dad\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie9
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://isearch.avg.com/?cid={279430EE-6662…p;v=&sap=hp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Ad-Aware Security Toolbar - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
O2 - BHO: Lexmark Printable Web - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
O3 - Toolbar: Ad-Aware Security Toolbar - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files (x86)\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [cdbap] rundll32.exe "C:\Users\dad\AppData\Local\Temp\cdbap.dll",SetMarkers
O4 - HKCU\..\Run: [MPEGAudio] rundll32.exe "C:\Users\dad\AppData\Local\MPEG\MPEGAudio.dll",wmain
O4 - HKCU\..\Run: [rylbui] rundll32.exe "C:\Users\dad\AppData\Local\Temp\rylbui.dll",GetErrorLog
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: lxdnCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\x64\3\\lxdnserv.exe
O23 - Service: lxdn_device - - C:\Windows\system32\lxdncoms.exe
O23 - Service: lxecCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\x64\3\\lxecserv.exe
O23 - Service: lxec_device - - C:\Windows\system32\lxeccoms.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PMBDeviceInfoProvider - Sony Corporation - C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 12507 bytes
Post #2
Hello chester and :welcome:

My name is JonTom

  • Malware Logs can sometimes take a lot of time to research and interpret.
  • Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  • Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  • Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  • PLEASE NOTE: If you do not reply after 3 days your thread will be closed.

Computer boots up slow and sometimes windows will not start

If it is not starting that is not a good sign. Please make sure that you back up any important data you have as soon as you can.

Have you ran any temporary file cleaners recently? From this point on, please do not touch temp files at all.

Lets see if the following can help us to get your shortcuts back:

  • Unhide


    • Download and run unhide.exe by grinler from here and save the file to your desktop.
    • Run the tool and allow it to complete.

  • Please perform the following scan


    • Please download DDS from here and save it to your desktop.
    • Disable any script blocking protection (How to Disable your Security Programs)
    • Right click on the DDS icon and select "Run as Administrator" to run the tool (may take up to 3 minutes to run).
    • When done, DDS.txt will open.
    • After a few moments, attach.txt will open in a second window.
    • Save both reports to your desktop.
    • Please post the contents of the DDS.txt and Attach.txt logs in your next reply.

  • aswMBR


    • Download aswMBR.exe to your desktop.
    • Double click the aswMBR.exe to run it.
    • When asked if you want to download Avast's virus definitions please select Yes.
    • Click the "Scan" button to start scan.

    [external image: Posted Image]

    • On completion of the scan click save log, save it to your desktop and post in your next reply.

    [external image: Posted Image]

    Please post both DDS logs and the aswMBR log in your next reply and let me know if your shortcuts have re-appeared.
Post #3
Thanks for your help Jon. I had trouble getting the computer to boot. I kept getting the screen "Insert boot disk….". Then while trying somemore the power went out at the house. When the power came on the computer booted right up. Go Figure! I honestly am not sure if I ran a temp file cleaner or not. I was going to and noticed how many files that it would have deleated and was considering not doing it. This was a right after the problem showed up and I cant remember if I did or did not. I will be sure not to, from here on out. The Unhide program worked. Here is the DDS txt . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29 Run by [removed] at 20:51:36 on 2012-04-30 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4029.2391 [GMT -5:00] . AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\spool\DRIVERS\x64\3\lxdnserv.exe C:\Program Files (x86)\Lexmark 2600 Series\lxdnmon.exe C:\Windows\system32\lxdncoms.exe C:\Windows\System32\hkcmd.exe C:\Program Files (x86)\Lexmark 2600 Series\lxdnMsdMon.exe C:\Windows\System32\igfxpers.exe C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\ezprint.exe C:\Windows\system32\lxeccoms.exe C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe C:\Windows\SysWOW64\PnkBstrA.exe C:\Windows\SysWOW64\PnkBstrB.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe C:\Program Files (x86)\Real\RealPlayer\RealPlay.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\WUDFHost.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe C:\Windows\system32\DllHost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe C:\Windows\ehome\ehPrivJob.exe C:\Windows\system32\conhost.exe C:\Windows\system32\taskeng.exe C:\Windows\explorer.exe C:\Windows\system32\REGSVR32.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://isearch.avg.com/?cid={279430EE-6662-4F63-A56E-8A7D6EAAE71E}&mid=08d64d00bd2947d0adba41b2e00d4f9f-1d6c8b6a4fd14e7d84d88f40e35531e8c08da0a6&lang=en&ds=ts025&pr=sa&d=&v=&sap=hp uWindow Title = Windows Internet Explorer provided by Yahoo! uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie9 uInternet Settings,ProxyOverride = *.local uURLSearchHooks: YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll mWinlogon: Userinit=userinit.exe, BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - C:\Program Files\Lexmark Toolbar\toolband.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll BHO: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: {9D425283-D487-4337-BAB6-AB8354A81457} - No File BHO: Lexmark Printable Web: {d2c5e510-be6d-42cc-9f61-e4f939078474} - C:\Program Files\Lexmark Printable Web\bho.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - C:\Program Files\Lexmark Toolbar\toolband.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File TB: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun uRun: [cdbap] rundll32.exe "C:\Users\dad\AppData\Local\Temp\cdbap.dll",SetMarkers uRun: [MPEGAudio] rundll32.exe "C:\Users\dad\AppData\Local\MPEG\MPEGAudio.dll",wmain uRun: [rylbui] rundll32.exe "C:\Users\dad\AppData\Local\Temp\rylbui.dll",GetErrorLog mRun: [FaxCenterServer] "C:\Program Files (x86)\Lexmark Fax Solutions\fm3032.exe" /s mRun: [Adobe Photo Downloader] "C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\apdproxy.exe" mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe mRun: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe mRun: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe" StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe uPolicies-explorer: HideSCAHealth = 1 (0x1) mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 0 (0x0) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab TCP: DhcpNameServer = 192.168.1.254 TCP: Interfaces\{5D2D0DD3-1C79-4FD1-8DAE-37B53C4060AB} : DhcpNameServer = 192.168.1.254 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll BHO-X64: 0x1 - No File BHO-X64: Lexmark Toolbar: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll BHO-X64: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll BHO-X64: Ad-Aware Security Toolbar - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: {9D425283-D487-4337-BAB6-AB8354A81457} - No File BHO-X64: Lexmark Printable Web: {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll TB-X64: Lexmark Toolbar: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll TB-X64: {9D425283-D487-4337-BAB6-AB8354A81457} - No File TB-X64: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll mRun-x64: [FaxCenterServer] "C:\Program Files (x86)\Lexmark Fax Solutions\fm3032.exe" /s mRun-x64: [Adobe Photo Downloader] "C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\apdproxy.exe" mRun-x64: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe mRun-x64: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun-x64: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe mRun-x64: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe" . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\dad\AppData\Roaming\Mozilla\Firefox\Profiles\ol2d19d4.default\ FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.startup.homepage - hxxp://isearch.avg.com/?cid={279430EE-6662-4F63-A56E-8A7D6EAAE71E}&mid=08d64d00bd2947d0adba41b2e00d4f9f-1d6c8b6a4fd14e7d84d88f40e35531e8c08da0a6&lang=en&ds=ts025&pr=sa&d=&v=&sap=hp FF - prefs.js: network.proxy.type - 0 FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll FF - component: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordlegacyext.dll FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll FF - plugin: C:\Users\dad\AppData\Local\Roblox\Versions\version-3bc3e39888854c74\NPRobloxProxy.dll FF - plugin: C:\Users\dad\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll . ============= SERVICES / DRIVERS =============== . R0 Lbd;Lbd;C:\Windows\system32\DRIVERS\Lbd.sys –> C:\Windows\system32\DRIVERS\Lbd.sys [?] R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys –> C:\Windows\system32\Drivers\PxHlpa64.sys [?] R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928] R2 lxdn_device;lxdn_device;C:\Windows\system32\lxdncoms.exe -service –> C:\Windows\system32\lxdncoms.exe -service [?] R2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;C:\Windows\System32\spool\DRIVERS\x64\3\lxdnserv.exe [2009-4-28 29184] R2 lxec_device;lxec_device;C:\Windows\system32\lxeccoms.exe -service –> C:\Windows\system32\lxeccoms.exe -service [?] R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-27 398176] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys –> C:\Windows\system32\DRIVERS\Rt64win7.sys [?] R3 VST64_DPV;VST64_DPV;C:\Windows\system32\DRIVERS\VSTDPV6.SYS –> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?] R3 VST64HWBS2;VST64HWBS2;C:\Windows\system32\DRIVERS\VSTBS26.SYS –> C:\Windows\system32\DRIVERS\VSTBS26.SYS [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-1-15 136176] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-4-1 2152152] S2 lxecCATSCustConnectService;lxecCATSCustConnectService;C:\Windows\System32\spool\DRIVERS\x64\3\lxecserv.exe [2012-1-3 45736] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-3-29 253088] S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys –> C:\Windows\system32\DRIVERS\fssfltr.sys [?] S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-1-15 136176] S3 Lavasoft Kernexplorer;Lavasoft helper driver;C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys [2011-4-1 17152] S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys –> C:\Windows\system32\Drivers\usbaapl64.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?] . =============== Created Last 30 ================ . 2012-04-28 01:00:34 ——– d—–w- C:\Data 2012-04-20 18:58:48 ——– d—–w- C:\ProgramData\Common Files 2012-04-20 18:58:43 ——– d—–w- C:\Users\dad\AppData\Roaming\FixCleaner 2012-04-20 18:58:39 ——– d—–w- C:\Program Files (x86)\FixCleaner 2012-04-20 18:14:24 ——– d—–w- C:\Users\dad\AppData\Local\adawarebp 2012-04-20 18:14:23 ——– d—–w- C:\ProgramData\Ad-Aware Browsing Protection 2012-04-20 18:14:21 ——– d—–w- C:\Program Files (x86)\Toolbar Cleaner 2012-04-20 18:14:19 ——– d—–w- C:\Program Files (x86)\adawaretb 2012-04-20 18:12:20 ——– d—–w- C:\Users\dad\AppData\Roaming\Ad-Aware Antivirus 2012-04-20 03:20:02 288 —-a-w- C:\Users\dad\AppData\Roaming\15DB4B7F.reg 2012-04-20 03:19:50 ——– d—–w- C:\Users\dad\AppData\Local\{ABEA01A2-8A97-11E1-826D-B8AC6F996F26} 2012-04-20 03:19:50 ——– d—–w- C:\ProgramData\F4D55F3E00002D6300011D33B4EB2367 2012-04-20 03:19:34 ——– d—–w- C:\Users\dad\AppData\Local\MPEG 2012-04-17 08:12:29 8669240 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{0B3FA9D9-1004-4F7C-BF9F-96ACB94D4D37}\mpengine.dll 2012-04-11 08:03:49 5559152 —-a-w- C:\Windows\System32\ntoskrnl.exe 2012-04-11 08:03:48 3968368 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-04-11 08:03:48 3913072 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-04-11 08:00:32 23408 —-a-w- C:\Windows\System32\drivers\fs_rec.sys 2012-04-11 08:00:31 81408 —-a-w- C:\Windows\System32\imagehlp.dll 2012-04-11 08:00:31 5120 —-a-w- C:\Windows\SysWow64\wmi.dll 2012-04-11 08:00:31 5120 —-a-w- C:\Windows\System32\wmi.dll 2012-04-11 08:00:31 220672 —-a-w- C:\Windows\System32\wintrust.dll 2012-04-11 08:00:31 172544 —-a-w- C:\Windows\SysWow64\wintrust.dll 2012-04-11 08:00:31 159232 —-a-w- C:\Windows\SysWow64\imagehlp.dll 2012-04-09 12:22:47 ——– d—–w- C:\Users\dad\AppData\Local\{238CCAEC-0B05-456B-8AEE-760909BB06D2} . ==================== Find3M ==================== . 2012-04-14 12:36:33 70304 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-04-14 12:36:33 418464 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-04-14 12:36:30 8741536 —-a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe 2012-02-28 06:56:48 2311168 —-a-w- C:\Windows\System32\jscript9.dll 2012-02-28 06:49:56 1390080 —-a-w- C:\Windows\System32\wininet.dll 2012-02-28 06:48:57 1493504 —-a-w- C:\Windows\System32\inetcpl.cpl 2012-02-28 06:42:55 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2012-02-28 01:18:55 1799168 —-a-w- C:\Windows\SysWow64\jscript9.dll 2012-02-28 01:11:21 1427456 —-a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-02-28 01:11:07 1127424 —-a-w- C:\Windows\SysWow64\wininet.dll2012-02-28 01:03:16 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2012-02-23 14:18:36 279656 ——w- C:\Windows\System32\MpSigStub.exe 2012-02-17 06:38:26 1031680 —-a-w- C:\Windows\System32\rdpcore.dll 2012-02-17 05:34:22 826880 —-a-w- C:\Windows\SysWow64\rdpcore.dll 2012-02-17 04:58:24 210944 —-a-w- C:\Windows\System32\drivers\rdpwd.sys 2012-02-17 04:57:32 23552 —-a-w- C:\Windows\System32\drivers\tdtcp.sys 2012-02-10 06:36:07 1544192 —-a-w- C:\Windows\System32\DWrite.dll 2012-02-10 05:38:43 1077248 —-a-w- C:\Windows\SysWow64\DWrite.dll 2012-02-03 04:34:34 3145728 —-a-w- C:\Windows\System32\win32k.sys . ============= FINISH: 20:59:57.94 =============== The following is the attach txt . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 1/10/2011 2:10:46 PM System Uptime: 4/30/2012 8:37:15 PM (1 hours ago) . Motherboard: FOXCONN | | G41MX 2.0/G41MX-K 2.0 Processor: Intel® Pentium® Dual CPU E2180 @ 2.00GHz | Socket775 | 2003/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 456 GiB total, 338.207 GiB free. D: is FIXED (NTFS) - 9 GiB total, 1.247 GiB free. E: is CDROM () F: is Removable G: is Removable H: is Removable I: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP198: 4/10/2012 3:57:30 AM - Windows Update RP199: 4/11/2012 3:00:13 AM - Windows Update RP200: 4/17/2012 3:11:54 AM - Windows Update RP201: 4/22/2012 1:17:07 PM - Removed FixCleaner RP202: 4/22/2012 1:17:29 PM - Removed FixCleaner RP203: 4/22/2012 1:18:12 PM - Removed FixCleaner . ==== Installed Programs ====================== . ABBYY FineReader 6.0 Sprint Ad-Aware Ad-Aware Security Toolbar Adobe AIR Adobe Photoshop Elements 6.0 Adobe Premiere Elements 1.0 Adobe Reader X (10.1.2) Amazon Kindle Amazon MP3 Downloader 1.0.15 Apple Application Support Apple Software Update Call of Duty® 4 - Modern Warfare™ Civilization III Combat Arms Compatibility Pack for the 2007 Office system D3DX10 GameSpy Arcade Google Chrome Google Earth Google Update Helper GoToMeeting 4.5.0.457 Java Auto Updater Java™ 6 Update 29 Lexmark Printable Web Lexmark Toolbar Malwarebytes Anti-Malware version 1.61.0.1400 McAfee Security Scan Plus Microsoft Office File Validation Add-In Microsoft Office Professional Edition 2003 Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Works 7.0 Mozilla Firefox 11.0 (x86 en-US) MSVCRT MSVCRT_amd64 MSXML 4.0 SP3 Parser MSXML 4.0 SP3 Parser (KB973685) Nexon Game Manager NOOK for PC OverDrive Media Console Pando Media Booster PMB QuickTime RealNetworks - Microsoft Visual C++ 2008 Runtime RealPlayer RealUpgrade 1.1 Roblox for dad Safari Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Skype™ 5.8 Spybot - Search & Destroy Stronghold Stronghold Kingdoms Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 Windows Live Communications Platform Windows Live Essentials Windows Live Installer Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources Windows Media Player Firefox Plugin World of Warcraft Yahoo! BrowserPlus 2.9.8 Yahoo! Software Update Yahoo! Toolbar . ==== Event Viewer Messages From Past Week ======== . 4/30/2012 8:58:20 PM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume . 4/30/2012 8:38:18 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: luafv 4/30/2012 8:37:50 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the lxecCATSCustConnectService service to connect. 4/30/2012 8:37:50 PM, Error: Service Control Manager [7000] - The lxecCATSCustConnectService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 4/27/2012 8:01:21 PM, Error: Service Control Manager [7022] - The Server service hung on starting. 4/27/2012 8:01:21 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: After starting, the service hung in a start-pending state. 4/27/2012 7:57:41 PM, Error: Service Control Manager [7001] - The HomeGroup Listener service depends on the Server service which failed to start because of the following error: After starting, the service hung in a start-pending state. . ==== End Of File =========================== I can not get aswMBR to run. I have downloaded it and saved it to my desk top. I have tried double clicking and right clicking and chose "run as administrator". When I do this the arrow will turn to a circle, as if it is starting the program, but then it goes away and nothing happens.
Post #4
Hello chester

I see malware in your logs but we may also be dealing with a potential hardware issue:

==== Event Viewer Messages From Past Week ========

4/30/2012 8:58:20 PM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume .

Please make sure that you have backed up your important data just in case.


I can not get aswMBR to run

Lets try this one instead:

  • MBRCheck


  • Please download MBRCheck by clicking here and save it to your desktop.
  • Be sure to disable your security programs.
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt).
  • A window will open on your desktop.
  • If an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter.
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file in your next reply.

If the scan does not complete just let me know.
Post #5
Jon, Here is the log for MBRcheck: MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows 7 Home Premium Edition Windows Information: Service Pack 1 (build 7601), 64-bit Base Board Manufacturer: FOXCONN BIOS Manufacturer: American Megatrends Inc. System Manufacturer: O.E.M System Product Name: O.E.M Logical Drives Mask: 0x000003fc Kernel Drivers (total 148): 0x03210000 \SystemRoot\system32\ntoskrnl.exe 0x037F8000 \SystemRoot\system32\hal.dll 0x00BAD000 \SystemRoot\system32\kdcom.dll 0x00CB9000 \SystemRoot\system32\mcupdate_GenuineIntel.dll 0x00D08000 \SystemRoot\system32\PSHED.dll 0x00D1C000 \SystemRoot\system32\CLFS.SYS 0x00EB8000 \SystemRoot\system32\CI.dll 0x00E00000 \SystemRoot\system32\drivers\Wdf01000.sys 0x00EA4000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x00F78000 \SystemRoot\system32\drivers\ACPI.sys 0x00FCF000 \SystemRoot\system32\drivers\WMILIB.SYS 0x00FD8000 \SystemRoot\system32\drivers\msisadrv.sys 0x00D7A000 \SystemRoot\system32\drivers\pci.sys 0x00FE2000 \SystemRoot\system32\drivers\vdrvroot.sys 0x00DAD000 \SystemRoot\System32\drivers\partmgr.sys 0x00DC2000 \SystemRoot\system32\drivers\volmgr.sys 0x00C00000 \SystemRoot\System32\drivers\volmgrx.sys 0x00FEF000 \SystemRoot\system32\drivers\intelide.sys 0x00C5C000 \SystemRoot\system32\drivers\PCIIDEX.SYS 0x00C6C000 \SystemRoot\System32\drivers\mountmgr.sys 0x00FF7000 \SystemRoot\system32\drivers\atapi.sys 0x00C86000 \SystemRoot\system32\drivers\ataport.SYS 0x00DD7000 \SystemRoot\system32\drivers\amdxata.sys 0x01068000 \SystemRoot\system32\drivers\fltmgr.sys 0x010B4000 \SystemRoot\system32\drivers\fileinfo.sys 0x010C8000 \SystemRoot\system32\DRIVERS\Lbd.sys 0x010DD000 \SystemRoot\System32\Drivers\PxHlpa64.sys 0x01215000 \SystemRoot\System32\Drivers\Ntfs.sys 0x010E9000 \SystemRoot\System32\Drivers\msrpc.sys 0x013B8000 \SystemRoot\System32\Drivers\ksecdd.sys 0x01147000 \SystemRoot\System32\Drivers\cng.sys 0x013D3000 \SystemRoot\System32\drivers\pcw.sys 0x013E4000 \SystemRoot\System32\Drivers\Fs_Rec.sys 0x014F0000 \SystemRoot\system32\drivers\ndis.sys 0x01400000 \SystemRoot\system32\drivers\NETIO.SYS 0x01460000 \SystemRoot\System32\Drivers\ksecpkg.sys 0x016F4000 \SystemRoot\System32\drivers\tcpip.sys 0x018F8000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x01942000 \SystemRoot\system32\drivers\volsnap.sys 0x0198E000 \SystemRoot\System32\Drivers\spldr.sys 0x01996000 \SystemRoot\System32\drivers\rdyboost.sys 0x019D0000 \SystemRoot\System32\Drivers\mup.sys 0x019E2000 \SystemRoot\System32\drivers\hwpolicy.sys 0x01600000 \SystemRoot\System32\DRIVERS\fvevol.sys 0x0163A000 \SystemRoot\system32\DRIVERS\disk.sys 0x01650000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS 0x016B6000 \SystemRoot\system32\drivers\cdrom.sys 0x016E0000 \SystemRoot\System32\Drivers\Null.SYS 0x016E9000 \SystemRoot\System32\Drivers\Beep.SYS 0x019EB000 \SystemRoot\System32\drivers\vga.sys 0x014AE000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x014D3000 \SystemRoot\System32\drivers\watchdog.sys 0x014E3000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x015E3000 \SystemRoot\system32\drivers\rdpencdd.sys 0x015EC000 \SystemRoot\system32\drivers\rdprefmp.sys 0x015F5000 \SystemRoot\System32\Drivers\Msfs.SYS 0x0148B000 \SystemRoot\System32\Drivers\Npfs.SYS 0x011B9000 \SystemRoot\system32\DRIVERS\tdx.sys 0x0149C000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x03A41000 \SystemRoot\system32\drivers\afd.sys 0x03ACA000 \SystemRoot\System32\DRIVERS\netbt.sys 0x03B0F000 \SystemRoot\system32\DRIVERS\wfplwf.sys 0x03B18000 \SystemRoot\system32\DRIVERS\pacer.sys 0x03B3E000 \SystemRoot\system32\DRIVERS\netbios.sys 0x03B4D000 \SystemRoot\system32\DRIVERS\serial.sys 0x03B6A000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x03B85000 \SystemRoot\system32\drivers\termdd.sys 0x03B99000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x03BEA000 \SystemRoot\system32\drivers\nsiproxy.sys 0x03A00000 \SystemRoot\system32\drivers\mssmbios.sys 0x03A0B000 \SystemRoot\System32\drivers\discache.sys 0x03A1A000 \SystemRoot\System32\Drivers\dfsc.sys 0x013EE000 \SystemRoot\system32\DRIVERS\blbdrive.sys 0x01000000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x01026000 \SystemRoot\system32\DRIVERS\intelppm.sys 0x04803000 \SystemRoot\system32\DRIVERS\igdkmd64.sys 0x05222000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x05316000 \SystemRoot\System32\drivers\dxgmms1.sys 0x0535C000 \SystemRoot\system32\drivers\HDAudBus.sys 0x05380000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0x0538D000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x053E3000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x03ECC000 \SystemRoot\system32\DRIVERS\VSTBS26.SYS 0x03F3C000 \SystemRoot\system32\DRIVERS\ks.sys 0x0401F000 \SystemRoot\system32\DRIVERS\VSTDPV6.SYS 0x03E00000 \SystemRoot\system32\DRIVERS\VSTCNXT6.SYS 0x04193000 \SystemRoot\system32\drivers\modem.sys 0x041A2000 \SystemRoot\system32\DRIVERS\serenum.sys 0x041AE000 \SystemRoot\system32\drivers\i8042prt.sys 0x041CC000 \SystemRoot\system32\drivers\kbdclass.sys 0x041DB000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys 0x041E8000 \SystemRoot\system32\drivers\CompositeBus.sys 0x04000000 \SystemRoot\system32\DRIVERS\AgileVpn.sys 0x03F7F000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x03FA3000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x03FAF000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x03FDE000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x0103C000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x011DB000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x01200000 \SystemRoot\system32\drivers\mouclass.sys 0x04016000 \SystemRoot\system32\drivers\swenum.sys 0x00DE2000 \SystemRoot\system32\drivers\umbus.sys 0x03CEA000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x03D44000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x03D59000 \SystemRoot\system32\drivers\HdAudio.sys 0x03DB5000 \SystemRoot\system32\drivers\portcls.sys 0x03C00000 \SystemRoot\system32\drivers\drmk.sys 0x03C22000 \SystemRoot\system32\drivers\ksthunk.sys 0x03C28000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS 0x03C43000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x03C45000 \SystemRoot\System32\Drivers\crashdmp.sys 0x03C53000 \SystemRoot\System32\Drivers\dump_dumpata.sys 0x03C5F000 \SystemRoot\System32\Drivers\dump_atapi.sys 0x03C68000 \SystemRoot\System32\Drivers\dump_dumpfve.sys 0x000A0000 \SystemRoot\System32\win32k.sys 0x03C7B000 \SystemRoot\System32\drivers\Dxapi.sys 0x03C87000 \SystemRoot\system32\DRIVERS\hidusb.sys 0x03C95000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0x03CAE000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x03CB7000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0x03CD4000 \SystemRoot\system32\DRIVERS\mouhid.sys 0x01680000 \SystemRoot\system32\DRIVERS\usbscan.sys 0x03DF2000 \SystemRoot\system32\DRIVERS\usbprint.sys 0x01691000 \SystemRoot\system32\DRIVERS\monitor.sys 0x00540000 \SystemRoot\System32\TSDDD.dll 0x007D0000 \SystemRoot\System32\cdd.dll 0x02032000 \SystemRoot\system32\drivers\WudfPf.sys 0x02053000 \SystemRoot\system32\DRIVERS\lltdio.sys 0x02068000 \SystemRoot\system32\DRIVERS\rspndr.sys 0x02080000 \SystemRoot\system32\drivers\HTTP.sys 0x02149000 \SystemRoot\system32\DRIVERS\bowser.sys 0x02167000 \SystemRoot\System32\drivers\mpsdrv.sys 0x0217F000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0x021AC000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0x02000000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0x07AA3000 \SystemRoot\system32\drivers\peauth.sys 0x07B49000 \SystemRoot\System32\Drivers\secdrv.SYS 0x07B54000 \SystemRoot\System32\DRIVERS\srvnet.sys 0x07B85000 \SystemRoot\System32\drivers\tcpipreg.sys 0x07B97000 \SystemRoot\System32\DRIVERS\srv2.sys 0x07A00000 \SystemRoot\System32\DRIVERS\srv.sys 0x08803000 \SystemRoot\system32\DRIVERS\WUDFRd.sys 0x08834000 \SystemRoot\system32\DRIVERS\Rt64win7.sys 0x088FB000 \SystemRoot\system32\DRIVERS\asyncmac.sys 0x08906000 \SystemRoot\System32\Drivers\fastfat.SYS 0x77720000 \Windows\System32\ntdll.dll 0x48310000 \Windows\System32\smss.exe 0xFFA40000 \Windows\System32\apisetschema.dll Processes (total 65): 0 System Idle Process 4 System 272 C:\Windows\System32\smss.exe 368 csrss.exe 424 C:\Windows\System32\wininit.exe 436 csrss.exe 472 C:\Windows\System32\services.exe 496 C:\Windows\System32\lsass.exe 504 C:\Windows\System32\lsm.exe 540 C:\Windows\System32\winlogon.exe 648 C:\Windows\System32\svchost.exe 724 C:\Windows\System32\svchost.exe 824 C:\Windows\System32\svchost.exe 856 C:\Windows\System32\svchost.exe 896 C:\Windows\System32\svchost.exe 1016 C:\Windows\System32\svchost.exe 352 C:\Windows\System32\svchost.exe 1108 C:\Windows\System32\spoolsv.exe 1140 C:\Windows\System32\svchost.exe 1240 C:\Windows\System32\dwm.exe 1288 C:\Windows\explorer.exe 1344 C:\Windows\System32\taskhost.exe 1440 C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe 1508 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 1564 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 1740 C:\Program Files\Bonjour\mDNSResponder.exe 1788 C:\Windows\System32\svchost.exe 1848 C:\Windows\System32\spool\drivers\x64\3\lxdnserv.exe 1932 C:\Windows\System32\lxdncoms.exe 1028 C:\Program Files (x86)\Lexmark 2600 Series\lxdnmon.exe 876 C:\Program Files (x86)\Lexmark 2600 Series\lxdnmsdmon.exe 1472 C:\Windows\System32\hkcmd.exe 1528 C:\Windows\System32\igfxpers.exe 1544 C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe 1680 C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe 1672 C:\Windows\System32\lxeccoms.exe 2072 C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe 2140 C:\Windows\SysWOW64\PnkBstrA.exe 2148 C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\apdproxy.exe 2188 C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe 2484 C:\Windows\SysWOW64\PnkBstrB.exe 2528 C:\Program Files (x86)\iTunes\iTunesHelper.exe 2536 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 2544 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2552 C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe 2600 C:\Windows\System32\svchost.exe 2668 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 2732 C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe 2868 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE 2452 C:\Windows\System32\SearchIndexer.exe 384 C:\Program Files\iPod\bin\iPodService.exe 3316 WUDFHost.exe 3500 C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe 3508 C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe 4088 C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe 3124 C:\Program Files (x86)\Lavasoft\Ad-Aware\AWSC.exe 2756 C:\Program Files\Windows Media Player\wmpnetwk.exe 3400 C:\Windows\System32\svchost.exe 2184 C:\Windows\System32\svchost.exe 2908 dllhost.exe 2616 C:\Program Files\Internet Explorer\iexplore.exe 3188 C:\Windows\System32\taskeng.exe 3368 C:\Users\dad\Desktop\MBRCheck.exe 2028 C:\Windows\System32\conhost.exe 3868 C:\Windows\System32\dllhost.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) \\.\D: –> \\.\PhysicalDrive0 at offset 0x00000072`1eb64000 (NTFS) PhysicalDrive0 Model Number: SAMSUNGHD501LJ, Rev: CR100-12 Size Device Name MBR Status ——————————————– 465 GB \\.\PhysicalDrive0 MBR Code Faked! SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79 Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done!
Post #6
Hello chester

