Spyware / Malware / Virus Removal

likely infection (ZeroAccess?) [Solved]

9 min read

Looking for the outcome? Ask AI

SuMMiT Topic Starter

Post #1May 8, 2012, 2:23 PM UTC

Recently began a case with y'all due to a ZeroAccess infection. I wasn't able to get back to the tech for a few days so the case got closed. (http://forums.whatthetech.com/index.php?showtopic=123031)
No worries there, but it seems my machine is still buggered up so I'd like to try and get back to this.

As you can see from the previous thread, we found a ZeroAccess infection. Following the tech's advice I ran Combofix. Upon completion it was unable to reboot the machine. The machine kind of just hung halfway through shutdown. I manually shut down and rebooted the machine. Upon startup I could not connect to the internet. A second reboot corrected that and I've been able to access the internet since.

The good news is I am again online and no longer experiencing google redirects.

Bad news is often when I close a tab in IE it reopens the same page in many tabs. Also, it seems as if my machine no longer recognizes its audio hardware - no access to volume in system tray and when I try to access the volume control through the start menu>progs>accessories>entertainment I receive a message that says "There are no active mixer devices available. To install mixer devices…..". I imagine there are other symptoms I just haven't noticed yet.

Thanks!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:21:49 AM, on 5/8/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe
C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
C:\WINDOWS\system32\HPSIsvc.exe
C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor Enterprise\McSACore.exe
C:\WINDOWS\system32\mfevtps.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Xobni\XobniService.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtTray.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\DellTPad\Apoint.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\OA001Mon.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe
C:\Program Files\Wave Systems Corp\SecureUpgrade.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe
C:\Program Files\McAfee\Managed VirusScan\DesktopUI\XTray.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files\ACT\Act for Windows\Act.Outlook.Service.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Documents and Settings\jzipkin\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\program files\real\realplayer\update\realsched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\jzipkin\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110919093418.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files\McAfee\SiteAdvisor Enterprise\McIEPlg.dll
O2 - BHO: Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile - {D5233FCD-D258-4903-89B8-FB1568E7413D} - mscoree.dll (file missing)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files\McAfee\SiteAdvisor Enterprise\McIEPlg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [OA001Mon] C:\WINDOWS\OA001Mon.exe
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [ChangeTPMAuth] C:\Program Files\Wave Systems Corp\Common\ChangeTPMAuth.exe /T:NTRU12
O4 - HKLM\..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe
O4 - HKLM\..\Run: [SecureUpgrade] C:\Program Files\Wave Systems Corp\SecureUpgrade.exe
O4 - HKLM\..\Run: [EmbassySecurityCheck] "C:\Program Files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe"
O4 - HKLM\..\Run: [DellControlPoint] "C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe"
O4 - HKLM\..\Run: [DCPstrApp] C:\Program Files\Dell\Dell ControlPoint\Security Manager\SecurityDeviceInfoSetRegistryString.exe
O4 - HKLM\..\Run: [DellConnectionManager] "C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe"
O4 - HKLM\..\Run: [MVS Splash] "C:\Program Files\McAfee\Managed VirusScan\DesktopUI\XTray.exe"
O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Act.Outlook.Service] "C:\Program Files\ACT\Act for Windows\Act.Outlook.Service.exe"
O4 - HKLM\..\Run: [Act! Preloader] "C:\Program Files\ACT\Act for Windows\ActSage.exe" -preload
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [YMailAdvisor] "C:\Program Files\Yahoo!\Common\YMailAdvisor.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [Dell Webcam Central] "C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" /mode2
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\program files\real\realplayer\update\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Facebook Update] "C:\Documents and Settings\jzipkin\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_2_202_233_ActiveX.exe -update activex
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Dell ControlPoint System Manager.lnk = C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Attach Web page to ACT! contact - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)
O9 - Extra 'Tools' menuitem: Attach Web page to ACT! contact… - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com (HKLM)
O15 - Trusted Zone: http://betavscan.mcafeeasap.com (HKLM)
O15 - Trusted Zone: http://vs.mcafeeasap.com (HKLM)
O15 - Trusted Zone: http://www.mcafeeasap.com (HKLM)
O15 - ESC Trusted Zone: http://*.mcafee.com (HKLM)
O15 - ESC Trusted Zone: http://betavscan.mcafeeasap.com (HKLM)
O15 - ESC Trusted Zone: http://vs.mcafeeasap.com (HKLM)
O15 - ESC Trusted Zone: http://www.mcafeeasap.com (HKLM)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1307550125529
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-31-0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = waypoint.local
O17 - HKLM\Software\..\Telephony: DomainName = waypoint.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = waypoint.local
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor Enterprise\McIEPlg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor Enterprise\McIEPlg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ACT! Scheduler - Sage Software, Inc. - C:\Program Files\ACT\Act for Windows\Act.Scheduler.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Dell ControlPoint Button Service (buttonsvc32) - Dell Inc. - C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe
O23 - Service: Credential Vault Host Control Service - Broadcom Corporation - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
O23 - Service: Credential Vault Host Storage - Broadcom Corporation - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
O23 - Service: Dell ControlPoint System Manager (dcpsysmgrsvc) - Dell Inc. - C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: HP SI Service (HPSIService) - HP - C:\WINDOWS\system32\HPSIsvc.exe
O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: McAfee SiteAdvisor Enterprise Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor Enterprise\McSACore.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe
O23 - Service: McAfee Virus and Spyware Protection Service (myAgtSvc) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: McAfee Peer Distribution Service (RumorServer) - McAfee, Inc. - C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe
O23 - Service: Smith Micro Connection Manager Service (SMManager) - Smith Micro Software, Inc. - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\drivers\audio\r267815\payload\wdm\stacsv.exe
O23 - Service: NTRU TSS v1.2.1.27 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe
O23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
O23 - Service: XobniService - Xobni Corporation - C:\Program Files\Xobni\XobniService.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 18018 bytes

Satchfan

Post #2May 9, 2012, 8:41 AM UTC

Hello SuMMIT

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

please follow all instructions in the order posted
please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for this issue on this machine.
please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

We’ll have to start again to see the present state of affairs.

Run DDS

Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.pif

disable any script blocking protection (How to Disable your Security Programs)
double click DDS icon to run the tool (may take up to 3 minutes to run)
when done, DDS.txt will open.
after a few moments, attach.txt will open in a second window.
save both reports to your desktop.
Post the contents of the DDS.txt and Attach.txt reports in your next reply

===================================================

Run aswMBR

download aswMBR.exe to your desktop.
double click aswMBR.exe to run it
if asked, accept the AVAST virus definition download
click the "Scan" button to start scan
on completion of the scan click Save log, save it to your desktop and post in your next reply

Logs to include with next post:

DDS.txt
Attach.txt
aswMBR log

Satchfan

SuMMiT

Post #3May 9, 2012, 2:40 PM UTC

Thanks for the assistance. Here are the logs… . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.4.1 Run by [removed] at 10:03:50 on 2012-05-09 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3572.2210 [GMT -4:00] . AV: McAfee® Security-as-a-Service Anti-virus *Disabled/Updated* {8C354827-2F54-4E28-90DC-AD391E77808C} . ============== Running Processes =============== . C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe svchost.exe C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe C:\Program Files\Intel\ASF Agent\ASFAgent.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe C:\WINDOWS\system32\HPSIsvc.exe C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe C:\Program Files\McAfee\SiteAdvisor Enterprise\McSACore.exe C:\WINDOWS\system32\mfevtps.exe C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Xobni\XobniService.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Program Files\WIDCOMM\Bluetooth Software\BtTray.exe C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\Program Files\DellTPad\Apoint.exe C:\WINDOWS\system32\AESTFltr.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\OA001Mon.exe C:\Program Files\DellTPad\ApMsgFwd.exe C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe C:\Program Files\Wave Systems Corp\SecureUpgrade.exe C:\Program Files\DellTPad\HidFind.exe C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe C:\Program Files\DellTPad\Apntex.exe C:\Program Files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe C:\Program Files\McAfee\Managed VirusScan\DesktopUI\XTray.exe C:\Program Files\Logitech\SetPointP\SetPoint.exe C:\Program Files\ACT\Act for Windows\Act.Outlook.Service.exe C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe C:\Program Files\Yahoo!\Common\YMailAdvisor.exe C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Microsoft ActiveSync\wcescomm.exe C:\Documents and Settings\jzipkin\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\MI3AA1~1\rapimgr.exe C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\program files\real\realplayer\update\realsched.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\McAfee\Managed VirusScan\DesktopUI\TOPSConsole.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://my.yahoo.com/ uURLSearchHooks: YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll mURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\oracle\javafx 2.1 runtime\bin\ssv.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20110919093418.dll BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll BHO: Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile: {d5233fcd-d258-4903-89b8-fb1568e7413d} - mscoree.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\oracle\javafx 2.1 runtime\bin\jp2ssv.dll BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe" uRun: [Facebook Update] "c:\documents and settings\jzipkin\local settings\application data\facebook\update\FacebookUpdate.exe" /c /nocrashserver uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil32_11_2_202_233_ActiveX.exe -update activex mRun: [Apoint] c:\program files\delltpad\Apoint.exe mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe mRun: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg mRun: [nwiz] nwiz.exe /installquiet mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NVHotkey] rundll32.exe nvHotkey.dll,Start mRun: [OA001Mon] c:\windows\OA001Mon.exe mRun: [IAStorIcon] c:\program files\intel\intel® rapid storage technology\IAStorIcon.exe mRun: [ChangeTPMAuth] c:\program files\wave systems corp\common\ChangeTPMAuth.exe /T:NTRU12 mRun: [WavXMgr] c:\program files\wave systems corp\services manager\docmgr\bin\WavXDocMgr.exe mRun: [SecureUpgrade] c:\program files\wave systems corp\SecureUpgrade.exe mRun: [EmbassySecurityCheck] "c:\program files\wave systems corp\embassy security setup\EMBASSYSecurityCheck.exe" mRun: [DellControlPoint] "c:\program files\dell\dell controlpoint\Dell.ControlPoint.exe" mRun: [DCPstrApp] c:\program files\dell\dell controlpoint\security manager\SecurityDeviceInfoSetRegistryString.exe mRun: [DellConnectionManager] "c:\program files\dell\dell controlpoint\connection manager\Dell.UCM.exe" mRun: [MVS Splash] "c:\program files\mcafee\managed virusscan\desktopui\XTray.exe" mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [Act.Outlook.Service] "c:\program files\act\act for windows\Act.Outlook.Service.exe" mRun: [Act! Preloader] "c:\program files\act\act for windows\ActSage.exe" -preload mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe" mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe" mRun: [YMailAdvisor] "c:\program files\yahoo!\common\YMailAdvisor.exe" mRun: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon mRun: [Dell Webcam Central] "c:\program files\dell webcam\dell webcam central\WebcamDell.exe" /mode2 mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dellco~1.lnk - c:\program files\dell\dell controlpoint\system manager\DCPSysMgr.exe mPolicies-explorer: NoWelcomeScreen = 1 (0x1) IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: Send to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll IE: {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL Trusted Zone: //about.htm/ Trusted Zone: //Exclude.htm/ Trusted Zone: //LanguageSelection.htm/ Trusted Zone: //Message.htm/ Trusted Zone: //MyAgttryCmd.htm/ Trusted Zone: //MyAgttryNag.htm/ Trusted Zone: //MyNotification.htm/ Trusted Zone: //NOCLessUpdate.htm/ Trusted Zone: //quarantine.htm/ Trusted Zone: //ScanNow.htm/ Trusted Zone: //strings.vbs/ Trusted Zone: //Template.htm/ Trusted Zone: //Update.htm/ Trusted Zone: //VirFound.htm/ Trusted Zone: mcafee.com\* Trusted Zone: mcafeeasap.com\betavscan Trusted Zone: mcafeeasap.com\vs Trusted Zone: mcafeeasap.com\www DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1307550125529 DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = 10.0.0.11 TCP: Interfaces\{3EC90BA7-13DA-43D8-B7BC-EF802309F89E} : DhcpNameServer = 10.0.0.11 Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll Handler: myrm - {4D034FC3-013F-4b95-B544-44D49ABE3E76} - c:\program files\mcafee\managed virusscan\agent\MyRmProt5.0.0.811.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor enterprise\McIEPlg.dll Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll . ============= SERVICES / DRIVERS =============== . R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-7-22 461864] R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2010-8-12 89624] R2 ASFAgent;ASF Agent;c:\program files\intel\asf agent\ASFAgent.exe [2007-4-19 133968] R2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\dell\dell controlpoint\DCPButtonSvc.exe [2008-9-4 406808] R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostControlService.exe [2008-11-11 808296] R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostStorageService.exe [2008-11-11 20840] R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\dell\dell controlpoint\system manager\DCPSysMgrSvc.exe [2008-11-11 451872] R2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [2011-12-29 99896] R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\intel\intel® rapid storage technology\IAStorDataMgrSvc.exe [2010-7-22 13336] R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2010-7-26 10448] R2 McAfee SiteAdvisor Enterprise Service;McAfee SiteAdvisor Enterprise Service;c:\program files\mcafee\siteadvisor enterprise\McSACore.exe [2011-5-12 324928] R2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-11-16 166024] R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2010-11-16 148520] R2 MSSQL$ACT7;SQL Server (ACT7);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2010-12-10 29293408] R2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\mcafee\managed virusscan\agent\myAgtSvc.exe [2011-8-23 291064] R2 RumorServer;McAfee Peer Distribution Service;c:\program files\mcafee\managed virusscan\agent\myAgtSvc.exe [2011-8-23 291064] R2 SMManager;Smith Micro Connection Manager Service;c:\program files\dell\dell controlpoint\connection manager\SMManager.exe [2008-10-1 90112] R2 XobniService;XobniService;c:\program files\xobni\XobniService.exe [2010-5-20 55016] R3 CCIDFILTER;Broadcom Smart Card Reader Filter Driver;c:\windows\system32\drivers\ccidflt.sys [2010-7-22 12840] R3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [2010-7-21 32808] R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [2010-7-21 240344] R3 MfeAVFK;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-7-22 180008] R3 MfeBOPK;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-7-22 59288] R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-8-12 87808] R3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\drivers\OA001Ufd.sys [2010-7-21 133632] R3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\drivers\OA001Vid.sys [2010-7-21 281472] S2 ACT! Scheduler;ACT! Scheduler;c:\program files\act\act for windows\Act.Scheduler.exe [2009-2-24 81920] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-7-26 136176] S2 pavprsrv;Oraclewebassistant;c:\windows\system32\svchost.exe -k netsvcs [2008-4-25 14336] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-25 253088] S3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2010-7-21 113664] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-7-26 136176] S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?] S3 MfeRKDK;McAfee Inc. MfeRKDK;c:\windows\system32\drivers\mferkdk.sys [2010-7-22 34248] S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [2009-12-18 20480] S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [2009-12-18 174720] S3 OA001Afx;Provides a software interface to control audio effects of OA001 camera.;c:\windows\system32\drivers\OA001Afx.sys [2010-7-21 134144] S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\verizo~1\vzacce~1\SMSIVZAM5.SYS [2010-4-14 32408] S3 TrmbTS;TrmbTS;c:\windows\system32\drivers\TrmbTS.sys [2010-8-26 29184] S3 TRMUSB5K;Trimble USB GPS Driver;c:\windows\system32\drivers\trmusb5k.sys –> c:\windows\system32\drivers\TRMUSB5K.sys [?] S3 USA19H;USA19H;c:\windows\system32\drivers\USA19H2k.sys [2010-8-13 704000] S3 USA19H2KP;Keyspan USB Serial Port Driver;c:\windows\system32\drivers\USA19H2kp.sys [2010-8-13 24192] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-25 14336] S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2009-7-22 47128] S4 RsFx0105;RsFx0105 Driver;c:\windows\system32\drivers\RsFx0105.sys [2011-9-22 238696] S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2011-9-22 370024] . =============== Created Last 30 ================ . 2012-04-30 16:21:39 ——– d—–w- C:\Data 2012-04-30 15:32:53 ——– d—–w- c:\program files\Oracle 2012-04-30 15:32:41 772504 —-a-w- c:\windows\system32\npDeployJava1.dll 2012-04-30 15:32:41 143872 —-a-w- c:\windows\system32\javacpl.cpl 2012-04-30 13:17:04 138496 -c–a-w- c:\windows\system32\dllcache\afd.sys 2012-04-30 13:17:04 138496 —-a-w- c:\windows\system32\drivers\afd.sys 2012-04-27 03:09:29 162816 —-a-w- c:\windows\system32\drivers\netbt.sys 2012-04-27 02:52:18 ——– d—–w- C:\TDSSKiller_Quarantine 2012-04-26 17:05:48 388608 —-a-w- C:\HiJackThis.exe 2012-04-25 13:45:51 418464 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2012-04-25 13:34:50 ——– d—–w- c:\documents and settings\jzipkin\application data\Intel Corporation . ==================== Find3M ==================== . 2012-05-09 13:45:06 1994 –sha-w- c:\documents and settings\all users\application data\KGyGaAvL.sys 2012-04-27 02:53:43 75264 —-a-w- c:\windows\system32\drivers\ipsec.sys 2012-04-25 13:45:50 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-04-04 22:47:02 687504 —-a-w- c:\windows\system32\deployJava1.dll . ============= FINISH: 10:04:49.81 =============== aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software Run date: 2012-05-09 10:12:34 —————————– 10:12:34.620 OS Version: Windows 5.1.2600 Service Pack 3 10:12:34.620 Number of processors: 2 586 0x1706 10:12:34.620 ComputerName: C4LHXH1 UserName: JZipkin 10:12:37.558 Initialize success 10:14:47.283 AVAST engine defs: 12050900 10:18:11.081 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 10:18:11.081 Disk 0 Vendor: ST916031 D005 Size: 152627MB BusType: 8 10:18:11.081 Disk 1 \Device\Harddisk1\SR0 -> \Device\SdBus-0 10:18:11.081 Disk 1 Vendor: ( Size: 240MB BusType: 12 10:18:11.128 Disk 0 MBR read successfully 10:18:11.128 Disk 0 MBR scan 10:18:11.190 Disk 0 Windows VISTA default MBR code 10:18:11.190 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 62 MB offset 63 10:18:11.221 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 152562 MB offset 128520 10:18:11.221 Disk 0 scanning sectors +312576705 10:18:11.331 Disk 0 scanning C:\WINDOWS\system32\drivers 10:18:27.157 Service scanning 10:19:02.574 Modules scanning 10:19:11.729 Disk 0 trace - called modules: 10:19:11.760 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 10:19:11.760 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8b653868] 10:19:11.760 3 CLASSPNP.SYS[b80e8fd7] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x8b633028] 10:19:12.416 AVAST engine scan C:\WINDOWS 10:19:25.993 AVAST engine scan C:\WINDOWS\system32 10:22:53.466 AVAST engine scan C:\WINDOWS\system32\drivers 10:23:09.496 AVAST engine scan C:\Documents and Settings\jzipkin 10:37:43.999 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\jzipkin\Desktop\MBR.dat" 10:37:43.999 The log file has been saved successfully to "C:\Documents and Settings\jzipkin\Desktop\aswMBR.txt"

Attachments:

📎attach.txt

Satchfan

Post #4May 9, 2012, 3:48 PM UTC last edited May 9, 2012, 3:49 PM UTC

Hi SuMMIT

After a quick glance, the old infection seems to be gone so we just need to see what is happening now.

Run TDSSKiller

Please download TDSSKiller.zip

extract it to your desktop
double click TDSSKiller.exe
press Start Scan
only if Malicious objects are found then ensure Cure is selected. Do not change it to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly.
click Continue > Reboot now
copy and paste the log in your next reply
a copy of the log will be saved automatically to the root of the drive (typically C:\) called TDSSKiller_*** (*** denotes version & date)

Can you also send the previous results of TDSSKiller and ComboFix If you still have them.

the old TDSSKiller report can be found in your root directory, (usually C:\ folder) and will reflect the date that it was run
the ComboFix log will be found at C:\Qoobox\ComboFix-quarantined-files.txt

Thanks

Satchfan

SuMMiT

Post #5May 9, 2012, 4:06 PM UTC

Thx Satchfan. Just ran TDSKiller. No threats found. Machine still acting funky.