Thank you for the log.

Lets proceed as follows:

  • TDSS Killer


    • Please read carefully and follow these steps.
    • Download TDSSKiller and save it to your Desktop.
    • Extract its contents to your desktop.
    • Once extracted, open the TDSSKiller folder and Right click on TDSSKiller.exe and select "Run as Administrator" to run the application.
    • When the window opens, click on Change Parameters.
    • Under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”.
    • Click on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

  • Combofix


    • Download ComboFix from one of the following locations:

      Link 1
      Link 2

    • VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

    • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here .
    • Right click on ComboFix.exe and select "Run as Administrator" to run the program. Follow the prompts.

    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    • Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

    [external image: Posted Image]

    • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    [external image: Posted Image]

    • Click on Yes, to continue scanning for malware.
    • When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
    • Notes: Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    • Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
    • Should there be issues with internet afterward:

      In IE: Tools Menu -> Internet Options -> Connections Tab -> Lan Settings -> uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

      In Firefox: Tools Menu -> Options… -> Advanced Tab -> Network Tab -> "Settings" under Connection and uncheck the proxyserver, set it to No Proxy.

    Please post the TDSSKiller log and the Combofix log in your next reply.
Post #7
Jon, TDSS found one threat. TDSS log 21:53:12.0876 0372 TDSS rootkit removing tool 2.7.34.0 May 2 2012 09:59:18 21:53:13.0931 0372 ============================================================ 21:53:13.0931 0372 Current date / time: 2012/05/02 21:53:13.0931 21:53:13.0931 0372 SystemInfo: 21:53:13.0931 0372 21:53:13.0931 0372 OS Version: 6.1.7601 ServicePack: 1.0 21:53:13.0931 0372 Product type: Workstation 21:53:13.0931 0372 ComputerName: DAD-PC 21:53:13.0931 0372 UserName: dad 21:53:13.0931 0372 Windows directory: C:\Windows 21:53:13.0931 0372 System windows directory: C:\Windows 21:53:13.0931 0372 Running under WOW64 21:53:13.0931 0372 Processor architecture: Intel x64 21:53:13.0931 0372 Number of processors: 2 21:53:13.0931 0372 Page size: 0x1000 21:53:13.0931 0372 Boot type: Normal boot 21:53:13.0931 0372 ============================================================ 21:53:14.0931 0372 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 21:53:15.0061 0372 Drive \Device\Harddisk5\DR6 - Size: 0xEF000000 (3.73 Gb), SectorSize: 0x200, Cylinders: 0x1E7, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W' 21:53:15.0061 0372 ============================================================ 21:53:15.0061 0372 \Device\Harddisk0\DR0: 21:53:15.0061 0372 MBR partitions: 21:53:15.0061 0372 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x390F5AE1 21:53:15.0071 0372 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x390F5B20, BlocksNum 0x128B510 21:53:15.0071 0372 \Device\Harddisk5\DR6: 21:53:15.0071 0372 MBR partitions: 21:53:15.0071 0372 \Device\Harddisk5\DR6\Partition0: MBR, Type 0xC, StartLBA 0x30, BlocksNum 0x777FD0 21:53:15.0071 0372 ============================================================ 21:53:15.0091 0372 C: <-> \Device\Harddisk0\DR0\Partition0 21:53:15.0131 0372 D: <-> \Device\Harddisk0\DR0\Partition1 21:53:15.0131 0372 ============================================================ 21:53:15.0131 0372 Initialize success 21:53:15.0131 0372 ============================================================ 21:53:58.0425 3308 ============================================================ 21:53:58.0425 3308 Scan started 21:53:58.0425 3308 Mode: Manual; TDLFS; 21:53:58.0425 3308 ============================================================ 21:53:59.0335 3308 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys 21:53:59.0345 3308 1394ohci - ok 21:53:59.0385 3308 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys 21:53:59.0385 3308 ACPI - ok 21:53:59.0405 3308 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys 21:53:59.0405 3308 AcpiPmi - ok 21:53:59.0505 3308 AdobeActiveFileMonitor6.0 (e8fe4fce23d2809bd88bcc1d0f8408ce) C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe 21:53:59.0505 3308 AdobeActiveFileMonitor6.0 - ok 21:53:59.0605 3308 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 21:53:59.0605 3308 AdobeARMservice - ok 21:53:59.0755 3308 AdobeFlashPlayerUpdateSvc (459ac130c6ab892b1cd5d7544626efc5) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 21:53:59.0755 3308 AdobeFlashPlayerUpdateSvc - ok 21:53:59.0805 3308 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 21:53:59.0815 3308 adp94xx - ok 21:53:59.0835 3308 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 21:53:59.0835 3308 adpahci - ok 21:53:59.0855 3308 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 21:53:59.0865 3308 adpu320 - ok 21:53:59.0885 3308 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll 21:53:59.0885 3308 AeLookupSvc - ok 21:53:59.0965 3308 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys 21:53:59.0975 3308 AFD - ok 21:54:00.0015 3308 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys 21:54:00.0025 3308 agp440 - ok 21:54:00.0045 3308 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe 21:54:00.0045 3308 ALG - ok 21:54:00.0065 3308 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys 21:54:00.0065 3308 aliide - ok 21:54:00.0075 3308 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys 21:54:00.0075 3308 amdide - ok 21:54:00.0085 3308 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 21:54:00.0085 3308 AmdK8 - ok 21:54:00.0095 3308 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 21:54:00.0105 3308 AmdPPM - ok 21:54:00.0135 3308 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys 21:54:00.0135 3308 amdsata - ok 21:54:00.0155 3308 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 21:54:00.0155 3308 amdsbs - ok 21:54:00.0175 3308 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys 21:54:00.0175 3308 amdxata - ok 21:54:00.0215 3308 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys 21:54:00.0215 3308 AppID - ok 21:54:00.0225 3308 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll 21:54:00.0235 3308 AppIDSvc - ok 21:54:00.0245 3308 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll 21:54:00.0245 3308 Appinfo - ok 21:54:00.0335 3308 Apple Mobile Device (d8e18021f91ad79ca8491cb5a5da22d4) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 21:54:00.0345 3308 Apple Mobile Device - ok 21:54:00.0355 3308 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 21:54:00.0355 3308 arc - ok 21:54:00.0375 3308 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 21:54:00.0375 3308 arcsas - ok 21:54:00.0395 3308 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 21:54:00.0395 3308 AsyncMac - ok 21:54:00.0395 3308 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys 21:54:00.0395 3308 atapi - ok 21:54:00.0465 3308 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll 21:54:00.0475 3308 AudioEndpointBuilder - ok 21:54:00.0485 3308 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll 21:54:00.0495 3308 AudioSrv - ok 21:54:00.0535 3308 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll 21:54:00.0535 3308 AxInstSV - ok 21:54:00.0575 3308 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 21:54:00.0575 3308 b06bdrv - ok 21:54:00.0595 3308 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 21:54:00.0595 3308 b57nd60a - ok 21:54:00.0635 3308 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll 21:54:00.0635 3308 BDESVC - ok 21:54:00.0655 3308 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 21:54:00.0655 3308 Beep - ok 21:54:00.0705 3308 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll 21:54:00.0715 3308 BFE - ok 21:54:00.0785 3308 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll 21:54:00.0805 3308 BITS - ok 21:54:00.0845 3308 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 21:54:00.0845 3308 blbdrive - ok 21:54:00.0945 3308 Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe 21:54:00.0945 3308 Bonjour Service - ok 21:54:01.0015 3308 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys 21:54:01.0015 3308 bowser - ok 21:54:01.0035 3308 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 21:54:01.0035 3308 BrFiltLo - ok 21:54:01.0045 3308 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 21:54:01.0045 3308 BrFiltUp - ok 21:54:01.0085 3308 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll 21:54:01.0085 3308 Browser - ok 21:54:01.0115 3308 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 21:54:01.0115 3308 Brserid - ok 21:54:01.0135 3308 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 21:54:01.0135 3308 BrSerWdm - ok 21:54:01.0135 3308 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 21:54:01.0145 3308 BrUsbMdm - ok 21:54:01.0145 3308 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 21:54:01.0145 3308 BrUsbSer - ok 21:54:01.0165 3308 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 21:54:01.0165 3308 BTHMODEM - ok 21:54:01.0195 3308 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll 21:54:01.0195 3308 bthserv - ok 21:54:01.0235 3308 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 21:54:01.0235 3308 cdfs - ok 21:54:01.0275 3308 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys 21:54:01.0275 3308 cdrom - ok 21:54:01.0315 3308 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll 21:54:01.0315 3308 CertPropSvc - ok 21:54:01.0325 3308 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 21:54:01.0325 3308 circlass - ok 21:54:01.0355 3308 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 21:54:01.0355 3308 CLFS - ok 21:54:01.0425 3308 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 21:54:01.0425 3308 clr_optimization_v2.0.50727_32 - ok 21:54:01.0475 3308 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 21:54:01.0475 3308 clr_optimization_v2.0.50727_64 - ok 21:54:01.0536 3308 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 21:54:01.0536 3308 clr_optimization_v4.0.30319_32 - ok 21:54:01.0566 3308 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 21:54:01.0566 3308 clr_optimization_v4.0.30319_64 - ok 21:54:01.0576 3308 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 21:54:01.0576 3308 CmBatt - ok 21:54:01.0606 3308 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys 21:54:01.0606 3308 cmdide - ok 21:54:01.0666 3308 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys 21:54:01.0666 3308 CNG - ok 21:54:01.0696 3308 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 21:54:01.0696 3308 Compbatt - ok 21:54:01.0726 3308 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys 21:54:01.0726 3308 CompositeBus - ok 21:54:01.0736 3308 COMSysApp - ok 21:54:01.0746 3308 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 21:54:01.0746 3308 crcdisk - ok 21:54:01.0786 3308 CryptSvc (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll 21:54:01.0796 3308 CryptSvc - ok 21:54:01.0856 3308 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll 21:54:01.0866 3308 DcomLaunch - ok 21:54:01.0906 3308 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll 21:54:01.0906 3308 defragsvc - ok 21:54:01.0946 3308 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys 21:54:01.0956 3308 DfsC - ok 21:54:01.0976 3308 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll 21:54:01.0986 3308 Dhcp - ok 21:54:02.0016 3308 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 21:54:02.0016 3308 discache - ok 21:54:02.0036 3308 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 21:54:02.0036 3308 Disk - ok 21:54:02.0076 3308 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll 21:54:02.0076 3308 Dnscache - ok 21:54:02.0116 3308 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll 21:54:02.0126 3308 dot3svc - ok 21:54:02.0166 3308 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll 21:54:02.0166 3308 DPS - ok 21:54:02.0196 3308 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 21:54:02.0196 3308 drmkaud - ok 21:54:02.0276 3308 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys 21:54:02.0286 3308 DXGKrnl - ok 21:54:02.0316 3308 EagleX64 - ok 21:54:02.0346 3308 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll 21:54:02.0356 3308 EapHost - ok 21:54:02.0516 3308 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 21:54:02.0556 3308 ebdrv - ok 21:54:02.0646 3308 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe 21:54:02.0656 3308 EFS - ok 21:54:02.0716 3308 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe 21:54:02.0726 3308 ehRecvr - ok 21:54:02.0766 3308 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe 21:54:02.0766 3308 ehSched - ok 21:54:02.0816 3308 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 21:54:02.0826 3308 elxstor - ok 21:54:02.0856 3308 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys 21:54:02.0856 3308 ErrDev - ok 21:54:02.0916 3308 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll 21:54:02.0926 3308 EventSystem - ok 21:54:02.0956 3308 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 21:54:02.0966 3308 exfat - ok 21:54:03.0006 3308 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 21:54:03.0006 3308 fastfat - ok 21:54:03.0076 3308 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe 21:54:03.0086 3308 Fax - ok 21:54:03.0106 3308 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 21:54:03.0106 3308 fdc - ok 21:54:03.0116 3308 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll 21:54:03.0116 3308 fdPHost - ok 21:54:03.0136 3308 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll 21:54:03.0136 3308 FDResPub - ok 21:54:03.0176 3308 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 21:54:03.0176 3308 FileInfo - ok 21:54:03.0186 3308 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 21:54:03.0186 3308 Filetrace - ok 21:54:03.0266 3308 FLEXnet Licensing Service (227846995afeefa70d328bf5334a86a5) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe 21:54:03.0276 3308 FLEXnet Licensing Service - ok 21:54:03.0296 3308 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 21:54:03.0306 3308 flpydisk - ok 21:54:03.0346 3308 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys 21:54:03.0346 3308 FltMgr - ok 21:54:03.0426 3308 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll 21:54:03.0446 3308 FontCache - ok 21:54:03.0546 3308 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 21:54:03.0546 3308 FontCache3.0.0.0 - ok 21:54:03.0596 3308 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 21:54:03.0596 3308 FsDepends - ok 21:54:03.0626 3308 fssfltr (6c06701bf1db05405804d7eb610991ce) C:\Windows\system32\DRIVERS\fssfltr.sys 21:54:03.0626 3308 fssfltr - ok 21:54:03.0756 3308 fsssvc (4ce9dac1518ff7e77bd213e6394b9d77) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe 21:54:03.0776 3308 fsssvc - ok 21:54:03.0896 3308 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys 21:54:03.0896 3308 Fs_Rec - ok 21:54:03.0956 3308 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys 21:54:03.0956 3308 fvevol - ok 21:54:03.0976 3308 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 21:54:03.0976 3308 gagp30kx - ok 21:54:04.0016 3308 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 21:54:04.0016 3308 GEARAspiWDM - ok 21:54:04.0086 3308 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll 21:54:04.0096 3308 gpsvc - ok 21:54:04.0186 3308 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 21:54:04.0186 3308 gupdate - ok 21:54:04.0196 3308 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 21:54:04.0196 3308 gupdatem - ok 21:54:04.0226 3308 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 21:54:04.0226 3308 hcw85cir - ok 21:54:04.0296 3308 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys 21:54:04.0306 3308 HdAudAddService - ok 21:54:04.0326 3308 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys 21:54:04.0326 3308 HDAudBus - ok 21:54:04.0346 3308 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 21:54:04.0346 3308 HidBatt - ok 21:54:04.0356 3308 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 21:54:04.0356 3308 HidBth - ok 21:54:04.0366 3308 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 21:54:04.0366 3308 HidIr - ok 21:54:04.0396 3308 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll 21:54:04.0396 3308 hidserv - ok 21:54:04.0406 3308 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys 21:54:04.0406 3308 HidUsb - ok 21:54:04.0446 3308 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll 21:54:04.0446 3308 hkmsvc - ok 21:54:04.0486 3308 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll 21:54:04.0486 3308 HomeGroupListener - ok 21:54:04.0536 3308 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll 21:54:04.0546 3308 HomeGroupProvider - ok 21:54:04.0566 3308 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys 21:54:04.0566 3308 HpSAMD - ok 21:54:04.0646 3308 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys 21:54:04.0656 3308 HTTP - ok 21:54:04.0706 3308 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys 21:54:04.0706 3308 hwpolicy - ok 21:54:04.0726 3308 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys 21:54:04.0726 3308 i8042prt - ok 21:54:04.0776 3308 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys 21:54:04.0786 3308 iaStorV - ok 21:54:04.0916 3308 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 21:54:04.0926 3308 idsvc - ok 21:54:05.0446 3308 igfx (677aa5991026a65ada128c4b59cf2bad) C:\Windows\system32\DRIVERS\igdkmd64.sys 21:54:05.0647 3308 igfx - ok 21:54:05.0757 3308 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 21:54:05.0757 3308 iirsp - ok 21:54:05.0837 3308 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll 21:54:05.0847 3308 IKEEXT - ok 21:54:05.0887 3308 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys 21:54:05.0887 3308 intelide - ok 21:54:05.0907 3308 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 21:54:05.0907 3308 intelppm - ok 21:54:05.0937 3308 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll 21:54:05.0937 3308 IPBusEnum - ok 21:54:05.0957 3308 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys 21:54:05.0957 3308 IpFilterDriver - ok 21:54:06.0017 3308 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll 21:54:06.0037 3308 iphlpsvc - ok 21:54:06.0047 3308 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys 21:54:06.0057 3308 IPMIDRV - ok 21:54:06.0067 3308 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 21:54:06.0077 3308 IPNAT - ok 21:54:06.0167 3308 iPod Service (3c0d4b3e80fc4854ca325dd123cc4ded) C:\Program Files\iPod\bin\iPodService.exe 21:54:06.0177 3308 iPod Service - ok 21:54:06.0197 3308 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 21:54:06.0197 3308 IRENUM - ok 21:54:06.0227 3308 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys 21:54:06.0227 3308 isapnp - ok 21:54:06.0247 3308 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys 21:54:06.0257 3308 iScsiPrt - ok 21:54:06.0277 3308 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys 21:54:06.0277 3308 kbdclass - ok 21:54:06.0317 3308 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys 21:54:06.0317 3308 kbdhid - ok 21:54:06.0357 3308 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 21:54:06.0357 3308 KeyIso - ok 21:54:06.0387 3308 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys 21:54:06.0387 3308 KSecDD - ok 21:54:06.0417 3308 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys 21:54:06.0417 3308 KSecPkg - ok 21:54:06.0437 3308 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 21:54:06.0437 3308 ksthunk - ok 21:54:06.0477 3308 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll 21:54:06.0487 3308 KtmRm - ok 21:54:06.0547 3308 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll 21:54:06.0557 3308 LanmanServer - ok 21:54:06.0567 3308 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll 21:54:06.0577 3308 LanmanWorkstation - ok 21:54:06.0757 3308 Lavasoft Ad-Aware Service (ed60ffd305ac0424920d146db9f9ed78) C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe 21:54:06.0777 3308 Lavasoft Ad-Aware Service - ok 21:54:06.0857 3308 Lavasoft Kernexplorer (9a7fa6371f68335fd3c3d6488bc5a9f8) C:\Program Files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys 21:54:06.0857 3308 Lavasoft Kernexplorer - ok 21:54:06.0957 3308 Lbd (c8b3131857931ae76798a741cc52b021) C:\Windows\system32\DRIVERS\Lbd.sys 21:54:06.0967 3308 Lbd - ok 21:54:06.0987 3308 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 21:54:06.0987 3308 lltdio - ok 21:54:07.0037 3308 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll 21:54:07.0047 3308 lltdsvc - ok 21:54:07.0057 3308 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll 21:54:07.0057 3308 lmhosts - ok 21:54:07.0087 3308 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 21:54:07.0087 3308 LSI_FC - ok 21:54:07.0097 3308 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 21:54:07.0097 3308 LSI_SAS - ok 21:54:07.0117 3308 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 21:54:07.0117 3308 LSI_SAS2 - ok 21:54:07.0147 3308 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 21:54:07.0147 3308 LSI_SCSI - ok 21:54:07.0177 3308 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 21:54:07.0177 3308 luafv - ok 21:54:07.0247 3308 lxdnCATSCustConnectService (4208b958e35f0e596aa241efb664636b) C:\Windows\system32\spool\DRIVERS\x64\3\\lxdnserv.exe 21:54:07.0247 3308 lxdnCATSCustConnectService - ok 21:54:07.0247 3308 lxdn_device - ok 21:54:07.0297 3308 lxecCATSCustConnectService (1f02b554ddc4086d786537a3bf6488f1) C:\Windows\system32\spool\DRIVERS\x64\3\\lxecserv.exe 21:54:07.0307 3308 lxecCATSCustConnectService - ok 21:54:07.0307 3308 lxec_device - ok 21:54:07.0357 3308 McComponentHostService (f453d1e6d881e8f8717e20ccd4199e85) C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe 21:54:07.0357 3308 McComponentHostService - ok 21:54:07.0407 3308 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll 21:54:07.0417 3308 Mcx2Svc - ok 21:54:07.0427 3308 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 21:54:07.0427 3308 megasas - ok 21:54:07.0457 3308 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 21:54:07.0467 3308 MegaSR - ok 21:54:07.0487 3308 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 21:54:07.0497 3308 MMCSS - ok 21:54:07.0507 3308 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 21:54:07.0507 3308 Modem - ok 21:54:07.0547 3308 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 21:54:07.0547 3308 monitor - ok 21:54:07.0557 3308 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys 21:54:07.0567 3308 mouclass - ok 21:54:07.0567 3308 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 21:54:07.0567 3308 mouhid - ok 21:54:07.0617 3308 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys 21:54:07.0617 3308 mountmgr - ok 21:54:07.0657 3308 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys 21:54:07.0657 3308 mpio - ok 21:54:07.0687 3308 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 21:54:07.0687 3308 mpsdrv - ok 21:54:07.0757 3308 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll 21:54:07.0767 3308 MpsSvc - ok 21:54:07.0807 3308 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys 21:54:07.0817 3308 MRxDAV - ok 21:54:07.0857 3308 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys 21:54:07.0857 3308 mrxsmb - ok 21:54:07.0907 3308 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys 21:54:07.0917 3308 mrxsmb10 - ok 21:54:07.0937 3308 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 21:54:07.0937 3308 mrxsmb20 - ok 21:54:07.0967 3308 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys 21:54:07.0967 3308 msahci - ok 21:54:08.0007 3308 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys 21:54:08.0007 3308 msdsm - ok 21:54:08.0037 3308 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe 21:54:08.0047 3308 MSDTC - ok 21:54:08.0077 3308 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 21:54:08.0077 3308 Msfs - ok 21:54:08.0087 3308 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 21:54:08.0087 3308 mshidkmdf - ok 21:54:08.0097 3308 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys 21:54:08.0097 3308 msisadrv - ok 21:54:08.0127 3308 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll 21:54:08.0137 3308 MSiSCSI - ok 21:54:08.0137 3308 msiserver - ok 21:54:08.0167 3308 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 21:54:08.0167 3308 MSKSSRV - ok 21:54:08.0177 3308 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 21:54:08.0177 3308 MSPCLOCK - ok 21:54:08.0187 3308 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 21:54:08.0187 3308 MSPQM - ok 21:54:08.0237 3308 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys 21:54:08.0247 3308 MsRPC - ok 21:54:08.0267 3308 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys 21:54:08.0267 3308 mssmbios - ok 21:54:08.0277 3308 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 21:54:08.0277 3308 MSTEE - ok 21:54:08.0297 3308 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 21:54:08.0297 3308 MTConfig - ok 21:54:08.0317 3308 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 21:54:08.0317 3308 Mup - ok 21:54:08.0367 3308 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll 21:54:08.0377 3308 napagent - ok 21:54:08.0427 3308 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 21:54:08.0427 3308 NativeWifiP - ok 21:54:08.0487 3308 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys 21:54:08.0507 3308 NDIS - ok 21:54:08.0517 3308 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 21:54:08.0517 3308 NdisCap - ok 21:54:08.0527 3308 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 21:54:08.0527 3308 NdisTapi - ok 21:54:08.0547 3308 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys 21:54:08.0547 3308 Ndisuio - ok 21:54:08.0567 3308 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys 21:54:08.0577 3308 NdisWan - ok 21:54:08.0607 3308 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys 21:54:08.0607 3308 NDProxy - ok 21:54:08.0637 3308 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 21:54:08.0637 3308 NetBIOS - ok 21:54:08.0687 3308 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys 21:54:08.0687 3308 NetBT - ok 21:54:08.0717 3308 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 21:54:08.0717 3308 Netlogon - ok 21:54:08.0767 3308 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll 21:54:08.0767 3308 Netman - ok 21:54:08.0817 3308 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll 21:54:08.0817 3308 netprofm - ok 21:54:08.0907 3308 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 21:54:08.0907 3308 NetTcpPortSharing - ok 21:54:08.0927 3308 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 21:54:08.0927 3308 nfrd960 - ok 21:54:08.0977 3308 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll 21:54:08.0977 3308 NlaSvc - ok 21:54:09.0007 3308 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 21:54:09.0007 3308 Npfs - ok 21:54:09.0017 3308 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll 21:54:09.0017 3308 nsi - ok 21:54:09.0027 3308 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 21:54:09.0037 3308 nsiproxy - ok 21:54:09.0147 3308 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys 21:54:09.0167 3308 Ntfs - ok 21:54:09.0247 3308 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 21:54:09.0247 3308 Null - ok 21:54:09.0287 3308 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys 21:54:09.0287 3308 nvraid - ok 21:54:09.0337 3308 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys 21:54:09.0337 3308 nvstor - ok 21:54:09.0357 3308 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys 21:54:09.0357 3308 nv_agp - ok 21:54:09.0397 3308 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys 21:54:09.0397 3308 ohci1394 - ok 21:54:09.0447 3308 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 21:54:09.0447 3308 ose - ok 21:54:09.0497 3308 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 21:54:09.0507 3308 p2pimsvc - ok 21:54:09.0527 3308 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll 21:54:09.0537 3308 p2psvc - ok 21:54:09.0548 3308 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 21:54:09.0558 3308 Parport - ok 21:54:09.0598 3308 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys 21:54:09.0598 3308 partmgr - ok 21:54:09.0618 3308 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll 21:54:09.0618 3308 PcaSvc - ok 21:54:09.0638 3308 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys 21:54:09.0638 3308 pci - ok 21:54:09.0648 3308 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys 21:54:09.0648 3308 pciide - ok 21:54:09.0668 3308 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 21:54:09.0678 3308 pcmcia - ok 21:54:09.0688 3308 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 21:54:09.0688 3308 pcw - ok 21:54:09.0738 3308 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 21:54:09.0738 3308 PEAUTH - ok 21:54:09.0818 3308 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe 21:54:09.0828 3308 PerfHost - ok 21:54:09.0938 3308 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll 21:54:09.0958 3308 pla - ok 21:54:10.0008 3308 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll 21:54:10.0018 3308 PlugPlay - ok 21:54:10.0138 3308 PMBDeviceInfoProvider (63694c307273062a2167ae4ce80730ef) C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe 21:54:10.0138 3308 PMBDeviceInfoProvider - ok 21:54:10.0148 3308 PnkBstrA - ok 21:54:10.0158 3308 PnkBstrB - ok 21:54:10.0178 3308 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll 21:54:10.0178 3308 PNRPAutoReg - ok 21:54:10.0208 3308 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 21:54:10.0208 3308 PNRPsvc - ok 21:54:10.0268 3308 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll 21:54:10.0278 3308 PolicyAgent - ok 21:54:10.0318 3308 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll 21:54:10.0318 3308 Power - ok 21:54:10.0388 3308 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys 21:54:10.0388 3308 PptpMiniport - ok 21:54:10.0418 3308 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 21:54:10.0418 3308 Processor - ok 21:54:10.0468 3308 ProfSvc (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll 21:54:10.0468 3308 ProfSvc - ok 21:54:10.0508 3308 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 21:54:10.0508 3308 ProtectedStorage - ok 21:54:10.0538 3308 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys 21:54:10.0538 3308 Psched - ok 21:54:10.0568 3308 PxHlpa64 (a6bf0a9b5a30d743623ca0d3be35df05) C:\Windows\system32\Drivers\PxHlpa64.sys 21:54:10.0578 3308 PxHlpa64 - ok 21:54:10.0658 3308 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 21:54:10.0678 3308 ql2300 - ok 21:54:10.0778 3308 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 21:54:10.0778 3308 ql40xx - ok 21:54:10.0818 3308 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll 21:54:10.0828 3308 QWAVE - ok 21:54:10.0838 3308 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 21:54:10.0838 3308 QWAVEdrv - ok 21:54:10.0858 3308 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 21:54:10.0858 3308 RasAcd - ok 21:54:10.0888 3308 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 21:54:10.0888 3308 RasAgileVpn - ok 21:54:10.0908 3308 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll 21:54:10.0908 3308 RasAuto - ok 21:54:10.0948 3308 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys 21:54:10.0948 3308 Rasl2tp - ok 21:54:10.0978 3308 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll 21:54:10.0988 3308 RasMan - ok 21:54:11.0008 3308 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 21:54:11.0008 3308 RasPppoe - ok 21:54:11.0018 3308 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 21:54:11.0018 3308 RasSstp - ok 21:54:11.0068 3308 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys 21:54:11.0068 3308 rdbss - ok 21:54:11.0088 3308 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 21:54:11.0088 3308 rdpbus - ok 21:54:11.0108 3308 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 21:54:11.0108 3308 RDPCDD - ok 21:54:11.0118 3308 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 21:54:11.0118 3308 RDPENCDD - ok 21:54:11.0138 3308 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 21:54:11.0138 3308 RDPREFMP - ok 21:54:11.0178 3308 RDPWD (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys 21:54:11.0178 3308 RDPWD - ok 21:54:11.0228 3308 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys 21:54:11.0238 3308 rdyboost - ok 21:54:11.0268 3308 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll 21:54:11.0268 3308 RemoteAccess - ok 21:54:11.0298 3308 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll 21:54:11.0298 3308 RemoteRegistry - ok 21:54:11.0318 3308 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll 21:54:11.0318 3308 RpcEptMapper - ok 21:54:11.0328 3308 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe 21:54:11.0328 3308 RpcLocator - ok 21:54:11.0388 3308 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll 21:54:11.0398 3308 RpcSs - ok 21:54:11.0438 3308 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 21:54:11.0438 3308 rspndr - ok 21:54:11.0488 3308 RTL8167 (4b42bc58294e83a6a92ec8b88c14c4a3) C:\Windows\system32\DRIVERS\Rt64win7.sys 21:54:11.0488 3308 RTL8167 - ok 21:54:11.0528 3308 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 21:54:11.0528 3308 SamSs - ok 21:54:11.0568 3308 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys 21:54:11.0568 3308 sbp2port - ok 21:54:11.0618 3308 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll 21:54:11.0628 3308 SCardSvr - ok 21:54:11.0658 3308 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys 21:54:11.0658 3308 scfilter - ok 21:54:11.0748 3308 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll 21:54:11.0768 3308 Schedule - ok 21:54:11.0818 3308 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll 21:54:11.0818 3308 SCPolicySvc - ok 21:54:11.0858 3308 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll 21:54:11.0858 3308 SDRSVC - ok 21:54:11.0908 3308 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 21:54:11.0918 3308 secdrv - ok 21:54:11.0918 3308 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll 21:54:11.0928 3308 seclogon - ok 21:54:11.0958 3308 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll 21:54:11.0968 3308 SENS - ok 21:54:11.0968 3308 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll 21:54:11.0978 3308 SensrSvc - ok 21:54:12.0008 3308 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 21:54:12.0008 3308 Serenum - ok 21:54:12.0038 3308 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 21:54:12.0038 3308 Serial - ok 21:54:12.0078 3308 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 21:54:12.0078 3308 sermouse - ok 21:54:12.0138 3308 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll 21:54:12.0138 3308 SessionEnv - ok 21:54:12.0158 3308 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys 21:54:12.0158 3308 sffdisk - ok 21:54:12.0178 3308 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys 21:54:12.0178 3308 sffp_mmc - ok 21:54:12.0198 3308 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys 21:54:12.0198 3308 sffp_sd - ok 21:54:12.0218 3308 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 21:54:12.0218 3308 sfloppy - ok 21:54:12.0258 3308 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll 21:54:12.0258 3308 SharedAccess - ok 21:54:12.0318 3308 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll 21:54:12.0328 3308 ShellHWDetection - ok 21:54:12.0338 3308 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 21:54:12.0348 3308 SiSRaid2 - ok 21:54:12.0358 3308 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 21:54:12.0358 3308 SiSRaid4 - ok 21:54:12.0438 3308 SkypeUpdate (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files (x86)\Skype\Updater\Updater.exe 21:54:12.0438 3308 SkypeUpdate - ok 21:54:12.0458 3308 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 21:54:12.0458 3308 Smb - ok 21:54:12.0498 3308 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe 21:54:12.0498 3308 SNMPTRAP - ok 21:54:12.0518 3308 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 21:54:12.0518 3308 spldr - ok 21:54:12.0578 3308 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe 21:54:12.0588 3308 Spooler - ok 21:54:12.0798 3308 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe 21:54:12.0818 3308 sppsvc - ok 21:54:12.0928 3308 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll 21:54:12.0928 3308 sppuinotify - ok 21:54:13.0008 3308 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys 21:54:13.0018 3308 srv - ok 21:54:13.0078 3308 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys 21:54:13.0088 3308 srv2 - ok 21:54:13.0128 3308 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys 21:54:13.0128 3308 srvnet - ok 21:54:13.0148 3308 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll 21:54:13.0158 3308 SSDPSRV - ok 21:54:13.0198 3308 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll 21:54:13.0198 3308 SstpSvc - ok 21:54:13.0228 3308 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 21:54:13.0228 3308 stexstor - ok 21:54:13.0288 3308 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll 21:54:13.0298 3308 stisvc - ok 21:54:13.0328 3308 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys 21:54:13.0328 3308 swenum - ok 21:54:13.0378 3308 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll 21:54:13.0388 3308 swprv - ok 21:54:13.0508 3308 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll 21:54:13.0528 3308 SysMain - ok 21:54:13.0628 3308 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll 21:54:13.0638 3308 TabletInputService - ok 21:54:13.0688 3308 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll 21:54:13.0688 3308 TapiSrv - ok 21:54:13.0718 3308 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll 21:54:13.0728 3308 TBS - ok 21:54:13.0848 3308 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys 21:54:13.0868 3308 Tcpip - ok 21:54:13.0988 3308 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys 21:54:13.0998 3308 TCPIP6 - ok 21:54:14.0068 3308 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys 21:54:14.0078 3308 tcpipreg - ok 21:54:14.0098 3308 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 21:54:14.0108 3308 TDPIPE - ok 21:54:14.0138 3308 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys 21:54:14.0138 3308 TDTCP - ok 21:54:14.0168 3308 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys 21:54:14.0178 3308 tdx - ok 21:54:14.0218 3308 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys 21:54:14.0218 3308 TermDD - ok 21:54:14.0298 3308 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll 21:54:14.0308 3308 TermService - ok 21:54:14.0328 3308 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll 21:54:14.0338 3308 Themes - ok 21:54:14.0368 3308 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 21:54:14.0368 3308 THREADORDER - ok 21:54:14.0388 3308 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll 21:54:14.0388 3308 TrkWks - ok 21:54:14.0448 3308 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe 21:54:14.0448 3308 TrustedInstaller - ok 21:54:14.0488 3308 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys 21:54:14.0488 3308 tssecsrv - ok 21:54:14.0548 3308 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys 21:54:14.0548 3308 TsUsbFlt - ok 21:54:14.0578 3308 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys 21:54:14.0578 3308 tunnel - ok 21:54:14.0608 3308 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 21:54:14.0608 3308 uagp35 - ok 21:54:14.0658 3308 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys 21:54:14.0668 3308 udfs - ok 21:54:14.0688 3308 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe 21:54:14.0688 3308 UI0Detect - ok 21:54:14.0738 3308 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys 21:54:14.0738 3308 uliagpkx - ok 21:54:14.0758 3308 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys 21:54:14.0758 3308 umbus - ok 21:54:14.0778 3308 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 21:54:14.0778 3308 UmPass - ok 21:54:14.0808 3308 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll 21:54:14.0818 3308 upnphost - ok 21:54:14.0858 3308 USBAAPL64 (aa33fc47ed58c34e6e9261e4f850b7eb) C:\Windows\system32\Drivers\usbaapl64.sys 21:54:14.0868 3308 USBAAPL64 - ok 21:54:14.0908 3308 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys 21:54:14.0908 3308 usbaudio - ok 21:54:14.0938 3308 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys 21:54:14.0938 3308 usbccgp - ok 21:54:14.0958 3308 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys 21:54:14.0958 3308 usbcir - ok 21:54:14.0988 3308 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys 21:54:14.0988 3308 usbehci - ok 21:54:15.0018 3308 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys 21:54:15.0018 3308 usbhub - ok 21:54:15.0038 3308 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys 21:54:15.0038 3308 usbohci - ok 21:54:15.0048 3308 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 21:54:15.0048 3308 usbprint - ok 21:54:15.0088 3308 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys 21:54:15.0088 3308 usbscan - ok 21:54:15.0108 3308 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS 21:54:15.0108 3308 USBSTOR - ok 21:54:15.0118 3308 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys 21:54:15.0118 3308 usbuhci - ok 21:54:15.0148 3308 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll 21:54:15.0148 3308 UxSms - ok 21:54:15.0178 3308 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 21:54:15.0178 3308 VaultSvc - ok 21:54:15.0188 3308 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys 21:54:15.0188 3308 vdrvroot - ok 21:54:15.0248 3308 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe 21:54:15.0258 3308 vds - ok 21:54:15.0278 3308 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 21:54:15.0278 3308 vga - ok 21:54:15.0298 3308 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 21:54:15.0298 3308 VgaSave - ok 21:54:15.0338 3308 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys 21:54:15.0348 3308 vhdmp - ok 21:54:15.0358 3308 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys 21:54:15.0358 3308 viaide - ok 21:54:15.0368 3308 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys 21:54:15.0378 3308 volmgr - ok 21:54:15.0418 3308 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys 21:54:15.0428 3308 volmgrx - ok 21:54:15.0458 3308 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys 21:54:15.0458 3308 volsnap - ok 21:54:15.0478 3308 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 21:54:15.0488 3308 vsmraid - ok 21:54:15.0568 3308 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe 21:54:15.0598 3308 VSS - ok 21:54:15.0698 3308 VST64HWBS2 (93132c69394a99d992095d8cfe464801) C:\Windows\system32\DRIVERS\VSTBS26.SYS 21:54:15.0708 3308 VST64HWBS2 - ok 21:54:15.0788 3308 VST64_DPV (02071d207a9858fbe3a48cbfd59c4a04) C:\Windows\system32\DRIVERS\VSTDPV6.SYS 21:54:15.0808 3308 VST64_DPV - ok 21:54:15.0888 3308 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys 21:54:15.0888 3308 vwifibus - ok 21:54:15.0938 3308 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll 21:54:15.0948 3308 W32Time - ok 21:54:15.0968 3308 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 21:54:15.0968 3308 WacomPen - ok 21:54:16.0008 3308 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 21:54:16.0008 3308 WANARP - ok 21:54:16.0018 3308 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 21:54:16.0018 3308 Wanarpv6 - ok 21:54:16.0108 3308 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe 21:54:16.0128 3308 WatAdminSvc - ok 21:54:16.0238 3308 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe 21:54:16.0268 3308 wbengine - ok 21:54:16.0348 3308 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll 21:54:16.0358 3308 WbioSrvc - ok 21:54:16.0418 3308 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll 21:54:16.0428 3308 wcncsvc - ok 21:54:16.0438 3308 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll 21:54:16.0448 3308 WcsPlugInService - ok 21:54:16.0478 3308 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 21:54:16.0478 3308 Wd - ok 21:54:16.0528 3308 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 21:54:16.0538 3308 Wdf01000 - ok 21:54:16.0558 3308 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 21:54:16.0558 3308 WdiServiceHost - ok 21:54:16.0568 3308 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 21:54:16.0568 3308 WdiSystemHost - ok 21:54:16.0618 3308 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll 21:54:16.0618 3308 WebClient - ok 21:54:16.0648 3308 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll 21:54:16.0658 3308 Wecsvc - ok 21:54:16.0668 3308 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll 21:54:16.0678 3308 wercplsupport - ok 21:54:16.0708 3308 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll 21:54:16.0708 3308 WerSvc - ok 21:54:16.0728 3308 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 21:54:16.0728 3308 WfpLwf - ok 21:54:16.0738 3308 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 21:54:16.0738 3308 WIMMount - ok 21:54:16.0798 3308 winachsf (18e40c245dbfaf36fd0134a7ef2df396) C:\Windows\system32\DRIVERS\VSTCNXT6.SYS 21:54:16.0808 3308 winachsf - ok 21:54:16.0858 3308 WinDefend - ok 21:54:16.0878 3308 WinHttpAutoProxySvc - ok 21:54:16.0958 3308 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll 21:54:16.0958 3308 Winmgmt - ok 21:54:17.0088 3308 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll 21:54:17.0118 3308 WinRM - ok 21:54:17.0248 3308 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys 21:54:17.0248 3308 WinUsb - ok 21:54:17.0328 3308 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll 21:54:17.0338 3308 Wlansvc - ok 21:54:17.0518 3308 wlidsvc (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 21:54:17.0538 3308 wlidsvc - ok 21:54:17.0628 3308 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys 21:54:17.0628 3308 WmiAcpi - ok 21:54:17.0708 3308 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe 21:54:17.0708 3308 wmiApSrv - ok 21:54:17.0748 3308 WMPNetworkSvc - ok 21:54:17.0758 3308 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll 21:54:17.0768 3308 WPCSvc - ok 21:54:17.0808 3308 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll 21:54:17.0818 3308 WPDBusEnum - ok 21:54:17.0848 3308 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 21:54:17.0848 3308 ws2ifsl - ok 21:54:17.0868 3308 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll 21:54:17.0878 3308 wscsvc - ok 21:54:17.0888 3308 WSearch - ok 21:54:18.0018 3308 wuauserv (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll 21:54:18.0048 3308 wuauserv - ok 21:54:18.0168 3308 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys 21:54:18.0168 3308 WudfPf - ok 21:54:18.0188 3308 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys 21:54:18.0188 3308 WUDFRd - ok 21:54:18.0208 3308 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll 21:54:18.0208 3308 wudfsvc - ok 21:54:18.0228 3308 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll 21:54:18.0238 3308 WwanSvc - ok 21:54:18.0348 3308 YahooAUService (dd0042f0c3b606a6a8b92d49afb18ad6) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe 21:54:18.0358 3308 YahooAUService - ok 21:54:18.0388 3308 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 21:54:18.0418 3308 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - infected 21:54:18.0418 3308 \Device\Harddisk0\DR0 - detected Rootkit.Boot.SST.b (0) 21:54:18.0488 3308 \Device\Harddisk0\DR0 ( TDSS File System ) - warning 21:54:18.0488 3308 \Device\Harddisk0\DR0 - detected TDSS File System (1) 21:54:18.0528 3308 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk5\DR6 21:54:22.0292 3308 \Device\Harddisk5\DR6 - ok 21:54:22.0292 3308 Boot (0x1200) (cb0a259b07a2fcf610a555c1e7c53a60) \Device\Harddisk0\DR0\Partition0 21:54:22.0302 3308 \Device\Harddisk0\DR0\Partition0 - ok 21:54:22.0332 3308 Boot (0x1200) (c08d589fa6a1cc70751c5296e9212c85) \Device\Harddisk0\DR0\Partition1 21:54:22.0332 3308 \Device\Harddisk0\DR0\Partition1 - ok 21:54:22.0342 3308 Boot (0x1200) (a7e38ce9c534d7596d430bf67e12ae55) \Device\Harddisk5\DR6\Partition0 21:54:22.0352 3308 \Device\Harddisk5\DR6\Partition0 - ok 21:54:22.0352 3308 ============================================================ 21:54:22.0352 3308 Scan finished 21:54:22.0352 3308 ============================================================ 21:54:22.0372 2460 Detected object count: 2 21:54:22.0372 2460 Actual detected object count: 2 21:55:06.0055 2460 \Device\Harddisk0\DR0\# - copied to quarantine 21:55:06.0055 2460 \Device\Harddisk0\DR0 - copied to quarantine 21:55:06.0075 2460 \Device\Harddisk0\DR0\TDLFS\mbr - copied to quarantine 21:55:06.0075 2460 \Device\Harddisk0\DR0\TDLFS\vbr - copied to quarantine 21:55:06.0085 2460 \Device\Harddisk0\DR0\TDLFS\bid - copied to quarantine 21:55:06.0085 2460 \Device\Harddisk0\DR0\TDLFS\affid - copied to quarantine 21:55:06.0085 2460 \Device\Harddisk0\DR0\TDLFS\boot - copied to quarantine 21:55:06.0085 2460 \Device\Harddisk0\DR0\TDLFS\cmd32 - copied to quarantine 21:55:06.0085 2460 \Device\Harddisk0\DR0\TDLFS\cmd64 - copied to quarantine 21:55:06.0085 2460 \Device\Harddisk0\DR0\TDLFS\dbg32 - copied to quarantine 21:55:06.0115 2460 \Device\Harddisk0\DR0\TDLFS\dbg64 - copied to quarantine 21:55:06.0125 2460 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine 21:55:06.0125 2460 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine 21:55:06.0125 2460 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine 21:55:06.0125 2460 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine 21:55:06.0125 2460 \Device\Harddisk0\DR0\TDLFS\subid - copied to quarantine 21:55:06.0125 2460 \Device\Harddisk0\DR0\TDLFS\info - copied to quarantine 21:55:06.0135 2460 \Device\Harddisk0\DR0\TDLFS\main - copied to quarantine 21:55:06.0135 2460 \Device\Harddisk0\DR0\TDLFS\mainfb.script - copied to quarantine 21:55:06.0195 2460 \Device\Harddisk0\DR0\TDLFS\com64 - copied to quarantine 21:55:06.0195 2460 \Device\Harddisk0\DR0\TDLFS\bbr232 - copied to quarantine 21:55:06.0215 2460 \Device\Harddisk0\DR0\TDLFS\serf332 - copied to quarantine 21:55:06.0235 2460 \Device\Harddisk0\DR0\TDLFS\serf364 - copied to quarantine 21:55:06.0245 2460 \Device\Harddisk0\DR0\TDLFS\bbr264 - copied to quarantine 21:55:06.0245 2460 \Device\Harddisk0\DR0\TDLFS\serf_conf - copied to quarantine 21:55:06.0365 2460 \Device\Harddisk0\DR0\TDLFS\bbr_conf - copied to quarantine 21:55:06.0365 2460 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - will be cured on reboot 21:55:06.0425 2460 \Device\Harddisk0\DR0 - ok 21:55:06.0915 2460 \Device\Harddisk0\DR0 ( Rootkit.Boot.SST.b ) - User select action: Cure 21:55:06.0915 2460 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user 21:55:06.0915 2460 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip 21:55:14.0486 2096 Deinitialize success Combo Fix log ComboFix 12-05-02.04 - dad 05/02/2012 22:05:30.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4029.2869 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116} SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\data C:\Install.exe c:\programdata\SPL591A.tmp c:\programdata\SPL7D45.tmp c:\programdata\SPLAC5D.tmp c:\programdata\SPLB960.tmp c:\programdata\SPLC1C.tmp c:\programdata\SPLC6D8.tmp c:\programdata\SPLCBE8.tmp . . ((((((((((((((((((((((((( Files Created from 2012-04-03 to 2012-05-03 ))))))))))))))))))))))))))))))) . . 2012-05-03 03:11 . 2012-05-03 03:11 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-05-03 02:55 . 2012-05-03 02:55 ——– d—–w- C:\TDSSKiller_Quarantine 2012-04-20 18:58 . 2012-04-20 18:58 ——– d—–w- c:\programdata\Common Files 2012-04-20 18:58 . 2012-04-20 18:59 ——– d—–w- c:\users\dad\AppData\Roaming\FixCleaner 2012-04-20 18:58 . 2012-04-22 18:18 ——– d—–w- c:\program files (x86)\FixCleaner 2012-04-20 18:14 . 2012-04-20 18:14 ——– d—–w- c:\users\dad\AppData\Local\adawarebp 2012-04-20 18:14 . 2012-05-01 01:38 ——– d—–w- c:\programdata\Ad-Aware Browsing Protection 2012-04-20 18:14 . 2012-04-20 18:14 ——– d—–w- c:\program files (x86)\Toolbar Cleaner 2012-04-20 18:14 . 2012-04-20 18:14 ——– d—–w- c:\program files (x86)\adawaretb 2012-04-20 18:12 . 2012-04-20 18:15 ——– d—–w- c:\users\dad\AppData\Roaming\Ad-Aware Antivirus 2012-04-20 03:20 . 2012-04-20 03:20 288 —-a-w- c:\users\dad\AppData\Roaming\15DB4B7F.reg 2012-04-20 03:19 . 2012-04-20 17:33 ——– d—–w- c:\programdata\F4D55F3E00002D6300011D33B4EB2367 2012-04-20 03:19 . 2012-04-20 03:19 ——– d—–w- c:\users\dad\AppData\Local\{ABEA01A2-8A97-11E1-826D-B8AC6F996F26} 2012-04-20 03:19 . 2012-04-22 17:50 ——– d—–w- c:\users\dad\AppData\Local\MPEG 2012-04-17 08:12 . 2012-03-14 03:27 8669240 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0B3FA9D9-1004-4F7C-BF9F-96ACB94D4D37}\mpengine.dll 2012-04-11 08:03 . 2012-03-06 06:53 5559152 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-04-11 08:03 . 2012-03-06 05:59 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-04-11 08:03 . 2012-03-06 05:59 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-04-11 08:00 . 2012-03-01 06:46 23408 —-a-w- c:\windows\system32\drivers\fs_rec.sys 2012-04-11 08:00 . 2012-03-01 06:38 220672 —-a-w- c:\windows\system32\wintrust.dll 2012-04-11 08:00 . 2012-03-01 06:33 81408 —-a-w- c:\windows\system32\imagehlp.dll 2012-04-11 08:00 . 2012-03-01 06:28 5120 —-a-w- c:\windows\system32\wmi.dll 2012-04-11 08:00 . 2012-03-01 05:37 172544 —-a-w- c:\windows\SysWow64\wintrust.dll 2012-04-11 08:00 . 2012-03-01 05:33 159232 —-a-w- c:\windows\SysWow64\imagehlp.dll 2012-04-11 08:00 . 2012-03-01 05:29 5120 —-a-w- c:\windows\SysWow64\wmi.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-04-14 12:36 . 2012-03-29 16:20 418464 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-04-14 12:36 . 2011-08-20 14:07 70304 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-04-14 12:36 . 2012-03-29 16:36 8741536 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2012-02-23 14:18 . 2011-01-10 20:25 279656 ——w- c:\windows\system32\MpSigStub.exe 2012-02-17 06:38 . 2012-03-14 01:03 1031680 —-a-w- c:\windows\system32\rdpcore.dll 2012-02-17 05:34 . 2012-03-14 01:03 826880 —-a-w- c:\windows\SysWow64\rdpcore.dll 2012-02-17 04:58 . 2012-03-14 01:03 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-02-17 04:57 . 2012-03-14 01:03 23552 —-a-w- c:\windows\system32\drivers\tdtcp.sys 2012-02-10 06:36 . 2012-03-14 01:04 1544192 —-a-w- c:\windows\system32\DWrite.dll 2012-02-10 05:38 . 2012-03-14 01:04 1077248 —-a-w- c:\windows\SysWow64\DWrite.dll 2012-02-03 04:34 . 2012-03-14 01:04 3145728 —-a-w- c:\windows\system32\win32k.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll" [2012-01-12 1517368] . [HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1] [HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{6c97a91e-4524-4019-86af-2aa2d567bf5c}] 2012-03-06 19:16 87440 —-a-w- c:\program files (x86)\adawaretb\adawareDx.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{6c97a91e-4524-4019-86af-2aa2d567bf5c}"= "c:\program files (x86)\adawaretb\adawareDx.dll" [2012-03-06 87440] . [HKEY_CLASSES_ROOT\clsid\{6c97a91e-4524-4019-86af-2aa2d567bf5c}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-02-29 17148552] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "FaxCenterServer"="c:\program files (x86)\Lexmark Fax Solutions\fm3032.exe" [2007-12-17 320168] "Adobe Photo Downloader"="c:\program files (x86)\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-11 67488] "AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656] "TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2011-06-16 273544] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-07-05 421888] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-10-09 421736] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2010-11-27 648032] "Ad-Aware Browsing Protection"="c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe" [2012-03-28 200600] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 0 (0x0) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-15 136176] R2 lxecCATSCustConnectService;lxecCATSCustConnectService;c:\windows\system32\spool\DRIVERS\x64\3\\lxecserv.exe [2010-04-14 45736] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-14 253088] R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-15 136176] R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys [2011-04-01 17152] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-09-02 2152152] S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe [2007-12-05 1044648] S2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\system32\spool\DRIVERS\x64\3\\lxdnserv.exe [2009-04-28 29184] S2 lxec_device;lxec_device;c:\windows\system32\lxeccoms.exe [2010-04-14 1052328] S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-27 398176] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 VST64_DPV;VST64_DPV;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x] S3 VST64HWBS2;VST64HWBS2;c:\windows\system32\DRIVERS\VSTBS26.SYS [x] . . — Other Services/Drivers In Memory — . *NewlyCreated* - WS2IFSL . Contents of the 'Scheduled Tasks' folder . 2012-05-03 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 12:36] . 2012-05-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-15 20:01] . 2012-05-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-15 20:01] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "lxdnmon.exe"="c:\program files (x86)\Lexmark 2600 Series\lxdnmon.exe" [2007-12-17 660136] "lxdnamon"="c:\program files (x86)\Lexmark 2600 Series\lxdnamon.exe" [2007-12-17 16040] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256] "lxecmon.exe"="c:\program files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe" [2010-05-17 770728] "EzPrint"="c:\program files (x86)\Lexmark Pro800-Pro900 Series\ezprint.exe" [2010-05-17 148280] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://isearch.avg.com/?cid={279430EE-6662-4F63-A56E-8A7D6EAAE71E}&mid=08d64d00bd2947d0adba41b2e00d4f9f-1d6c8b6a4fd14e7d84d88f40e35531e8c08da0a6&lang=en&ds=ts025&pr=sa&d=&v=&sap=hp mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\users\dad\AppData\Roaming\Mozilla\Firefox\Profiles\ol2d19d4.default\ FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.startup.homepage - hxxp://isearch.avg.com/?cid={279430EE-6662-4F63-A56E-8A7D6EAAE71E}&mid=08d64d00bd2947d0adba41b2e00d4f9f-1d6c8b6a4fd14e7d84d88f40e35531e8c08da0a6&lang=en&ds=ts025&pr=sa&d=&v=&sap=hp FF - prefs.js: network.proxy.type - 0 . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKCU-Run-MPEGAudio - c:\users\dad\AppData\Local\MPEG\MPEGAudio.dll . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Lexmark 2600 Series\lxdnMsdMon.exe c:\windows\SysWOW64\PnkBstrA.exe c:\windows\SysWOW64\PnkBstrB.exe . ************************************************************************** . Completion time: 2012-05-02 22:18:17 - machine was rebooted ComboFix-quarantined-files.txt 2012-05-03 03:18 . Pre-Run: 358,765,924,352 bytes free Post-Run: 358,604,943,360 bytes free . - - End Of File - - B57395A34DB84AE5DFED3116EE03BEC8
Post #8
Hello chester