All 3 logs you asked for…

Here's the log:
11:58:50.0187 4328 TDSS rootkit removing tool 2.7.34.0 May 2 2012 09:59:18
11:58:50.0484 4328 ============================================================
11:58:50.0484 4328 Current date / time: 2012/05/09 11:58:50.0484
11:58:50.0484 4328 SystemInfo:
11:58:50.0484 4328
11:58:50.0484 4328 OS Version: 5.1.2600 ServicePack: 3.0
11:58:50.0484 4328 Product type: Workstation
11:58:50.0484 4328 ComputerName: C4LHXH1
11:58:50.0484 4328 UserName: JZipkin
11:58:50.0484 4328 Windows directory: C:\WINDOWS
11:58:50.0484 4328 System windows directory: C:\WINDOWS
11:58:50.0484 4328 Processor architecture: Intel x86
11:58:50.0484 4328 Number of processors: 2
11:58:50.0484 4328 Page size: 0x1000
11:58:50.0484 4328 Boot type: Normal boot
11:58:50.0484 4328 ============================================================
11:58:51.0687 4328 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
11:58:51.0703 4328 ============================================================
11:58:51.0703 4328 \Device\Harddisk0\DR0:
11:58:51.0703 4328 MBR partitions:
11:58:51.0703 4328 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1F608, BlocksNum 0x129F94B9
11:58:51.0703 4328 ============================================================
11:58:51.0750 4328 C: <-> \Device\Harddisk0\DR0\Partition0
11:58:51.0750 4328 ============================================================
11:58:51.0750 4328 Initialize success
11:58:51.0750 4328 ============================================================
12:00:13.0358 6588 ============================================================
12:00:13.0358 6588 Scan started
12:00:13.0358 6588 Mode: Manual;
12:00:13.0358 6588 ============================================================
12:00:17.0139 6588 Abiosdsk - ok
12:00:17.0342 6588 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
12:00:17.0499 6588 abp480n5 - ok
12:00:17.0889 6588 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
12:00:17.0936 6588 ACPI - ok
12:00:17.0936 6588 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
12:00:17.0936 6588 ACPIEC - ok
12:00:18.0374 6588 ACT! Scheduler (04fa07c4eed949b3ba64b536d1438130) C:\Program Files\ACT\Act for Windows\Act.Scheduler.exe
12:00:18.0639 6588 ACT! Scheduler - ok
12:00:19.0499 6588 AdobeFlashPlayerUpdateSvc (459ac130c6ab892b1cd5d7544626efc5) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
12:00:19.0499 6588 AdobeFlashPlayerUpdateSvc - ok
12:00:19.0905 6588 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
12:00:20.0155 6588 adpu160m - ok
12:00:20.0639 6588 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
12:00:20.0639 6588 aec - ok
12:00:21.0045 6588 AESTAud (822d53766d57c90c437536232ece9023) C:\WINDOWS\system32\drivers\AESTAud.sys
12:00:21.0264 6588 AESTAud - ok
12:00:22.0123 6588 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
12:00:22.0123 6588 AFD - ok
12:00:22.0311 6588 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
12:00:22.0311 6588 agp440 - ok
12:00:22.0577 6588 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
12:00:22.0608 6588 agpCPQ - ok
12:00:22.0670 6588 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
12:00:22.0858 6588 Aha154x - ok
12:00:23.0077 6588 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
12:00:23.0233 6588 aic78u2 - ok
12:00:23.0389 6588 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
12:00:23.0514 6588 aic78xx - ok
12:00:23.0623 6588 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll
12:00:23.0655 6588 Alerter - ok
12:00:23.0936 6588 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe
12:00:23.0936 6588 ALG - ok
12:00:23.0983 6588 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
12:00:24.0014 6588 AliIde - ok
12:00:24.0170 6588 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
12:00:24.0186 6588 alim1541 - ok
12:00:24.0389 6588 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
12:00:24.0452 6588 amdagp - ok
12:00:24.0498 6588 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
12:00:24.0623 6588 amsint - ok
12:00:25.0748 6588 ApfiltrService (22403504e15810e99a563782e9d45311) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
12:00:26.0045 6588 ApfiltrService - ok
12:00:26.0686 6588 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll
12:00:26.0811 6588 AppMgmt - ok
12:00:27.0061 6588 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
12:00:27.0077 6588 Arp1394 - ok
12:00:27.0108 6588 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
12:00:27.0311 6588 asc - ok
12:00:27.0389 6588 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
12:00:27.0514 6588 asc3350p - ok
12:00:27.0577 6588 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
12:00:27.0639 6588 asc3550 - ok
12:00:28.0248 6588 ASFAgent (9ad6ef4d591211a93848103368125b41) C:\Program Files\Intel\ASF Agent\ASFAgent.exe
12:00:28.0467 6588 ASFAgent - ok
12:00:28.0795 6588 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
12:00:28.0952 6588 aspnet_state - ok
12:00:28.0998 6588 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
12:00:29.0108 6588 AsyncMac - ok
12:00:29.0311 6588 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
12:00:29.0342 6588 atapi - ok
12:00:29.0342 6588 Atdisk - ok
12:00:29.0530 6588 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
12:00:29.0530 6588 Atmarpc - ok
12:00:29.0733 6588 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll
12:00:29.0795 6588 AudioSrv - ok
12:00:29.0858 6588 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
12:00:29.0858 6588 audstub - ok
12:00:31.0155 6588 BCM43XX (9208c78bd9283f79a30252ad954c77a2) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
12:00:31.0592 6588 BCM43XX - ok
12:00:31.0623 6588 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
12:00:31.0623 6588 Beep - ok
12:00:32.0420 6588 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll
12:00:32.0514 6588 BITS - ok
12:00:32.0780 6588 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll
12:00:32.0780 6588 Browser - ok
12:00:33.0998 6588 btaudio (f688bbbe8e3e7e03e35caabd66616ddb) C:\WINDOWS\system32\drivers\btaudio.sys
12:00:34.0311 6588 btaudio - ok
12:00:34.0514 6588 BTDriver (2f9f111d31aa3fbbe5781d829a4524e6) C:\WINDOWS\system32\DRIVERS\btport.sys
12:00:34.0639 6588 BTDriver - ok
12:00:36.0514 6588 BTKRNL (38a3331e2f690d4cdc9de0604b9416e5) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
12:00:37.0030 6588 BTKRNL - ok
12:00:38.0108 6588 btwdins (d48148110ae078cb7221d0fcf20adfec) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
12:00:38.0451 6588 btwdins - ok
12:00:40.0326 6588 BTWDNDIS (80f61de965c116051614ac2f04222ff7) C:\WINDOWS\system32\DRIVERS\btwdndis.sys
12:00:40.0623 6588 BTWDNDIS - ok
12:00:42.0014 6588 btwhid (949eca9c56f657c06d3166d51f3226c7) C:\WINDOWS\system32\DRIVERS\btwhid.sys
12:00:42.0311 6588 btwhid - ok
12:00:42.0561 6588 btwmodem (5922bae0cd84924b9cd7e6bb515ee070) C:\WINDOWS\system32\DRIVERS\btwmodem.sys
12:00:42.0608 6588 btwmodem - ok
12:00:42.0764 6588 BTWUSB (d5af663711660d32ec230c6aaf7b6b83) C:\WINDOWS\system32\Drivers\btwusb.sys
12:00:42.0983 6588 BTWUSB - ok
12:00:43.0701 6588 buttonsvc32 (4c2a9823c48882bce93e26105e1434e2) C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe
12:00:43.0858 6588 buttonsvc32 - ok
12:00:43.0858 6588 catchme - ok
12:00:43.0936 6588 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
12:00:43.0936 6588 cbidf - ok
12:00:43.0936 6588 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
12:00:43.0936 6588 cbidf2k - ok
12:00:44.0186 6588 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
12:00:44.0233 6588 CCDECODE - ok
12:00:44.0326 6588 CCIDFILTER (d006b6a67b8daed85e6d91783e9b45d6) C:\WINDOWS\system32\DRIVERS\ccidflt.sys
12:00:44.0467 6588 CCIDFILTER - ok
12:00:44.0670 6588 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
12:00:44.0764 6588 cd20xrnt - ok
12:00:44.0826 6588 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
12:00:44.0889 6588 Cdaudio - ok
12:00:45.0170 6588 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
12:00:45.0170 6588 Cdfs - ok
12:00:45.0467 6588 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
12:00:45.0467 6588 Cdrom - ok
12:00:45.0467 6588 Changer - ok
12:00:45.0498 6588 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe
12:00:45.0498 6588 CiSvc - ok
12:00:45.0654 6588 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe
12:00:45.0701 6588 ClipSrv - ok
12:00:46.0311 6588 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
12:00:46.0529 6588 clr_optimization_v2.0.50727_32 - ok
12:00:46.0576 6588 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
12:00:46.0576 6588 CmBatt - ok
12:00:46.0670 6588 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
12:00:46.0686 6588 CmdIde - ok
12:00:46.0733 6588 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
12:00:46.0764 6588 Compbatt - ok
12:00:46.0779 6588 COMSysApp - ok
12:00:46.0826 6588 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
12:00:46.0842 6588 Cpqarray - ok
12:00:49.0326 6588 Credential Vault Host Control Service (9d57165906778c9e5e0ecb34b311564b) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
12:00:49.0795 6588 Credential Vault Host Control Service - ok
12:00:49.0842 6588 Credential Vault Host Storage (e31e97859deee648d5867eadfbdbf25a) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
12:00:50.0139 6588 Credential Vault Host Storage - ok
12:00:50.0326 6588 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll
12:00:50.0326 6588 CryptSvc - ok
12:00:50.0436 6588 cvusbdrv (dc6429fbc73b0b0b38cc5386c8a607ed) C:\WINDOWS\system32\Drivers\cvusbdrv.sys
12:00:50.0498 6588 cvusbdrv - ok
12:00:51.0154 6588 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
12:00:51.0326 6588 dac2w2k - ok
12:00:51.0373 6588 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
12:00:51.0545 6588 dac960nt - ok
12:00:52.0014 6588 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll
12:00:52.0076 6588 DcomLaunch - ok
12:00:53.0701 6588 dcpsysmgrsvc (ce597e34d62c603871e2f2f5155a88e5) C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
12:00:53.0811 6588 dcpsysmgrsvc - ok
12:00:54.0029 6588 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll
12:00:54.0123 6588 Dhcp - ok
12:00:54.0264 6588 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
12:00:54.0264 6588 Disk - ok
12:00:54.0279 6588 dmadmin - ok
12:00:56.0670 6588 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
12:00:56.0842 6588 dmboot - ok
12:00:57.0139 6588 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
12:00:57.0186 6588 dmio - ok
12:00:57.0279 6588 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
12:00:57.0279 6588 dmload - ok
12:00:57.0420 6588 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll
12:00:57.0420 6588 dmserver - ok
12:00:57.0701 6588 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
12:00:57.0717 6588 DMusic - ok
12:00:57.0967 6588 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll
12:00:57.0967 6588 Dnscache - ok
12:00:58.0639 6588 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll
12:00:58.0686 6588 Dot3svc - ok
12:00:58.0717 6588 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
12:00:58.0748 6588 dpti2o - ok
12:00:58.0811 6588 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
12:00:58.0811 6588 drmkaud - ok
12:00:59.0326 6588 e1yexpress (71ff7ad30bd9e3c06df112383bb60089) C:\WINDOWS\system32\DRIVERS\e1y5132.sys
12:00:59.0811 6588 e1yexpress - ok
12:00:59.0904 6588 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll
12:00:59.0904 6588 EapHost - ok
12:00:59.0998 6588 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll
12:01:00.0045 6588 ERSvc - ok
12:01:00.0420 6588 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe
12:01:00.0498 6588 Eventlog - ok
12:01:01.0685 6588 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll
12:01:01.0873 6588 EventSystem - ok
12:01:02.0185 6588 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
12:01:02.0201 6588 Fastfat - ok
12:01:02.0545 6588 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
12:01:02.0576 6588 FastUserSwitchingCompatibility - ok
12:01:03.0639 6588 Fax (e97d6a8684466df94ff3bc24fb787a07) C:\WINDOWS\system32\fxssvc.exe
12:01:03.0717 6588 Fax - ok
12:01:03.0826 6588 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
12:01:03.0967 6588 Fdc - ok
12:01:04.0060 6588 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
12:01:04.0092 6588 Fips - ok
12:01:05.0685 6588 FLEXnet Licensing Service (f76d04f7413b07daa029f6520b64b4e8) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
12:01:06.0045 6588 FLEXnet Licensing Service - ok
12:01:06.0092 6588 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
12:01:06.0092 6588 Flpydisk - ok
12:01:06.0295 6588 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
12:01:06.0310 6588 FltMgr - ok
12:01:06.0420 6588 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
12:01:06.0435 6588 FontCache3.0.0.0 - ok
12:01:06.0451 6588 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
12:01:06.0451 6588 Fs_Rec - ok
12:01:06.0467 6588 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
12:01:06.0467 6588 Ftdisk - ok
12:01:06.0482 6588 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
12:01:06.0482 6588 Gpc - ok
12:01:06.0545 6588 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
12:01:06.0639 6588 gupdate - ok
12:01:06.0654 6588 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
12:01:06.0748 6588 gupdatem - ok
12:01:06.0779 6588 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
12:01:06.0795 6588 HDAudBus - ok
12:01:06.0873 6588 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
12:01:06.0889 6588 helpsvc - ok
12:01:06.0951 6588 HidServ (deb04da35cc871b6d309b77e1443c796) C:\WINDOWS\System32\hidserv.dll
12:01:06.0982 6588 HidServ - ok
12:01:07.0014 6588 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
12:01:07.0014 6588 hidusb - ok
12:01:07.0045 6588 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll
12:01:07.0045 6588 hkmsvc - ok
12:01:07.0060 6588 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
12:01:07.0107 6588 hpn - ok
12:01:07.0154 6588 HPSIService (a9d667f5308982a3305f364eb02458d0) C:\WINDOWS\system32\HPSIsvc.exe
12:01:07.0232 6588 HPSIService - ok
12:01:07.0310 6588 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
12:01:07.0310 6588 HTTP - ok
12:01:07.0357 6588 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll
12:01:07.0373 6588 HTTPFilter - ok
12:01:07.0404 6588 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
12:01:07.0404 6588 i2omgmt - ok
12:01:07.0435 6588 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
12:01:07.0435 6588 i2omp - ok
12:01:07.0467 6588 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
12:01:07.0482 6588 i8042prt - ok
12:01:07.0560 6588 iaStor (26541a068572f650a2fa490726fe81be) C:\WINDOWS\system32\drivers\iaStor.sys
12:01:07.0560 6588 iaStor - ok
12:01:07.0779 6588 IAStorDataMgrSvc (31a0e93cdf29007d6c6fffb632f375ed) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
12:01:07.0935 6588 IAStorDataMgrSvc - ok
12:01:07.0951 6588 idebusdr - ok
12:01:08.0139 6588 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
12:01:08.0451 6588 idsvc - ok
12:01:08.0514 6588 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
12:01:08.0514 6588 Imapi - ok
12:01:08.0545 6588 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe
12:01:08.0545 6588 ImapiService - ok
12:01:08.0576 6588 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
12:01:08.0639 6588 ini910u - ok
12:01:08.0639 6588 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
12:01:08.0654 6588 IntelIde - ok
12:01:08.0670 6588 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
12:01:08.0670 6588 intelppm - ok
12:01:08.0701 6588 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
12:01:08.0701 6588 Ip6Fw - ok
12:01:08.0717 6588 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
12:01:08.0717 6588 IpFilterDriver - ok
12:01:08.0717 6588 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
12:01:08.0717 6588 IpInIp - ok
12:01:08.0748 6588 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
12:01:08.0764 6588 IpNat - ok
12:01:08.0779 6588 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
12:01:08.0779 6588 IPSec - ok
12:01:08.0842 6588 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
12:01:08.0842 6588 IRENUM - ok
12:01:08.0904 6588 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
12:01:08.0904 6588 isapnp - ok
12:01:09.0060 6588 JavaQuickStarterService (5472d771c0197355c1d347f20392b982) C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
12:01:09.0154 6588 JavaQuickStarterService - ok
12:01:09.0201 6588 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
12:01:09.0217 6588 Kbdclass - ok
12:01:09.0232 6588 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
12:01:09.0264 6588 kbdhid - ok
12:01:09.0342 6588 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
12:01:09.0342 6588 kmixer - ok
12:01:09.0404 6588 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
12:01:09.0404 6588 KSecDD - ok
12:01:09.0435 6588 LanmanServer (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll
12:01:09.0451 6588 LanmanServer - ok
12:01:09.0467 6588 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll
12:01:09.0482 6588 lanmanworkstation - ok
12:01:09.0498 6588 LBeepKE (ca63fe81705ad660e482bef210bf2c73) C:\WINDOWS\system32\Drivers\LBeepKE.sys
12:01:09.0685 6588 LBeepKE - ok
12:01:09.0701 6588 lbrtfdc - ok
12:01:09.0842 6588 LBTServ (ab097d0f93b30a6d79d430422ac6a7e8) C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
12:01:09.0889 6588 LBTServ - ok
12:01:09.0935 6588 LHidFilt (b68309f25c5787385da842eb5b496958) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
12:01:09.0998 6588 LHidFilt - ok
12:01:10.0029 6588 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll
12:01:10.0029 6588 LmHosts - ok
12:01:10.0045 6588 LMouFilt (63d3b1d3cd267fcc186a0146b80d453b) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
12:01:10.0092 6588 LMouFilt - ok
12:01:10.0092 6588 MBAMSwissArmy - ok
12:01:10.0185 6588 McAfee SiteAdvisor Enterprise Service (4f2d526298cbc517edb82501e8041112) C:\Program Files\McAfee\SiteAdvisor Enterprise\McSACore.exe
12:01:10.0264 6588 McAfee SiteAdvisor Enterprise Service - ok
12:01:10.0373 6588 McShield (1fe222eaf4ba73ced5a0707b38f3c0b1) C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
12:01:10.0373 6588 McShield - ok
12:01:10.0420 6588 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll
12:01:10.0420 6588 Messenger - ok
12:01:10.0467 6588 mfeapfk (37364b530339ff0b0ababc8df1c532c3) C:\WINDOWS\system32\drivers\mfeapfk.sys
12:01:10.0467 6588 mfeapfk - ok
12:01:10.0514 6588 MfeAVFK (cd2a8a43bd6b0d15a3255829b1778285) C:\WINDOWS\system32\drivers\mfeavfk.sys
12:01:10.0514 6588 MfeAVFK - ok
12:01:10.0514 6588 mfeavfk01 - ok
12:01:10.0545 6588 MfeBOPK (2cd52e91ba338f10ba14d3f90bbda5e8) C:\WINDOWS\system32\drivers\mfebopk.sys
12:01:10.0545 6588 MfeBOPK - ok
12:01:10.0638 6588 mfehidk (cf669582f5f98c4ba79d59cfe169198b) C:\WINDOWS\system32\drivers\mfehidk.sys
12:01:10.0904 6588 mfehidk - ok
12:01:10.0920 6588 mferkdet (42f84c2a82a057d74c54ef70e0cf0a2c) C:\WINDOWS\system32\drivers\mferkdet.sys
12:01:10.0920 6588 mferkdet - ok
12:01:10.0951 6588 MfeRKDK (820d6aa3f7f0cfa8a1fa8f63d3f1df04) C:\WINDOWS\system32\drivers\MfeRKDK.sys
12:01:11.0029 6588 MfeRKDK - ok
12:01:11.0060 6588 mfetdi2k (03b2b8bd4d0a2d3636be9248b5dce33a) C:\WINDOWS\system32\drivers\mfetdi2k.sys
12:01:11.0123 6588 mfetdi2k - ok
12:01:11.0185 6588 mfetdik (3812e49fa67a3f604895f0d0c2e1ef90) C:\WINDOWS\system32\drivers\mfetdik.sys
12:01:11.0279 6588 mfetdik - ok
12:01:11.0342 6588 mfevtp (5339baac5c43ddbdb448863f8ea8fcdc) C:\WINDOWS\system32\mfevtps.exe
12:01:11.0435 6588 mfevtp - ok
12:01:11.0451 6588 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
12:01:11.0451 6588 mnmdd - ok
12:01:11.0482 6588 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe
12:01:11.0482 6588 mnmsrvc - ok
12:01:11.0513 6588 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
12:01:11.0513 6588 Modem - ok
12:01:11.0560 6588 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
12:01:11.0560 6588 Mouclass - ok
12:01:11.0592 6588 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
12:01:11.0607 6588 mouhid - ok
12:01:11.0638 6588 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
12:01:11.0638 6588 MountMgr - ok
12:01:11.0670 6588 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
12:01:11.0748 6588 mraid35x - ok
12:01:11.0779 6588 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
12:01:11.0779 6588 MRxDAV - ok
12:01:11.0857 6588 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
12:01:11.0873 6588 MRxSmb - ok
12:01:11.0920 6588 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe
12:01:11.0920 6588 MSDTC - ok
12:01:11.0935 6588 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
12:01:11.0935 6588 Msfs - ok
12:01:11.0935 6588 MSIServer - ok
12:01:11.0951 6588 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
12:01:11.0967 6588 MSKSSRV - ok
12:01:11.0967 6588 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
12:01:11.0967 6588 MSPCLOCK - ok
12:01:11.0967 6588 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
12:01:11.0982 6588 MSPQM - ok
12:01:11.0982 6588 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
12:01:11.0982 6588 mssmbios - ok
12:01:12.0138 6588 MSSQL$ACT7 - ok
12:01:12.0185 6588 MSSQL$SQLEXPRESS - ok
12:01:12.0279 6588 MSSQLServerADHelper (1d89eb4e2a99cabd4e81225f4f4c4b25) C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe
12:01:12.0373 6588 MSSQLServerADHelper - ok
12:01:12.0545 6588 MSSQLServerADHelper100 (f1761c8fb2b25a32c6d63e36bb88c3ae) c:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE
12:01:12.0592 6588 MSSQLServerADHelper100 - ok
12:01:12.0623 6588 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
12:01:12.0623 6588 MSTEE - ok
12:01:12.0654 6588 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
12:01:12.0654 6588 Mup - ok
12:01:12.0795 6588 myAgtSvc (a35ab0a7a983ebca85805da63d763382) C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
12:01:12.0810 6588 myAgtSvc - ok
12:01:12.0842 6588 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
12:01:12.0842 6588 NABTSFEC - ok
12:01:12.0888 6588 NAL (1d99ac4ce3abbd96a8c0d77ff104096d) C:\WINDOWS\system32\Drivers\iqvw32.sys
12:01:13.0060 6588 NAL - ok
12:01:13.0123 6588 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll
12:01:13.0138 6588 napagent - ok
12:01:13.0185 6588 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
12:01:13.0201 6588 NDIS - ok
12:01:13.0232 6588 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
12:01:13.0232 6588 NdisIP - ok
12:01:13.0263 6588 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
12:01:13.0263 6588 NdisTapi - ok
12:01:13.0295 6588 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
12:01:13.0295 6588 Ndisuio - ok
12:01:13.0310 6588 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
12:01:13.0310 6588 NdisWan - ok
12:01:13.0342 6588 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
12:01:13.0342 6588 NDProxy - ok
12:01:13.0373 6588 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
12:01:13.0388 6588 NetBIOS - ok
12:01:13.0435 6588 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
12:01:13.0451 6588 NetBT - ok
12:01:13.0482 6588 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe
12:01:13.0482 6588 NetDDE - ok
12:01:13.0482 6588 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe
12:01:13.0482 6588 NetDDEdsdm - ok
12:01:13.0513 6588 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
12:01:13.0513 6588 Netlogon - ok
12:01:13.0545 6588 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll
12:01:13.0545 6588 Netman - ok
12:01:13.0654 6588 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
12:01:13.0685 6588 NetTcpPortSharing - ok
12:01:13.0732 6588 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
12:01:13.0732 6588 NIC1394 - ok
12:01:13.0810 6588 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll
12:01:13.0810 6588 Nla - ok
12:01:13.0842 6588 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
12:01:13.0842 6588 Npfs - ok
12:01:13.0982 6588 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
12:01:14.0013 6588 Ntfs - ok
12:01:14.0029 6588 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
12:01:14.0029 6588 NtLmSsp - ok
12:01:14.0107 6588 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll
12:01:14.0138 6588 NtmsSvc - ok
12:01:14.0170 6588 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
12:01:14.0185 6588 Null - ok
12:01:14.0717 6588 nv (2e095f4f396f7106a5f1d8b00ec00d4f) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
12:01:15.0326 6588 nv - ok
12:01:15.0638 6588 nvsvc (328acce9c643fe050a4143fe3ec3c025) C:\WINDOWS\system32\nvsvc32.exe
12:01:15.0888 6588 nvsvc - ok
12:01:15.0951 6588 NWADI (fc2a8aaa0f3321f41231ede0af1968ae) C:\WINDOWS\system32\DRIVERS\NWADIenum.sys
12:01:15.0998 6588 NWADI - ok
12:01:16.0013 6588 nwcworkstation - ok
12:01:16.0045 6588 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
12:01:16.0045 6588 NwlnkFlt - ok
12:01:16.0060 6588 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
12:01:16.0092 6588 NwlnkFwd - ok
12:01:16.0138 6588 NWUSBCDFIL (224131778c92aee8c13afac5fbff19ca) C:\WINDOWS\system32\DRIVERS\NwUsbCdFil.sys
12:01:16.0170 6588 NWUSBCDFIL - ok
12:01:16.0217 6588 NWUSBModem (b7112f30d7eff4b5052eba879f46228f) C:\WINDOWS\system32\DRIVERS\nwusbmdm.sys
12:01:16.0326 6588 NWUSBModem - ok
12:01:16.0357 6588 NWUSBPort (b7112f30d7eff4b5052eba879f46228f) C:\WINDOWS\system32\DRIVERS\nwusbser.sys
12:01:16.0435 6588 NWUSBPort - ok
12:01:16.0451 6588 NWUSBPort2 (b7112f30d7eff4b5052eba879f46228f) C:\WINDOWS\system32\DRIVERS\nwusbser2.sys
12:01:16.0529 6588 NWUSBPort2 - ok
12:01:16.0560 6588 OA001Afx (0f538df1673e5216f3baacb6911d9d0f) C:\WINDOWS\system32\Drivers\OA001Afx.sys
12:01:16.0607 6588 OA001Afx - ok
12:01:16.0638 6588 OA001Ufd (2cf21d5f8f1b74bb1922135ac2b12ddb) C:\WINDOWS\system32\DRIVERS\OA001Ufd.sys
12:01:16.0701 6588 OA001Ufd - ok
12:01:16.0748 6588 OA001Vid (159e5a08a6a5231863cddbd787a4eabb) C:\WINDOWS\system32\DRIVERS\OA001Vid.sys
12:01:16.0795 6588 OA001Vid - ok
12:01:16.0967 6588 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
12:01:17.0060 6588 odserv - ok
12:01:17.0123 6588 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
12:01:17.0123 6588 ohci1394 - ok
12:01:17.0217 6588 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
12:01:17.0263 6588 ose - ok
12:01:17.0310 6588 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
12:01:17.0326 6588 Parport - ok
12:01:17.0326 6588 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
12:01:17.0326 6588 PartMgr - ok
12:01:17.0342 6588 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
12:01:17.0342 6588 ParVdm - ok
12:01:17.0357 6588 pavprsrv - ok
12:01:17.0373 6588 PBADRV (4088c1ecd1f54281a92fa663b0fdc36f) C:\WINDOWS\system32\DRIVERS\PBADRV.sys
12:01:17.0638 6588 PBADRV - ok
12:01:17.0670 6588 PCASp50 (1961590aa191b6b7dcf18a6a693af7b8) C:\WINDOWS\system32\Drivers\PCASp50.sys
12:01:17.0717 6588 PCASp50 - ok
12:01:17.0717 6588 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
12:01:17.0717 6588 PCI - ok
12:01:17.0717 6588 PCIDump - ok
12:01:17.0748 6588 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
12:01:17.0748 6588 PCIIde - ok
12:01:17.0779 6588 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
12:01:17.0826 6588 Pcmcia - ok
12:01:17.0826 6588 PDCOMP - ok
12:01:17.0826 6588 PDFRAME - ok
12:01:17.0826 6588 PDRELI - ok
12:01:17.0826 6588 PDRFRAME - ok
12:01:17.0873 6588 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
12:01:17.0935 6588 perc2 - ok
12:01:17.0935 6588 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
12:01:17.0935 6588 perc2hib - ok
12:01:17.0982 6588 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe
12:01:17.0982 6588 PlugPlay - ok
12:01:18.0013 6588 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
12:01:18.0013 6588 PolicyAgent - ok
12:01:18.0029 6588 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
12:01:18.0060 6588 PptpMiniport - ok
12:01:18.0060 6588 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
12:01:18.0076 6588 ProtectedStorage - ok
12:01:18.0076 6588 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
12:01:18.0076 6588 PSched - ok
12:01:18.0154 6588 PSI_SVC_2 (e0d0cb09aa07b22be984e4f7ec0326f5) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
12:01:18.0295 6588 PSI_SVC_2 - ok
12:01:18.0310 6588 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
12:01:18.0326 6588 Ptilink - ok
12:01:18.0342 6588 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
12:01:18.0357 6588 ql1080 - ok
12:01:18.0373 6588 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
12:01:18.0373 6588 Ql10wnt - ok
12:01:18.0388 6588 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
12:01:18.0404 6588 ql12160 - ok
12:01:18.0404 6588 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
12:01:18.0420 6588 ql1240 - ok
12:01:18.0420 6588 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
12:01:18.0435 6588 ql1280 - ok
12:01:18.0451 6588 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
12:01:18.0467 6588 RasAcd - ok
12:01:18.0482 6588 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll
12:01:18.0498 6588 RasAuto - ok
12:01:18.0513 6588 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
12:01:18.0513 6588 Rasl2tp - ok
12:01:18.0529 6588 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll
12:01:18.0545 6588 RasMan - ok
12:01:18.0545 6588 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
12:01:18.0545 6588 RasPppoe - ok
12:01:18.0560 6588 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
12:01:18.0560 6588 Raspti - ok
12:01:18.0623 6588 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
12:01:18.0623 6588 Rdbss - ok
12:01:18.0654 6588 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
12:01:18.0654 6588 RDPCDD - ok
12:01:18.0685 6588 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
12:01:18.0701 6588 rdpdr - ok
12:01:18.0732 6588 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
12:01:18.0732 6588 RDPWD - ok
12:01:18.0763 6588 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe
12:01:18.0779 6588 RDSessMgr - ok
12:01:18.0810 6588 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
12:01:18.0842 6588 redbook - ok
12:01:18.0873 6588 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll
12:01:18.0888 6588 RemoteAccess - ok
12:01:18.0904 6588 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll
12:01:18.0920 6588 RemoteRegistry - ok
12:01:18.0951 6588 rimmptsk (ea885e7a56f1be1f14c372337c42fe48) C:\WINDOWS\system32\DRIVERS\rimmptsk.sys
12:01:19.0107 6588 rimmptsk - ok
12:01:19.0138 6588 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe
12:01:19.0138 6588 RpcLocator - ok
12:01:19.0217 6588 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\System32\rpcss.dll
12:01:19.0217 6588 RpcSs - ok
12:01:19.0295 6588 RsFx0105 (6a7360e36cbd636972aeef0dd292a946) C:\WINDOWS\system32\DRIVERS\RsFx0105.sys
12:01:19.0467 6588 RsFx0105 - ok
12:01:19.0498 6588 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe
12:01:19.0498 6588 RSVP - ok
12:01:19.0685 6588 RumorServer (a35ab0a7a983ebca85805da63d763382) C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
12:01:19.0685 6588 RumorServer - ok
12:01:19.0732 6588 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
12:01:19.0732 6588 SamSs - ok
12:01:19.0748 6588 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe
12:01:19.0763 6588 SCardSvr - ok
12:01:19.0795 6588 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll
12:01:19.0810 6588 Schedule - ok
12:01:19.0857 6588 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
12:01:19.0857 6588 sdbus - ok
12:01:19.0857 6588 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
12:01:19.0857 6588 Secdrv - ok
12:01:19.0904 6588 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll
12:01:19.0904 6588 seclogon - ok
12:01:20.0060 6588 SecureStorageService (e80163f46ae96cc0a05fb9f3f55deb18) C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe
12:01:20.0310 6588 SecureStorageService - ok
12:01:20.0342 6588 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll
12:01:20.0342 6588 SENS - ok
12:01:20.0373 6588 Sentinel (8627c992b8a80504fc477b2e8ff8ec4f) C:\WINDOWS\System32\Drivers\SENTINEL.SYS
12:01:20.0388 6588 Sentinel - ok
12:01:20.0435 6588 Serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
12:01:20.0435 6588 Serenum - ok
12:01:20.0482 6588 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
12:01:20.0482 6588 Serial - ok
12:01:20.0513 6588 sermouse (1f16931c722c69e4a7866244796c66a0) C:\WINDOWS\system32\DRIVERS\sermouse.sys
12:01:20.0576 6588 sermouse - ok
12:01:20.0576 6588 sffdisk (0fa803c64df0914b41f807ea276bf2a6) C:\WINDOWS\system32\DRIVERS\sffdisk.sys
12:01:20.0576 6588 sffdisk - ok
12:01:20.0607 6588 sffp_sd (c17c331e435ed8737525c86a7557b3ac) C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
12:01:20.0607 6588 sffp_sd - ok
12:01:20.0607 6588 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
12:01:20.0623 6588 Sfloppy - ok
12:01:20.0654 6588 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll
12:01:20.0670 6588 SharedAccess - ok
12:01:20.0701 6588 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
12:01:20.0716 6588 ShellHWDetection - ok
12:01:20.0716 6588 Simbad - ok
12:01:20.0716 6588 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
12:01:20.0716 6588 sisagp - ok
12:01:20.0716 6588 slee_503_service - ok
12:01:20.0763 6588 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
12:01:20.0763 6588 SLIP - ok
12:01:20.0951 6588 SMManager (24d62fc9201d172f69c47355d185213b) C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe
12:01:21.0013 6588 SMManager - ok
12:01:21.0123 6588 SMSIVZAM5 (1e715247efffdda938c085913045d599) C:\PROGRA~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS
12:01:21.0248 6588 SMSIVZAM5 - ok
12:01:21.0279 6588 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
12:01:21.0279 6588 Sparrow - ok
12:01:21.0326 6588 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
12:01:21.0326 6588 splitter - ok
12:01:21.0357 6588 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
12:01:21.0357 6588 Spooler - ok
12:01:21.0482 6588 SQLAgent$SQLEXPRESS (a892134c28777978ecde8283dc57ac0f) c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE
12:01:21.0545 6588 SQLAgent$SQLEXPRESS - ok
12:01:21.0638 6588 SQLBrowser (10d936dced9eacd1a1b3fcdda6d7a4eb) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
12:01:21.0685 6588 SQLBrowser - ok
12:01:21.0716 6588 SQLWriter (135cdccc167ef0c250125bbd3abe18d5) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
12:01:21.0763 6588 SQLWriter - ok
12:01:21.0795 6588 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
12:01:21.0795 6588 sr - ok
12:01:21.0841 6588 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll
12:01:21.0841 6588 srservice - ok
12:01:21.0904 6588 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
12:01:21.0904 6588 Srv - ok
12:01:21.0951 6588 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll
12:01:21.0966 6588 SSDPSRV - ok
12:01:22.0029 6588 STacSV (0a8fa56553913e87aa24a6ce218b88de) c:\drivers\audio\r267815\payload\wdm\stacsv.exe
12:01:22.0154 6588 STacSV - ok
12:01:22.0154 6588 STHDA - ok
12:01:22.0232 6588 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll
12:01:22.0232 6588 stisvc - ok
12:01:22.0279 6588 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
12:01:22.0279 6588 streamip - ok
12:01:22.0310 6588 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
12:01:22.0310 6588 swenum - ok
12:01:22.0310 6588 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
12:01:22.0310 6588 swmidi - ok
12:01:22.0326 6588 SwPrv - ok
12:01:22.0326 6588 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
12:01:22.0357 6588 symc810 - ok
12:01:22.0373 6588 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
12:01:22.0451 6588 symc8xx - ok
12:01:22.0451 6588 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
12:01:22.0451 6588 sym_hi - ok
12:01:22.0466 6588 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
12:01:22.0529 6588 sym_u3 - ok
12:01:22.0545 6588 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
12:01:22.0545 6588 sysaudio - ok
12:01:22.0576 6588 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe
12:01:22.0576 6588 SysmonLog - ok
12:01:22.0607 6588 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll
12:01:22.0607 6588 TapiSrv - ok
12:01:22.0670 6588 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
12:01:22.0670 6588 Tcpip - ok
12:01:22.0857 6588 tcsd_win32.exe (ba9202e263a6fc1ffd7889fea186a2c4) C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe
12:01:22.0998 6588 tcsd_win32.exe - ok
12:01:23.0154 6588 TdmService (ea63bf38938ad9917beb1846d6d15c84) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
12:01:23.0263 6588 TdmService - ok
12:01:23.0498 6588 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
12:01:23.0498 6588 TDPIPE - ok
12:01:23.0513 6588 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
12:01:23.0513 6588 TDTCP - ok
12:01:23.0529 6588 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
12:01:23.0529 6588 TermDD - ok
12:01:23.0576 6588 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll
12:01:23.0576 6588 TermService - ok
12:01:23.0638 6588 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
12:01:23.0638 6588 Themes - ok
12:01:23.0670 6588 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\system32\tlntsvr.exe
12:01:23.0685 6588 TlntSvr - ok
12:01:23.0685 6588 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
12:01:23.0685 6588 TosIde - ok
12:01:23.0701 6588 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll
12:01:23.0701 6588 TrkWks - ok
12:01:23.0748 6588 TrmbTS (5070590587118b2960e14927b4393d32) C:\WINDOWS\system32\Drivers\TrmbTS.sys
12:01:23.0795 6588 TrmbTS - ok
12:01:23.0795 6588 TRMUSB5K - ok
12:01:23.0857 6588 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
12:01:23.0857 6588 Udfs - ok
12:01:23.0873 6588 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
12:01:23.0920 6588 ultra - ok
12:01:23.0951 6588 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
12:01:23.0966 6588 Update - ok
12:01:23.0982 6588 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll
12:01:23.0998 6588 upnphost - ok
12:01:24.0029 6588 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe
12:01:24.0029 6588 UPS - ok
12:01:24.0107 6588 USA19H (6d1e41657fdb48f9147598c773297513) C:\WINDOWS\system32\DRIVERS\USA19H2k.sys
12:01:24.0279 6588 USA19H - ok
12:01:24.0295 6588 USA19H2KP (8a217fc16dd14ab8ad2eaa1f08b3b5c5) C:\WINDOWS\system32\DRIVERS\USA19H2kp.SYS
12:01:24.0388 6588 USA19H2KP - ok
12:01:24.0435 6588 usbccgp (c18d6c74953621346df6b0a11f80c1cc) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
12:01:24.0482 6588 usbccgp - ok
12:01:24.0529 6588 USBCCID (150442fa5224dc338028543e2fffa7b4) C:\WINDOWS\system32\DRIVERS\usbccid.sys
12:01:24.0654 6588 USBCCID - ok
12:01:24.0701 6588 usbehci (4bac8df07f1d8434fc640e677a62204e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
12:01:24.0779 6588 usbehci - ok
12:01:24.0810 6588 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
12:01:24.0810 6588 usbhub - ok
12:01:24.0826 6588 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
12:01:24.0826 6588 usbprint - ok
12:01:24.0857 6588 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
12:01:24.0873 6588 usbscan - ok
12:01:24.0904 6588 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
12:01:24.0904 6588 USBSTOR - ok
12:01:24.0920 6588 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
12:01:24.0920 6588 usbuhci - ok
12:01:24.0951 6588 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
12:01:24.0951 6588 usbvideo - ok
12:01:24.0982 6588 usb_rndisx (b6cc50279d6cd28e090a5d33244adc9a) C:\WINDOWS\system32\DRIVERS\usb8023x.sys
12:01:24.0998 6588 usb_rndisx - ok
12:01:25.0029 6588 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
12:01:25.0029 6588 VgaSave - ok
12:01:25.0029 6588 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
12:01:25.0045 6588 viaagp - ok
12:01:25.0045 6588 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
12:01:25.0045 6588 ViaIde - ok
12:01:25.0076 6588 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
12:01:25.0091 6588 VolSnap - ok
12:01:25.0138 6588 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe
12:01:25.0138 6588 VSS - ok
12:01:25.0170 6588 w32time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll
12:01:25.0170 6588 w32time - ok
12:01:25.0185 6588 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
12:01:25.0185 6588 Wanarp - ok
12:01:25.0216 6588 WavxDMgr (0be8dd6c95c5bdff9c5f3fa8095d304c) C:\WINDOWS\system32\DRIVERS\WavxDMgr.sys
12:01:25.0357 6588 WavxDMgr - ok
12:01:25.0404 6588 wceusbsh (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
12:01:25.0451 6588 wceusbsh - ok
12:01:25.0513 6588 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
12:01:25.0654 6588 Wdf01000 - ok
12:01:25.0654 6588 WDICA - ok
12:01:25.0654 6588 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
12:01:25.0670 6588 wdmaud - ok
12:01:25.0748 6588 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll
12:01:25.0748 6588 WebClient - ok
12:01:25.0748 6588 WinDriver6 - ok
12:01:25.0841 6588 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll
12:01:25.0857 6588 winmgmt - ok
12:01:25.0920 6588 WinRM (18f347402da544a780949b8fdf83351b) C:\WINDOWS\system32\WsmSvc.dll
12:01:26.0076 6588 WinRM - ok
12:01:26.0123 6588 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
12:01:26.0123 6588 WmdmPmSN - ok
12:01:26.0201 6588 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll
12:01:26.0232 6588 Wmi - ok
12:01:26.0310 6588 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
12:01:26.0310 6588 WmiAcpi - ok
12:01:26.0388 6588 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe
12:01:26.0404 6588 WmiApSrv - ok
12:01:26.0998 6588 WMPNetworkSvc (f74e3d9a7fa9556c3bbb14d4e5e63d3b) C:\Program Files\Windows Media Player\WMPNetwk.exe
12:01:27.0029 6588 WMPNetworkSvc - ok
12:01:27.0045 6588 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
12:01:27.0045 6588 WS2IFSL - ok
12:01:27.0076 6588 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll
12:01:27.0076 6588 wscsvc - ok
12:01:27.0091 6588 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
12:01:27.0107 6588 WSTCODEC - ok
12:01:27.0107 6588 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll
12:01:27.0107 6588 wuauserv - ok
12:01:27.0154 6588 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
12:01:27.0154 6588 WudfPf - ok
12:01:27.0170 6588 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
12:01:27.0170 6588 WudfRd - ok
12:01:27.0185 6588 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
12:01:27.0201 6588 WudfSvc - ok
12:01:27.0232 6588 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll
12:01:27.0248 6588 WZCSVC - ok
12:01:27.0279 6588 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll
12:01:27.0295 6588 xmlprov - ok
12:01:27.0451 6588 XobniService (986c5b8f380f7408ecee96c3c5dbf66c) C:\Program Files\Xobni\XobniService.exe
12:01:27.0513 6588 XobniService - ok
12:01:27.0607 6588 YahooAUService (dd0042f0c3b606a6a8b92d49afb18ad6) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
12:01:27.0607 6588 YahooAUService - ok
12:01:27.0810 6588 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
12:01:27.0888 6588 \Device\Harddisk0\DR0 - ok
12:01:27.0904 6588 Boot (0x1200) (1164849f2816b8faac91ba9894555e1e) \Device\Harddisk0\DR0\Partition0
12:01:27.0904 6588 \Device\Harddisk0\DR0\Partition0 - ok
12:01:27.0904 6588 ============================================================
12:01:27.0904 6588 Scan finished
12:01:27.0904 6588 ============================================================
12:01:27.0904 0556 Detected object count: 0
12:01:27.0904 0556 Actual detected object count: 0
12:02:01.0591 1208 Deinitialize success