Thank you for the logs.

Please run TDSSKiller again and delete/quarantine the following detected item:

\Device\Harddisk0\DR0 ( TDSS File System )

Do you recognise the following file? c:\users\dad\AppData\Roaming\15DB4B7F.reg

Lets take a closer look at it with the following:

  • Please scan the following files


  • Please go to VirusTotal


  • On the page you'll find a "Choose File" button.
  • Click on the Choose File button.
  • In the File Upload window which opens, copy and paste this into the File Name box.


c:\users\dad\AppData\Roaming\15DB4B7F.reg


  • Next, click the Open button.
  • Then click the "Send File" button just below.
  • This will scan the file. Please be patient.
  • If you get a message saying File has already been analyzed: click Reanalyze file now.
  • Once scanned, copy and paste the link to the results page in your next reply.

Please post the TDSSKiller log and the link to the Virus Total results page in your next reply.
Post #9
Jon,
\Device\Harddisk0\DR0 ( TDSS File System ) I think this was part of a memory stick I had in the computer that I forgot about when running the first scan. I unplugged the stick. Here is the scan without the stick.

Should I scan again with the stick and take care of that item?



10:22:17.0863 1548 TDSS rootkit removing tool 2.7.34.0 May 2 2012 09:59:18
10:22:18.0502 1548 ============================================================
10:22:18.0502 1548 Current date / time: 2012/05/03 10:22:18.0502
10:22:18.0502 1548 SystemInfo:
10:22:18.0502 1548
10:22:18.0502 1548 OS Version: 6.1.7601 ServicePack: 1.0
10:22:18.0502 1548 Product type: Workstation
10:22:18.0502 1548 ComputerName: DAD-PC
10:22:18.0502 1548 UserName: dad
10:22:18.0502 1548 Windows directory: C:\Windows
10:22:18.0502 1548 System windows directory: C:\Windows
10:22:18.0502 1548 Running under WOW64
10:22:18.0502 1548 Processor architecture: Intel x64
10:22:18.0502 1548 Number of processors: 2
10:22:18.0502 1548 Page size: 0x1000
10:22:18.0502 1548 Boot type: Normal boot
10:22:18.0502 1548 ============================================================
10:22:19.0256 1548 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xFC59, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000040
10:22:19.0266 1548 ============================================================
10:22:19.0266 1548 \Device\Harddisk0\DR0:
10:22:19.0266 1548 MBR partitions:
10:22:19.0266 1548 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x390F5AE1
10:22:19.0266 1548 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x390F5B20, BlocksNum 0x128B510
10:22:19.0266 1548 ============================================================
10:22:19.0286 1548 C: <-> \Device\Harddisk0\DR0\Partition0
10:22:19.0326 1548 D: <-> \Device\Harddisk0\DR0\Partition1
10:22:19.0336 1548 ============================================================
10:22:19.0336 1548 Initialize success
10:22:19.0336 1548 ============================================================
10:22:30.0599 5920 ============================================================
10:22:30.0599 5920 Scan started
10:22:30.0599 5920 Mode: Manual; TDLFS;
10:22:30.0599 5920 ============================================================
10:22:31.0285 5920 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
10:22:31.0285 5920 1394ohci - ok
10:22:31.0332 5920 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
10:22:31.0332 5920 ACPI - ok
10:22:31.0363 5920 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
10:22:31.0363 5920 AcpiPmi - ok
10:22:31.0472 5920 AdobeActiveFileMonitor6.0 (e8fe4fce23d2809bd88bcc1d0f8408ce) C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
10:22:31.0472 5920 AdobeActiveFileMonitor6.0 - ok
10:22:31.0566 5920 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
10:22:31.0566 5920 AdobeARMservice - ok
10:22:31.0722 5920 AdobeFlashPlayerUpdateSvc (459ac130c6ab892b1cd5d7544626efc5) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
10:22:31.0722 5920 AdobeFlashPlayerUpdateSvc - ok
10:22:31.0769 5920 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
10:22:31.0784 5920 adp94xx - ok
10:22:31.0800 5920 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
10:22:31.0816 5920 adpahci - ok
10:22:31.0847 5920 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
10:22:31.0847 5920 adpu320 - ok
10:22:31.0863 5920 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
10:22:31.0863 5920 AeLookupSvc - ok
10:22:31.0941 5920 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
10:22:31.0956 5920 AFD - ok
10:22:32.0003 5920 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
10:22:32.0019 5920 agp440 - ok
10:22:32.0034 5920 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
10:22:32.0034 5920 ALG - ok
10:22:32.0050 5920 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
10:22:32.0050 5920 aliide - ok
10:22:32.0065 5920 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
10:22:32.0065 5920 amdide - ok
10:22:32.0081 5920 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
10:22:32.0081 5920 AmdK8 - ok
10:22:32.0112 5920 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
10:22:32.0112 5920 AmdPPM - ok
10:22:32.0143 5920 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
10:22:32.0143 5920 amdsata - ok
10:22:32.0159 5920 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
10:22:32.0159 5920 amdsbs - ok
10:22:32.0190 5920 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
10:22:32.0190 5920 amdxata - ok
10:22:32.0221 5920 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
10:22:32.0221 5920 AppID - ok
10:22:32.0253 5920 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
10:22:32.0253 5920 AppIDSvc - ok
10:22:32.0268 5920 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
10:22:32.0268 5920 Appinfo - ok
10:22:32.0346 5920 Apple Mobile Device (d8e18021f91ad79ca8491cb5a5da22d4) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
10:22:32.0346 5920 Apple Mobile Device - ok
10:22:32.0377 5920 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
10:22:32.0377 5920 arc - ok
10:22:32.0424 5920 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
10:22:32.0424 5920 arcsas - ok
10:22:32.0455 5920 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
10:22:32.0455 5920 AsyncMac - ok
10:22:32.0455 5920 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
10:22:32.0455 5920 atapi - ok
10:22:32.0518 5920 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
10:22:32.0533 5920 AudioEndpointBuilder - ok
10:22:32.0549 5920 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
10:22:32.0549 5920 AudioSrv - ok
10:22:32.0627 5920 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
10:22:32.0643 5920 AxInstSV - ok
10:22:32.0830 5920 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
10:22:32.0830 5920 b06bdrv - ok
10:22:32.0861 5920 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
10:22:32.0861 5920 b57nd60a - ok
10:22:32.0892 5920 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
10:22:32.0892 5920 BDESVC - ok
10:22:32.0908 5920 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
10:22:32.0908 5920 Beep - ok
10:22:32.0986 5920 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
10:22:32.0986 5920 BFE - ok
10:22:33.0064 5920 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\system32\qmgr.dll
10:22:33.0064 5920 BITS - ok
10:22:33.0111 5920 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
10:22:33.0111 5920 blbdrive - ok
10:22:33.0220 5920 Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe
10:22:33.0220 5920 Bonjour Service - ok
10:22:33.0282 5920 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
10:22:33.0282 5920 bowser - ok
10:22:33.0298 5920 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
10:22:33.0298 5920 BrFiltLo - ok
10:22:33.0298 5920 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
10:22:33.0298 5920 BrFiltUp - ok
10:22:33.0329 5920 BridgeMP (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys
10:22:33.0329 5920 BridgeMP - ok
10:22:33.0376 5920 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
10:22:33.0376 5920 Browser - ok
10:22:33.0407 5920 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
10:22:33.0407 5920 Brserid - ok
10:22:33.0423 5920 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
10:22:33.0423 5920 BrSerWdm - ok
10:22:33.0423 5920 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
10:22:33.0423 5920 BrUsbMdm - ok
10:22:33.0438 5920 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
10:22:33.0438 5920 BrUsbSer - ok
10:22:33.0438 5920 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
10:22:33.0454 5920 BTHMODEM - ok
10:22:33.0469 5920 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
10:22:33.0485 5920 bthserv - ok
10:22:33.0485 5920 catchme - ok
10:22:33.0516 5920 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
10:22:33.0516 5920 cdfs - ok
10:22:33.0563 5920 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
10:22:33.0563 5920 cdrom - ok
10:22:33.0610 5920 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
10:22:33.0610 5920 CertPropSvc - ok
10:22:33.0610 5920 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
10:22:33.0610 5920 circlass - ok
10:22:33.0657 5920 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
10:22:33.0657 5920 CLFS - ok
10:22:33.0719 5920 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
10:22:33.0719 5920 clr_optimization_v2.0.50727_32 - ok
10:22:33.0766 5920 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
10:22:33.0766 5920 clr_optimization_v2.0.50727_64 - ok
10:22:33.0828 5920 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
10:22:33.0828 5920 clr_optimization_v4.0.30319_32 - ok
10:22:33.0859 5920 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
10:22:33.0859 5920 clr_optimization_v4.0.30319_64 - ok
10:22:33.0859 5920 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
10:22:33.0859 5920 CmBatt - ok
10:22:33.0891 5920 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
10:22:33.0891 5920 cmdide - ok
10:22:33.0953 5920 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
10:22:33.0953 5920 CNG - ok
10:22:33.0969 5920 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
10:22:33.0969 5920 Compbatt - ok
10:22:33.0984 5920 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
10:22:33.0984 5920 CompositeBus - ok
10:22:34.0000 5920 COMSysApp - ok
10:22:34.0000 5920 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
10:22:34.0000 5920 crcdisk - ok
10:22:34.0047 5920 CryptSvc (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
10:22:34.0047 5920 CryptSvc - ok
10:22:34.0109 5920 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
10:22:34.0125 5920 DcomLaunch - ok
10:22:34.0156 5920 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
10:22:34.0171 5920 defragsvc - ok
10:22:34.0203 5920 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
10:22:34.0203 5920 DfsC - ok
10:22:34.0234 5920 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
10:22:34.0234 5920 Dhcp - ok
10:22:34.0265 5920 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
10:22:34.0265 5920 discache - ok
10:22:34.0281 5920 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
10:22:34.0281 5920 Disk - ok
10:22:34.0343 5920 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
10:22:34.0343 5920 Dnscache - ok
10:22:34.0390 5920 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
10:22:34.0390 5920 dot3svc - ok
10:22:34.0437 5920 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
10:22:34.0437 5920 DPS - ok
10:22:34.0468 5920 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
10:22:34.0468 5920 drmkaud - ok
10:22:34.0546 5920 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
10:22:34.0561 5920 DXGKrnl - ok
10:22:34.0593 5920 EagleX64 - ok
10:22:34.0624 5920 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
10:22:34.0639 5920 EapHost - ok
10:22:34.0833 5920 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
10:22:34.0893 5920 ebdrv - ok
10:22:34.0993 5920 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
10:22:34.0993 5920 EFS - ok
10:22:35.0073 5920 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
10:22:35.0083 5920 ehRecvr - ok
10:22:35.0113 5920 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
10:22:35.0113 5920 ehSched - ok
10:22:35.0173 5920 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
10:22:35.0183 5920 elxstor - ok
10:22:35.0203 5920 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
10:22:35.0213 5920 ErrDev - ok
10:22:35.0273 5920 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
10:22:35.0273 5920 EventSystem - ok
10:22:35.0303 5920 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
10:22:35.0303 5920 exfat - ok
10:22:35.0343 5920 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
10:22:35.0353 5920 fastfat - ok
10:22:35.0413 5920 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
10:22:35.0433 5920 Fax - ok
10:22:35.0443 5920 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
10:22:35.0443 5920 fdc - ok
10:22:35.0463 5920 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
10:22:35.0463 5920 fdPHost - ok
10:22:35.0473 5920 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
10:22:35.0473 5920 FDResPub - ok
10:22:35.0493 5920 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
10:22:35.0503 5920 FileInfo - ok
10:22:35.0513 5920 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
10:22:35.0513 5920 Filetrace - ok
10:22:35.0613 5920 FLEXnet Licensing Service (227846995afeefa70d328bf5334a86a5) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
10:22:35.0623 5920 FLEXnet Licensing Service - ok
10:22:35.0643 5920 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
10:22:35.0643 5920 flpydisk - ok
10:22:35.0683 5920 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
10:22:35.0693 5920 FltMgr - ok
10:22:35.0773 5920 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
10:22:35.0793 5920 FontCache - ok
10:22:35.0883 5920 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
10:22:35.0883 5920 FontCache3.0.0.0 - ok
10:22:35.0933 5920 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
10:22:35.0933 5920 FsDepends - ok
10:22:35.0973 5920 fssfltr (6c06701bf1db05405804d7eb610991ce) C:\Windows\system32\DRIVERS\fssfltr.sys
10:22:35.0973 5920 fssfltr - ok
10:22:36.0093 5920 fsssvc (4ce9dac1518ff7e77bd213e6394b9d77) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
10:22:36.0113 5920 fsssvc - ok
10:22:36.0213 5920 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
10:22:36.0213 5920 Fs_Rec - ok
10:22:36.0263 5920 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
10:22:36.0263 5920 fvevol - ok
10:22:36.0293 5920 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
10:22:36.0293 5920 gagp30kx - ok
10:22:36.0333 5920 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
10:22:36.0333 5920 GEARAspiWDM - ok
10:22:36.0403 5920 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
10:22:36.0413 5920 gpsvc - ok
10:22:36.0493 5920 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
10:22:36.0493 5920 gupdate - ok
10:22:36.0503 5920 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
10:22:36.0503 5920 gupdatem - ok
10:22:36.0523 5920 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
10:22:36.0523 5920 hcw85cir - ok
10:22:36.0593 5920 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
10:22:36.0603 5920 HdAudAddService - ok
10:22:36.0623 5920 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
10:22:36.0623 5920 HDAudBus - ok
10:22:36.0643 5920 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
10:22:36.0643 5920 HidBatt - ok
10:22:36.0653 5920 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
10:22:36.0653 5920 HidBth - ok
10:22:36.0663 5920 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
10:22:36.0663 5920 HidIr - ok
10:22:36.0683 5920 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\System32\hidserv.dll
10:22:36.0693 5920 hidserv - ok
10:22:36.0693 5920 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
10:22:36.0703 5920 HidUsb - ok
10:22:36.0733 5920 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
10:22:36.0733 5920 hkmsvc - ok
10:22:36.0783 5920 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
10:22:36.0783 5920 HomeGroupListener - ok
10:22:36.0830 5920 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
10:22:36.0830 5920 HomeGroupProvider - ok
10:22:36.0845 5920 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
10:22:36.0845 5920 HpSAMD - ok
10:22:36.0923 5920 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
10:22:36.0939 5920 HTTP - ok
10:22:36.0986 5920 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
10:22:36.0986 5920 hwpolicy - ok
10:22:37.0001 5920 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
10:22:37.0001 5920 i8042prt - ok
10:22:37.0048 5920 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
10:22:37.0064 5920 iaStorV - ok
10:22:37.0189 5920 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
10:22:37.0204 5920 idsvc - ok
10:22:37.0703 5920 igfx (677aa5991026a65ada128c4b59cf2bad) C:\Windows\system32\DRIVERS\igdkmd64.sys
10:22:37.0937 5920 igfx - ok
10:22:38.0047 5920 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
10:22:38.0047 5920 iirsp - ok
10:22:38.0125 5920 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
10:22:38.0140 5920 IKEEXT - ok
10:22:38.0171 5920 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
10:22:38.0187 5920 intelide - ok
10:22:38.0187 5920 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
10:22:38.0187 5920 intelppm - ok
10:22:38.0218 5920 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
10:22:38.0234 5920 IPBusEnum - ok
10:22:38.0249 5920 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
10:22:38.0249 5920 IpFilterDriver - ok
10:22:38.0296 5920 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
10:22:38.0312 5920 iphlpsvc - ok
10:22:38.0327 5920 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
10:22:38.0327 5920 IPMIDRV - ok
10:22:38.0359 5920 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
10:22:38.0359 5920 IPNAT - ok
10:22:38.0452 5920 iPod Service (3c0d4b3e80fc4854ca325dd123cc4ded) C:\Program Files\iPod\bin\iPodService.exe
10:22:38.0468 5920 iPod Service - ok
10:22:38.0483 5920 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
10:22:38.0483 5920 IRENUM - ok
10:22:38.0499 5920 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
10:22:38.0499 5920 isapnp - ok
10:22:38.0515 5920 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
10:22:38.0530 5920 iScsiPrt - ok
10:22:38.0546 5920 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
10:22:38.0546 5920 kbdclass - ok
10:22:38.0593 5920 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
10:22:38.0593 5920 kbdhid - ok
10:22:38.0624 5920 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
10:22:38.0624 5920 KeyIso - ok
10:22:38.0655 5920 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
10:22:38.0671 5920 KSecDD - ok
10:22:38.0686 5920 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
10:22:38.0686 5920 KSecPkg - ok
10:22:38.0702 5920 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
10:22:38.0702 5920 ksthunk - ok
10:22:38.0749 5920 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
10:22:38.0764 5920 KtmRm - ok
10:22:38.0811 5920 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\System32\srvsvc.dll
10:22:38.0811 5920 LanmanServer - ok
10:22:38.0827 5920 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
10:22:38.0842 5920 LanmanWorkstation - ok
10:22:38.0998 5920 Lavasoft Ad-Aware Service (ed60ffd305ac0424920d146db9f9ed78) C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
10:22:39.0014 5920 Lavasoft Ad-Aware Service - ok
10:22:39.0107 5920 Lavasoft Kernexplorer (9a7fa6371f68335fd3c3d6488bc5a9f8) C:\Program Files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys
10:22:39.0107 5920 Lavasoft Kernexplorer - ok
10:22:39.0201 5920 Lbd (c8b3131857931ae76798a741cc52b021) C:\Windows\system32\DRIVERS\Lbd.sys
10:22:39.0217 5920 Lbd - ok
10:22:39.0248 5920 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
10:22:39.0248 5920 lltdio - ok
10:22:39.0279 5920 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
10:22:39.0295 5920 lltdsvc - ok
10:22:39.0310 5920 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
10:22:39.0310 5920 lmhosts - ok
10:22:39.0326 5920 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
10:22:39.0341 5920 LSI_FC - ok
10:22:39.0341 5920 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
10:22:39.0341 5920 LSI_SAS - ok
10:22:39.0373 5920 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
10:22:39.0373 5920 LSI_SAS2 - ok
10:22:39.0388 5920 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
10:22:39.0388 5920 LSI_SCSI - ok
10:22:39.0419 5920 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
10:22:39.0419 5920 luafv - ok
10:22:39.0482 5920 lxdnCATSCustConnectService (4208b958e35f0e596aa241efb664636b) C:\Windows\system32\spool\DRIVERS\x64\3\\lxdnserv.exe
10:22:39.0482 5920 lxdnCATSCustConnectService - ok
10:22:39.0482 5920 lxdn_device - ok
10:22:39.0544 5920 lxecCATSCustConnectService (1f02b554ddc4086d786537a3bf6488f1) C:\Windows\system32\spool\DRIVERS\x64\3\\lxecserv.exe
10:22:39.0544 5920 lxecCATSCustConnectService - ok
10:22:39.0544 5920 lxec_device - ok
10:22:39.0607 5920 McComponentHostService (f453d1e6d881e8f8717e20ccd4199e85) C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe
10:22:39.0622 5920 McComponentHostService - ok
10:22:39.0669 5920 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
10:22:39.0669 5920 Mcx2Svc - ok
10:22:39.0685 5920 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
10:22:39.0685 5920 megasas - ok
10:22:39.0716 5920 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
10:22:39.0716 5920 MegaSR - ok
10:22:39.0747 5920 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
10:22:39.0763 5920 MMCSS - ok
10:22:39.0778 5920 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
10:22:39.0778 5920 Modem - ok
10:22:39.0809 5920 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
10:22:39.0809 5920 monitor - ok
10:22:39.0825 5920 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
10:22:39.0825 5920 mouclass - ok
10:22:39.0841 5920 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
10:22:39.0841 5920 mouhid - ok
10:22:39.0887 5920 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
10:22:39.0887 5920 mountmgr - ok
10:22:39.0919 5920 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
10:22:39.0919 5920 mpio - ok
10:22:39.0950 5920 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
10:22:39.0950 5920 mpsdrv - ok
10:22:40.0012 5920 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
10:22:40.0028 5920 MpsSvc - ok
10:22:40.0059 5920 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
10:22:40.0059 5920 MRxDAV - ok
10:22:40.0106 5920 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
10:22:40.0106 5920 mrxsmb - ok
10:22:40.0153 5920 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
10:22:40.0153 5920 mrxsmb10 - ok
10:22:40.0168 5920 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
10:22:40.0168 5920 mrxsmb20 - ok
10:22:40.0184 5920 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
10:22:40.0184 5920 msahci - ok
10:22:40.0199 5920 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
10:22:40.0215 5920 msdsm - ok
10:22:40.0231 5920 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
10:22:40.0246 5920 MSDTC - ok
10:22:40.0293 5920 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
10:22:40.0293 5920 Msfs - ok
10:22:40.0293 5920 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
10:22:40.0293 5920 mshidkmdf - ok
10:22:40.0309 5920 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
10:22:40.0309 5920 msisadrv - ok
10:22:40.0340 5920 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
10:22:40.0340 5920 MSiSCSI - ok
10:22:40.0340 5920 msiserver - ok
10:22:40.0371 5920 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
10:22:40.0371 5920 MSKSSRV - ok
10:22:40.0387 5920 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
10:22:40.0387 5920 MSPCLOCK - ok
10:22:40.0402 5920 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
10:22:40.0402 5920 MSPQM - ok
10:22:40.0449 5920 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
10:22:40.0449 5920 MsRPC - ok
10:22:40.0465 5920 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
10:22:40.0465 5920 mssmbios - ok
10:22:40.0480 5920 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
10:22:40.0480 5920 MSTEE - ok
10:22:40.0496 5920 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
10:22:40.0496 5920 MTConfig - ok
10:22:40.0511 5920 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
10:22:40.0527 5920 Mup - ok
10:22:40.0574 5920 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
10:22:40.0589 5920 napagent - ok
10:22:40.0621 5920 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
10:22:40.0621 5920 NativeWifiP - ok
10:22:40.0683 5920 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
10:22:40.0683 5920 NDIS - ok
10:22:40.0699 5920 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
10:22:40.0699 5920 NdisCap - ok
10:22:40.0714 5920 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
10:22:40.0714 5920 NdisTapi - ok
10:22:40.0730 5920 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
10:22:40.0730 5920 Ndisuio - ok
10:22:40.0745 5920 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
10:22:40.0745 5920 NdisWan - ok
10:22:40.0777 5920 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
10:22:40.0777 5920 NDProxy - ok
10:22:40.0808 5920 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
10:22:40.0808 5920 NetBIOS - ok
10:22:40.0855 5920 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
10:22:40.0870 5920 NetBT - ok
10:22:40.0886 5920 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
10:22:40.0901 5920 Netlogon - ok
10:22:40.0933 5920 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
10:22:40.0948 5920 Netman - ok
10:22:40.0979 5920 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
10:22:40.0979 5920 netprofm - ok
10:22:41.0073 5920 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
10:22:41.0073 5920 NetTcpPortSharing - ok
10:22:41.0089 5920 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
10:22:41.0089 5920 nfrd960 - ok
10:22:41.0135 5920 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
10:22:41.0151 5920 NlaSvc - ok
10:22:41.0167 5920 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
10:22:41.0167 5920 Npfs - ok
10:22:41.0182 5920 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
10:22:41.0198 5920 nsi - ok
10:22:41.0198 5920 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
10:22:41.0198 5920 nsiproxy - ok
10:22:41.0323 5920 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
10:22:41.0354 5920 Ntfs - ok
10:22:41.0432 5920 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
10:22:41.0432 5920 Null - ok
10:22:41.0479 5920 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
10:22:41.0479 5920 nvraid - ok
10:22:41.0525 5920 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
10:22:41.0541 5920 nvstor - ok
10:22:41.0557 5920 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
10:22:41.0557 5920 nv_agp - ok
10:22:41.0572 5920 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
10:22:41.0572 5920 ohci1394 - ok
10:22:41.0635 5920 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
10:22:41.0635 5920 ose - ok
10:22:41.0681 5920 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
10:22:41.0681 5920 p2pimsvc - ok
10:22:41.0713 5920 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
10:22:41.0713 5920 p2psvc - ok
10:22:41.0728 5920 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
10:22:41.0728 5920 Parport - ok
10:22:41.0775 5920 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
10:22:41.0775 5920 partmgr - ok
10:22:41.0806 5920 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
10:22:41.0806 5920 PcaSvc - ok
10:22:41.0822 5920 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
10:22:41.0822 5920 pci - ok
10:22:41.0837 5920 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
10:22:41.0837 5920 pciide - ok
10:22:41.0853 5920 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
10:22:41.0853 5920 pcmcia - ok
10:22:41.0869 5920 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
10:22:41.0869 5920 pcw - ok
10:22:41.0915 5920 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
10:22:41.0915 5920 PEAUTH - ok
10:22:42.0009 5920 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
10:22:42.0009 5920 PerfHost - ok
10:22:42.0118 5920 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
10:22:42.0149 5920 pla - ok
10:22:42.0196 5920 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
10:22:42.0196 5920 PlugPlay - ok
10:22:42.0305 5920 PMBDeviceInfoProvider (63694c307273062a2167ae4ce80730ef) C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
10:22:42.0305 5920 PMBDeviceInfoProvider - ok
10:22:42.0321 5920 PnkBstrA - ok
10:22:42.0321 5920 PnkBstrB - ok
10:22:42.0352 5920 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
10:22:42.0352 5920 PNRPAutoReg - ok
10:22:42.0383 5920 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
10:22:42.0383 5920 PNRPsvc - ok
10:22:42.0446 5920 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
10:22:42.0461 5920 PolicyAgent - ok
10:22:42.0493 5920 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
10:22:42.0493 5920 Power - ok
10:22:42.0571 5920 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
10:22:42.0571 5920 PptpMiniport - ok
10:22:42.0602 5920 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
10:22:42.0602 5920 Processor - ok
10:22:42.0649 5920 ProfSvc (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
10:22:42.0649 5920 ProfSvc - ok
10:22:42.0680 5920 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
10:22:42.0680 5920 ProtectedStorage - ok
10:22:42.0727 5920 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
10:22:42.0727 5920 Psched - ok
10:22:42.0758 5920 PxHlpa64 (a6bf0a9b5a30d743623ca0d3be35df05) C:\Windows\system32\Drivers\PxHlpa64.sys
10:22:42.0758 5920 PxHlpa64 - ok
10:22:42.0851 5920 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
10:22:42.0867 5920 ql2300 - ok
10:22:42.0961 5920 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
10:22:42.0961 5920 ql40xx - ok
10:22:43.0007 5920 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
10:22:43.0007 5920 QWAVE - ok
10:22:43.0023 5920 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
10:22:43.0023 5920 QWAVEdrv - ok
10:22:43.0039 5920 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
10:22:43.0039 5920 RasAcd - ok
10:22:43.0070 5920 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
10:22:43.0070 5920 RasAgileVpn - ok
10:22:43.0085 5920 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
10:22:43.0085 5920 RasAuto - ok
10:22:43.0132 5920 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
10:22:43.0132 5920 Rasl2tp - ok
10:22:43.0148 5920 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
10:22:43.0163 5920 RasMan - ok
10:22:43.0179 5920 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
10:22:43.0179 5920 RasPppoe - ok
10:22:43.0179 5920 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
10:22:43.0179 5920 RasSstp - ok
10:22:43.0226 5920 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
10:22:43.0241 5920 rdbss - ok
10:22:43.0257 5920 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
10:22:43.0257 5920 rdpbus - ok
10:22:43.0273 5920 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
10:22:43.0273 5920 RDPCDD - ok
10:22:43.0288 5920 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
10:22:43.0288 5920 RDPENCDD - ok
10:22:43.0304 5920 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
10:22:43.0304 5920 RDPREFMP - ok
10:22:43.0351 5920 RDPWD (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
10:22:43.0351 5920 RDPWD - ok
10:22:43.0397 5920 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
10:22:43.0413 5920 rdyboost - ok
10:22:43.0444 5920 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
10:22:43.0444 5920 RemoteAccess - ok
10:22:43.0475 5920 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
10:22:43.0491 5920 RemoteRegistry - ok
10:22:43.0507 5920 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
10:22:43.0507 5920 RpcEptMapper - ok
10:22:43.0522 5920 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
10:22:43.0538 5920 RpcLocator - ok
10:22:43.0585 5920 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\System32\rpcss.dll
10:22:43.0600 5920 RpcSs - ok
10:22:43.0631 5920 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
10:22:43.0631 5920 rspndr - ok
10:22:43.0694 5920 RTL8167 (4b42bc58294e83a6a92ec8b88c14c4a3) C:\Windows\system32\DRIVERS\Rt64win7.sys
10:22:43.0709 5920 RTL8167 - ok
10:22:43.0741 5920 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
10:22:43.0741 5920 SamSs - ok
10:22:43.0772 5920 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
10:22:43.0787 5920 sbp2port - ok
10:22:43.0819 5920 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
10:22:43.0834 5920 SCardSvr - ok
10:22:43.0865 5920 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
10:22:43.0865 5920 scfilter - ok
10:22:43.0959 5920 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
10:22:43.0975 5920 Schedule - ok
10:22:44.0006 5920 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
10:22:44.0006 5920 SCPolicySvc - ok
10:22:44.0053 5920 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
10:22:44.0068 5920 SDRSVC - ok
10:22:44.0115 5920 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
10:22:44.0115 5920 secdrv - ok
10:22:44.0115 5920 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
10:22:44.0131 5920 seclogon - ok
10:22:44.0146 5920 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\system32\sens.dll
10:22:44.0146 5920 SENS - ok
10:22:44.0146 5920 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
10:22:44.0162 5920 SensrSvc - ok
10:22:44.0177 5920 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
10:22:44.0177 5920 Serenum - ok
10:22:44.0209 5920 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
10:22:44.0209 5920 Serial - ok
10:22:44.0255 5920 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
10:22:44.0255 5920 sermouse - ok
10:22:44.0318 5920 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
10:22:44.0318 5920 SessionEnv - ok
10:22:44.0349 5920 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
10:22:44.0349 5920 sffdisk - ok
10:22:44.0365 5920 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
10:22:44.0365 5920 sffp_mmc - ok
10:22:44.0396 5920 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
10:22:44.0396 5920 sffp_sd - ok
10:22:44.0396 5920 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
10:22:44.0411 5920 sfloppy - ok
10:22:44.0458 5920 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
10:22:44.0474 5920 SharedAccess - ok
10:22:44.0536 5920 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
10:22:44.0536 5920 ShellHWDetection - ok
10:22:44.0552 5920 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
10:22:44.0552 5920 SiSRaid2 - ok
10:22:44.0567 5920 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
10:22:44.0567 5920 SiSRaid4 - ok
10:22:44.0630 5920 SkypeUpdate (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files (x86)\Skype\Updater\Updater.exe
10:22:44.0630 5920 SkypeUpdate - ok
10:22:44.0661 5920 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
10:22:44.0661 5920 Smb - ok
10:22:44.0692 5920 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
10:22:44.0692 5920 SNMPTRAP - ok
10:22:44.0708 5920 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
10:22:44.0708 5920 spldr - ok
10:22:44.0770 5920 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
10:22:44.0786 5920 Spooler - ok
10:22:44.0989 5920 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
10:22:45.0020 5920 sppsvc - ok
10:22:45.0098 5920 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
10:22:45.0098 5920 sppuinotify - ok
10:22:45.0176 5920 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
10:22:45.0176 5920 srv - ok
10:22:45.0254 5920 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
10:22:45.0254 5920 srv2 - ok
10:22:45.0285 5920 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
10:22:45.0301 5920 srvnet - ok
10:22:45.0316 5920 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
10:22:45.0316 5920 SSDPSRV - ok
10:22:45.0347 5920 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
10:22:45.0347 5920 SstpSvc - ok
10:22:45.0379 5920 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
10:22:45.0379 5920 stexstor - ok
10:22:45.0441 5920 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
10:22:45.0457 5920 stisvc - ok
10:22:45.0488 5920 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
10:22:45.0488 5920 swenum - ok
10:22:45.0535 5920 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
10:22:45.0550 5920 swprv - ok
10:22:45.0659 5920 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
10:22:45.0691 5920 SysMain - ok
10:22:45.0800 5920 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
10:22:45.0800 5920 TabletInputService - ok
10:22:45.0847 5920 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
10:22:45.0847 5920 TapiSrv - ok
10:22:45.0878 5920 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
10:22:45.0878 5920 TBS - ok
10:22:46.0003 5920 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
10:22:46.0018 5920 Tcpip - ok
10:22:46.0143 5920 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
10:22:46.0159 5920 TCPIP6 - ok
10:22:46.0205 5920 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
10:22:46.0221 5920 tcpipreg - ok
10:22:46.0237 5920 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
10:22:46.0237 5920 TDPIPE - ok
10:22:46.0268 5920 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
10:22:46.0268 5920 TDTCP - ok
10:22:46.0315 5920 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
10:22:46.0315 5920 tdx - ok
10:22:46.0346 5920 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
10:22:46.0346 5920 TermDD - ok
10:22:46.0424 5920 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
10:22:46.0424 5920 TermService - ok
10:22:46.0439 5920 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
10:22:46.0455 5920 Themes - ok
10:22:46.0486 5920 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
10:22:46.0486 5920 THREADORDER - ok
10:22:46.0502 5920 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
10:22:46.0502 5920 TrkWks - ok
10:22:46.0549 5920 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
10:22:46.0549 5920 TrustedInstaller - ok
10:22:46.0580 5920 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
10:22:46.0580 5920 tssecsrv - ok
10:22:46.0642 5920 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
10:22:46.0642 5920 TsUsbFlt - ok
10:22:46.0673 5920 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
10:22:46.0673 5920 tunnel - ok
10:22:46.0689 5920 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
10:22:46.0689 5920 uagp35 - ok
10:22:46.0720 5920 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
10:22:46.0736 5920 udfs - ok
10:22:46.0751 5920 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
10:22:46.0751 5920 UI0Detect - ok
10:22:46.0798 5920 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
10:22:46.0798 5920 uliagpkx - ok
10:22:46.0829 5920 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
10:22:46.0829 5920 umbus - ok
10:22:46.0845 5920 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
10:22:46.0845 5920 UmPass - ok
10:22:46.0876 5920 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
10:22:46.0876 5920 upnphost - ok
10:22:46.0923 5920 USBAAPL64 (aa33fc47ed58c34e6e9261e4f850b7eb) C:\Windows\system32\Drivers\usbaapl64.sys
10:22:46.0923 5920 USBAAPL64 - ok
10:22:46.0970 5920 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
10:22:46.0970 5920 usbaudio - ok
10:22:47.0001 5920 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
10:22:47.0001 5920 usbccgp - ok
10:22:47.0032 5920 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
10:22:47.0032 5920 usbcir - ok
10:22:47.0063 5920 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
10:22:47.0063 5920 usbehci - ok
10:22:47.0095 5920 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
10:22:47.0095 5920 usbhub - ok
10:22:47.0110 5920 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
10:22:47.0110 5920 usbohci - ok
10:22:47.0126 5920 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
10:22:47.0141 5920 usbprint - ok
10:22:47.0173 5920 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
10:22:47.0173 5920 usbscan - ok
10:22:47.0188 5920 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
10:22:47.0188 5920 USBSTOR - ok
10:22:47.0204 5920 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys
10:22:47.0204 5920 usbuhci - ok
10:22:47.0235 5920 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
10:22:47.0235 5920 UxSms - ok
10:22:47.0266 5920 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
10:22:47.0266 5920 VaultSvc - ok
10:22:47.0266 5920 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
10:22:47.0282 5920 vdrvroot - ok
10:22:47.0329 5920 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
10:22:47.0344 5920 vds - ok
10:22:47.0360 5920 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
10:22:47.0360 5920 vga - ok
10:22:47.0375 5920 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
10:22:47.0375 5920 VgaSave - ok
10:22:47.0422 5920 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
10:22:47.0422 5920 vhdmp - ok
10:22:47.0453 5920 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
10:22:47.0453 5920 viaide - ok
10:22:47.0469 5920 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
10:22:47.0469 5920 volmgr - ok
10:22:47.0516 5920 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
10:22:47.0516 5920 volmgrx - ok
10:22:47.0547 5920 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
10:22:47.0547 5920 volsnap - ok
10:22:47.0578 5920 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
10:22:47.0578 5920 vsmraid - ok
10:22:47.0656 5920 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
10:22:47.0672 5920 VSS - ok
10:22:47.0781 5920 VST64HWBS2 (93132c69394a99d992095d8cfe464801) C:\Windows\system32\DRIVERS\VSTBS26.SYS
10:22:47.0781 5920 VST64HWBS2 - ok
10:22:47.0875 5920 VST64_DPV (02071d207a9858fbe3a48cbfd59c4a04) C:\Windows\system32\DRIVERS\VSTDPV6.SYS
10:22:47.0890 5920 VST64_DPV - ok
10:22:47.0968 5920 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
10:22:47.0968 5920 vwifibus - ok
10:22:48.0015 5920 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
10:22:48.0031 5920 W32Time - ok
10:22:48.0046 5920 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
10:22:48.0046 5920 WacomPen - ok
10:22:48.0093 5920 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
10:22:48.0093 5920 WANARP - ok
10:22:48.0109 5920 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
10:22:48.0109 5920 Wanarpv6 - ok
10:22:48.0202 5920 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
10:22:48.0218 5920 WatAdminSvc - ok
10:22:48.0327 5920 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
10:22:48.0343 5920 wbengine - ok
10:22:48.0436 5920 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
10:22:48.0436 5920 WbioSrvc - ok
10:22:48.0499 5920 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
10:22:48.0514 5920 wcncsvc - ok
10:22:48.0545 5920 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
10:22:48.0561 5920 WcsPlugInService - ok
10:22:48.0592 5920 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
10:22:48.0592 5920 Wd - ok
10:22:48.0639 5920 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
10:22:48.0655 5920 Wdf01000 - ok
10:22:48.0670 5920 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
10:22:48.0670 5920 WdiServiceHost - ok
10:22:48.0670 5920 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
10:22:48.0670 5920 WdiSystemHost - ok
10:22:48.0717 5920 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
10:22:48.0733 5920 WebClient - ok
10:22:48.0748 5920 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
10:22:48.0748 5920 Wecsvc - ok
10:22:48.0764 5920 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
10:22:48.0764 5920 wercplsupport - ok
10:22:48.0779 5920 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
10:22:48.0779 5920 WerSvc - ok
10:22:48.0795 5920 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
10:22:48.0795 5920 WfpLwf - ok
10:22:48.0826 5920 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
10:22:48.0826 5920 WIMMount - ok
10:22:48.0873 5920 winachsf (18e40c245dbfaf36fd0134a7ef2df396) C:\Windows\system32\DRIVERS\VSTCNXT6.SYS
10:22:48.0889 5920 winachsf - ok
10:22:48.0951 5920 WinDefend - ok
10:22:48.0951 5920 WinHttpAutoProxySvc - ok
10:22:49.0029 5920 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
10:22:49.0029 5920 Winmgmt - ok
10:22:49.0169 5920 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
10:22:49.0185 5920 WinRM - ok
10:22:49.0294 5920 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
10:22:49.0294 5920 WinUsb - ok
10:22:49.0357 5920 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
10:22:49.0388 5920 Wlansvc - ok
10:22:49.0544 5920 wlidsvc (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
10:22:49.0559 5920 wlidsvc - ok
10:22:49.0622 5920 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
10:22:49.0622 5920 WmiAcpi - ok
10:22:49.0700 5920 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
10:22:49.0700 5920 wmiApSrv - ok
10:22:49.0731 5920 WMPNetworkSvc - ok
10:22:49.0747 5920 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
10:22:49.0747 5920 WPCSvc - ok
10:22:49.0778 5920 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
10:22:49.0793 5920 WPDBusEnum - ok
10:22:49.0825 5920 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
10:22:49.0825 5920 ws2ifsl - ok
10:22:49.0856 5920 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\system32\wscsvc.dll
10:22:49.0856 5920 wscsvc - ok
10:22:49.0871 5920 WSearch - ok
10:22:50.0012 5920 wuauserv (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
10:22:50.0043 5920 wuauserv - ok
10:22:50.0137 5920 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
10:22:50.0137 5920 WudfPf - ok
10:22:50.0168 5920 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
10:22:50.0168 5920 WUDFRd - ok
10:22:50.0183 5920 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
10:22:50.0183 5920 wudfsvc - ok
10:22:50.0199 5920 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
10:22:50.0215 5920 WwanSvc - ok
10:22:50.0308 5920 YahooAUService (dd0042f0c3b606a6a8b92d49afb18ad6) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
10:22:50.0308 5920 YahooAUService - ok
10:22:50.0339 5920 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
10:22:50.0417 5920 \Device\Harddisk0\DR0 - ok
10:22:50.0417 5920 Boot (0x1200) (cb0a259b07a2fcf610a555c1e7c53a60) \Device\Harddisk0\DR0\Partition0
10:22:50.0417 5920 \Device\Harddisk0\DR0\Partition0 - ok
10:22:50.0433 5920 Boot (0x1200) (c08d589fa6a1cc70751c5296e9212c85) \Device\Harddisk0\DR0\Partition1
10:22:50.0433 5920 \Device\Harddisk0\DR0\Partition1 - ok
10:22:50.0433 5920 ============================================================
10:22:50.0433 5920 Scan finished
10:22:50.0433 5920 ============================================================
10:22:50.0449 5416 Detected object count: 0
10:22:50.0449 5416 Actual detected object count: 0
10:26:00.0441 0656 Deinitialize success


Here is the link for the VirusTotal scan https://www.virustotal.com/file/cde8f4145af…sis/1336059913/
Post #10
Hello chester

Should I scan again with the stick and take care of that item?

Yes please.


  • Please work through the following steps


    • Hold down the Windows key (has the Windows symbol on it) and press the "R" key. A Run box will open. Type in Notepad and press Enter then click on "OK").
    • NOTE: Do not Use Wordpad or any other text editor except Notepad or the script will fail.
    • Copy and Paste the text in the quotebox below into the open Notepad window:

      File::
      c:\users\dad\AppData\Roaming\15DB4B7F.reg

      RegLock::
      [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

    • Save this as "CFScript.txt" (including the quotation marks), change the "Save as type" to "All Files" and save it to your desktop.
    • Close any open browsers.
    • Disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Refering to the picture below, drag CFScript.txt into ComboFix.exe

      [external image: Posted Image]
    • When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
    • Once the log is produced, re-engage your resident anti virus.

  • MalwareBytes AntiMalware:


    • I can see that you have MBAM installed.
    • Double click on your MalwareBytes AntiMalware icon to launch the program.
    • Click on the "Update" tab and then on "Check for Updates".
    • The program will now install the latest Malware definition files.
    • Once complete, click on the "Scanner" tab, select "Perform Quick Scan"and then click on "Scan".
    • Once the program has scanned your computer, a log file will be created in Notepad.
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.


    • If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
    • The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
    • Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
    • Come back here to this thread and Paste the log in your next reply.