Here is the previous TDS Killer log:
22:46:51.0625 2540 TDSS rootkit removing tool [removed] Apr 24 2012 18:43:43
22:46:52.0109 2540 ============================================================
22:46:52.0109 2540 Current date / time: 2012/04/26 22:46:52.0109
22:46:52.0109 2540 SystemInfo:
22:46:52.0109 2540
22:46:52.0109 2540 OS Version: 5.1.2600 ServicePack: 3.0
22:46:52.0109 2540 Product type: Workstation
22:46:52.0109 2540 ComputerName: C4LHXH1
22:46:52.0109 2540 UserName: JZipkin
22:46:52.0109 2540 Windows directory: C:\WINDOWS
22:46:52.0109 2540 System windows directory: C:\WINDOWS
22:46:52.0109 2540 Processor architecture: Intel x86
22:46:52.0109 2540 Number of processors: 2
22:46:52.0109 2540 Page size: 0x1000
22:46:52.0109 2540 Boot type: Normal boot
22:46:52.0109 2540 ============================================================
22:46:53.0625 2540 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
22:46:53.0640 2540 ============================================================
22:46:53.0640 2540 \Device\Harddisk0\DR0:
22:46:53.0640 2540 MBR partitions:
22:46:53.0640 2540 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1F608, BlocksNum 0x129F94B9
22:46:53.0640 2540 ============================================================
22:46:53.0765 2540 C: <-> \Device\Harddisk0\DR0\Partition0
22:46:53.0765 2540 ============================================================
22:46:53.0765 2540 Initialize success
22:46:53.0765 2540 ============================================================
22:47:16.0031 3852 ============================================================
22:47:16.0031 3852 Scan started
22:47:16.0031 3852 Mode: Manual; SigCheck; TDLFS;
22:47:16.0031 3852 ============================================================
22:47:16.0328 3852 Abiosdsk - ok
22:47:16.0375 3852 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
22:47:18.0062 3852 abp480n5 - ok
22:47:18.0093 3852 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
22:47:18.0218 3852 ACPI - ok
22:47:18.0218 3852 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
22:47:18.0328 3852 ACPIEC - ok
22:47:18.0437 3852 ACT! Scheduler (04fa07c4eed949b3ba64b536d1438130) C:\Program Files\ACT\Act for Windows\Act.Scheduler.exe
22:47:18.0562 3852 ACT! Scheduler ( UnsignedFile.Multi.Generic ) - warning
22:47:18.0562 3852 ACT! Scheduler - detected UnsignedFile.Multi.Generic (1)
22:47:18.0656 3852 AdobeFlashPlayerUpdateSvc (459ac130c6ab892b1cd5d7544626efc5) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
22:47:18.0734 3852 AdobeFlashPlayerUpdateSvc - ok
22:47:18.0796 3852 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
22:47:18.0953 3852 adpu160m - ok
22:47:18.0984 3852 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
22:47:19.0109 3852 aec - ok
22:47:19.0140 3852 AESTAud (822d53766d57c90c437536232ece9023) C:\WINDOWS\system32\drivers\AESTAud.sys
22:47:19.0281 3852 AESTAud - ok
22:47:19.0343 3852 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
22:47:19.0484 3852 AFD - ok
22:47:19.0515 3852 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
22:47:19.0609 3852 agp440 - ok
22:47:19.0625 3852 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
22:47:19.0718 3852 agpCPQ - ok
22:47:19.0750 3852 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
22:47:19.0843 3852 Aha154x - ok
22:47:19.0875 3852 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
22:47:20.0031 3852 aic78u2 - ok
22:47:20.0046 3852 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
22:47:20.0171 3852 aic78xx - ok
22:47:20.0203 3852 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll
22:47:20.0281 3852 Alerter - ok
22:47:20.0296 3852 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe
22:47:20.0359 3852 ALG - ok
22:47:20.0375 3852 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
22:47:20.0515 3852 AliIde - ok
22:47:20.0531 3852 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
22:47:20.0625 3852 alim1541 - ok
22:47:20.0640 3852 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
22:47:20.0718 3852 amdagp - ok
22:47:20.0750 3852 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
22:47:20.0859 3852 amsint - ok
22:47:20.0890 3852 ApfiltrService (22403504e15810e99a563782e9d45311) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
22:47:20.0984 3852 ApfiltrService - ok
22:47:21.0015 3852 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll
22:47:21.0093 3852 AppMgmt - ok
22:47:21.0140 3852 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
22:47:21.0250 3852 Arp1394 - ok
22:47:21.0250 3852 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
22:47:21.0390 3852 asc - ok
22:47:21.0406 3852 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
22:47:21.0500 3852 asc3350p - ok
22:47:21.0515 3852 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
22:47:21.0671 3852 asc3550 - ok
22:47:21.0843 3852 ASFAgent (9ad6ef4d591211a93848103368125b41) C:\Program Files\Intel\ASF Agent\ASFAgent.exe
22:47:21.0921 3852 ASFAgent - ok
22:47:22.0046 3852 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
22:47:22.0125 3852 aspnet_state - ok
22:47:22.0171 3852 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
22:47:22.0265 3852 AsyncMac - ok
22:47:22.0281 3852 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
22:47:22.0359 3852 atapi - ok
22:47:22.0359 3852 Atdisk - ok
22:47:22.0375 3852 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
22:47:22.0468 3852 Atmarpc - ok
22:47:22.0500 3852 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll
22:47:22.0562 3852 AudioSrv - ok
22:47:22.0578 3852 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
22:47:22.0687 3852 audstub - ok
22:47:22.0781 3852 BCM43XX (9208c78bd9283f79a30252ad954c77a2) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
22:47:23.0093 3852 BCM43XX - ok
22:47:23.0109 3852 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
22:47:23.0218 3852 Beep - ok
22:47:23.0250 3852 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll
22:47:23.0421 3852 BITS - ok
22:47:23.0437 3852 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll
22:47:23.0531 3852 Browser - ok
22:47:23.0812 3852 btaudio (f688bbbe8e3e7e03e35caabd66616ddb) C:\WINDOWS\system32\drivers\btaudio.sys
22:47:23.0875 3852 btaudio - ok
22:47:23.0953 3852 BTDriver (2f9f111d31aa3fbbe5781d829a4524e6) C:\WINDOWS\system32\DRIVERS\btport.sys
22:47:24.0031 3852 BTDriver - ok
22:47:24.0093 3852 BTKRNL (38a3331e2f690d4cdc9de0604b9416e5) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
22:47:24.0187 3852 BTKRNL - ok
22:47:24.0421 3852 btwdins (d48148110ae078cb7221d0fcf20adfec) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
22:47:24.0531 3852 btwdins - ok
22:47:24.0750 3852 BTWDNDIS (80f61de965c116051614ac2f04222ff7) C:\WINDOWS\system32\DRIVERS\btwdndis.sys
22:47:24.0812 3852 BTWDNDIS - ok
22:47:24.0828 3852 btwhid (949eca9c56f657c06d3166d51f3226c7) C:\WINDOWS\system32\DRIVERS\btwhid.sys
22:47:24.0937 3852 btwhid - ok
22:47:24.0953 3852 btwmodem (5922bae0cd84924b9cd7e6bb515ee070) C:\WINDOWS\system32\DRIVERS\btwmodem.sys
22:47:25.0031 3852 btwmodem - ok
22:47:25.0078 3852 BTWUSB (d5af663711660d32ec230c6aaf7b6b83) C:\WINDOWS\system32\Drivers\btwusb.sys
22:47:25.0187 3852 BTWUSB - ok
22:47:25.0406 3852 buttonsvc32 (4c2a9823c48882bce93e26105e1434e2) C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe
22:47:25.0500 3852 buttonsvc32 - ok
22:47:25.0500 3852 catchme - ok
22:47:25.0531 3852 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
22:47:25.0609 3852 cbidf - ok
22:47:25.0625 3852 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
22:47:25.0687 3852 cbidf2k - ok
22:47:25.0781 3852 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
22:47:25.0859 3852 CCDECODE - ok
22:47:25.0906 3852 CCIDFILTER (d006b6a67b8daed85e6d91783e9b45d6) C:\WINDOWS\system32\DRIVERS\ccidflt.sys
22:47:25.0968 3852 CCIDFILTER - ok
22:47:26.0000 3852 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
22:47:26.0093 3852 cd20xrnt - ok
22:47:26.0125 3852 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
22:47:26.0218 3852 Cdaudio - ok
22:47:26.0265 3852 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
22:47:26.0343 3852 Cdfs - ok
22:47:26.0359 3852 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
22:47:26.0437 3852 Cdrom - ok
22:47:26.0437 3852 Changer - ok
22:47:26.0484 3852 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe
22:47:26.0578 3852 CiSvc - ok
22:47:26.0593 3852 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe
22:47:26.0671 3852 ClipSrv - ok
22:47:26.0781 3852 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
22:47:26.0843 3852 clr_optimization_v2.0.50727_32 - ok
22:47:26.0875 3852 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
22:47:26.0984 3852 CmBatt - ok
22:47:27.0015 3852 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
22:47:27.0109 3852 CmdIde - ok
22:47:27.0125 3852 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
22:47:27.0218 3852 Compbatt - ok
22:47:27.0218 3852 COMSysApp - ok
22:47:27.0250 3852 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
22:47:27.0343 3852 Cpqarray - ok
22:47:27.0484 3852 Credential Vault Host Control Service (9d57165906778c9e5e0ecb34b311564b) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
22:47:27.0562 3852 Credential Vault Host Control Service - ok
22:47:27.0625 3852 Credential Vault Host Storage (e31e97859deee648d5867eadfbdbf25a) C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
22:47:27.0687 3852 Credential Vault Host Storage - ok
22:47:27.0796 3852 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll
22:47:27.0906 3852 CryptSvc - ok
22:47:27.0968 3852 cvusbdrv (dc6429fbc73b0b0b38cc5386c8a607ed) C:\WINDOWS\system32\Drivers\cvusbdrv.sys
22:47:28.0046 3852 cvusbdrv - ok
22:47:28.0078 3852 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
22:47:28.0187 3852 dac2w2k - ok
22:47:28.0203 3852 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
22:47:28.0359 3852 dac960nt - ok
22:47:28.0421 3852 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll
22:47:28.0500 3852 DcomLaunch - ok
22:47:28.0640 3852 dcpsysmgrsvc (ce597e34d62c603871e2f2f5155a88e5) C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe
22:47:28.0718 3852 dcpsysmgrsvc - ok
22:47:28.0796 3852 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll
22:47:28.0875 3852 Dhcp - ok
22:47:28.0906 3852 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
22:47:29.0031 3852 Disk - ok
22:47:29.0031 3852 dmadmin - ok
22:47:29.0156 3852 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
22:47:29.0343 3852 dmboot - ok
22:47:29.0359 3852 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
22:47:29.0484 3852 dmio - ok
22:47:29.0484 3852 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
22:47:29.0578 3852 dmload - ok
22:47:29.0609 3852 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll
22:47:29.0687 3852 dmserver - ok
22:47:29.0890 3852 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
22:47:30.0000 3852 DMusic - ok
22:47:30.0031 3852 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll
22:47:30.0203 3852 Dnscache - ok
22:47:30.0296 3852 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll
22:47:30.0375 3852 Dot3svc - ok
22:47:30.0390 3852 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
22:47:30.0484 3852 dpti2o - ok
22:47:30.0500 3852 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
22:47:30.0593 3852 drmkaud - ok
22:47:30.0640 3852 e1yexpress (71ff7ad30bd9e3c06df112383bb60089) C:\WINDOWS\system32\DRIVERS\e1y5132.sys
22:47:30.0765 3852 e1yexpress - ok
22:47:30.0796 3852 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll
22:47:30.0890 3852 EapHost - ok
22:47:30.0921 3852 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll
22:47:31.0000 3852 ERSvc - ok
22:47:31.0046 3852 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe
22:47:31.0078 3852 Eventlog - ok
22:47:31.0093 3852 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll
22:47:31.0171 3852 EventSystem - ok
22:47:31.0234 3852 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
22:47:31.0296 3852 Fastfat - ok
22:47:31.0343 3852 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
22:47:31.0468 3852 FastUserSwitchingCompatibility - ok
22:47:31.0531 3852 Fax (e97d6a8684466df94ff3bc24fb787a07) C:\WINDOWS\system32\fxssvc.exe
22:47:31.0625 3852 Fax - ok
22:47:31.0640 3852 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
22:47:31.0718 3852 Fdc - ok
22:47:31.0750 3852 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
22:47:31.0843 3852 Fips - ok
22:47:31.0968 3852 FLEXnet Licensing Service (f76d04f7413b07daa029f6520b64b4e8) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
22:47:32.0078 3852 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - warning
22:47:32.0078 3852 FLEXnet Licensing Service - detected UnsignedFile.Multi.Generic (1)
22:47:32.0140 3852 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
22:47:32.0218 3852 Flpydisk - ok
22:47:32.0250 3852 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
22:47:32.0312 3852 FltMgr - ok
22:47:32.0421 3852 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
22:47:32.0437 3852 FontCache3.0.0.0 - ok
22:47:32.0468 3852 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
22:47:32.0546 3852 Fs_Rec - ok
22:47:32.0578 3852 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
22:47:32.0656 3852 Ftdisk - ok
22:47:32.0718 3852 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
22:47:32.0812 3852 Gpc - ok
22:47:32.0906 3852 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
22:47:32.0968 3852 gupdate - ok
22:47:32.0968 3852 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
22:47:32.0984 3852 gupdatem - ok
22:47:33.0000 3852 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
22:47:33.0093 3852 HDAudBus - ok
22:47:33.0171 3852 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
22:47:33.0265 3852 helpsvc - ok
22:47:33.0296 3852 HidServ (deb04da35cc871b6d309b77e1443c796) C:\WINDOWS\System32\hidserv.dll
22:47:33.0359 3852 HidServ - ok
22:47:33.0390 3852 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
22:47:33.0484 3852 hidusb - ok
22:47:33.0625 3852 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll
22:47:33.0718 3852 hkmsvc - ok
22:47:33.0765 3852 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
22:47:33.0890 3852 hpn - ok
22:47:33.0953 3852 HPSIService (a9d667f5308982a3305f364eb02458d0) C:\WINDOWS\system32\HPSIsvc.exe
22:47:34.0015 3852 HPSIService - ok
22:47:34.0078 3852 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
22:47:34.0109 3852 HTTP - ok
22:47:34.0156 3852 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll
22:47:34.0250 3852 HTTPFilter - ok
22:47:34.0265 3852 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
22:47:34.0359 3852 i2omgmt - ok
22:47:34.0390 3852 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
22:47:34.0468 3852 i2omp - ok
22:47:34.0500 3852 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
22:47:34.0578 3852 i8042prt - ok
22:47:34.0640 3852 iaStor (26541a068572f650a2fa490726fe81be) C:\WINDOWS\system32\drivers\iaStor.sys
22:47:34.0671 3852 iaStor - ok
22:47:34.0859 3852 IAStorDataMgrSvc (31a0e93cdf29007d6c6fffb632f375ed) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
22:47:34.0937 3852 IAStorDataMgrSvc - ok
22:47:34.0984 3852 idebusdr - ok
22:47:35.0125 3852 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
22:47:35.0328 3852 idsvc - ok
22:47:35.0437 3852 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
22:47:35.0546 3852 Imapi - ok
22:47:35.0750 3852 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe
22:47:35.0828 3852 ImapiService - ok
22:47:35.0875 3852 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
22:47:36.0015 3852 ini910u - ok
22:47:36.0046 3852 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
22:47:36.0109 3852 IntelIde - ok
22:47:36.0156 3852 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
22:47:36.0218 3852 intelppm - ok
22:47:36.0250 3852 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
22:47:36.0343 3852 Ip6Fw - ok
22:47:36.0359 3852 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
22:47:36.0468 3852 IpFilterDriver - ok
22:47:36.0484 3852 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
22:47:36.0562 3852 IpInIp - ok
22:47:36.0609 3852 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
22:47:36.0687 3852 IpNat - ok
22:47:36.0703 3852 IPSec (f1c5abe758a66149f930fcadd1b5224f) C:\WINDOWS\system32\DRIVERS\ipsec.sys
22:47:36.0703 3852 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ipsec.sys. Real md5: f1c5abe758a66149f930fcadd1b5224f, Fake md5: 23c74d75e36e7158768dd63d92789a91
22:47:36.0703 3852 IPSec ( Virus.Win32.ZAccess.k ) - infected
22:47:36.0703 3852 IPSec - detected Virus.Win32.ZAccess.k (0)
22:47:36.0734 3852 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
22:47:36.0781 3852 IRENUM - ok
22:47:36.0812 3852 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
22:47:36.0875 3852 isapnp - ok
22:47:37.0046 3852 JavaQuickStarterService (92e16f5d034e7864da308ba6309a98b7) C:\Program Files\Java\jre7\bin\jqs.exe
22:47:37.0109 3852 JavaQuickStarterService - ok
22:47:37.0156 3852 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
22:47:37.0234 3852 Kbdclass - ok
22:47:37.0265 3852 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
22:47:37.0328 3852 kbdhid - ok
22:47:37.0375 3852 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
22:47:37.0468 3852 kmixer - ok
22:47:37.0500 3852 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
22:47:37.0656 3852 KSecDD - ok
22:47:37.0734 3852 LanmanServer (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll
22:47:37.0843 3852 LanmanServer - ok
22:47:37.0890 3852 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll
22:47:37.0968 3852 lanmanworkstation - ok
22:47:38.0015 3852 LBeepKE (ca63fe81705ad660e482bef210bf2c73) C:\WINDOWS\system32\Drivers\LBeepKE.sys
22:47:38.0312 3852 LBeepKE - ok
22:47:38.0312 3852 lbrtfdc - ok
22:47:38.0484 3852 LBTServ (ab097d0f93b30a6d79d430422ac6a7e8) C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
22:47:38.0625 3852 LBTServ - ok
22:47:38.0640 3852 LHidFilt (b68309f25c5787385da842eb5b496958) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
22:47:38.0718 3852 LHidFilt - ok
22:47:38.0750 3852 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll
22:47:38.0843 3852 LmHosts - ok
22:47:38.0859 3852 LMouFilt (63d3b1d3cd267fcc186a0146b80d453b) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
22:47:38.0953 3852 LMouFilt - ok
22:47:38.0953 3852 MBAMSwissArmy - ok
22:47:39.0203 3852 McAfee SiteAdvisor Enterprise Service (4f2d526298cbc517edb82501e8041112) C:\Program Files\McAfee\SiteAdvisor Enterprise\McSACore.exe
22:47:39.0328 3852 McAfee SiteAdvisor Enterprise Service - ok
22:47:39.0406 3852 McShield (1fe222eaf4ba73ced5a0707b38f3c0b1) C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
22:47:39.0484 3852 McShield - ok
22:47:39.0546 3852 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll
22:47:39.0640 3852 Messenger - ok
22:47:39.0718 3852 mfeapfk (37364b530339ff0b0ababc8df1c532c3) C:\WINDOWS\system32\drivers\mfeapfk.sys
22:47:39.0828 3852 mfeapfk - ok
22:47:39.0859 3852 MfeAVFK (cd2a8a43bd6b0d15a3255829b1778285) C:\WINDOWS\system32\drivers\mfeavfk.sys
22:47:39.0953 3852 MfeAVFK - ok
22:47:39.0953 3852 mfeavfk01 - ok
22:47:40.0000 3852 MfeBOPK (2cd52e91ba338f10ba14d3f90bbda5e8) C:\WINDOWS\system32\drivers\mfebopk.sys
22:47:40.0078 3852 MfeBOPK - ok
22:47:40.0109 3852 mfehidk (cf669582f5f98c4ba79d59cfe169198b) C:\WINDOWS\system32\drivers\mfehidk.sys
22:47:40.0250 3852 mfehidk - ok
22:47:40.0281 3852 mferkdet (42f84c2a82a057d74c54ef70e0cf0a2c) C:\WINDOWS\system32\drivers\mferkdet.sys
22:47:40.0359 3852 mferkdet - ok
22:47:40.0390 3852 MfeRKDK (820d6aa3f7f0cfa8a1fa8f63d3f1df04) C:\WINDOWS\system32\drivers\MfeRKDK.sys
22:47:40.0453 3852 MfeRKDK - ok
22:47:40.0484 3852 mfetdi2k (03b2b8bd4d0a2d3636be9248b5dce33a) C:\WINDOWS\system32\drivers\mfetdi2k.sys
22:47:40.0546 3852 mfetdi2k - ok
22:47:40.0593 3852 mfetdik (3812e49fa67a3f604895f0d0c2e1ef90) C:\WINDOWS\system32\drivers\mfetdik.sys
22:47:40.0640 3852 mfetdik - ok
22:47:40.0765 3852 mfevtp (5339baac5c43ddbdb448863f8ea8fcdc) C:\WINDOWS\system32\mfevtps.exe
22:47:40.0828 3852 mfevtp - ok
22:47:40.0875 3852 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
22:47:40.0968 3852 mnmdd - ok
22:47:41.0000 3852 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe
22:47:41.0078 3852 mnmsrvc - ok
22:47:41.0093 3852 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
22:47:41.0171 3852 Modem - ok
22:47:41.0218 3852 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
22:47:41.0296 3852 Mouclass - ok
22:47:41.0328 3852 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
22:47:41.0421 3852 mouhid - ok
22:47:41.0437 3852 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
22:47:41.0515 3852 MountMgr - ok
22:47:41.0531 3852 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
22:47:41.0656 3852 mraid35x - ok
22:47:41.0718 3852 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
22:47:41.0812 3852 MRxDAV - ok
22:47:41.0875 3852 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
22:47:42.0078 3852 MRxSmb - ok
22:47:42.0140 3852 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe
22:47:42.0203 3852 MSDTC - ok
22:47:42.0234 3852 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
22:47:42.0312 3852 Msfs - ok
22:47:42.0312 3852 MSIServer - ok
22:47:42.0359 3852 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
22:47:42.0453 3852 MSKSSRV - ok
22:47:42.0484 3852 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
22:47:42.0562 3852 MSPCLOCK - ok
22:47:42.0562 3852 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
22:47:42.0656 3852 MSPQM - ok
22:47:42.0687 3852 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
22:47:42.0781 3852 mssmbios - ok
22:47:43.0093 3852 MSSQL$ACT7 - ok
22:47:43.0171 3852 MSSQL$SQLEXPRESS - ok
22:47:43.0359 3852 MSSQLServerADHelper (1d89eb4e2a99cabd4e81225f4f4c4b25) C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe
22:47:43.0562 3852 MSSQLServerADHelper - ok
22:47:43.0828 3852 MSSQLServerADHelper100 (f1761c8fb2b25a32c6d63e36bb88c3ae) c:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE
22:47:43.0953 3852 MSSQLServerADHelper100 - ok
22:47:43.0984 3852 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
22:47:44.0125 3852 MSTEE - ok
22:47:44.0187 3852 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
22:47:44.0296 3852 Mup - ok
22:47:44.0437 3852 myAgtSvc (a35ab0a7a983ebca85805da63d763382) C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
22:47:44.0453 3852 myAgtSvc - ok
22:47:44.0500 3852 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
22:47:44.0593 3852 NABTSFEC - ok
22:47:44.0656 3852 NAL (1d99ac4ce3abbd96a8c0d77ff104096d) C:\WINDOWS\system32\Drivers\iqvw32.sys
22:47:44.0843 3852 NAL - ok
22:47:45.0250 3852 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll
22:47:45.0359 3852 napagent - ok
22:47:45.0421 3852 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
22:47:45.0531 3852 NDIS - ok
22:47:45.0562 3852 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
22:47:45.0640 3852 NdisIP - ok
22:47:45.0718 3852 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
22:47:45.0812 3852 NdisTapi - ok
22:47:45.0843 3852 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
22:47:45.0921 3852 Ndisuio - ok
22:47:45.0953 3852 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
22:47:46.0046 3852 NdisWan - ok
22:47:46.0078 3852 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
22:47:46.0234 3852 NDProxy - ok
22:47:46.0265 3852 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
22:47:46.0328 3852 NetBIOS - ok
22:47:46.0359 3852 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
22:47:46.0453 3852 NetBT - ok
22:47:46.0515 3852 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe
22:47:46.0593 3852 NetDDE - ok
22:47:46.0593 3852 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe
22:47:46.0671 3852 NetDDEdsdm - ok
22:47:46.0718 3852 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
22:47:46.0796 3852 Netlogon - ok
22:47:46.0828 3852 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll
22:47:46.0906 3852 Netman - ok
22:47:47.0000 3852 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
22:47:47.0031 3852 NetTcpPortSharing - ok
22:47:47.0062 3852 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
22:47:47.0156 3852 NIC1394 - ok
22:47:47.0218 3852 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll
22:47:47.0234 3852 Nla - ok
22:47:47.0250 3852 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
22:47:47.0328 3852 Npfs - ok
22:47:47.0406 3852 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
22:47:47.0546 3852 Ntfs - ok
22:47:47.0546 3852 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
22:47:47.0625 3852 NtLmSsp - ok
22:47:47.0687 3852 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll
22:47:47.0781 3852 NtmsSvc - ok
22:47:47.0828 3852 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
22:47:47.0921 3852 Null - ok
22:47:48.0359 3852 nv (2e095f4f396f7106a5f1d8b00ec00d4f) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
22:47:49.0015 3852 nv - ok
22:47:49.0218 3852 nvsvc (328acce9c643fe050a4143fe3ec3c025) C:\WINDOWS\system32\nvsvc32.exe
22:47:49.0296 3852 nvsvc ( UnsignedFile.Multi.Generic ) - warning