    Please post the TDSSK log, the Combofix log and the MBAM log for me to review in your next reply and let me know how the machine is running now.
Post #11 last edited
Jon, The computer seems to be running better. I was curious and tried aswMBR and it will now run. Here is the log for combofix ComboFix 12-05-02.04 - dad 05/04/2012 20:21:27.2.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4029.2612 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\dad\Desktop\CFScript.txt AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116} SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . FILE :: "c:\users\dad\AppData\Roaming\15DB4B7F.reg" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\dad\AppData\Roaming\15DB4B7F.reg . . ((((((((((((((((((((((((( Files Created from 2012-04-05 to 2012-05-05 ))))))))))))))))))))))))))))))) . . 2012-05-05 01:30 . 2012-05-05 01:30 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp 2012-05-05 01:30 . 2012-05-05 01:30 ——– d—–w- c:\users\Default\AppData\Local\temp 2012-05-04 17:12 . 2012-04-13 08:46 8917360 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2DF61F0C-9E8B-474C-ADD6-F819C673DF59}\mpengine.dll 2012-05-03 02:55 . 2012-05-03 02:55 ——– d—–w- C:\TDSSKiller_Quarantine 2012-04-20 18:58 . 2012-04-20 18:58 ——– d—–w- c:\programdata\Common Files 2012-04-20 18:58 . 2012-04-20 18:59 ——– d—–w- c:\users\dad\AppData\Roaming\FixCleaner 2012-04-20 18:58 . 2012-04-22 18:18 ——– d—–w- c:\program files (x86)\FixCleaner 2012-04-20 18:14 . 2012-04-20 18:14 ——– d—–w- c:\users\dad\AppData\Local\adawarebp 2012-04-20 18:14 . 2012-05-01 01:38 ——– d—–w- c:\programdata\Ad-Aware Browsing Protection 2012-04-20 18:14 . 2012-04-20 18:14 ——– d—–w- c:\program files (x86)\Toolbar Cleaner 2012-04-20 18:14 . 2012-04-20 18:14 ——– d—–w- c:\program files (x86)\adawaretb 2012-04-20 18:12 . 2012-04-20 18:15 ——– d—–w- c:\users\dad\AppData\Roaming\Ad-Aware Antivirus 2012-04-20 03:19 . 2012-04-20 17:33 ——– d—–w- c:\programdata\F4D55F3E00002D6300011D33B4EB2367 2012-04-20 03:19 . 2012-04-20 03:19 ——– d—–w- c:\users\dad\AppData\Local\{ABEA01A2-8A97-11E1-826D-B8AC6F996F26} 2012-04-20 03:19 . 2012-04-22 17:50 ——– d—–w- c:\users\dad\AppData\Local\MPEG 2012-04-11 08:03 . 2012-03-06 06:53 5559152 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-04-11 08:03 . 2012-03-06 05:59 3968368 —-a-w- c:\windows\SysWow64\ntkrnlpa.exe 2012-04-11 08:03 . 2012-03-06 05:59 3913072 —-a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-04-11 08:00 . 2012-03-01 06:46 23408 —-a-w- c:\windows\system32\drivers\fs_rec.sys 2012-04-11 08:00 . 2012-03-01 06:38 220672 —-a-w- c:\windows\system32\wintrust.dll 2012-04-11 08:00 . 2012-03-01 06:33 81408 —-a-w- c:\windows\system32\imagehlp.dll 2012-04-11 08:00 . 2012-03-01 06:28 5120 —-a-w- c:\windows\system32\wmi.dll 2012-04-11 08:00 . 2012-03-01 05:37 172544 —-a-w- c:\windows\SysWow64\wintrust.dll 2012-04-11 08:00 . 2012-03-01 05:33 159232 —-a-w- c:\windows\SysWow64\imagehlp.dll 2012-04-11 08:00 . 2012-03-01 05:29 5120 —-a-w- c:\windows\SysWow64\wmi.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-05-03 19:09 . 2011-02-09 22:59 737072 —-a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll 2012-05-03 19:09 . 2011-02-10 06:57 4283672 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll 2012-05-03 19:08 . 2011-02-09 21:48 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll 2012-05-03 19:08 . 2011-04-07 18:41 539984 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll 2012-04-14 12:36 . 2012-03-29 16:20 418464 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-04-14 12:36 . 2011-08-20 14:07 70304 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-04-14 12:36 . 2012-03-29 16:36 8741536 —-a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2012-02-23 15:18 . 2011-01-10 20:25 279656 ——w- c:\windows\system32\MpSigStub.exe 2012-02-17 06:38 . 2012-03-14 01:03 1031680 —-a-w- c:\windows\system32\rdpcore.dll 2012-02-17 05:34 . 2012-03-14 01:03 826880 —-a-w- c:\windows\SysWow64\rdpcore.dll 2012-02-17 04:58 . 2012-03-14 01:03 210944 —-a-w- c:\windows\system32\drivers\rdpwd.sys 2012-02-17 04:57 . 2012-03-14 01:03 23552 —-a-w- c:\windows\system32\drivers\tdtcp.sys 2012-02-10 06:36 . 2012-03-14 01:04 1544192 —-a-w- c:\windows\system32\DWrite.dll 2012-02-10 05:38 . 2012-03-14 01:04 1077248 —-a-w- c:\windows\SysWow64\DWrite.dll . . ((((((((((((((((((((((((((((( SnapShot@2012-05-03_03.12.43 ))))))))))))))))))))))))))))))))))))))))) . + 2011-01-10 23:48 . 2012-05-03 03:15 40042 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin + 2009-07-14 05:10 . 2012-05-03 03:15 35320 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin + 2011-01-10 20:39 . 2012-05-03 03:15 10812 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1843835133-3810166187-1692799473-1001_UserData.bin - 2012-05-03 03:12 . 2012-05-03 03:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat + 2012-05-05 01:31 . 2012-05-05 01:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat - 2012-05-03 03:12 . 2012-05-03 03:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2012-05-05 01:31 . 2012-05-05 01:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat + 2009-07-14 02:36 . 2012-05-05 01:28 627104 c:\windows\system32\perfh009.dat + 2009-07-14 02:36 . 2012-05-05 01:28 107420 c:\windows\system32\perfc009.dat - 2009-07-14 05:01 . 2012-05-03 03:11 341580 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2009-07-14 05:01 . 2012-05-05 01:30 341580 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat + 2011-05-27 19:44 . 2012-05-05 01:30 9421405 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-1843835133-3810166187-1692799473-1001-12288.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll" [2012-01-12 1517368] . [HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1] [HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}] [HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin] . [HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{6c97a91e-4524-4019-86af-2aa2d567bf5c}] 2012-03-06 19:16 87440 —-a-w- c:\program files (x86)\adawaretb\adawareDx.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{6c97a91e-4524-4019-86af-2aa2d567bf5c}"= "c:\program files (x86)\adawaretb\adawareDx.dll" [2012-03-06 87440] . [HKEY_CLASSES_ROOT\clsid\{6c97a91e-4524-4019-86af-2aa2d567bf5c}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-02-29 17148552] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "FaxCenterServer"="c:\program files (x86)\Lexmark Fax Solutions\fm3032.exe" [2007-12-17 320168] "Adobe Photo Downloader"="c:\program files (x86)\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-11 67488] "AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656] "TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2011-06-16 273544] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-07-05 421888] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-10-09 421736] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712] "PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2010-11-27 648032] "Ad-Aware Browsing Protection"="c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe" [2012-03-28 200600] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 0 (0x0) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-15 136176] R2 lxecCATSCustConnectService;lxecCATSCustConnectService;c:\windows\system32\spool\DRIVERS\x64\3\\lxecserv.exe [2010-04-14 45736] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-14 253088] R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x] R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-15 136176] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-09-02 2152152] S2 lxdn_device;lxdn_device;c:\windows\system32\lxdncoms.exe [2007-12-05 1044648] S2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;c:\windows\system32\spool\DRIVERS\x64\3\\lxdnserv.exe [2009-04-28 29184] S2 lxec_device;lxec_device;c:\windows\system32\lxeccoms.exe [2010-04-14 1052328] S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-27 398176] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x] S3 VST64_DPV;VST64_DPV;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x] S3 VST64HWBS2;VST64HWBS2;c:\windows\system32\DRIVERS\VSTBS26.SYS [x] . . Contents of the 'Scheduled Tasks' folder . 2012-05-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files (x86)\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-04-01 07:40] . 2012-05-05 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 12:36] . 2012-05-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-15 20:01] . 2012-05-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-15 20:01] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "lxdnmon.exe"="c:\program files (x86)\Lexmark 2600 Series\lxdnmon.exe" [2007-12-17 660136] "lxdnamon"="c:\program files (x86)\Lexmark 2600 Series\lxdnamon.exe" [2007-12-17 16040] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256] "lxecmon.exe"="c:\program files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe" [2010-05-17 770728] "EzPrint"="c:\program files (x86)\Lexmark Pro800-Pro900 Series\ezprint.exe" [2010-05-17 148280] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://isearch.avg.com/?cid={279430EE-6662-4F63-A56E-8A7D6EAAE71E}&mid=08d64d00bd2947d0adba41b2e00d4f9f-1d6c8b6a4fd14e7d84d88f40e35531e8c08da0a6&lang=en&ds=ts025&pr=sa&d=&v=&sap=hp mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\users\dad\AppData\Roaming\Mozilla\Firefox\Profiles\ol2d19d4.default\ FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.startup.homepage - hxxp://isearch.avg.com/?cid={279430EE-6662-4F63-A56E-8A7D6EAAE71E}&mid=08d64d00bd2947d0adba41b2e00d4f9f-1d6c8b6a4fd14e7d84d88f40e35531e8c08da0a6&lang=en&ds=ts025&pr=sa&d=&v=&sap=hp FF - prefs.js: network.proxy.type - 0 . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_233_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_233.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security] @Denied: (Full) (Everyone) . ———————— Other Running Processes ———————— . c:\program files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\windows\SysWOW64\PnkBstrA.exe c:\windows\SysWOW64\PnkBstrB.exe c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\program files (x86)\Lexmark 2600 Series\lxdnMsdMon.exe . ************************************************************************** . Completion time: 2012-05-04 20:50:08 - machine was rebooted ComboFix-quarantined-files.txt 2012-05-05 01:50 ComboFix2.txt 2012-05-03 03:18 . Pre-Run: 362,344,382,464 bytes free Post-Run: 362,501,033,984 bytes free . - - End Of File - - E0ABF572265E07F928BEC3FE1056D6AA Malwarebytes log Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Database version: v2012.05.05.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 dad :: DAD-PC [administrator] 5/4/2012 9:02:34 PM mbam-log-2012-05-04 (21-02-34).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 204134 Time elapsed: 2 minute(s), 9 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) TDss log 21:08:19.0816 3052 TDSS rootkit removing tool 2.7.34.0 May 2 2012 09:59:18 21:08:20.0328 3052 ============================================================ 21:08:20.0328 3052 Current date / time: 2012/05/04 21:08:20.0328 21:08:20.0328 3052 SystemInfo: 21:08:20.0328 3052 21:08:20.0328 3052 OS Version: 6.1.7601 ServicePack: 1.0 21:08:20.0328 3052 Product type: Workstation 21:08:20.0328 3052 ComputerName: DAD-PC 21:08:20.0328 3052 UserName: dad 21:08:20.0328 3052 Windows directory: C:\Windows 21:08:20.0328 3052 System windows directory: C:\Windows 21:08:20.0328 3052 Running under WOW64 21:08:20.0328 3052 Processor architecture: Intel x64 21:08:20.0328 3052 Number of processors: 2 21:08:20.0328 3052 Page size: 0x1000 21:08:20.0328 3052 Boot type: Normal boot 21:08:20.0328 3052 ============================================================ 21:08:20.0988 3052 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xFC59, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000040 21:08:21.0008 3052 Drive \Device\Harddisk5\DR6 - Size: 0xEF000000 (3.73 Gb), SectorSize: 0x200, Cylinders: 0x1E7, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W' 21:08:21.0008 3052 ============================================================ 21:08:21.0008 3052 \Device\Harddisk0\DR0: 21:08:21.0008 3052 MBR partitions: 21:08:21.0008 3052 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x390F5AE1 21:08:21.0008 3052 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x390F5B20, BlocksNum 0x128B510 21:08:21.0008 3052 \Device\Harddisk5\DR6: 21:08:21.0008 3052 MBR partitions: 21:08:21.0008 3052 \Device\Harddisk5\DR6\Partition0: MBR, Type 0xC, StartLBA 0x30, BlocksNum 0x777FD0 21:08:21.0008 3052 ============================================================ 21:08:21.0038 3052 C: <-> \Device\Harddisk0\DR0\Partition0 21:08:21.0078 3052 D: <-> \Device\Harddisk0\DR0\Partition1 21:08:21.0078 3052 ============================================================ 21:08:21.0078 3052 Initialize success 21:08:21.0078 3052 ============================================================ 21:08:28.0956 3120 ============================================================ 21:08:28.0956 3120 Scan started 21:08:28.0956 3120 Mode: Manual; TDLFS; 21:08:28.0956 3120 ============================================================ 21:08:29.0315 3120 1394ohci (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys 21:08:29.0315 3120 1394ohci - ok 21:08:29.0361 3120 ACPI (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys 21:08:29.0361 3120 ACPI - ok 21:08:29.0377 3120 AcpiPmi (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys 21:08:29.0377 3120 AcpiPmi - ok 21:08:29.0455 3120 AdobeActiveFileMonitor6.0 (e8fe4fce23d2809bd88bcc1d0f8408ce) C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe 21:08:29.0455 3120 AdobeActiveFileMonitor6.0 - ok 21:08:29.0533 3120 AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 21:08:29.0533 3120 AdobeARMservice - ok 21:08:29.0658 3120 AdobeFlashPlayerUpdateSvc (459ac130c6ab892b1cd5d7544626efc5) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 21:08:29.0658 3120 AdobeFlashPlayerUpdateSvc - ok 21:08:29.0705 3120 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys 21:08:29.0720 3120 adp94xx - ok 21:08:29.0736 3120 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys 21:08:29.0736 3120 adpahci - ok 21:08:29.0767 3120 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys 21:08:29.0767 3120 adpu320 - ok 21:08:29.0798 3120 AeLookupSvc (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll 21:08:29.0798 3120 AeLookupSvc - ok 21:08:29.0861 3120 AFD (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys 21:08:29.0876 3120 AFD - ok 21:08:29.0907 3120 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys 21:08:29.0923 3120 agp440 - ok 21:08:29.0939 3120 ALG (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe 21:08:29.0939 3120 ALG - ok 21:08:29.0954 3120 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys 21:08:29.0954 3120 aliide - ok 21:08:29.0954 3120 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys 21:08:29.0970 3120 amdide - ok 21:08:29.0970 3120 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys 21:08:29.0970 3120 AmdK8 - ok 21:08:29.0985 3120 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys 21:08:29.0985 3120 AmdPPM - ok 21:08:30.0001 3120 amdsata (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys 21:08:30.0001 3120 amdsata - ok 21:08:30.0017 3120 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys 21:08:30.0017 3120 amdsbs - ok 21:08:30.0032 3120 amdxata (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys 21:08:30.0032 3120 amdxata - ok 21:08:30.0079 3120 AppID (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys 21:08:30.0079 3120 AppID - ok 21:08:30.0095 3120 AppIDSvc (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll 21:08:30.0095 3120 AppIDSvc - ok 21:08:30.0110 3120 Appinfo (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll 21:08:30.0110 3120 Appinfo - ok 21:08:30.0188 3120 Apple Mobile Device (d8e18021f91ad79ca8491cb5a5da22d4) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 21:08:30.0188 3120 Apple Mobile Device - ok 21:08:30.0219 3120 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys 21:08:30.0219 3120 arc - ok 21:08:30.0235 3120 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys 21:08:30.0235 3120 arcsas - ok 21:08:30.0251 3120 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys 21:08:30.0251 3120 AsyncMac - ok 21:08:30.0266 3120 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys 21:08:30.0266 3120 atapi - ok 21:08:30.0329 3120 AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll 21:08:30.0329 3120 AudioEndpointBuilder - ok 21:08:30.0344 3120 AudioSrv (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll 21:08:30.0344 3120 AudioSrv - ok 21:08:30.0384 3120 AxInstSV (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll 21:08:30.0384 3120 AxInstSV - ok 21:08:30.0414 3120 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys 21:08:30.0424 3120 b06bdrv - ok 21:08:30.0444 3120 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys 21:08:30.0444 3120 b57nd60a - ok 21:08:30.0474 3120 BDESVC (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll 21:08:30.0474 3120 BDESVC - ok 21:08:30.0494 3120 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys 21:08:30.0504 3120 Beep - ok 21:08:30.0544 3120 BFE (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll 21:08:30.0554 3120 BFE - ok 21:08:30.0624 3120 BITS (1ea7969e3271cbc59e1730697dc74682) C:\Windows\system32\qmgr.dll 21:08:30.0634 3120 BITS - ok 21:08:30.0674 3120 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys 21:08:30.0674 3120 blbdrive - ok 21:08:30.0764 3120 Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe 21:08:30.0764 3120 Bonjour Service - ok 21:08:30.0794 3120 bowser (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys 21:08:30.0794 3120 bowser - ok 21:08:30.0814 3120 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys 21:08:30.0814 3120 BrFiltLo - ok 21:08:30.0824 3120 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys 21:08:30.0824 3120 BrFiltUp - ok 21:08:30.0834 3120 BridgeMP (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys 21:08:30.0834 3120 BridgeMP - ok 21:08:30.0874 3120 Browser (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll 21:08:30.0874 3120 Browser - ok 21:08:30.0904 3120 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys 21:08:30.0904 3120 Brserid - ok 21:08:30.0924 3120 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys 21:08:30.0924 3120 BrSerWdm - ok 21:08:30.0934 3120 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys 21:08:30.0934 3120 BrUsbMdm - ok 21:08:30.0934 3120 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys 21:08:30.0944 3120 BrUsbSer - ok 21:08:30.0944 3120 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys 21:08:30.0954 3120 BTHMODEM - ok 21:08:30.0974 3120 bthserv (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll 21:08:30.0984 3120 bthserv - ok 21:08:30.0994 3120 catchme - ok 21:08:31.0044 3120 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys 21:08:31.0044 3120 cdfs - ok 21:08:31.0084 3120 cdrom (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys 21:08:31.0084 3120 cdrom - ok 21:08:31.0124 3120 CertPropSvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll 21:08:31.0124 3120 CertPropSvc - ok 21:08:31.0134 3120 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys 21:08:31.0134 3120 circlass - ok 21:08:31.0154 3120 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys 21:08:31.0164 3120 CLFS - ok 21:08:31.0224 3120 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 21:08:31.0224 3120 clr_optimization_v2.0.50727_32 - ok 21:08:31.0284 3120 clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 21:08:31.0284 3120 clr_optimization_v2.0.50727_64 - ok 21:08:31.0334 3120 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 21:08:31.0334 3120 clr_optimization_v4.0.30319_32 - ok 21:08:31.0364 3120 clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 21:08:31.0364 3120 clr_optimization_v4.0.30319_64 - ok 21:08:31.0374 3120 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys 21:08:31.0374 3120 CmBatt - ok 21:08:31.0404 3120 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys 21:08:31.0404 3120 cmdide - ok 21:08:31.0464 3120 CNG (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys 21:08:31.0464 3120 CNG - ok 21:08:31.0484 3120 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys 21:08:31.0484 3120 Compbatt - ok 21:08:31.0504 3120 CompositeBus (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys 21:08:31.0504 3120 CompositeBus - ok 21:08:31.0504 3120 COMSysApp - ok 21:08:31.0514 3120 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys 21:08:31.0514 3120 crcdisk - ok 21:08:31.0554 3120 CryptSvc (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll 21:08:31.0554 3120 CryptSvc - ok 21:08:31.0614 3120 DcomLaunch (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll 21:08:31.0614 3120 DcomLaunch - ok 21:08:31.0654 3120 defragsvc (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll 21:08:31.0654 3120 defragsvc - ok 21:08:31.0704 3120 DfsC (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys 21:08:31.0704 3120 DfsC - ok 21:08:31.0734 3120 Dhcp (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll 21:08:31.0744 3120 Dhcp - ok 21:08:31.0774 3120 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys 21:08:31.0774 3120 discache - ok 21:08:31.0784 3120 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys 21:08:31.0794 3120 Disk - ok 21:08:31.0824 3120 Dnscache (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll 21:08:31.0824 3120 Dnscache - ok 21:08:31.0854 3120 dot3svc (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll 21:08:31.0864 3120 dot3svc - ok 21:08:31.0894 3120 DPS (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll 21:08:31.0904 3120 DPS - ok 21:08:31.0984 3120 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys 21:08:31.0994 3120 drmkaud - ok 21:08:32.0114 3120 DXGKrnl (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys 21:08:32.0134 3120 DXGKrnl - ok 21:08:32.0164 3120 EagleX64 - ok 21:08:32.0224 3120 EapHost (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll 21:08:32.0224 3120 EapHost - ok 21:08:32.0407 3120 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys 21:08:32.0469 3120 ebdrv - ok 21:08:32.0563 3120 EFS (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe 21:08:32.0563 3120 EFS - ok 21:08:32.0641 3120 ehRecvr (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe 21:08:32.0656 3120 ehRecvr - ok 21:08:32.0687 3120 ehSched (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe 21:08:32.0687 3120 ehSched - ok 21:08:32.0734 3120 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys 21:08:32.0750 3120 elxstor - ok 21:08:32.0781 3120 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys 21:08:32.0781 3120 ErrDev - ok 21:08:32.0843 3120 EventSystem (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll 21:08:32.0843 3120 EventSystem - ok 21:08:32.0875 3120 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys 21:08:32.0875 3120 exfat - ok 21:08:32.0906 3120 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys 21:08:32.0921 3120 fastfat - ok 21:08:32.0984 3120 Fax (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe 21:08:32.0999 3120 Fax - ok 21:08:32.0999 3120 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys 21:08:32.0999 3120 fdc - ok 21:08:33.0031 3120 fdPHost (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll 21:08:33.0031 3120 fdPHost - ok 21:08:33.0046 3120 FDResPub (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll 21:08:33.0046 3120 FDResPub - ok 21:08:33.0062 3120 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys 21:08:33.0062 3120 FileInfo - ok 21:08:33.0077 3120 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys 21:08:33.0077 3120 Filetrace - ok 21:08:33.0171 3120 FLEXnet Licensing Service (227846995afeefa70d328bf5334a86a5) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe 21:08:33.0171 3120 FLEXnet Licensing Service - ok 21:08:33.0202 3120 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys 21:08:33.0202 3120 flpydisk - ok 21:08:33.0249 3120 FltMgr (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys 21:08:33.0249 3120 FltMgr - ok 21:08:33.0343 3120 FontCache (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll 21:08:33.0358 3120 FontCache - ok 21:08:33.0452 3120 FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 21:08:33.0452 3120 FontCache3.0.0.0 - ok 21:08:33.0514 3120 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys 21:08:33.0514 3120 FsDepends - ok 21:08:33.0545 3120 fssfltr (6c06701bf1db05405804d7eb610991ce) C:\Windows\system32\DRIVERS\fssfltr.sys 21:08:33.0545 3120 fssfltr - ok 21:08:33.0670 3120 fsssvc (4ce9dac1518ff7e77bd213e6394b9d77) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe 21:08:33.0686 3120 fsssvc - ok 21:08:33.0779 3120 Fs_Rec (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys 21:08:33.0779 3120 Fs_Rec - ok 21:08:33.0826 3120 fvevol (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys 21:08:33.0826 3120 fvevol - ok 21:08:33.0842 3120 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys 21:08:33.0857 3120 gagp30kx - ok 21:08:33.0889 3120 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 21:08:33.0889 3120 GEARAspiWDM - ok 21:08:33.0951 3120 gpsvc (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll 21:08:33.0967 3120 gpsvc - ok 21:08:34.0045 3120 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 21:08:34.0045 3120 gupdate - ok 21:08:34.0045 3120 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe 21:08:34.0045 3120 gupdatem - ok 21:08:34.0076 3120 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys 21:08:34.0076 3120 hcw85cir - ok 21:08:34.0138 3120 HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys 21:08:34.0154 3120 HdAudAddService - ok 21:08:34.0169 3120 HDAudBus (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys 21:08:34.0185 3120 HDAudBus - ok 21:08:34.0201 3120 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys 21:08:34.0201 3120 HidBatt - ok 21:08:34.0201 3120 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys 21:08:34.0216 3120 HidBth - ok 21:08:34.0216 3120 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys 21:08:34.0216 3120 HidIr - ok 21:08:34.0247 3120 hidserv (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\System32\hidserv.dll 21:08:34.0247 3120 hidserv - ok 21:08:34.0263 3120 HidUsb (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys 21:08:34.0263 3120 HidUsb - ok 21:08:34.0294 3120 hkmsvc (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll 21:08:34.0294 3120 hkmsvc - ok 21:08:34.0325 3120 HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll 21:08:34.0325 3120 HomeGroupListener - ok 21:08:34.0372 3120 HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll 21:08:34.0372 3120 HomeGroupProvider - ok 21:08:34.0388 3120 HpSAMD (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys 21:08:34.0388 3120 HpSAMD - ok 21:08:34.0466 3120 HTTP (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys 21:08:34.0481 3120 HTTP - ok 21:08:34.0513 3120 hwpolicy (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys 21:08:34.0513 3120 hwpolicy - ok 21:08:34.0559 3120 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys 21:08:34.0559 3120 i8042prt - ok 21:08:34.0606 3120 iaStorV (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys 21:08:34.0606 3120 iaStorV - ok 21:08:34.0731 3120 idsvc (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 21:08:34.0747 3120 idsvc - ok 21:08:35.0246 3120 igfx (677aa5991026a65ada128c4b59cf2bad) C:\Windows\system32\DRIVERS\igdkmd64.sys 21:08:35.0527 3120 igfx - ok 21:08:35.0636 3120 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys 21:08:35.0636 3120 iirsp - ok 21:08:35.0714 3120 IKEEXT (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll 21:08:35.0714 3120 IKEEXT - ok 21:08:35.0745 3120 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys 21:08:35.0761 3120 intelide - ok 21:08:35.0761 3120 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys 21:08:35.0761 3120 intelppm - ok 21:08:35.0792 3120 IPBusEnum (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll 21:08:35.0792 3120 IPBusEnum - ok 21:08:35.0823 3120 IpFilterDriver (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys 21:08:35.0823 3120 IpFilterDriver - ok 21:08:35.0870 3120 iphlpsvc (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll 21:08:35.0885 3120 iphlpsvc - ok 21:08:35.0917 3120 IPMIDRV (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys 21:08:35.0917 3120 IPMIDRV - ok 21:08:35.0948 3120 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys 21:08:35.0948 3120 IPNAT - ok 21:08:36.0041 3120 iPod Service (3c0d4b3e80fc4854ca325dd123cc4ded) C:\Program Files\iPod\bin\iPodService.exe 21:08:36.0057 3120 iPod Service - ok 21:08:36.0073 3120 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys 21:08:36.0073 3120 IRENUM - ok 21:08:36.0088 3120 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys 21:08:36.0088 3120 isapnp - ok 21:08:36.0119 3120 iScsiPrt (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys 21:08:36.0119 3120 iScsiPrt - ok 21:08:36.0151 3120 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys 21:08:36.0151 3120 kbdclass - ok 21:08:36.0166 3120 kbdhid (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys 21:08:36.0182 3120 kbdhid - ok 21:08:36.0197 3120 KeyIso (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 21:08:36.0197 3120 KeyIso - ok 21:08:36.0229 3120 KSecDD (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys 21:08:36.0229 3120 KSecDD - ok 21:08:36.0260 3120 KSecPkg (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys 21:08:36.0260 3120 KSecPkg - ok 21:08:36.0275 3120 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys 21:08:36.0275 3120 ksthunk - ok 21:08:36.0322 3120 KtmRm (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll 21:08:36.0322 3120 KtmRm - ok 21:08:36.0369 3120 LanmanServer (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\System32\srvsvc.dll 21:08:36.0385 3120 LanmanServer - ok 21:08:36.0400 3120 LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll 21:08:36.0400 3120 LanmanWorkstation - ok 21:08:36.0572 3120 Lavasoft Ad-Aware Service (ed60ffd305ac0424920d146db9f9ed78) C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe 21:08:36.0587 3120 Lavasoft Ad-Aware Service - ok 21:08:36.0665 3120 Lavasoft Kernexplorer (9a7fa6371f68335fd3c3d6488bc5a9f8) C:\Program Files (x86)\Lavasoft\Ad-Aware\KernExplorer64.sys 21:08:36.0665 3120 Lavasoft Kernexplorer - ok 21:08:36.0775 3120 Lbd (c8b3131857931ae76798a741cc52b021) C:\Windows\system32\DRIVERS\Lbd.sys 21:08:36.0775 3120 Lbd - ok 21:08:36.0806 3120 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys 21:08:36.0806 3120 lltdio - ok 21:08:36.0853 3120 lltdsvc (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll 21:08:36.0853 3120 lltdsvc - ok 21:08:36.0884 3120 lmhosts (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll 21:08:36.0884 3120 lmhosts - ok 21:08:36.0899 3120 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys 21:08:36.0915 3120 LSI_FC - ok 21:08:36.0915 3120 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys 21:08:36.0915 3120 LSI_SAS - ok 21:08:36.0946 3120 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys 21:08:36.0946 3120 LSI_SAS2 - ok 21:08:36.0962 3120 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys 21:08:36.0962 3120 LSI_SCSI - ok 21:08:36.0993 3120 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys 21:08:36.0993 3120 luafv - ok 21:08:37.0055 3120 lxdnCATSCustConnectService (4208b958e35f0e596aa241efb664636b) C:\Windows\system32\spool\DRIVERS\x64\3\\lxdnserv.exe 21:08:37.0055 3120 lxdnCATSCustConnectService - ok 21:08:37.0055 3120 lxdn_device - ok 21:08:37.0118 3120 lxecCATSCustConnectService (1f02b554ddc4086d786537a3bf6488f1) C:\Windows\system32\spool\DRIVERS\x64\3\\lxecserv.exe 21:08:37.0118 3120 lxecCATSCustConnectService - ok 21:08:37.0118 3120 lxec_device - ok 21:08:37.0165 3120 McComponentHostService (f453d1e6d881e8f8717e20ccd4199e85) C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe 21:08:37.0165 3120 McComponentHostService - ok 21:08:37.0211 3120 Mcx2Svc (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll 21:08:37.0211 3120 Mcx2Svc - ok 21:08:37.0227 3120 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys 21:08:37.0227 3120 megasas - ok 21:08:37.0258 3120 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys 21:08:37.0258 3120 MegaSR - ok 21:08:37.0289 3120 MMCSS (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 21:08:37.0289 3120 MMCSS - ok 21:08:37.0321 3120 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys 21:08:37.0321 3120 Modem - ok 21:08:37.0352 3120 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys 21:08:37.0352 3120 monitor - ok 21:08:37.0383 3120 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys 21:08:37.0399 3120 mouclass - ok 21:08:37.0414 3120 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys 21:08:37.0414 3120 mouhid - ok 21:08:37.0445 3120 mountmgr (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys 21:08:37.0445 3120 mountmgr - ok 21:08:37.0477 3120 mpio (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys 21:08:37.0477 3120 mpio - ok 21:08:37.0492 3120 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys 21:08:37.0508 3120 mpsdrv - ok 21:08:37.0570 3120 MpsSvc (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll 21:08:37.0586 3120 MpsSvc - ok 21:08:37.0601 3120 MRxDAV (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys 21:08:37.0601 3120 MRxDAV - ok 21:08:37.0648 3120 mrxsmb (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys 21:08:37.0648 3120 mrxsmb - ok 21:08:37.0695 3120 mrxsmb10 (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys 21:08:37.0695 3120 mrxsmb10 - ok 21:08:37.0711 3120 mrxsmb20 (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 21:08:37.0711 3120 mrxsmb20 - ok 21:08:37.0726 3120 msahci (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys 21:08:37.0726 3120 msahci - ok 21:08:37.0742 3120 msdsm (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys 21:08:37.0742 3120 msdsm - ok 21:08:37.0773 3120 MSDTC (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe 21:08:37.0789 3120 MSDTC - ok 21:08:37.0820 3120 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys 21:08:37.0820 3120 Msfs - ok 21:08:37.0820 3120 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys 21:08:37.0835 3120 mshidkmdf - ok 21:08:37.0851 3120 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys 21:08:37.0851 3120 msisadrv - ok 21:08:37.0882 3120 MSiSCSI (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll 21:08:37.0882 3120 MSiSCSI - ok 21:08:37.0898 3120 msiserver - ok 21:08:37.0929 3120 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys 21:08:37.0929 3120 MSKSSRV - ok 21:08:37.0929 3120 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys 21:08:37.0929 3120 MSPCLOCK - ok 21:08:37.0945 3120 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys 21:08:37.0945 3120 MSPQM - ok 21:08:37.0991 3120 MsRPC (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys 21:08:37.0991 3120 MsRPC - ok 21:08:38.0007 3120 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys 21:08:38.0007 3120 mssmbios - ok 21:08:38.0023 3120 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys 21:08:38.0023 3120 MSTEE - ok 21:08:38.0038 3120 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys 21:08:38.0038 3120 MTConfig - ok 21:08:38.0054 3120 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys 21:08:38.0054 3120 Mup - ok 21:08:38.0101 3120 napagent (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll 21:08:38.0116 3120 napagent - ok 21:08:38.0147 3120 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys 21:08:38.0147 3120 NativeWifiP - ok 21:08:38.0210 3120 NDIS (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys 21:08:38.0225 3120 NDIS - ok 21:08:38.0241 3120 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys 21:08:38.0241 3120 NdisCap - ok 21:08:38.0241 3120 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys 21:08:38.0257 3120 NdisTapi - ok 21:08:38.0303 3120 Ndisuio (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys 21:08:38.0303 3120 Ndisuio - ok 21:08:38.0319 3120 NdisWan (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys 21:08:38.0319 3120 NdisWan - ok 21:08:38.0350 3120 NDProxy (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys 21:08:38.0350 3120 NDProxy - ok 21:08:38.0381 3120 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys 21:08:38.0381 3120 NetBIOS - ok 21:08:38.0428 3120 NetBT (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys 21:08:38.0428 3120 NetBT - ok 21:08:38.0459 3120 Netlogon (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 21:08:38.0459 3120 Netlogon - ok 21:08:38.0506 3120 Netman (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll 21:08:38.0506 3120 Netman - ok 21:08:38.0537 3120 netprofm (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll 21:08:38.0553 3120 netprofm - ok 21:08:38.0631 3120 NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 21:08:38.0631 3120 NetTcpPortSharing - ok 21:08:38.0647 3120 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys 21:08:38.0647 3120 nfrd960 - ok 21:08:38.0709 3120 NlaSvc (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll 21:08:38.0709 3120 NlaSvc - ok 21:08:38.0740 3120 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys 21:08:38.0740 3120 Npfs - ok 21:08:38.0756 3120 nsi (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll 21:08:38.0756 3120 nsi - ok 21:08:38.0771 3120 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys 21:08:38.0771 3120 nsiproxy - ok 21:08:38.0881 3120 Ntfs (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys 21:08:38.0896 3120 Ntfs - ok 21:08:38.0990 3120 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys 21:08:38.0990 3120 Null - ok 21:08:39.0021 3120 nvraid (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys 21:08:39.0021 3120 nvraid - ok 21:08:39.0052 3120 nvstor (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys 21:08:39.0052 3120 nvstor - ok 21:08:39.0083 3120 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys 21:08:39.0083 3120 nv_agp - ok 21:08:39.0099 3120 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys 21:08:39.0099 3120 ohci1394 - ok 21:08:39.0161 3120 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 21:08:39.0161 3120 ose - ok 21:08:39.0208 3120 p2pimsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 21:08:39.0208 3120 p2pimsvc - ok 21:08:39.0239 3120 p2psvc (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll 21:08:39.0239 3120 p2psvc - ok 21:08:39.0271 3120 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys 21:08:39.0271 3120 Parport - ok 21:08:39.0302 3120 partmgr (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys 21:08:39.0302 3120 partmgr - ok 21:08:39.0317 3120 PcaSvc (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll 21:08:39.0333 3120 PcaSvc - ok 21:08:39.0333 3120 pci (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys 21:08:39.0349 3120 pci - ok 21:08:39.0349 3120 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys 21:08:39.0349 3120 pciide - ok 21:08:39.0380 3120 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys 21:08:39.0380 3120 pcmcia - ok 21:08:39.0395 3120 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys 21:08:39.0395 3120 pcw - ok 21:08:39.0442 3120 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys 21:08:39.0442 3120 PEAUTH - ok 21:08:39.0520 3120 PerfHost (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe 21:08:39.0520 3120 PerfHost - ok 21:08:39.0629 3120 pla (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll 21:08:39.0661 3120 pla - ok 21:08:39.0692 3120 PlugPlay (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll 21:08:39.0707 3120 PlugPlay - ok 21:08:39.0817 3120 PMBDeviceInfoProvider (63694c307273062a2167ae4ce80730ef) C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe 21:08:39.0817 3120 PMBDeviceInfoProvider - ok 21:08:39.0832 3120 PnkBstrA - ok 21:08:39.0832 3120 PnkBstrB - ok 21:08:39.0863 3120 PNRPAutoReg (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll 21:08:39.0863 3120 PNRPAutoReg - ok 21:08:39.0895 3120 PNRPsvc (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll 21:08:39.0895 3120 PNRPsvc - ok 21:08:39.0941 3120 PolicyAgent (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll 21:08:39.0957 3120 PolicyAgent - ok 21:08:39.0988 3120 Power (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll 21:08:40.0004 3120 Power - ok 21:08:40.0066 3120 PptpMiniport (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys 21:08:40.0066 3120 PptpMiniport - ok 21:08:40.0082 3120 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys 21:08:40.0082 3120 Processor - ok 21:08:40.0129 3120 ProfSvc (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll 21:08:40.0129 3120 ProfSvc - ok 21:08:40.0160 3120 ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 21:08:40.0160 3120 ProtectedStorage - ok 21:08:40.0191 3120 Psched (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys 21:08:40.0191 3120 Psched - ok 21:08:40.0222 3120 PxHlpa64 (a6bf0a9b5a30d743623ca0d3be35df05) C:\Windows\system32\Drivers\PxHlpa64.sys 21:08:40.0222 3120 PxHlpa64 - ok 21:08:40.0316 3120 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys 21:08:40.0347 3120 ql2300 - ok 21:08:40.0425 3120 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys 21:08:40.0425 3120 ql40xx - ok 21:08:40.0472 3120 QWAVE (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll 21:08:40.0472 3120 QWAVE - ok 21:08:40.0487 3120 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys 21:08:40.0503 3120 QWAVEdrv - ok 21:08:40.0503 3120 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys 21:08:40.0503 3120 RasAcd - ok 21:08:40.0534 3120 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys 21:08:40.0534 3120 RasAgileVpn - ok 21:08:40.0550 3120 RasAuto (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll 21:08:40.0550 3120 RasAuto - ok 21:08:40.0581 3120 Rasl2tp (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys 21:08:40.0581 3120 Rasl2tp - ok 21:08:40.0612 3120 RasMan (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll 21:08:40.0612 3120 RasMan - ok 21:08:40.0628 3120 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys 21:08:40.0628 3120 RasPppoe - ok 21:08:40.0643 3120 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys 21:08:40.0643 3120 RasSstp - ok 21:08:40.0690 3120 rdbss (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys 21:08:40.0690 3120 rdbss - ok 21:08:40.0706 3120 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys 21:08:40.0706 3120 rdpbus - ok 21:08:40.0737 3120 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys 21:08:40.0737 3120 RDPCDD - ok 21:08:40.0753 3120 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys 21:08:40.0753 3120 RDPENCDD - ok 21:08:40.0768 3120 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys 21:08:40.0768 3120 RDPREFMP - ok 21:08:40.0815 3120 RDPWD (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys 21:08:40.0815 3120 RDPWD - ok 21:08:40.0846 3120 rdyboost (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys 21:08:40.0846 3120 rdyboost - ok 21:08:40.0877 3120 RemoteAccess (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll 21:08:40.0877 3120 RemoteAccess - ok 21:08:40.0909 3120 RemoteRegistry (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll 21:08:40.0909 3120 RemoteRegistry - ok 21:08:40.0924 3120 RpcEptMapper (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll 21:08:40.0924 3120 RpcEptMapper - ok 21:08:40.0940 3120 RpcLocator (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe 21:08:40.0940 3120 RpcLocator - ok 21:08:41.0002 3120 RpcSs (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\System32\rpcss.dll 21:08:41.0002 3120 RpcSs - ok 21:08:41.0049 3120 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys 21:08:41.0049 3120 rspndr - ok 21:08:41.0111 3120 RTL8167 (4b42bc58294e83a6a92ec8b88c14c4a3) C:\Windows\system32\DRIVERS\Rt64win7.sys 21:08:41.0111 3120 RTL8167 - ok 21:08:41.0143 3120 SamSs (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 21:08:41.0143 3120 SamSs - ok 21:08:41.0189 3120 sbp2port (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys 21:08:41.0189 3120 sbp2port - ok 21:08:41.0221 3120 SCardSvr (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll 21:08:41.0221 3120 SCardSvr - ok 21:08:41.0252 3120 scfilter (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys 21:08:41.0252 3120 scfilter - ok 21:08:41.0330 3120 Schedule (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll 21:08:41.0345 3120 Schedule - ok 21:08:41.0377 3120 SCPolicySvc (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll 21:08:41.0377 3120 SCPolicySvc - ok 21:08:41.0408 3120 SDRSVC (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll 21:08:41.0408 3120 SDRSVC - ok 21:08:41.0455 3120 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys 21:08:41.0455 3120 secdrv - ok 21:08:41.0455 3120 seclogon (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll 21:08:41.0455 3120 seclogon - ok 21:08:41.0486 3120 SENS (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\system32\sens.dll 21:08:41.0501 3120 SENS - ok 21:08:41.0501 3120 SensrSvc (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll 21:08:41.0501 3120 SensrSvc - ok 21:08:41.0534 3120 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys 21:08:41.0534 3120 Serenum - ok 21:08:41.0565 3120 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys 21:08:41.0565 3120 Serial - ok 21:08:41.0596 3120 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys 21:08:41.0596 3120 sermouse - ok 21:08:41.0658 3120 SessionEnv (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll 21:08:41.0658 3120 SessionEnv - ok 21:08:41.0674 3120 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys 21:08:41.0674 3120 sffdisk - ok 21:08:41.0690 3120 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys 21:08:41.0705 3120 sffp_mmc - ok 21:08:41.0721 3120 sffp_sd (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys 21:08:41.0721 3120 sffp_sd - ok 21:08:41.0721 3120 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys 21:08:41.0736 3120 sfloppy - ok 21:08:41.0768 3120 SharedAccess (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll 21:08:41.0768 3120 SharedAccess - ok 21:08:41.0830 3120 ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll 21:08:41.0846 3120 ShellHWDetection - ok 21:08:41.0861 3120 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys 21:08:41.0861 3120 SiSRaid2 - ok 21:08:41.0861 3120 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys 21:08:41.0861 3120 SiSRaid4 - ok 21:08:41.0924 3120 SkypeUpdate (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files (x86)\Skype\Updater\Updater.exe 21:08:41.0924 3120 SkypeUpdate - ok 21:08:41.0939 3120 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys 21:08:41.0955 3120 Smb - ok 21:08:41.0986 3120 SNMPTRAP (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe 21:08:41.0986 3120 SNMPTRAP - ok 21:08:42.0002 3120 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys 21:08:42.0002 3120 spldr - ok 21:08:42.0048 3120 Spooler (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe 21:08:42.0048 3120 Spooler - ok 21:08:42.0251 3120 sppsvc (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe 21:08:42.0267 3120 sppsvc - ok 21:08:42.0376 3120 sppuinotify (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll 21:08:42.0376 3120 sppuinotify - ok 21:08:42.0454 3120 srv (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys 21:08:42.0454 3120 srv - ok 21:08:42.0516 3120 srv2 (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys 21:08:42.0516 3120 srv2 - ok 21:08:42.0532 3120 srvnet (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys 21:08:42.0548 3120 srvnet - ok 21:08:42.0563 3120 SSDPSRV (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll 21:08:42.0563 3120 SSDPSRV - ok 21:08:42.0579 3120 SstpSvc (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll 21:08:42.0579 3120 SstpSvc - ok 21:08:42.0594 3120 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys 21:08:42.0594 3120 stexstor - ok 21:08:42.0657 3120 stisvc (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll 21:08:42.0657 3120 stisvc - ok 21:08:42.0688 3120 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys 21:08:42.0688 3120 swenum - ok 21:08:42.0735 3120 swprv (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll 21:08:42.0750 3120 swprv - ok 21:08:42.0860 3120 SysMain (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll 21:08:42.0875 3120 SysMain - ok 21:08:42.0984 3120 TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll 21:08:42.0984 3120 TabletInputService - ok 21:08:43.0047 3120 TapiSrv (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll 21:08:43.0047 3120 TapiSrv - ok 21:08:43.0062 3120 TBS (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll 21:08:43.0062 3120 TBS - ok 21:08:43.0187 3120 Tcpip (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys 21:08:43.0203 3120 Tcpip - ok 21:08:43.0343 3120 TCPIP6 (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys 21:08:43.0359 3120 TCPIP6 - ok 21:08:43.0406 3120 tcpipreg (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys 21:08:43.0406 3120 tcpipreg - ok 21:08:43.0437 3120 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys 21:08:43.0437 3120 TDPIPE - ok 21:08:43.0452 3120 TDTCP (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys 21:08:43.0452 3120 TDTCP - ok 21:08:43.0499 3120 tdx (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys 21:08:43.0499 3120 tdx - ok 21:08:43.0530 3120 TermDD (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys 21:08:43.0530 3120 TermDD - ok 21:08:43.0593 3120 TermService (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll 21:08:43.0593 3120 TermService - ok 21:08:43.0608 3120 Themes (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll 21:08:43.0608 3120 Themes - ok 21:08:43.0640 3120 THREADORDER (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll 21:08:43.0655 3120 THREADORDER - ok 21:08:43.0671 3120 TrkWks (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll 21:08:43.0671 3120 TrkWks - ok 21:08:43.0718 3120 TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe 21:08:43.0718 3120 TrustedInstaller - ok 21:08:43.0749 3120 tssecsrv (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys 21:08:43.0749 3120 tssecsrv - ok 21:08:43.0796 3120 TsUsbFlt (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys 21:08:43.0811 3120 TsUsbFlt - ok 21:08:43.0842 3120 tunnel (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys 21:08:43.0842 3120 tunnel - ok 21:08:43.0874 3120 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys 21:08:43.0874 3120 uagp35 - ok 21:08:43.0905 3120 udfs (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys 21:08:43.0905 3120 udfs - ok 21:08:43.0952 3120 UI0Detect (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe 21:08:43.0952 3120 UI0Detect - ok 21:08:43.0983 3120 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys 21:08:43.0983 3120 uliagpkx - ok 21:08:43.0998 3120 umbus (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys 21:08:43.0998 3120 umbus - ok 21:08:44.0014 3120 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys 21:08:44.0014 3120 UmPass - ok 21:08:44.0045 3120 upnphost (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll 21:08:44.0061 3120 upnphost - ok 21:08:44.0092 3120 USBAAPL64 (aa33fc47ed58c34e6e9261e4f850b7eb) C:\Windows\system32\Drivers\usbaapl64.sys 21:08:44.0092 3120 USBAAPL64 - ok 21:08:44.0108 3120 usbaudio (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys 21:08:44.0123 3120 usbaudio - ok 21:08:44.0154 3120 usbccgp (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys 21:08:44.0154 3120 usbccgp - ok 21:08:44.0170 3120 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys 21:08:44.0170 3120 usbcir - ok 21:08:44.0201 3120 usbehci (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys 21:08:44.0201 3120 usbehci - ok 21:08:44.0217 3120 usbhub (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys 21:08:44.0232 3120 usbhub - ok 21:08:44.0248 3120 usbohci (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys 21:08:44.0248 3120 usbohci - ok 21:08:44.0264 3120 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys 21:08:44.0264 3120 usbprint - ok 21:08:44.0295 3120 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys 21:08:44.0295 3120 usbscan - ok 21:08:44.0326 3120 USBSTOR (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS 21:08:44.0326 3120 USBSTOR - ok 21:08:44.0342 3120 usbuhci (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys 21:08:44.0342 3120 usbuhci - ok 21:08:44.0373 3120 UxSms (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll 21:08:44.0373 3120 UxSms - ok 21:08:44.0404 3120 VaultSvc (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe 21:08:44.0404 3120 VaultSvc - ok 21:08:44.0420 3120 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys 21:08:44.0420 3120 vdrvroot - ok 21:08:44.0466 3120 vds (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe 21:08:44.0482 3120 vds - ok 21:08:44.0498 3120 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys 21:08:44.0498 3120 vga - ok 21:08:44.0513 3120 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys 21:08:44.0513 3120 VgaSave - ok 21:08:44.0544 3120 vhdmp (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys 21:08:44.0544 3120 vhdmp - ok 21:08:44.0560 3120 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys 21:08:44.0560 3120 viaide - ok 21:08:44.0576 3120 volmgr (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys 21:08:44.0576 3120 volmgr - ok 21:08:44.0622 3120 volmgrx (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys 21:08:44.0622 3120 volmgrx - ok 21:08:44.0654 3120 volsnap (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys 21:08:44.0654 3120 volsnap - ok 21:08:44.0685 3120 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys 21:08:44.0685 3120 vsmraid - ok 21:08:44.0763 3120 VSS (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe 21:08:44.0794 3120 VSS - ok 21:08:44.0903 3120 VST64HWBS2 (93132c69394a99d992095d8cfe464801) C:\Windows\system32\DRIVERS\VSTBS26.SYS 21:08:44.0903 3120 VST64HWBS2 - ok 21:08:44.0997 3120 VST64_DPV (02071d207a9858fbe3a48cbfd59c4a04) C:\Windows\system32\DRIVERS\VSTDPV6.SYS 21:08:45.0012 3120 VST64_DPV - ok 21:08:45.0075 3120 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys 21:08:45.0075 3120 vwifibus - ok 21:08:45.0122 3120 W32Time (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll 21:08:45.0122 3120 W32Time - ok 21:08:45.0153 3120 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys 21:08:45.0153 3120 WacomPen - ok 21:08:45.0184 3120 WANARP (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 21:08:45.0184 3120 WANARP - ok 21:08:45.0200 3120 Wanarpv6 (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys 21:08:45.0200 3120 Wanarpv6 - ok 21:08:45.0293 3120 WatAdminSvc (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe 21:08:45.0309 3120 WatAdminSvc - ok 21:08:45.0418 3120 wbengine (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe 21:08:45.0449 3120 wbengine - ok 21:08:45.0543 3120 WbioSrvc (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll 21:08:45.0543 3120 WbioSrvc - ok 21:08:45.0605 3120 wcncsvc (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll 21:08:45.0621 3120 wcncsvc - ok 21:08:45.0636 3120 WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll 21:08:45.0636 3120 WcsPlugInService - ok 21:08:45.0668 3120 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys 21:08:45.0668 3120 Wd - ok 21:08:45.0714 3120 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys 21:08:45.0730 3120 Wdf01000 - ok 21:08:45.0761 3120 WdiServiceHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 21:08:45.0761 3120 WdiServiceHost - ok 21:08:45.0761 3120 WdiSystemHost (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll 21:08:45.0777 3120 WdiSystemHost - ok 21:08:45.0808 3120 WebClient (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll 21:08:45.0824 3120 WebClient - ok 21:08:45.0839 3120 Wecsvc (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll 21:08:45.0839 3120 Wecsvc - ok 21:08:45.0855 3120 wercplsupport (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll 21:08:45.0855 3120 wercplsupport - ok 21:08:45.0870 3120 WerSvc (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll 21:08:45.0886 3120 WerSvc - ok 21:08:45.0886 3120 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys 21:08:45.0886 3120 WfpLwf - ok 21:08:45.0902 3120 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys 21:08:45.0902 3120 WIMMount - ok 21:08:45.0964 3120 winachsf (18e40c245dbfaf36fd0134a7ef2df396) C:\Windows\system32\DRIVERS\VSTCNXT6.SYS 21:08:45.0980 3120 winachsf - ok 21:08:46.0026 3120 WinDefend - ok 21:08:46.0042 3120 WinHttpAutoProxySvc - ok 21:08:46.0104 3120 Winmgmt (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll 21:08:46.0120 3120 Winmgmt - ok 21:08:46.0245 3120 WinRM (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll 21:08:46.0276 3120 WinRM - ok 21:08:46.0385 3120 WinUsb (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys 21:08:46.0401 3120 WinUsb - ok 21:08:46.0463 3120 Wlansvc (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll 21:08:46.0479 3120 Wlansvc - ok 21:08:46.0650 3120 wlidsvc (7e47c328fc4768cb8beafbcfafa70362) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE 21:08:46.0666 3120 wlidsvc - ok 21:08:46.0744 3120 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys 21:08:46.0744 3120 WmiAcpi - ok 21:08:46.0820 3120 wmiApSrv (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe 21:08:46.0820 3120 wmiApSrv - ok 21:08:46.0860 3120 WMPNetworkSvc - ok 21:08:46.0870 3120 WPCSvc (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll 21:08:46.0870 3120 WPCSvc - ok 21:08:46.0910 3120 WPDBusEnum (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll 21:08:46.0920 3120 WPDBusEnum - ok 21:08:46.0940 3120 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys 21:08:46.0950 3120 ws2ifsl - ok 21:08:46.0980 3120 wscsvc (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\system32\wscsvc.dll 21:08:46.0980 3120 wscsvc - ok 21:08:46.0980 3120 WSearch - ok 21:08:47.0100 3120 wuauserv (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll 21:08:47.0130 3120 wuauserv - ok 21:08:47.0230 3120 WudfPf (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys 21:08:47.0240 3120 WudfPf - ok 21:08:47.0260 3120 WUDFRd (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys 21:08:47.0260 3120 WUDFRd - ok 21:08:47.0280 3120 wudfsvc (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll 21:08:47.0280 3120 wudfsvc - ok 21:08:47.0300 3120 WwanSvc (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll 21:08:47.0310 3120 WwanSvc - ok 21:08:47.0400 3120 YahooAUService (dd0042f0c3b606a6a8b92d49afb18ad6) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe 21:08:47.0410 3120 YahooAUService - ok 21:08:47.0430 3120 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0 21:08:47.0510 3120 \Device\Harddisk0\DR0 - ok 21:08:47.0510 3120 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk5\DR6 21:08:50.0334 3120 \Device\Harddisk5\DR6 - ok 21:08:50.0350 3120 Boot (0x1200) (cb0a259b07a2fcf610a555c1e7c53a60) \Device\Harddisk0\DR0\Partition0 21:08:50.0350 3120 \Device\Harddisk0\DR0\Partition0 - ok 21:08:50.0381 3120 Boot (0x1200) (c08d589fa6a1cc70751c5296e9212c85) \Device\Harddisk0\DR0\Partition1 21:08:50.0381 3120 \Device\Harddisk0\DR0\Partition1 - ok 21:08:50.0381 3120 Boot (0x1200) (a7e38ce9c534d7596d430bf67e12ae55) \Device\Harddisk5\DR6\Partition0 21:08:50.0381 3120 \Device\Harddisk5\DR6\Partition0 - ok 21:08:50.0381 3120 ============================================================ 21:08:50.0381 3120 Scan finished 21:08:50.0381 3120 ============================================================ 21:08:50.0396 1792 Detected object count: 0 21:08:50.0396 1792 Actual detected object count: 0
Post #12
Hello chester