22:47:49.0296 3852 nvsvc - detected UnsignedFile.Multi.Generic (1)
22:47:49.0359 3852 NWADI (fc2a8aaa0f3321f41231ede0af1968ae) C:\WINDOWS\system32\DRIVERS\NWADIenum.sys
22:47:49.0437 3852 NWADI - ok
22:47:49.0437 3852 nwcworkstation - ok
22:47:49.0468 3852 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
22:47:49.0562 3852 NwlnkFlt - ok
22:47:49.0578 3852 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
22:47:49.0671 3852 NwlnkFwd - ok
22:47:49.0718 3852 NWUSBCDFIL (224131778c92aee8c13afac5fbff19ca) C:\WINDOWS\system32\DRIVERS\NwUsbCdFil.sys
22:47:49.0812 3852 NWUSBCDFIL - ok
22:47:49.0875 3852 NWUSBModem (b7112f30d7eff4b5052eba879f46228f) C:\WINDOWS\system32\DRIVERS\nwusbmdm.sys
22:47:50.0078 3852 NWUSBModem - ok
22:47:50.0093 3852 NWUSBPort (b7112f30d7eff4b5052eba879f46228f) C:\WINDOWS\system32\DRIVERS\nwusbser.sys
22:47:50.0203 3852 NWUSBPort - ok
22:47:50.0218 3852 NWUSBPort2 (b7112f30d7eff4b5052eba879f46228f) C:\WINDOWS\system32\DRIVERS\nwusbser2.sys
22:47:50.0312 3852 NWUSBPort2 - ok
22:47:50.0343 3852 OA001Afx (0f538df1673e5216f3baacb6911d9d0f) C:\WINDOWS\system32\Drivers\OA001Afx.sys
22:47:50.0453 3852 OA001Afx - ok
22:47:50.0500 3852 OA001Ufd (2cf21d5f8f1b74bb1922135ac2b12ddb) C:\WINDOWS\system32\DRIVERS\OA001Ufd.sys
22:47:50.0625 3852 OA001Ufd - ok
22:47:50.0687 3852 OA001Vid (159e5a08a6a5231863cddbd787a4eabb) C:\WINDOWS\system32\DRIVERS\OA001Vid.sys
22:47:50.0765 3852 OA001Vid - ok
22:47:51.0421 3852 odserv (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
22:47:51.0781 3852 odserv - ok
22:47:51.0890 3852 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
22:47:51.0984 3852 ohci1394 - ok
22:47:52.0078 3852 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
22:47:52.0140 3852 ose - ok
22:47:52.0171 3852 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
22:47:52.0265 3852 Parport - ok
22:47:52.0281 3852 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
22:47:52.0359 3852 PartMgr - ok
22:47:52.0375 3852 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
22:47:52.0484 3852 ParVdm - ok
22:47:52.0484 3852 pavprsrv - ok
22:47:52.0500 3852 PBADRV (4088c1ecd1f54281a92fa663b0fdc36f) C:\WINDOWS\system32\DRIVERS\PBADRV.sys
22:47:52.0609 3852 PBADRV - ok
22:47:52.0656 3852 PCASp50 (1961590aa191b6b7dcf18a6a693af7b8) C:\WINDOWS\system32\Drivers\PCASp50.sys
22:47:52.0718 3852 PCASp50 - ok
22:47:52.0781 3852 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
22:47:52.0859 3852 PCI - ok
22:47:52.0875 3852 PCIDump - ok
22:47:52.0890 3852 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
22:47:52.0968 3852 PCIIde - ok
22:47:52.0984 3852 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
22:47:53.0093 3852 Pcmcia - ok
22:47:53.0093 3852 PDCOMP - ok
22:47:53.0093 3852 PDFRAME - ok
22:47:53.0109 3852 PDRELI - ok
22:47:53.0109 3852 PDRFRAME - ok
22:47:53.0125 3852 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
22:47:53.0250 3852 perc2 - ok
22:47:53.0265 3852 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
22:47:53.0328 3852 perc2hib - ok
22:47:53.0390 3852 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe
22:47:53.0390 3852 PlugPlay - ok
22:47:53.0437 3852 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
22:47:53.0515 3852 PolicyAgent - ok
22:47:53.0578 3852 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
22:47:53.0656 3852 PptpMiniport - ok
22:47:53.0656 3852 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
22:47:53.0718 3852 ProtectedStorage - ok
22:47:53.0734 3852 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
22:47:53.0812 3852 PSched - ok
22:47:53.0859 3852 PSI_SVC_2 (e0d0cb09aa07b22be984e4f7ec0326f5) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
22:47:53.0937 3852 PSI_SVC_2 - ok
22:47:53.0968 3852 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
22:47:54.0062 3852 Ptilink - ok
22:47:54.0093 3852 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
22:47:54.0187 3852 ql1080 - ok
22:47:54.0218 3852 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
22:47:54.0281 3852 Ql10wnt - ok
22:47:54.0312 3852 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
22:47:54.0375 3852 ql12160 - ok
22:47:54.0390 3852 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
22:47:54.0484 3852 ql1240 - ok
22:47:54.0484 3852 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
22:47:54.0562 3852 ql1280 - ok
22:47:54.0593 3852 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
22:47:54.0656 3852 RasAcd - ok
22:47:54.0703 3852 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll
22:47:54.0781 3852 RasAuto - ok
22:47:54.0812 3852 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
22:47:54.0890 3852 Rasl2tp - ok
22:47:54.0921 3852 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll
22:47:55.0000 3852 RasMan - ok
22:47:55.0015 3852 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
22:47:55.0109 3852 RasPppoe - ok
22:47:55.0125 3852 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
22:47:55.0218 3852 Raspti - ok
22:47:55.0281 3852 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
22:47:55.0375 3852 Rdbss - ok
22:47:55.0390 3852 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
22:47:55.0453 3852 RDPCDD - ok
22:47:55.0484 3852 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
22:47:55.0593 3852 rdpdr - ok
22:47:55.0640 3852 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
22:47:55.0859 3852 RDPWD - ok
22:47:55.0921 3852 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe
22:47:56.0000 3852 RDSessMgr - ok
22:47:56.0015 3852 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
22:47:56.0109 3852 redbook - ok
22:47:56.0140 3852 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll
22:47:56.0234 3852 RemoteAccess - ok
22:47:56.0265 3852 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll
22:47:56.0343 3852 RemoteRegistry - ok
22:47:56.0390 3852 rimmptsk (ea885e7a56f1be1f14c372337c42fe48) C:\WINDOWS\system32\DRIVERS\rimmptsk.sys
22:47:56.0546 3852 rimmptsk - ok
22:47:56.0578 3852 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe
22:47:56.0656 3852 RpcLocator - ok
22:47:56.0734 3852 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\System32\rpcss.dll
22:47:56.0765 3852 RpcSs - ok
22:47:56.0812 3852 RsFx0105 (6a7360e36cbd636972aeef0dd292a946) C:\WINDOWS\system32\DRIVERS\RsFx0105.sys
22:47:56.0953 3852 RsFx0105 - ok
22:47:56.0984 3852 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe
22:47:57.0062 3852 RSVP - ok
22:47:57.0218 3852 RumorServer (a35ab0a7a983ebca85805da63d763382) C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
22:47:57.0234 3852 RumorServer - ok
22:47:57.0281 3852 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
22:47:57.0343 3852 SamSs - ok
22:47:57.0406 3852 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe
22:47:57.0500 3852 SCardSvr - ok
22:47:57.0515 3852 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll
22:47:57.0593 3852 Schedule - ok
22:47:57.0625 3852 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
22:47:57.0718 3852 sdbus - ok
22:47:57.0718 3852 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
22:47:57.0765 3852 Secdrv - ok
22:47:57.0796 3852 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll
22:47:57.0875 3852 seclogon - ok
22:47:57.0984 3852 SecureStorageService (e80163f46ae96cc0a05fb9f3f55deb18) C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe
22:47:58.0125 3852 SecureStorageService ( UnsignedFile.Multi.Generic ) - warning
22:47:58.0125 3852 SecureStorageService - detected UnsignedFile.Multi.Generic (1)
22:47:58.0171 3852 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll
22:47:58.0250 3852 SENS - ok
22:47:58.0296 3852 Sentinel (8627c992b8a80504fc477b2e8ff8ec4f) C:\WINDOWS\System32\Drivers\SENTINEL.SYS
22:47:58.0328 3852 Sentinel ( UnsignedFile.Multi.Generic ) - warning
22:47:58.0328 3852 Sentinel - detected UnsignedFile.Multi.Generic (1)
22:47:58.0375 3852 Serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
22:47:58.0453 3852 Serenum - ok
22:47:58.0484 3852 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
22:47:58.0593 3852 Serial - ok
22:47:58.0609 3852 sermouse (1f16931c722c69e4a7866244796c66a0) C:\WINDOWS\system32\DRIVERS\sermouse.sys
22:47:58.0765 3852 sermouse - ok
22:47:58.0796 3852 sffdisk (0fa803c64df0914b41f807ea276bf2a6) C:\WINDOWS\system32\DRIVERS\sffdisk.sys
22:47:58.0890 3852 sffdisk - ok
22:47:58.0921 3852 sffp_sd (c17c331e435ed8737525c86a7557b3ac) C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
22:47:58.0984 3852 sffp_sd - ok
22:47:59.0000 3852 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
22:47:59.0093 3852 Sfloppy - ok
22:47:59.0140 3852 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll
22:47:59.0218 3852 SharedAccess - ok
22:47:59.0265 3852 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
22:47:59.0281 3852 ShellHWDetection - ok
22:47:59.0281 3852 Simbad - ok
22:47:59.0312 3852 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
22:47:59.0390 3852 sisagp - ok
22:47:59.0390 3852 slee_503_service - ok
22:47:59.0437 3852 slimsvc (11028c6a84a967070cb1286550f2058f) C:\WINDOWS\system32\plscsi.dll
22:49:29.0468 3852 slimsvc ( Backdoor.Multi.ZAccess.gen ) - infected
22:49:29.0468 3852 slimsvc - detected Backdoor.Multi.ZAccess.gen (0)
22:49:29.0500 3852 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
22:49:49.0718 3852 SLIP - ok
22:49:49.0906 3852 SMManager (24d62fc9201d172f69c47355d185213b) C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe
22:49:49.0937 3852 SMManager ( UnsignedFile.Multi.Generic ) - warning
22:49:49.0937 3852 SMManager - detected UnsignedFile.Multi.Generic (1)
22:49:50.0000 3852 SMSIVZAM5 (1e715247efffdda938c085913045d599) C:\PROGRA~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS
22:49:50.0015 3852 SMSIVZAM5 - ok
22:49:50.0062 3852 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
22:49:50.0109 3852 Sparrow - ok
22:49:50.0140 3852 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
22:49:50.0234 3852 splitter - ok
22:49:50.0281 3852 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
22:49:50.0343 3852 Spooler - ok
22:49:50.0500 3852 SQLAgent$SQLEXPRESS (a892134c28777978ecde8283dc57ac0f) c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE
22:49:50.0562 3852 SQLAgent$SQLEXPRESS - ok
22:49:50.0687 3852 SQLBrowser (10d936dced9eacd1a1b3fcdda6d7a4eb) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
22:49:50.0718 3852 SQLBrowser - ok
22:49:50.0734 3852 SQLWriter (135cdccc167ef0c250125bbd3abe18d5) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
22:49:50.0765 3852 SQLWriter - ok
22:49:50.0812 3852 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
22:49:50.0921 3852 sr - ok
22:49:50.0968 3852 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll
22:49:51.0078 3852 srservice - ok
22:49:51.0156 3852 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
22:49:51.0281 3852 Srv - ok
22:49:51.0328 3852 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll
22:49:51.0375 3852 SSDPSRV - ok
22:49:51.0453 3852 STacSV (0a8fa56553913e87aa24a6ce218b88de) c:\drivers\audio\r267815\payload\wdm\stacsv.exe
22:49:51.0484 3852 STacSV - ok
22:49:51.0578 3852 STHDA (c111965a8dbd00768787d807ec3113ff) C:\WINDOWS\system32\drivers\sthda.sys
22:49:51.0656 3852 STHDA - ok
22:49:51.0906 3852 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll
22:49:52.0046 3852 stisvc - ok
22:49:52.0125 3852 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
22:49:52.0203 3852 streamip - ok
22:49:52.0234 3852 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
22:49:52.0296 3852 swenum - ok
22:49:52.0328 3852 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
22:49:52.0406 3852 swmidi - ok
22:49:52.0406 3852 SwPrv - ok
22:49:52.0406 3852 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
22:49:52.0484 3852 symc810 - ok
22:49:52.0484 3852 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
22:49:52.0578 3852 symc8xx - ok
22:49:52.0593 3852 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
22:49:52.0687 3852 sym_hi - ok
22:49:52.0734 3852 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
22:49:52.0796 3852 sym_u3 - ok
22:49:52.0812 3852 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
22:49:52.0906 3852 sysaudio - ok
22:49:52.0953 3852 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe
22:49:53.0031 3852 SysmonLog - ok
22:49:53.0078 3852 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll
22:49:53.0140 3852 TapiSrv - ok
22:49:53.0203 3852 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
22:49:53.0218 3852 Tcpip - ok
22:49:53.0500 3852 tcsd_win32.exe (ba9202e263a6fc1ffd7889fea186a2c4) C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe
22:49:53.0625 3852 tcsd_win32.exe ( UnsignedFile.Multi.Generic ) - warning
22:49:53.0625 3852 tcsd_win32.exe - detected UnsignedFile.Multi.Generic (1)
22:49:53.0765 3852 TdmService (ea63bf38938ad9917beb1846d6d15c84) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
22:49:53.0828 3852 TdmService ( UnsignedFile.Multi.Generic ) - warning
22:49:53.0828 3852 TdmService - detected UnsignedFile.Multi.Generic (1)
22:49:54.0062 3852 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
22:49:54.0265 3852 TDPIPE - ok
22:49:54.0281 3852 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
22:49:54.0359 3852 TDTCP - ok
22:49:54.0390 3852 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
22:49:54.0468 3852 TermDD - ok
22:49:54.0531 3852 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll
22:49:54.0625 3852 TermService - ok
22:49:54.0671 3852 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
22:49:54.0687 3852 Themes - ok
22:49:54.0718 3852 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\system32\tlntsvr.exe
22:49:54.0750 3852 TlntSvr - ok
22:49:54.0812 3852 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
22:49:54.0875 3852 TosIde - ok
22:49:54.0890 3852 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll
22:49:54.0984 3852 TrkWks - ok
22:49:55.0031 3852 TrmbTS (5070590587118b2960e14927b4393d32) C:\WINDOWS\system32\Drivers\TrmbTS.sys
22:49:55.0062 3852 TrmbTS ( UnsignedFile.Multi.Generic ) - warning
22:49:55.0062 3852 TrmbTS - detected UnsignedFile.Multi.Generic (1)
22:49:55.0093 3852 TRMUSB5K (53908ad09d37d86db3d7c00aced738e1) C:\WINDOWS\system32\drivers\TRMUSB5K.sys
22:49:55.0109 3852 TRMUSB5K ( UnsignedFile.Multi.Generic ) - warning
22:49:55.0109 3852 TRMUSB5K - detected UnsignedFile.Multi.Generic (1)
22:49:55.0140 3852 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
22:49:55.0218 3852 Udfs - ok
22:49:55.0265 3852 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
22:49:55.0296 3852 ultra - ok
22:49:55.0328 3852 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
22:49:55.0421 3852 Update - ok
22:49:55.0468 3852 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll
22:49:55.0531 3852 upnphost - ok
22:49:55.0546 3852 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe
22:49:55.0640 3852 UPS - ok
22:49:55.0750 3852 USA19H (6d1e41657fdb48f9147598c773297513) C:\WINDOWS\system32\DRIVERS\USA19H2k.sys
22:49:55.0828 3852 USA19H - ok
22:49:55.0843 3852 USA19H2KP (8a217fc16dd14ab8ad2eaa1f08b3b5c5) C:\WINDOWS\system32\DRIVERS\USA19H2kp.SYS
22:49:55.0875 3852 USA19H2KP - ok
22:49:55.0921 3852 usbccgp (c18d6c74953621346df6b0a11f80c1cc) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
22:49:55.0968 3852 usbccgp - ok
22:49:56.0062 3852 USBCCID (150442fa5224dc338028543e2fffa7b4) C:\WINDOWS\system32\DRIVERS\usbccid.sys
22:49:56.0078 3852 USBCCID - ok
22:49:56.0109 3852 usbehci (4bac8df07f1d8434fc640e677a62204e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
22:49:56.0171 3852 usbehci - ok
22:49:56.0218 3852 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
22:49:56.0296 3852 usbhub - ok
22:49:56.0328 3852 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
22:49:56.0421 3852 usbprint - ok
22:49:56.0453 3852 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
22:49:56.0531 3852 usbscan - ok
22:49:56.0593 3852 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
22:49:56.0671 3852 USBSTOR - ok
22:49:56.0703 3852 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
22:49:56.0765 3852 usbuhci - ok
22:49:56.0796 3852 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
22:49:56.0859 3852 usbvideo - ok
22:49:56.0906 3852 usb_rndisx (b6cc50279d6cd28e090a5d33244adc9a) C:\WINDOWS\system32\DRIVERS\usb8023x.sys
22:49:56.0968 3852 usb_rndisx - ok
22:49:57.0000 3852 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
22:49:57.0093 3852 VgaSave - ok
22:49:57.0109 3852 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
22:49:57.0187 3852 viaagp - ok
22:49:57.0218 3852 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
22:49:57.0281 3852 ViaIde - ok
22:49:57.0312 3852 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
22:49:57.0375 3852 VolSnap - ok
22:49:57.0406 3852 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe
22:49:57.0453 3852 VSS - ok
22:49:57.0468 3852 w32time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll
22:49:57.0531 3852 w32time - ok
22:49:57.0546 3852 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
22:49:57.0625 3852 Wanarp - ok
22:49:57.0671 3852 WavxDMgr (0be8dd6c95c5bdff9c5f3fa8095d304c) C:\WINDOWS\system32\DRIVERS\WavxDMgr.sys
22:49:57.0687 3852 WavxDMgr - ok
22:49:57.0734 3852 wceusbsh (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys
22:49:57.0781 3852 wceusbsh - ok
22:49:57.0812 3852 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
22:49:57.0828 3852 Wdf01000 - ok
22:49:57.0843 3852 WDICA - ok
22:49:57.0843 3852 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
22:49:57.0953 3852 wdmaud - ok
22:49:58.0015 3852 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll
22:49:58.0093 3852 WebClient - ok
22:49:58.0156 3852 WinDriver6 (2c7d830e86b378771af5dafeae428a09) C:\WINDOWS\system32\drivers\windrvr6.sys
22:49:58.0171 3852 WinDriver6 ( UnsignedFile.Multi.Generic ) - warning
22:49:58.0171 3852 WinDriver6 - detected UnsignedFile.Multi.Generic (1)
22:49:58.0250 3852 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll
22:49:58.0343 3852 winmgmt - ok
22:49:58.0406 3852 WinRM (18f347402da544a780949b8fdf83351b) C:\WINDOWS\system32\WsmSvc.dll
22:49:58.0484 3852 WinRM - ok
22:49:58.0546 3852 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
22:49:58.0593 3852 WmdmPmSN - ok
22:49:58.0671 3852 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll
22:49:58.0734 3852 Wmi - ok
22:49:58.0812 3852 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
22:49:58.0906 3852 WmiAcpi - ok
22:49:58.0968 3852 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe
22:49:59.0062 3852 WmiApSrv - ok
22:49:59.0187 3852 WMPNetworkSvc (f74e3d9a7fa9556c3bbb14d4e5e63d3b) C:\Program Files\Windows Media Player\WMPNetwk.exe
22:49:59.0250 3852 WMPNetworkSvc - ok
22:49:59.0281 3852 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
22:49:59.0375 3852 WSTCODEC - ok
22:49:59.0390 3852 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll
22:49:59.0484 3852 wuauserv - ok
22:49:59.0531 3852 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
22:49:59.0562 3852 WudfPf - ok
22:49:59.0578 3852 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
22:49:59.0625 3852 WudfRd - ok
22:49:59.0656 3852 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
22:49:59.0671 3852 WudfSvc - ok
22:49:59.0734 3852 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll
22:49:59.0828 3852 WZCSVC - ok
22:49:59.0890 3852 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll
22:49:59.0968 3852 xmlprov - ok
22:50:00.0062 3852 XobniService (986c5b8f380f7408ecee96c3c5dbf66c) C:\Program Files\Xobni\XobniService.exe
22:50:00.0125 3852 XobniService - ok
22:50:00.0218 3852 YahooAUService (dd0042f0c3b606a6a8b92d49afb18ad6) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
22:50:00.0265 3852 YahooAUService - ok
22:50:00.0453 3852 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
22:50:00.0640 3852 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
22:50:00.0640 3852 \Device\Harddisk0\DR0 - detected TDSS File System (1)
22:50:00.0640 3852 Boot (0x1200) (1164849f2816b8faac91ba9894555e1e) \Device\Harddisk0\DR0\Partition0
22:50:00.0640 3852 \Device\Harddisk0\DR0\Partition0 - ok
22:50:00.0640 3852 ============================================================
22:50:00.0640 3852 Scan finished
22:50:00.0640 3852 ============================================================
22:50:00.0750 4672 Detected object count: 14
22:50:00.0750 4672 Actual detected object count: 14
22:52:18.0203 4672 ACT! Scheduler ( UnsignedFile.Multi.Generic ) - skipped by user
22:52:18.0203 4672 ACT! Scheduler ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:52:18.0203 4672 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user
22:52:18.0203 4672 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:52:18.0343 4672 C:\WINDOWS\system32\DRIVERS\ipsec.sys - copied to quarantine
22:52:18.0625 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\@ - copied to quarantine
22:52:18.0656 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\cfg.ini - copied to quarantine
22:52:18.0703 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\Desktop.ini - copied to quarantine
22:52:18.0937 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\L\rohepcid - copied to quarantine
22:52:18.0937 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\oemid - copied to quarantine
22:52:19.0000 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\U\00000001.@ - copied to quarantine
22:52:19.0125 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\U\00000002.@ - copied to quarantine
22:52:19.0265 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\U\00000004.@ - copied to quarantine
22:52:19.0390 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\U\80000000.@ - copied to quarantine
22:52:19.0578 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\U\80000004.@ - copied to quarantine
22:52:19.0640 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\U\80000032.@ - copied to quarantine
22:52:19.0750 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\version - copied to quarantine
22:52:21.0734 4672 Backup copy found, using it..
22:52:22.0578 4672 C:\WINDOWS\system32\DRIVERS\ipsec.sys - will be cured on reboot
22:52:25.0171 4672 C:\WINDOWS\$NtUninstallKB23213$\2027358086 - will be deleted on reboot
22:52:25.0171 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\@ - will be deleted on reboot
22:52:25.0171 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\cfg.ini - will be deleted on reboot
22:52:25.0171 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\Desktop.ini - will be deleted on reboot
22:52:25.0187 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\oemid - will be deleted on reboot
22:52:25.0187 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\U\00000001.@ - will be deleted on reboot
22:52:25.0187 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\U\00000002.@ - will be deleted on reboot
22:52:25.0187 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\U\00000004.@ - will be deleted on reboot
22:52:25.0187 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\U\80000000.@ - will be deleted on reboot
22:52:25.0187 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\U\80000004.@ - will be deleted on reboot
22:52:25.0187 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\U\80000032.@ - will be deleted on reboot
22:52:25.0187 4672 C:\WINDOWS\$NtUninstallKB23213$\961045477\version - will be deleted on reboot
22:52:25.0203 4672 IPSec ( Virus.Win32.ZAccess.k ) - User select action: Cure
22:52:25.0203 4672 nvsvc ( UnsignedFile.Multi.Generic ) - skipped by user
22:52:25.0203 4672 nvsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:52:25.0203 4672 SecureStorageService ( UnsignedFile.Multi.Generic ) - skipped by user
22:52:25.0203 4672 SecureStorageService ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:52:25.0203 4672 Sentinel ( UnsignedFile.Multi.Generic ) - skipped by user
22:52:25.0203 4672 Sentinel ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:52:25.0203 4672 slimsvc ( Backdoor.Multi.ZAccess.gen ) - skipped by user
22:52:25.0203 4672 slimsvc ( Backdoor.Multi.ZAccess.gen ) - User select action: Skip
22:52:25.0203 4672 SMManager ( UnsignedFile.Multi.Generic ) - skipped by user
22:52:25.0203 4672 SMManager ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:52:25.0203 4672 tcsd_win32.exe ( UnsignedFile.Multi.Generic ) - skipped by user
22:52:25.0203 4672 tcsd_win32.exe ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:52:25.0218 4672 TdmService ( UnsignedFile.Multi.Generic ) - skipped by user
22:52:25.0218 4672 TdmService ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:52:25.0218 4672 TrmbTS ( UnsignedFile.Multi.Generic ) - skipped by user
22:52:25.0218 4672 TrmbTS ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:52:25.0218 4672 TRMUSB5K ( UnsignedFile.Multi.Generic ) - skipped by user
22:52:25.0218 4672 TRMUSB5K ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:52:25.0218 4672 WinDriver6 ( UnsignedFile.Multi.Generic ) - skipped by user
22:52:25.0218 4672 WinDriver6 ( UnsignedFile.Multi.Generic ) - User select action: Skip
22:52:25.0218 4672 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
22:52:25.0218 4672 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip
22:52:53.0578 3124 Deinitialize success

And the previous ComboFix log:
ComboFix 12-04-26.01 - jzipkin 04/30/2012 9:25.8.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3572.2970 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: McAfee® Security-as-a-Service Anti-virus *Disabled/Outdated* {8C354827-2F54-4E28-90DC-AD391E77808C}
* Created a new restore point
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\$NtUninstallKB23213$
c:\windows\$NtUninstallKB23213$\3772199020
.
Infected copy of c:\windows\system32\drivers\afd.sys was found and disinfected
Restored copy from - The cat found it

.
((((((((((((((((((((((((( Files Created from 2012-03-28 to 2012-04-30 )))))))))))))))))))))))))))))))
.
.
2012-04-30 13:17 . 2011-08-17 13:49 138496 -c–a-w- c:\windows\system32\dllcache\afd.sys
2012-04-30 13:17 . 2011-08-17 13:49 138496 —-a-w- c:\windows\system32\drivers\afd.sys
2012-04-27 11:42 . 2012-04-27 11:42 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Sun
2012-04-27 03:09 . 2008-04-14 12:00 162816 —-a-w- c:\windows\system32\drivers\netbt.sys
2012-04-27 02:52 . 2012-04-27 02:52 ——– d—–w- C:\TDSSKiller_Quarantine
2012-04-26 17:05 . 2012-04-26 17:04 388608 —-a-w- C:\HiJackThis.exe
2012-04-25 13:45 . 2012-04-25 13:45 418464 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-04-25 13:34 . 2012-04-25 13:34 ——– d—–w- c:\documents and settings\JZipkin\Application Data\Intel Corporation
2012-04-06 14:50 . 2012-04-06 14:56 ——– d—–w- c:\program files\ArcPad
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-30 13:47 . 2010-07-26 18:14 1994 –sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2012-04-30 13:44 . 2010-07-23 18:20 0 —-a-w- c:\documents and settings\JZipkin\Local Settings\Application Data\WavXMapDrive.bat
2012-04-27 02:53 . 2008-04-25 16:16 75264 —-a-w- c:\windows\system32\drivers\ipsec.sys
2012-04-25 13:45 . 2011-06-29 15:20 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((( SnapShot@2012-04-27_12.13.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-04-30 13:40 . 2012-04-30 13:40 16384 c:\windows\Temp\Perflib_Perfdata_8d0.dat
+ 2012-04-30 13:40 . 2012-04-30 13:40 16384 c:\windows\Temp\Perflib_Perfdata_580.dat
+ 2008-04-25 16:16 . 2012-04-30 13:46 560798 c:\windows\system32\perfh009.dat
- 2008-04-25 16:16 . 2012-04-27 12:13 560798 c:\windows\system32\perfh009.dat
+ 2008-04-25 16:16 . 2012-04-30 13:46 117144 c:\windows\system32\perfc009.dat
- 2008-04-25 16:16 . 2012-04-27 12:13 117144 c:\windows\system32\perfc009.dat
+ 2012-04-30 13:48 . 2012-04-30 13:48 145612997 c:\windows\Temp\UPD1D.tmp\updscan.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn1\yt.dll" [2011-12-09 1517368]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]
@="{022F2F51-CDDA-4873-8A29-72C66C808A3F}"
[HKEY_CLASSES_ROOT\CLSID\{022F2F51-CDDA-4873-8A29-72C66C808A3F}]
2009-11-07 05:07 297808 ——w- c:\windows\system32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{661963C1-99A1-44e7-A671-1CF3768AE9D4}"
[HKEY_CLASSES_ROOT\CLSID\{661963C1-99A1-44e7-A671-1CF3768AE9D4}]
2009-11-07 05:07 297808 ——w- c:\windows\system32\mscoree.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"Facebook Update"="c:\documents and settings\jzipkin\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" [2011-10-21 137536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-02-17 278528]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-04-05 495708]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2010-04-05 737280]
"nwiz"="nwiz.exe" [2009-12-15 1657448]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-12-15 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-12-15 13770752]
"NVHotkey"="nvHotkey.dll" [2009-12-15 86016]
"OA001Mon"="c:\windows\OA001Mon.exe" [2010-01-28 24576]
"IAStorIcon"="c:\program files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"ChangeTPMAuth"="c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe" [2008-05-30 180224]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2008-05-14 105472]
"SecureUpgrade"="c:\program files\Wave Systems Corp\SecureUpgrade.exe" [2008-06-24 243000]
"EmbassySecurityCheck"="c:\program files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe" [2008-06-24 79160]
"DellControlPoint"="c:\program files\Dell\Dell ControlPoint\Dell.ControlPoint.exe" [2008-08-18 598016]
"DCPstrApp"="c:\program files\Dell\Dell ControlPoint\Security Manager\SecurityDeviceInfoSetRegistryString.exe" [2008-08-04 6656]
"DellConnectionManager"="c:\program files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe" [2008-10-01 1454080]
"MVS Splash"="c:\program files\McAfee\Managed VirusScan\DesktopUI\XTray.exe" [2011-08-25 476480]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Act.Outlook.Service"="c:\program files\ACT\Act for Windows\Act.Outlook.Service.exe" [2009-02-24 28672]
"Act! Preloader"="c:\program files\ACT\Act for Windows\ActSage.exe" [2009-02-24 393216]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2012-03-27 40376]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2012-03-26 640440]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2009-05-08 174424]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" [2008-10-17 442536]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2011-06-29 273544]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-05-04 252136]
.
c:\documents and settings\McAfeeMVSUser\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [N/A]
.
c:\documents and settings\ataylor.WAYPOINT.000\Start Menu\Programs\Startup\
Logitech . Product Registration.lnk - c:\program files\Common Files\LogiShrd\eReg\SetPoint\eReg.exe [2009-11-16 517384]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-8-15 604776]
Dell ControlPoint System Manager.lnk - c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe [2008-11-11 950048]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-05-06 09:29 64592 —-a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\McAfee\\Managed VirusScan\\Agent\\myAgtSvc.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\ACT\\Act for Windows\\ActSage.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [8/12/2010 2:55 PM 89624]
R2 ASFAgent;ASF Agent;c:\program files\Intel\ASF Agent\ASFAgent.exe [4/19/2007 6:56 AM 133968]
R2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\Dell\Dell ControlPoint\DCPButtonSvc.exe [9/4/2008 6:28 PM 406808]
R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [11/11/2008 5:35 PM 808296]
R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [11/11/2008 5:35 PM 20840]
R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [11/11/2008 4:00 PM 451872]
R2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [12/29/2011 4:47 PM 99896]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [7/22/2010 1:13 PM 13336]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [7/26/2010 11:19 AM 10448]
R2 McAfee SiteAdvisor Enterprise Service;McAfee SiteAdvisor Enterprise Service;c:\program files\McAfee\SiteAdvisor Enterprise\McSACore.exe [5/12/2011 11:48 AM 324928]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [11/16/2010 10:37 AM 148520]
R2 MSSQL$ACT7;SQL Server (ACT7);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [12/10/2010 6:29 PM 29293408]
R2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [8/23/2011 9:50 AM 291064]
R2 RumorServer;McAfee Peer Distribution Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [8/23/2011 9:50 AM 291064]
R2 SMManager;Smith Micro Connection Manager Service;c:\program files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [10/1/2008 5:28 AM 90112]
R2 XobniService;XobniService;c:\program files\Xobni\XobniService.exe [5/20/2010 1:46 PM 55016]
R3 CCIDFILTER;Broadcom Smart Card Reader Filter Driver;c:\windows\system32\drivers\ccidflt.sys [7/22/2010 1:11 PM 12840]
R3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [7/21/2010 5:27 PM 32808]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [7/21/2010 5:25 PM 240344]
R3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\drivers\OA001Ufd.sys [7/21/2010 5:25 PM 133632]
R3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\drivers\OA001Vid.sys [7/21/2010 5:25 PM 281472]
S2 ACT! Scheduler;ACT! Scheduler;c:\program files\ACT\Act for Windows\Act.Scheduler.exe [2/24/2009 2:08 PM 81920]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/26/2010 11:43 AM 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/25/2012 9:45 AM 253088]
S3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [7/21/2010 5:25 PM 113664]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7/26/2010 11:43 AM 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [8/12/2010 2:55 PM 87808]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [12/18/2009 12:13 PM 20480]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [12/18/2009 12:12 PM 174720]
S3 OA001Afx;Provides a software interface to control audio effects of OA001 camera.;c:\windows\system32\drivers\OA001Afx.sys [7/21/2010 5:25 PM 134144]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [4/14/2010 8:29 PM 32408]
S3 TrmbTS;TrmbTS;c:\windows\system32\drivers\TrmbTS.sys [8/26/2010 12:49 PM 29184]
S3 TRMUSB5K;Trimble USB GPS Driver;c:\windows\system32\drivers\TRMUSB5K.sys –> c:\windows\system32\drivers\TRMUSB5K.sys [?]
S3 USA19H;USA19H;c:\windows\system32\drivers\USA19H2k.sys [8/13/2010 3:56 PM 704000]
S3 USA19H2KP;Keyspan USB Serial Port Driver;c:\windows\system32\drivers\USA19H2kp.sys [8/13/2010 3:56 PM 24192]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/25/2008 12:16 PM 14336]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [7/22/2009 11:08 PM 47128]
S4 RsFx0105;RsFx0105 Driver;c:\windows\system32\drivers\RsFx0105.sys [9/22/2011 6:10 PM 238696]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [9/22/2011 6:17 PM 370024]
.
— Other Services/Drivers In Memory —
.
*Deregistered* - mfeavfk01
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
pavprsrv
slee_503_service
idebusdr
slimsvc
PAC7302
.
Contents of the 'Scheduled Tasks' folder
.
2012-04-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-25 13:45]
.
2011-10-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
2012-04-26 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-308600077-3542235570-3293604796-1145Core.job
- c:\documents and settings\jzipkin\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-10-21 17:46]
.
2012-04-27 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-308600077-3542235570-3293604796-1145UA.job
- c:\documents and settings\jzipkin\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-10-21 17:46]
.
2012-04-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 15:43]
.
2012-04-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 15:43]
.
2012-04-30 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-308600077-3542235570-3293604796-1145.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
2012-04-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-308600077-3542235570-3293604796-1145.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = 10.0.0.11
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-30 09:44
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
.
c:\docume~1\jzipkin\LOCALS~1\Temp\RESA.tmp 1208 bytes
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1008)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
- - - - - - - > 'explorer.exe'(4660)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmUserInterface.dll
c:\windows\system32\btmmhook.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\nvsvc32.exe
c:\windows\System32\SCardSvr.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Common Files\McAfee\SystemCore\mcshield.exe
c:\program files\Common Files\McAfee\SystemCore\mfeann.exe
c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\rundll32.exe
c:\program files\DellTPad\ApMsgFwd.exe
c:\program files\DellTPad\HidFind.exe
c:\program files\DellTPad\Apntex.exe
c:\program files\real\realplayer\RealPlay.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\program files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
.
**************************************************************************
.
Completion time: 2012-04-30 09:51:00 - machine was rebooted
ComboFix-quarantined-files.txt 2012-04-30 13:50
ComboFix2.txt 2012-04-27 12:19
ComboFix3.txt 2011-12-01 01:29
.
Pre-Run: 112,821,948,416 bytes free
Post-Run: 112,831,508,480 bytes free
.
- - End Of File - - 0841F1BF5F0A9268C2A9F1B9B0008023

Satchfan

Post #6May 9, 2012, 4:34 PM UTC

Thanks for the logs.

As you say, nothing in the current log but plenty in both of the previous ones, so we need a current log from ComboFix.

Run ComboFix

Delete the version of ComboFix you have here:

c:\documents and settings\jzipkin\Desktop\ComboFix.exe

Download a new version which MUST be saved directly to your desktop. Choose save as and then make sure you choose Desktop

Download a new version from one of the following locations:

Link1
Link2
Link3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, as they may otherwise interfere with our tools. See here for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.

When finished, it will produce a log. Please include the ComboFix.txt in your next reply. It can be found at C:\ComboFix.txt

I’m a bit busy for a while now but will hopefully reply again later when I’ve received the new log and had chance to look at it.

Thanks

Satchfan

SuMMiT

Post #7May 9, 2012, 4:59 PM UTC

Thx so much. Reply when you've got the chance. I'm juggling a few too many things at the moment myself.

Note, after running Combofix and launching IE i was notified that IE was not my default browser. Something must have changed it.

Windows still doesn't recognize my audio hardware. Got me a silent computer. Fortunately I've got the iPad for streaming music

Here's the log…

ComboFix 12-05-09.01 - jzipkin 05/09/2012 12:41:25.9.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3572.2808 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: McAfee® Security-as-a-Service Anti-virus *Disabled/Updated* {8C354827-2F54-4E28-90DC-AD391E77808C}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\data
c:\data\9p8fxr_o\us_sres.data
c:\data\default\us_sres.data
c:\documents and settings\All Users\Application Data\8615B8621C.sys
.
.
((((((((((((((((((((((((( Files Created from 2012-04-09 to 2012-05-09 )))))))))))))))))))))))))))))))
.
.
2012-04-30 15:41 . 2012-04-30 15:41 ——– d—–w- c:\program files\Common Files\Java
2012-04-30 15:32 . 2012-04-30 15:32 ——– d—–w- c:\program files\Oracle
2012-04-30 15:32 . 2012-04-30 15:32 ——– d—–w- c:\documents and settings\JZipkin\Application Data\Oracle
2012-04-30 15:32 . 2012-04-04 22:47 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-04-30 15:32 . 2012-04-04 22:47 772504 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-04-30 13:17 . 2011-08-17 13:49 138496 -c–a-w- c:\windows\system32\dllcache\afd.sys
2012-04-30 13:17 . 2011-08-17 13:49 138496 —-a-w- c:\windows\system32\drivers\afd.sys
2012-04-27 11:42 . 2012-04-27 11:42 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Sun
2012-04-27 03:09 . 2008-04-14 12:00 162816 —-a-w- c:\windows\system32\drivers\netbt.sys
2012-04-27 02:52 . 2012-04-27 02:52 ——– d—–w- C:\TDSSKiller_Quarantine
2012-04-26 17:05 . 2012-04-26 17:04 388608 —-a-w- C:\HiJackThis.exe
2012-04-25 13:45 . 2012-05-09 16:25 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-04-25 13:34 . 2012-04-25 13:34 ——– d—–w- c:\documents and settings\JZipkin\Application Data\Intel Corporation
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-09 16:31 . 2010-07-26 18:14 1994 –sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2012-05-09 16:25 . 2011-06-29 15:20 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-09 16:19 . 2010-07-23 18:20 0 —-a-w- c:\documents and settings\JZipkin\Local Settings\Application Data\WavXMapDrive.bat
2012-04-27 02:53 . 2008-04-25 16:16 75264 —-a-w- c:\windows\system32\drivers\ipsec.sys
2012-04-04 22:47 . 2010-07-22 17:11 687504 —-a-w- c:\windows\system32\deployJava1.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-04-27_12.13.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-05-09 16:11 . 2012-05-09 16:11 16384 c:\windows\Temp\Perflib_Perfdata_86c.dat
+ 2012-05-09 16:11 . 2012-05-09 16:11 16384 c:\windows\Temp\Perflib_Perfdata_3d0.dat
- 2000-04-26 18:34 . 2000-04-26 18:34 44304 c:\windows\system32\msrpfs35.dll
+ 2000-04-26 17:34 . 2000-04-26 17:34 44304 c:\windows\system32\msrpfs35.dll
- 2000-04-26 18:34 . 2000-04-26 18:34 24848 c:\windows\system32\msjter35.dll
+ 2000-04-26 17:34 . 2000-04-26 17:34 24848 c:\windows\system32\msjter35.dll
- 2000-04-26 18:34 . 2000-04-26 18:34 39424 c:\windows\system32\JETCOMP.exe
+ 2000-04-26 17:34 . 2000-04-26 17:34 39424 c:\windows\system32\JETCOMP.exe
+ 2012-05-09 16:45 . 2012-05-09 16:45 18562 c:\windows\SoftwareDistribution\EventCache\{5859FC3F-BCE2-4C33-BB64-15D3B21AD7F0}.bin
+ 2012-05-02 16:50 . 2012-05-02 16:50 69632 c:\windows\Installer\{ED3F245C-9E61-4B3F-8C5D-B8FA6586D4A6}\NewShortcut2_641FEB7A27D74786AE359F6E377F4AAD.exe
+ 2012-05-02 16:50 . 2012-05-02 16:50 73728 c:\windows\Installer\{ED3F245C-9E61-4B3F-8C5D-B8FA6586D4A6}\ARPPRODUCTICON.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut9_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut8_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut7_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut6_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut5_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut4_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut3_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut25_FA757C52436948AB9E3AF98E3A1444E4.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 57344 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut24_7052CB5222334B9B8C5FD1652D742A45.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut23_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 45056 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut22_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut2_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut19_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 49152 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut18_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut17_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut16_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 45056 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut15_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 45056 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut14_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut13_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut12_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut11_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut10_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\NewShortcut1_530BD8A7349B45BBAFA5B5BCA6321BA1.exe
+ 2012-05-01 20:53 . 2012-05-01 20:53 40960 c:\windows\Installer\{E27D856D-664C-49F3-95A3-E6B639BB2AC1}\ARPPRODUCTICON.exe
+ 2011-01-21 18:28 . 2012-05-04 15:44 49152 c:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll
- 2011-01-21 18:28 . 2011-10-13 13:47 49152 c:\windows\Installer\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}\ConfigIcon.dll
- 2000-04-26 18:34 . 2000-04-26 18:34 368912 c:\windows\system32\VBAR332.DLL
+ 2000-04-26 17:34 . 2000-04-26 17:34 368912 c:\windows\system32\VBAR332.DLL
- 2008-04-25 16:16 . 2012-04-27 12:13 560798 c:\windows\system32\perfh009.dat
+ 2008-04-25 16:16 . 2012-05-09 16:20 560798 c:\windows\system32\perfh009.dat
- 2008-04-25 16:16 . 2012-04-27 12:13 117144 c:\windows\system32\perfc009.dat
+ 2008-04-25 16:16 . 2012-05-09 16:20 117144 c:\windows\system32\perfc009.dat
+ 2010-07-22 17:03 . 2012-05-02 14:27 203657 c:\windows\system32\nvModes.dat
- 2000-04-26 18:34 . 2000-04-26 18:34 294912 c:\windows\system32\msxbse35.dll
+ 2000-04-26 17:34 . 2000-04-26 17:34 294912 c:\windows\system32\msxbse35.dll
- 2000-04-26 18:34 . 2000-04-26 18:34 166672 c:\windows\system32\mstext35.dll
+ 2000-04-26 17:34 . 2000-04-26 17:34 166672 c:\windows\system32\mstext35.dll
+ 2000-04-26 17:34 . 2000-04-26 17:34 415504 c:\windows\system32\msrepl35.dll
- 2000-04-26 18:34 . 2000-04-26 18:34 415504 c:\windows\system32\msrepl35.dll
+ 2000-04-26 17:34 . 2000-04-26 17:34 262144 c:\windows\system32\msrd2x35.dll
- 2000-04-26 18:34 . 2000-04-26 18:34 262144 c:\windows\system32\msrd2x35.dll
- 2000-04-26 18:34 . 2000-04-26 18:34 250128 c:\windows\system32\mspdox35.dll
+ 2000-04-26 17:34 . 2000-04-26 17:34 250128 c:\windows\system32\mspdox35.dll
- 2000-04-26 18:34 . 2000-04-26 18:34 168720 c:\windows\system32\msltus35.dll
+ 2000-04-26 17:34 . 2000-04-26 17:34 168720 c:\windows\system32\msltus35.dll
- 2000-04-26 18:35 . 2000-04-26 18:35 139264 c:\windows\system32\msjint35.dll
+ 2000-04-26 17:35 . 2000-04-26 17:35 139264 c:\windows\system32\msjint35.dll
- 2000-04-26 18:34 . 2000-04-26 18:34 252688 c:\windows\system32\msexcl35.dll
+ 2000-04-26 17:34 . 2000-04-26 17:34 252688 c:\windows\system32\msexcl35.dll
- 2000-04-26 18:34 . 2000-04-26 18:34 344064 c:\windows\system32\msexch35.dll
+ 2000-04-26 17:34 . 2000-04-26 17:34 344064 c:\windows\system32\msexch35.dll
+ 2012-05-09 16:25 . 2012-05-09 16:25 351904 c:\windows\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.exe
+ 2012-05-09 16:25 . 2012-05-09 16:25 424096 c:\windows\system32\Macromed\Flash\FlashUtil32_11_2_202_235_ActiveX.dll
+ 2012-04-25 13:45 . 2012-05-09 16:25 257696 c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
+ 2012-04-30 15:32 . 2012-04-04 22:47 227720 c:\windows\system32\javaws.exe
+ 2012-04-30 15:32 . 2012-04-30 15:32 174024 c:\windows\system32\javaw.exe
+ 2012-04-30 15:32 . 2012-04-30 15:32 174024 c:\windows\system32\java.exe
+ 2012-04-30 15:41 . 2012-04-30 15:41 176128 c:\windows\Installer\658815.msi
+ 2012-04-30 15:32 . 2012-04-30 15:32 457216 c:\windows\Installer\658807.msi
+ 2012-04-30 15:32 . 2012-04-30 15:32 863232 c:\windows\Installer\658803.msi
+ 2012-02-10 16:00 . 2012-02-10 16:00 562688 c:\windows\Installer\$PatchCache$\Managed\D658D72EC4663F94593A6E6B93BBA21C\5.30.0\trdmu.exe
+ 2000-04-26 17:34 . 2000-04-26 17:34 1238288 c:\windows\system32\msjt4jlt.dll
- 2000-04-26 18:34 . 2000-04-26 18:34 1238288 c:\windows\system32\msjt4jlt.dll
- 2000-04-26 18:34 . 2000-04-26 18:34 1050896 c:\windows\system32\msjet35.dll
+ 2000-04-26 17:34 . 2000-04-26 17:34 1050896 c:\windows\system32\msjet35.dll
+ 2012-05-04 15:43 . 2012-05-04 15:43 20333056 c:\windows\Installer\a95b120.msp
+ 2012-05-02 16:50 . 2012-05-02 16:50 15164928 c:\windows\Installer\8520f2.msi
+ 2012-05-01 20:53 . 2012-05-01 20:53 12092416 c:\windows\Installer\6b3b7a6.msi
+ 2012-05-02 16:47 . 2012-05-02 16:47 15342592 c:\windows\Downloaded Installations\{3CCFE781-02D7-4EE6-BB33-D1BF2D63F1E0}\TerraSync 5.30 for Windows Mobile.msi
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn1\yt.dll" [2011-12-09 1517368]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]
@="{022F2F51-CDDA-4873-8A29-72C66C808A3F}"
[HKEY_CLASSES_ROOT\CLSID\{022F2F51-CDDA-4873-8A29-72C66C808A3F}]
2009-11-07 05:07 297808 ——w- c:\windows\system32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{661963C1-99A1-44e7-A671-1CF3768AE9D4}"
[HKEY_CLASSES_ROOT\CLSID\{661963C1-99A1-44e7-A671-1CF3768AE9D4}]
2009-11-07 05:07 297808 ——w- c:\windows\system32\mscoree.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"Facebook Update"="c:\documents and settings\jzipkin\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" [2011-10-21 137536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-02-17 278528]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-04-05 495708]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2010-04-05 737280]
"nwiz"="nwiz.exe" [2009-12-15 1657448]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-12-15 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-12-15 13770752]
"NVHotkey"="nvHotkey.dll" [2009-12-15 86016]
"OA001Mon"="c:\windows\OA001Mon.exe" [2010-01-28 24576]
"IAStorIcon"="c:\program files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"ChangeTPMAuth"="c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe" [2008-05-30 180224]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2008-05-14 105472]
"SecureUpgrade"="c:\program files\Wave Systems Corp\SecureUpgrade.exe" [2008-06-24 243000]
"EmbassySecurityCheck"="c:\program files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe" [2008-06-24 79160]
"DellControlPoint"="c:\program files\Dell\Dell ControlPoint\Dell.ControlPoint.exe" [2008-08-18 598016]
"DCPstrApp"="c:\program files\Dell\Dell ControlPoint\Security Manager\SecurityDeviceInfoSetRegistryString.exe" [2008-08-04 6656]
"DellConnectionManager"="c:\program files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe" [2008-10-01 1454080]
"MVS Splash"="c:\program files\McAfee\Managed VirusScan\DesktopUI\XTray.exe" [2011-08-25 476480]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Act.Outlook.Service"="c:\program files\ACT\Act for Windows\Act.Outlook.Service.exe" [2009-02-24 28672]
"Act! Preloader"="c:\program files\ACT\Act for Windows\ActSage.exe" [2009-02-24 393216]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2012-03-27 40376]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2012-03-26 640440]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2009-05-08 174424]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" [2008-10-17 442536]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2011-06-29 273544]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
c:\documents and settings\McAfeeMVSUser\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [N/A]
.
c:\documents and settings\ataylor.WAYPOINT.000\Start Menu\Programs\Startup\
Logitech . Product Registration.lnk - c:\program files\Common Files\LogiShrd\eReg\SetPoint\eReg.exe [2009-11-16 517384]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-8-15 604776]
Dell ControlPoint System Manager.lnk - c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe [2008-11-11 950048]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-05-06 09:29 64592 —-a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\McAfee\\Managed VirusScan\\Agent\\myAgtSvc.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\ACT\\Act for Windows\\ActSage.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [8/12/2010 2:55 PM 89624]
R2 ASFAgent;ASF Agent;c:\program files\Intel\ASF Agent\ASFAgent.exe [4/19/2007 6:56 AM 133968]
R2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\Dell\Dell ControlPoint\DCPButtonSvc.exe [9/4/2008 6:28 PM 406808]
R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [11/11/2008 5:35 PM 808296]
R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [11/11/2008 5:35 PM 20840]
R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [11/11/2008 4:00 PM 451872]
R2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [12/29/2011 4:47 PM 99896]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [7/22/2010 1:13 PM 13336]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [7/26/2010 11:19 AM 10448]
R2 McAfee SiteAdvisor Enterprise Service;McAfee SiteAdvisor Enterprise Service;c:\program files\McAfee\SiteAdvisor Enterprise\McSACore.exe [5/12/2011 11:48 AM 324928]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [11/16/2010 10:37 AM 148520]
R2 MSSQL$ACT7;SQL Server (ACT7);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [12/10/2010 6:29 PM 29293408]
R2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [8/23/2011 9:50 AM 291064]
R2 RumorServer;McAfee Peer Distribution Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [8/23/2011 9:50 AM 291064]
R2 SMManager;Smith Micro Connection Manager Service;c:\program files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [10/1/2008 5:28 AM 90112]
R2 XobniService;XobniService;c:\program files\Xobni\XobniService.exe [5/20/2010 1:46 PM 55016]
R3 CCIDFILTER;Broadcom Smart Card Reader Filter Driver;c:\windows\system32\drivers\ccidflt.sys [7/22/2010 1:11 PM 12840]
R3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [7/21/2010 5:27 PM 32808]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [7/21/2010 5:25 PM 240344]
R3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\drivers\OA001Ufd.sys [7/21/2010 5:25 PM 133632]
R3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\drivers\OA001Vid.sys [7/21/2010 5:25 PM 281472]
S2 ACT! Scheduler;ACT! Scheduler;c:\program files\ACT\Act for Windows\Act.Scheduler.exe [2/24/2009 2:08 PM 81920]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/26/2010 11:43 AM 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/25/2012 9:45 AM 257696]
S3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [7/21/2010 5:25 PM 113664]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7/26/2010 11:43 AM 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [8/12/2010 2:55 PM 87808]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [12/18/2009 12:13 PM 20480]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [12/18/2009 12:12 PM 174720]
S3 OA001Afx;Provides a software interface to control audio effects of OA001 camera.;c:\windows\system32\drivers\OA001Afx.sys [7/21/2010 5:25 PM 134144]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [4/14/2010 8:29 PM 32408]
S3 TrmbTS;TrmbTS;c:\windows\system32\drivers\TrmbTS.sys [8/26/2010 12:49 PM 29184]
S3 TRMUSB5K;Trimble USB GPS Driver;c:\windows\system32\drivers\TRMUSB5K.sys –> c:\windows\system32\drivers\TRMUSB5K.sys [?]
S3 USA19H;USA19H;c:\windows\system32\drivers\USA19H2k.sys [8/13/2010 3:56 PM 704000]
S3 USA19H2KP;Keyspan USB Serial Port Driver;c:\windows\system32\drivers\USA19H2kp.sys [8/13/2010 3:56 PM 24192]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/25/2008 12:16 PM 14336]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [7/22/2009 11:08 PM 47128]
S4 RsFx0105;RsFx0105 Driver;c:\windows\system32\drivers\RsFx0105.sys [9/22/2011 6:10 PM 238696]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [9/22/2011 6:17 PM 370024]
.
— Other Services/Drivers In Memory —
.
*Deregistered* - mfeavfk01
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
pavprsrv
slee_503_service
idebusdr
slimsvc
PAC7302
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-25 16:25]
.
2011-10-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
2012-05-08 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-308600077-3542235570-3293604796-1145Core.job
- c:\documents and settings\jzipkin\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-10-21 17:46]
.
2012-05-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-308600077-3542235570-3293604796-1145UA.job
- c:\documents and settings\jzipkin\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-10-21 17:46]
.
2012-05-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 15:43]
.
2012-05-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 15:43]
.
2012-05-09 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-308600077-3542235570-3293604796-1145.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
2012-05-09 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-308600077-3542235570-3293604796-1145.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = 10.0.0.11
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-09 12:49
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1004)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
Completion time: 2012-05-09 12:50:44
ComboFix-quarantined-files.txt 2012-05-09 16:50
ComboFix2.txt 2012-04-30 13:51
ComboFix3.txt 2012-04-27 12:19
ComboFix4.txt 2011-12-01 01:29
.
Pre-Run: 109,720,256,512 bytes free
Post-Run: 110,209,527,808 bytes free
.
- - End Of File - - 9886818B7A448DB6E5D13529C10F0CCA

SuMMiT

Post #8May 9, 2012, 8:07 PM UTC

got some good news to share. IE is no longer opening multiple tabs when i close one. so, that's good. even better, I've got audio back! I found my IDT High Definition CODEC had a corrupted driver. I uninstalled it and ran the Windows Add Hardware wizard and it reinstalled the driver. I then rebooted to be safe and heard the shutdown tone, the startup tone, and am now listening to Pandora. Joy! Thx for all your help up to this point.

Satchfan

Post #9May 9, 2012, 9:04 PM UTC last edited May 9, 2012, 9:25 PM UTC

That’s all good news, you’ve done a good job there.

I would think that most of your problems were solved earlier with the help that you got from Jeff.

Let’s run a couple more scans to make sure that your computer is clear and also protected.

================================================

Run Security Check

Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

================================================

Run ESET Online Scan

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.

3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.

Let me know if there are any outstanding problems

Cheers

Satchfan

SuMMiT

Post #10May 10, 2012, 3:03 PM UTC

Morning Satchfan,
Here are the logs. ESET took over an hour and found some stuff.

Results of screen317's Security Check version 0.99.32
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
ESET Online Scanner v3
McAfee Browser Protection Service
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
McAfee SiteAdvisor Enterprise Plus
Free Internet Window Washer
JavaFX 2.1.0
Java™ 7 Update 4
Adobe Reader X (10.1.1)
````````````````````````````````
Process Check:
objlist.exe by Laurent
McAfee Managed VirusScan Agent myAgtSvc.exe
McAfee Managed VirusScan DesktopUI XTray.exe
``````````End of Log````````````

_____________________________________________________________

C:\Documents and Settings\jzipkin\Application Data\Sun\Java\Deployment\cache\6.0\36\58fde3a4-743bbf0e a variant of Java/TrojanDownloader.OpenStream.NBF trojan
C:\Documents and Settings\jzipkin\Application Data\Sun\Java\Deployment\cache\6.0\9\2339d6c9-32e7da4c a variant of Java/TrojanDownloader.OpenStream.NBF trojan
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP197\A0028359.sys Win32/Sirefef.DA trojan
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP197\A0028506.sys Win32/Sirefef.DA trojan
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP198\A0028562.sys Win32/Sirefef.DA trojan
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP198\A0029562.sys Win32/Sirefef.DA trojan
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP198\A0029584.sys Win32/Sirefef.DA trojan
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP198\A0030584.sys Win32/Sirefef.DA trojan
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP198\A0031584.sys Win32/Sirefef.DA trojan
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP199\A0032584.sys Win32/Sirefef.DA trojan
C:\TDSSKiller_Quarantine\26.04.2012_22.46.52\rtkt0000\svc0000\tsk0000.dta Win32/Sirefef.DA trojan

Satchfan

Post #11May 10, 2012, 4:14 PM UTC

Hi SuMMIT

The objects found apart from the 2 we'll deal with here are either quarantined or in system restore which we'll deal with when tidying up.

Open ComboFix

Please do the following:

close any open browsers.
close/disable all anti virus and anti malware programs so that they do not interfere with the running of ComboFix.
open notepad and copy/paste the text in the codebox below into it:

File:: C:\Documents and Settings\jzipkin\Application Data\Sun\Java\Deployment\cache\6.0\36\58fde3a4-743bbf0e C:\Documents and Settings\jzipkin\Application Data\Sun\Java\Deployment\cache\6.0\9\2339d6c9-32e7da4c

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it'll produce a log at C:\ComboFix.txt. Post the contents of Combofix.txt in your next reply.

==========================================

Can you tell me what form of protection you have for your computer. I see no evidence of a firewall or real time antivirus, (I may be mistaken and missed it, if so please enlighten me.

)

Are there any outstanding problems?

Satchfan

SuMMiT

Post #12May 10, 2012, 4:51 PM UTC

Here's the Combofix log. I did not reboot after the scan. Should I?

FYI, when I begin running Combofix I get a Windows notification that "rmbr.3xe has encountered a problem and needs to close". Once I clear this msg Combofix runs. Can't find any info on that online other than a lot of ppl with infections are getting this msg when running Combofix. Any thoughts?

For real time Antivirus I am running McAfee which is up to date with its definitions. You may not see it as I have disabled it for each scan you have requested. Don't know if that includes a firewall or not, but currently I am behind a hardware firewall. Seems like it may all be carp** because McAfee notified me when the infection occurred (grey bar popped up on my screen informing me of an infection and disappeared before I had a chance to read it) but didn't manage to block it. What good is that?!

Anyhow, here's the log…..

ComboFix 12-05-10.02 - jzipkin 05/10/2012 12:23:12.10.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3572.2927 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\jzipkin\Desktop\CFScript.txt
AV: McAfee® Security-as-a-Service Anti-virus *Disabled/Updated* {8C354827-2F54-4E28-90DC-AD391E77808C}
.
FILE ::
"c:\documents and settings\jzipkin\Application Data\Sun\Java\Deployment\cache\6.0\36\58fde3a4-743bbf0e"
"c:\documents and settings\jzipkin\Application Data\Sun\Java\Deployment\cache\6.0\9\2339d6c9-32e7da4c"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\8615B8621C.sys
c:\documents and settings\jzipkin\Application Data\Sun\Java\Deployment\cache\6.0\36\58fde3a4-743bbf0e
c:\documents and settings\jzipkin\Application Data\Sun\Java\Deployment\cache\6.0\9\2339d6c9-32e7da4c
C:\Thumbs.db
c:\windows\dasetup.log
c:\windows\system32\regobj.dll
c:\windows\Temp\tmp3.tmp
.
.
((((((((((((((((((((((((( Files Created from 2012-04-10 to 2012-05-10 )))))))))))))))))))))))))))))))
.
.
2012-05-09 19:47 . 2010-04-05 09:19 3354624 —-a-w- c:\windows\system32\stlang.dll
2012-05-09 19:47 . 2010-04-05 09:18 11870298 —-a-w- c:\windows\system32\idtsg.cpl
2012-05-09 19:47 . 2010-04-05 09:18 253952 —-a-w- c:\windows\system32\AESTCtrl.cpl
2012-04-30 15:41 . 2012-04-30 15:41 ——– d—–w- c:\program files\Common Files\Java
2012-04-30 15:32 . 2012-04-30 15:32 ——– d—–w- c:\program files\Oracle
2012-04-30 15:32 . 2012-04-30 15:32 ——– d—–w- c:\documents and settings\JZipkin\Application Data\Oracle
2012-04-30 15:32 . 2012-04-04 22:47 143872 —-a-w- c:\windows\system32\javacpl.cpl
2012-04-30 15:32 . 2012-04-04 22:47 772504 —-a-w- c:\windows\system32\npDeployJava1.dll
2012-04-30 13:17 . 2011-08-17 13:49 138496 -c–a-w- c:\windows\system32\dllcache\afd.sys
2012-04-30 13:17 . 2011-08-17 13:49 138496 —-a-w- c:\windows\system32\drivers\afd.sys
2012-04-27 11:42 . 2012-04-27 11:42 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Sun
2012-04-27 03:09 . 2008-04-14 12:00 162816 —-a-w- c:\windows\system32\drivers\netbt.sys
2012-04-27 02:52 . 2012-04-27 02:52 ——– d—–w- C:\TDSSKiller_Quarantine
2012-04-26 17:05 . 2012-04-26 17:04 388608 —-a-w- C:\HiJackThis.exe
2012-04-25 13:45 . 2012-05-09 16:25 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-04-25 13:34 . 2012-04-25 13:34 ——– d—–w- c:\documents and settings\JZipkin\Application Data\Intel Corporation
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-10 16:08 . 2010-07-26 18:14 1994 –sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2012-05-10 13:47 . 2010-07-23 18:20 0 —-a-w- c:\documents and settings\JZipkin\Local Settings\Application Data\WavXMapDrive.bat
2012-05-09 16:25 . 2011-06-29 15:20 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-27 02:53 . 2008-04-25 16:16 75264 —-a-w- c:\windows\system32\drivers\ipsec.sys
2012-04-04 22:47 . 2010-07-22 17:11 687504 —-a-w- c:\windows\system32\deployJava1.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2012-05-09_16.49.09 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-05-10 13:45 . 2012-05-10 13:45 16384 c:\windows\Temp\Perflib_Perfdata_a14.dat
+ 2012-05-10 13:45 . 2012-05-10 13:45 16384 c:\windows\Temp\Perflib_Perfdata_2a0.dat
+ 2008-04-25 16:16 . 2012-05-10 13:50 560798 c:\windows\system32\perfh009.dat
- 2008-04-25 16:16 . 2012-05-09 16:20 560798 c:\windows\system32\perfh009.dat
+ 2008-04-25 16:16 . 2012-05-10 13:50 117144 c:\windows\system32\perfc009.dat
- 2008-04-25 16:16 . 2012-05-09 16:20 117144 c:\windows\system32\perfc009.dat
+ 2010-07-21 21:25 . 2010-04-05 09:19 1656499 c:\windows\system32\drivers\sthda.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn1\yt.dll" [2011-12-09 1517368]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]
@="{022F2F51-CDDA-4873-8A29-72C66C808A3F}"
[HKEY_CLASSES_ROOT\CLSID\{022F2F51-CDDA-4873-8A29-72C66C808A3F}]
2009-11-07 05:07 297808 ——w- c:\windows\system32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{661963C1-99A1-44e7-A671-1CF3768AE9D4}"
[HKEY_CLASSES_ROOT\CLSID\{661963C1-99A1-44e7-A671-1CF3768AE9D4}]
2009-11-07 05:07 297808 ——w- c:\windows\system32\mscoree.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"Facebook Update"="c:\documents and settings\jzipkin\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" [2011-10-21 137536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-02-17 278528]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2010-04-05 737280]
"nwiz"="nwiz.exe" [2009-12-15 1657448]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-12-15 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-12-15 13770752]
"NVHotkey"="nvHotkey.dll" [2009-12-15 86016]
"OA001Mon"="c:\windows\OA001Mon.exe" [2010-01-28 24576]
"IAStorIcon"="c:\program files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"ChangeTPMAuth"="c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe" [2008-05-30 180224]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2008-05-14 105472]
"SecureUpgrade"="c:\program files\Wave Systems Corp\SecureUpgrade.exe" [2008-06-24 243000]
"EmbassySecurityCheck"="c:\program files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe" [2008-06-24 79160]
"DellControlPoint"="c:\program files\Dell\Dell ControlPoint\Dell.ControlPoint.exe" [2008-08-18 598016]
"DCPstrApp"="c:\program files\Dell\Dell ControlPoint\Security Manager\SecurityDeviceInfoSetRegistryString.exe" [2008-08-04 6656]
"DellConnectionManager"="c:\program files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe" [2008-10-01 1454080]
"MVS Splash"="c:\program files\McAfee\Managed VirusScan\DesktopUI\XTray.exe" [2011-08-25 476480]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Act.Outlook.Service"="c:\program files\ACT\Act for Windows\Act.Outlook.Service.exe" [2009-02-24 28672]
"Act! Preloader"="c:\program files\ACT\Act for Windows\ActSage.exe" [2009-02-24 393216]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2012-03-27 40376]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2012-03-26 640440]
"YMailAdvisor"="c:\program files\Yahoo!\Common\YMailAdvisor.exe" [2009-05-08 174424]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]
"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell.exe" [2008-10-17 442536]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2011-06-29 273544]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-04-05 495708]
.
c:\documents and settings\McAfeeMVSUser\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [N/A]
.
c:\documents and settings\ataylor.WAYPOINT.000\Start Menu\Programs\Startup\
Logitech . Product Registration.lnk - c:\program files\Common Files\LogiShrd\eReg\SetPoint\eReg.exe [2009-11-16 517384]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-8-15 604776]
Dell ControlPoint System Manager.lnk - c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe [2008-11-11 950048]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-05-06 09:29 64592 —-a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\McAfee\\Managed VirusScan\\Agent\\myAgtSvc.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\ACT\\Act for Windows\\ActSage.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
.
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [8/12/2010 2:55 PM 89624]
R2 ASFAgent;ASF Agent;c:\program files\Intel\ASF Agent\ASFAgent.exe [4/19/2007 6:56 AM 133968]
R2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\Dell\Dell ControlPoint\DCPButtonSvc.exe [9/4/2008 6:28 PM 406808]
R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [11/11/2008 5:35 PM 808296]
R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [11/11/2008 5:35 PM 20840]
R2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [11/11/2008 4:00 PM 451872]
R2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe [12/29/2011 4:47 PM 99896]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [7/22/2010 1:13 PM 13336]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [7/26/2010 11:19 AM 10448]
R2 McAfee SiteAdvisor Enterprise Service;McAfee SiteAdvisor Enterprise Service;c:\program files\McAfee\SiteAdvisor Enterprise\McSACore.exe [5/12/2011 11:48 AM 324928]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [11/16/2010 10:37 AM 148520]
R2 MSSQL$ACT7;SQL Server (ACT7);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [12/10/2010 6:29 PM 29293408]
R2 myAgtSvc;McAfee Virus and Spyware Protection Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [8/23/2011 9:50 AM 291064]
R2 RumorServer;McAfee Peer Distribution Service;c:\program files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe [8/23/2011 9:50 AM 291064]
R2 SMManager;Smith Micro Connection Manager Service;c:\program files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [10/1/2008 5:28 AM 90112]
R2 XobniService;XobniService;c:\program files\Xobni\XobniService.exe [5/20/2010 1:46 PM 55016]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [7/21/2010 5:25 PM 113664]
R3 CCIDFILTER;Broadcom Smart Card Reader Filter Driver;c:\windows\system32\drivers\ccidflt.sys [7/22/2010 1:11 PM 12840]
R3 cvusbdrv;Broadcom USH CV;c:\windows\system32\drivers\cvusbdrv.sys [7/21/2010 5:27 PM 32808]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [7/21/2010 5:25 PM 240344]
R3 OA001Ufd;Creative Camera OA001 Upper Filter Driver;c:\windows\system32\drivers\OA001Ufd.sys [7/21/2010 5:25 PM 133632]
R3 OA001Vid;Creative Camera OA001 Function Driver;c:\windows\system32\drivers\OA001Vid.sys [7/21/2010 5:25 PM 281472]
S2 ACT! Scheduler;ACT! Scheduler;c:\program files\ACT\Act for Windows\Act.Scheduler.exe [2/24/2009 2:08 PM 81920]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/26/2010 11:43 AM 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/25/2012 9:45 AM 257696]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7/26/2010 11:43 AM 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys –> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [8/12/2010 2:55 PM 87808]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [12/18/2009 12:13 PM 20480]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [12/18/2009 12:12 PM 174720]
S3 OA001Afx;Provides a software interface to control audio effects of OA001 camera.;c:\windows\system32\drivers\OA001Afx.sys [7/21/2010 5:25 PM 134144]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [4/14/2010 8:29 PM 32408]
S3 TrmbTS;TrmbTS;c:\windows\system32\drivers\TrmbTS.sys [8/26/2010 12:49 PM 29184]
S3 TRMUSB5K;Trimble USB GPS Driver;c:\windows\system32\drivers\TRMUSB5K.sys –> c:\windows\system32\drivers\TRMUSB5K.sys [?]
S3 USA19H;USA19H;c:\windows\system32\drivers\USA19H2k.sys [8/13/2010 3:56 PM 704000]
S3 USA19H2KP;Keyspan USB Serial Port Driver;c:\windows\system32\drivers\USA19H2kp.sys [8/13/2010 3:56 PM 24192]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/25/2008 12:16 PM 14336]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [7/22/2009 11:08 PM 47128]
S4 RsFx0105;RsFx0105 Driver;c:\windows\system32\drivers\RsFx0105.sys [9/22/2011 6:10 PM 238696]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [9/22/2011 6:17 PM 370024]
.
— Other Services/Drivers In Memory —
.
*Deregistered* - mfeavfk01
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
pavprsrv
slee_503_service
idebusdr
slimsvc
PAC7302
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-25 16:25]
.
2011-10-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
2012-05-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-308600077-3542235570-3293604796-1145Core.job
- c:\documents and settings\jzipkin\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-10-21 17:46]
.
2012-05-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-308600077-3542235570-3293604796-1145UA.job
- c:\documents and settings\jzipkin\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe [2011-10-21 17:46]
.
2012-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 15:43]
.
2012-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-26 15:43]
.
2012-05-10 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-308600077-3542235570-3293604796-1145.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
2012-05-10 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-308600077-3542235570-3293604796-1145.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth; Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
TCP: DhcpNameServer = 10.0.0.11
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-10 12:30
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1016)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
Completion time: 2012-05-10 12:31:29
ComboFix-quarantined-files.txt 2012-05-10 16:31
ComboFix2.txt 2012-05-09 16:50
ComboFix3.txt 2012-04-30 13:51
ComboFix4.txt 2012-04-27 12:19
ComboFix5.txt 2012-05-10 16:21
.
Pre-Run: 110,025,052,160 bytes free
Post-Run: 110,158,979,072 bytes free
.
- - End Of File - - C35E79A114E24CCC3C7650097C7A925B

Satchfan

Post #13May 11, 2012, 8:42 AM UTC

McAfee notified me when the infection occurred (grey bar popped up on my screen informing me of an infection and disappeared before I had a chance to read it) but didn't manage to block it. What good is that?

You’ll find many antivirus programs are unable to deal with all of the bad stuff that is around these days as most of the malware are not viruses but a lot more devious and dangerous.

Your ComboFix log was fine.

Let me know if everything is OK now and we'll tidy up

Satchfan

SuMMiT

Post #14May 11, 2012, 2:25 PM UTC

Thanks! Everything seems fine. Any sense in running ESET again? If not, let's go ahead with the tidying up.

Satchfan

Post #15May 11, 2012, 2:58 PM UTC

You can run Eset again if you wish but it should be clear so beware of “false-positives”.

Now that you’re free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:

You can delete the DDS and aswMBR logs and programs from your desktop.

Uninstall Combofix

Follow these steps to uninstall Combofix

click START then RUN
now type Combofix /uninstall in the runbox and click OK.

Note the space between the X and the /, it needs to be there.
🖼Click to load external image (Posted Image)

please follow the prompts to uninstall Combofix.
once it's finished uninstalling itself you will receive a message saying Combofix was uninstalled successfully.

===================================================

Firewall

As I said previously, I see no evidence of a firewall. I suggest you get one in place now. I can’t stress how important it is that you use a firewall on your computer. This is one of the ways computers are open to Malware. Without a firewall, your computer is susceptible to being attacked again. Windows XP firewall is not adequate protection.

If you are certain that you have a router with firewall features that’s fine – if not, I suggest you do the following:

Download one of the following firewalls:

ZoneAlarm
Sunbelt Personal Firewall

NOTE only install one firewall. Having more than one could cause many programs to stop working altogether. Also, the firewalls may get in each others' way and cause some security holes that would not be there with just one firewall.

For a tutorial on Firewalls and a listing of some other available ones see Understanding and Using Firewalls

===================================================

Recommended programs

SpywareBlaster. SpywareBlaster protects against bad ActiveX, it immunizes your PC against them. It blocks over 11,000 bad sites and uses no resources of your computer.

===================================================

Install Spybot - Search and Destroy - Download and install Spybot Search and Destroy which provides real time spyware and hijacker protection .

You should scan your computer with the program on a regular basis as you would with your anti-virus software.

A tutorial on installing and using SS&D can be found here:

===================================================

Update and run Malwarebytes. This really is an excellent program that you should also update and run on a regular basis, probably weekly.

It’s probably a good idea to run an online scan occasionally as well and Eset is a pretty reliable one.

===================================================

I also recommend that you read the following:

How to prevent malware by miekiemoes

Safe computing

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

likely infection (ZeroAccess?) [Solved]

✨ Ask AI

Ask AI