Thank you for the logs.

The computer seems to be running better

:thumbup:

I was curious and tried aswMBR and it will now run

Please post up the log along with the report from the following:

  • Please run the following scan


  • Note: You will need to use Internet Explorer for this scan.
  • Note for Vista/Windows 7 Users: ESET is compatible but Internet Explorer must be run as Administrator. To do this, right-click on your Internet Explorer icon and select "Run as Administrator".
  • Please disable your real time security programs before performing the scan.


  • Scan your system with Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use.
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps).
  • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the [external image: Posted Image] icon on your desktop.


  • Check [external image: Posted Image]
  • Click the [external image: Posted Image] button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option to "Remove Found Threats" is UN checked.
  • Push the "Start" button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the [external image: Posted Image] button.
  • Push [external image: Posted Image]

Please post the aswMBR log, the ESET log and a new set of DDS logs in your next reply.
Post #13
Jon, Here you go; aswMBR aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-05-05 17:55:20 —————————– 17:55:20.448 OS Version: Windows x64 6.1.7601 Service Pack 1 17:55:20.449 Number of processors: 2 586 0xF0D 17:55:20.450 ComputerName: DAD-PC UserName: dad 17:55:21.936 Initialize success 18:08:30.881 AVAST engine defs: 12050501 18:09:17.229 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 18:09:17.229 Disk 0 Vendor: SAMSUNG_HD501LJ CR100-12 Size: 476940MB BusType: 3 18:09:17.276 Disk 0 MBR read successfully 18:09:17.276 Disk 0 MBR scan 18:09:17.291 Disk 0 Windows 7 default MBR code 18:09:17.291 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 467435 MB offset 63 18:09:17.322 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 9494 MB offset 957307680 18:09:17.385 Disk 0 scanning C:\Windows\system32\drivers 18:09:24.966 Service scanning 18:09:44.030 Modules scanning 18:09:44.030 Disk 0 trace - called modules: 18:09:44.092 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS intelide.sys PCIIDEX.SYS hal.dll atapi.sys 18:09:44.092 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80048df060] 18:09:44.108 3 CLASSPNP.SYS[fffff880019a443f] -> nt!IofCallDriver -> [0xfffffa80043c8520] 18:09:44.108 5 ACPI.sys[fffff88000f5e7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0xfffffa80043c4680] 18:09:45.481 AVAST engine scan C:\Windows 18:09:49.803 AVAST engine scan C:\Windows\system32 18:12:32.027 AVAST engine scan C:\Windows\system32\drivers 18:12:42.230 AVAST engine scan C:\Users\dad 18:21:29.122 AVAST engine scan C:\ProgramData 18:23:51.207 Scan finished successfully 18:28:04.099 Disk 0 MBR has been saved successfully to "C:\Users\dad\Desktop\MBR.dat" 18:28:04.348 The log file has been saved successfully to "C:\Users\dad\Desktop\aswMBR.txt" ESET C:\TDSSKiller_Quarantine\02.05.2012_21.53.13\mbr0000\tdlfs0000\tsk0005.dta Win32/Olmasco.O trojan C:\TDSSKiller_Quarantine\02.05.2012_21.53.13\mbr0000\tdlfs0000\tsk0006.dta Win64/Olmasco.W trojan C:\TDSSKiller_Quarantine\02.05.2012_21.53.13\mbr0000\tdlfs0000\tsk0007.dta Win32/Olmasco.O trojan C:\TDSSKiller_Quarantine\02.05.2012_21.53.13\mbr0000\tdlfs0000\tsk0008.dta Win64/Olmasco.X trojan C:\TDSSKiller_Quarantine\02.05.2012_21.53.13\mbr0000\tdlfs0000\tsk0009.dta Win32/Olmasco.O trojan C:\TDSSKiller_Quarantine\02.05.2012_21.53.13\mbr0000\tdlfs0000\tsk0010.dta Win64/Olmasco.R trojan C:\TDSSKiller_Quarantine\02.05.2012_21.53.13\mbr0000\tdlfs0000\tsk0011.dta a variant of Win32/Olmasco.Q trojan C:\TDSSKiller_Quarantine\02.05.2012_21.53.13\mbr0000\tdlfs0000\tsk0012.dta Win64/Olmasco.X trojan C:\Users\dad\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\331c6c3-363a9bfb a variant of Java/TrojanDownloader.OpenConnection.AQ trojan DDs . DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29 Run by [removed] at 22:43:31 on 2012-05-05 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4029.2152 [GMT -5:00] . AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Windows\system32\taskhost.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\spool\DRIVERS\x64\3\lxdnserv.exe C:\Windows\system32\lxdncoms.exe C:\Windows\system32\lxeccoms.exe C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe C:\Windows\SysWOW64\PnkBstrA.exe C:\Windows\SysWOW64\PnkBstrB.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\wbem\unsecapp.exe C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\WUDFHost.exe C:\Program Files (x86)\Lexmark 2600 Series\lxdnmon.exe C:\Program Files (x86)\Lexmark 2600 Series\lxdnMsdMon.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\DllHost.exe C:\Windows\SysWOW64\NOTEPAD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\taskeng.exe C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\conhost.exe C:\Windows\SysWOW64\cscript.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://isearch.avg.com/?cid={279430EE-6662-4F63-A56E-8A7D6EAAE71E}&mid=08d64d00bd2947d0adba41b2e00d4f9f-1d6c8b6a4fd14e7d84d88f40e35531e8c08da0a6&lang=en&ds=ts025&pr=sa&d=&v=&sap=hp uInternet Settings,ProxyOverride = *.local uURLSearchHooks: YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - C:\Program Files\Lexmark Toolbar\toolband.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll BHO: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Lexmark Printable Web: {d2c5e510-be6d-42cc-9f61-e4f939078474} - C:\Program Files\Lexmark Printable Web\bho.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - C:\Program Files\Lexmark Toolbar\toolband.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll TB: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun mRun: [FaxCenterServer] "C:\Program Files (x86)\Lexmark Fax Solutions\fm3032.exe" /s mRun: [Adobe Photo Downloader] "C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\apdproxy.exe" mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe mRun: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe mRun: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe" StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 0 (0x0) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab TCP: DhcpNameServer = 192.168.1.254 TCP: Interfaces\{5D2D0DD3-1C79-4FD1-8DAE-37B53C4060AB} : DhcpNameServer = 192.168.1.254 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll BHO-X64: 0x1 - No File BHO-X64: Lexmark Toolbar: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO-X64: AcroIEHelperStub - No File BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll BHO-X64: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll BHO-X64: Ad-Aware Security Toolbar - No File BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Lexmark Printable Web: {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll TB-X64: Lexmark Toolbar: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn1\yt.dll TB-X64: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\adawaretb\adawareDx.dll mRun-x64: [FaxCenterServer] "C:\Program Files (x86)\Lexmark Fax Solutions\fm3032.exe" /s mRun-x64: [Adobe Photo Downloader] "C:\Program Files (x86)\Adobe\Photoshop Elements 6.0\apdproxy.exe" mRun-x64: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe mRun-x64: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun-x64: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe mRun-x64: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe" . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\dad\AppData\Roaming\Mozilla\Firefox\Profiles\ol2d19d4.default\ FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.startup.homepage - hxxp://isearch.avg.com/?cid={279430EE-6662-4F63-A56E-8A7D6EAAE71E}&mid=08d64d00bd2947d0adba41b2e00d4f9f-1d6c8b6a4fd14e7d84d88f40e35531e8c08da0a6&lang=en&ds=ts025&pr=sa&d=&v=&sap=hp FF - prefs.js: network.proxy.type - 0 FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll FF - plugin: C:\Users\dad\AppData\Local\Roblox\Versions\version-3bc3e39888854c74\NPRobloxProxy.dll FF - plugin: C:\Users\dad\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll . ============= SERVICES / DRIVERS =============== . R0 Lbd;Lbd;C:\Windows\system32\DRIVERS\Lbd.sys –> C:\Windows\system32\DRIVERS\Lbd.sys [?] R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys –> C:\Windows\system32\Drivers\PxHlpa64.sys [?] R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-4-1 2152152] R2 lxdn_device;lxdn_device;C:\Windows\system32\lxdncoms.exe -service –> C:\Windows\system32\lxdncoms.exe -service [?] R2 lxdnCATSCustConnectService;lxdnCATSCustConnectService;C:\Windows\System32\spool\DRIVERS\x64\3\lxdnserv.exe [2009-4-28 29184] R2 lxec_device;lxec_device;C:\Windows\system32\lxeccoms.exe -service –> C:\Windows\system32\lxeccoms.exe -service [?] R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-27 398176] R3 Lavasoft Kernexplorer;Lavasoft helper driver;C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys [2011-4-1 17152] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys –> C:\Windows\system32\DRIVERS\Rt64win7.sys [?] R3 VST64_DPV;VST64_DPV;C:\Windows\system32\DRIVERS\VSTDPV6.SYS –> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?] R3 VST64HWBS2;VST64HWBS2;C:\Windows\system32\DRIVERS\VSTBS26.SYS –> C:\Windows\system32\DRIVERS\VSTBS26.SYS [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-1-15 136176] S2 lxecCATSCustConnectService;lxecCATSCustConnectService;C:\Windows\System32\spool\DRIVERS\x64\3\lxecserv.exe [2012-1-3 45736] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-3-29 257696] S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys –> C:\Windows\system32\DRIVERS\fssfltr.sys [?] S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-1-15 136176] S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232] S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys –> C:\Windows\system32\drivers\tsusbflt.sys [?] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys –> C:\Windows\system32\Drivers\usbaapl64.sys [?] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe –> C:\Windows\system32\Wat\WatAdminSvc.exe [?] . =============== Created Last 30 ================ . 2012-05-05 23:37:45 ——– d—–w- C:\Program Files (x86)\ESET 2012-05-05 01:31:45 ——– d—–w- C:\$RECYCLE.BIN 2012-05-04 17:12:50 8917360 —-a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{2DF61F0C-9E8B-474C-ADD6-F819C673DF59}\mpengine.dll 2012-05-03 03:22:12 8917360 ——w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Updates\mpengine.dll 2012-05-03 03:04:19 98816 —-a-w- C:\Windows\sed.exe 2012-05-03 03:04:19 518144 —-a-w- C:\Windows\SWREG.exe 2012-05-03 03:04:19 256000 —-a-w- C:\Windows\PEV.exe 2012-05-03 03:04:19 208896 —-a-w- C:\Windows\MBR.exe 2012-05-03 02:55:06 ——– d—–w- C:\TDSSKiller_Quarantine 2012-04-20 18:58:48 ——– d—–w- C:\ProgramData\Common Files 2012-04-20 18:58:43 ——– d—–w- C:\Users\dad\AppData\Roaming\FixCleaner 2012-04-20 18:58:39 ——– d—–w- C:\Program Files (x86)\FixCleaner 2012-04-20 18:14:24 ——– d—–w- C:\Users\dad\AppData\Local\adawarebp 2012-04-20 18:14:23 ——– d—–w- C:\ProgramData\Ad-Aware Browsing Protection 2012-04-20 18:14:21 ——– d—–w- C:\Program Files (x86)\Toolbar Cleaner 2012-04-20 18:14:19 ——– d—–w- C:\Program Files (x86)\adawaretb 2012-04-20 18:12:20 ——– d—–w- C:\Users\dad\AppData\Roaming\Ad-Aware Antivirus 2012-04-20 03:19:50 ——– d—–w- C:\Users\dad\AppData\Local\{ABEA01A2-8A97-11E1-826D-B8AC6F996F26} 2012-04-20 03:19:50 ——– d—–w- C:\ProgramData\F4D55F3E00002D6300011D33B4EB2367 2012-04-20 03:19:34 ——– d—–w- C:\Users\dad\AppData\Local\MPEG 2012-04-11 08:03:49 5559152 —-a-w- C:\Windows\System32\ntoskrnl.exe 2012-04-11 08:03:48 3968368 —-a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-04-11 08:03:48 3913072 —-a-w- C:\Windows\SysWow64\ntoskrnl.exe 2012-04-11 08:00:32 23408 —-a-w- C:\Windows\System32\drivers\fs_rec.sys 2012-04-11 08:00:31 81408 —-a-w- C:\Windows\System32\imagehlp.dll 2012-04-11 08:00:31 5120 —-a-w- C:\Windows\SysWow64\wmi.dll 2012-04-11 08:00:31 5120 —-a-w- C:\Windows\System32\wmi.dll 2012-04-11 08:00:31 220672 —-a-w- C:\Windows\System32\wintrust.dll 2012-04-11 08:00:31 172544 —-a-w- C:\Windows\SysWow64\wintrust.dll 2012-04-11 08:00:31 159232 —-a-w- C:\Windows\SysWow64\imagehlp.dll 2012-04-09 12:22:47 ——– d—–w- C:\Users\dad\AppData\Local\{238CCAEC-0B05-456B-8AEE-760909BB06D2} . ==================== Find3M ==================== . 2012-05-05 15:36:32 70304 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-05-05 15:36:32 419488 —-a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-05-05 15:36:29 8744608 —-a-w- C:\Windows\SysWow64\FlashPlayerInstaller.exe 2012-02-28 06:56:48 2311168 —-a-w- C:\Windows\System32\jscript9.dll 2012-02-28 06:49:56 1390080 —-a-w- C:\Windows\System32\wininet.dll 2012-02-28 06:48:57 1493504 —-a-w- C:\Windows\System32\inetcpl.cpl 2012-02-28 06:42:55 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2012-02-28 01:18:55 1799168 —-a-w- C:\Windows\SysWow64\jscript9.dll 2012-02-28 01:11:21 1427456 —-a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-02-28 01:11:07 1127424 —-a-w- C:\Windows\SysWow64\wininet.dll 2012-02-28 01:03:16 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2012-02-23 15:18:36 279656 ——w- C:\Windows\System32\MpSigStub.exe 2012-02-17 06:38:26 1031680 —-a-w- C:\Windows\System32\rdpcore.dll 2012-02-17 05:34:22 826880 —-a-w- C:\Windows\SysWow64\rdpcore.dll 2012-02-17 04:58:24 210944 —-a-w- C:\Windows\System32\drivers\rdpwd.sys 2012-02-17 04:57:32 23552 —-a-w- C:\Windows\System32\drivers\tdtcp.sys 2012-02-10 06:36:07 1544192 —-a-w- C:\Windows\System32\DWrite.dll 2012-02-10 05:38:43 1077248 —-a-w- C:\Windows\SysWow64\DWrite.dll . ============= FINISH: 22:43:50.89 ===============
Post #14
Hello chester

Thank you for the logs.

  • Please search for and delete the following folder


    • Right-click your "Start" button and select "Explore".
    • Navigate to and delete the following folder in bold.


    C:\TDSSKiller_Quarantine <==== Delete this folder.


    • Once deleted, Empty your Recycle Bin.

  • Please Clear Your Sun Java Cache


    • Click on "Start", then on "Control Panel" and then on the Java icon (looks like a coffee cup). If you do not see the icon, look to your left and click "Switch to Classic View".
    • On the "General" tab, under "Temporary Internet Files", click the "Settings" button.
    • Next, click on the "Delete Files" button.
    • There are two options in the window to clear the cache - ("Applications and Applets" and "Trace and Log Files").
    • Leave BOTH Checked
    • Click "OK" on Delete Temporary Files Window.
    • Note: This deletes all of the Downloaded Applications and Applets from the Cache.
    • Click "OK" to leave the Temporary Files Window.
    • Click "OK" to leave the Java Control Panel.

    Let me know once you have completed the above.
Post #15
Jon, I deleted the TDss file and the Java files. I will be out of town tonight and will not be able to reply till tomorrow evening or the next day. Chester

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI