Malware/Spyware? [Solved]

I went to the TDSSKiller web site and found instructions on finding the log. On my desktop I clicked My Computer > local disk (C:) and on the next page found 5 TDSSKiller logs that have been saved to Notebook. The earliest timed log is 11:35:57, which must have been the first scan. Which scan should I send, the first or the latest? Now I'll try ComboFix.

There are 5 scan logs for TDSSKiller. I didn't realize I had done that many scans. Below is the first scan. I think I have them all in the order they were done. ——————————————————————————————————————- 11:35:55.0437 2496 TDSS rootkit removing tool 2.7.34.0 May 2 2012 09:59:18 11:35:57.0453 2496 ============================================================ 11:35:57.0453 2496 Current date / time: 2012/05/12 11:35:57.0453 11:35:57.0453 2496 SystemInfo: 11:35:57.0453 2496 11:35:57.0453 2496 OS Version: 5.1.2600 ServicePack: 3.0 11:35:57.0453 2496 Product type: Workstation 11:35:57.0453 2496 ComputerName: SERVER 11:35:57.0453 2496 UserName: Jerry 11:35:57.0453 2496 Windows directory: C:\WINDOWS 11:35:57.0453 2496 System windows directory: C:\WINDOWS 11:35:57.0453 2496 Processor architecture: Intel x86 11:35:57.0453 2496 Number of processors: 1 11:35:57.0453 2496 Page size: 0x1000 11:35:57.0453 2496 Boot type: Normal boot 11:35:57.0453 2496 ============================================================ 11:36:00.0015 2496 Drive \Device\Harddisk0\DR0 - Size: 0x4A94F0000 (18.65 Gb), SectorSize: 0x200, Cylinders: 0xA1A, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000054 11:36:00.0015 2496 ============================================================ 11:36:00.0015 2496 \Device\Harddisk0\DR0: 11:36:00.0031 2496 MBR partitions: 11:36:00.0031 2496 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2546451 11:36:00.0031 2496 ============================================================ 11:36:00.0078 2496 C: <-> \Device\Harddisk0\DR0\Partition0 11:36:00.0078 2496 ============================================================ 11:36:00.0078 2496 Initialize success 11:36:00.0078 2496 ============================================================ 11:36:07.0093 3728 ============================================================ 11:36:07.0093 3728 Scan started 11:36:07.0093 3728 Mode: Manual; 11:36:07.0093 3728 ============================================================ 11:36:07.0796 3728 2wirepcp - ok 11:36:07.0875 3728 3compxe - ok 11:36:07.0968 3728 a016mdfl - ok 11:36:08.0046 3728 a016obex - ok 11:36:08.0125 3728 Abiosdsk - ok 11:36:08.0234 3728 abnetmon - ok 11:36:08.0296 3728 abp480n5 - ok 11:36:08.0437 3728 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) C:\WINDOWS\system32\drivers\ac97intc.sys 11:36:08.0437 3728 ac97intc - ok 11:36:08.0562 3728 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 11:36:08.0578 3728 ACPI - ok 11:36:08.0687 3728 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 11:36:08.0718 3728 ACPIEC - ok 11:36:08.0781 3728 adpu160m - ok 11:36:08.0859 3728 AEAudioService - ok 11:36:08.0984 3728 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 11:36:08.0984 3728 aec - ok 11:36:09.0109 3728 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys 11:36:09.0125 3728 AFD - ok 11:36:09.0234 3728 AFGMp50 - ok 11:36:09.0343 3728 AgereModemAudio (6416f9b6b220f0a890525c38235afad7) C:\Program Files\LSI SoftModem\agrsmsvc.exe 11:36:09.0343 3728 AgereModemAudio - ok 11:36:09.0593 3728 AgereSoftModem (7560f465f1ce69c53bf17559ee195548) C:\WINDOWS\system32\DRIVERS\AGRSM.sys 11:36:09.0687 3728 AgereSoftModem - ok 11:36:09.0781 3728 Aha154x - ok 11:36:09.0859 3728 aic78u2 - ok 11:36:09.0937 3728 aic78xx - ok 11:36:10.0000 3728 aksusb - ok 11:36:10.0140 3728 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll 11:36:10.0140 3728 Alerter - ok 11:36:10.0234 3728 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe 11:36:10.0234 3728 ALG - ok 11:36:10.0375 3728 ALIEHCD (bcfe73d1867912f8dd08e4169218f6ee) C:\WINDOWS\system32\Drivers\ALIEHCI.sys 11:36:10.0375 3728 ALIEHCD - ok 11:36:10.0468 3728 alihub (d44a1471ca776ef8d0740f53f1fdc757) C:\WINDOWS\system32\DRIVERS\AliHub.sys 11:36:10.0468 3728 alihub - ok 11:36:10.0546 3728 AliIde - ok 11:36:10.0656 3728 aliroothub (940be3324d504d36dab84a6bb0db4465) C:\WINDOWS\system32\DRIVERS\AliRtHub.sys 11:36:10.0656 3728 aliroothub - ok 11:36:10.0734 3728 AlteraByteBlaster - ok 11:36:10.0812 3728 amoagent - ok 11:36:10.0906 3728 amsint - ok 11:36:11.0000 3728 Anydlc - ok 11:36:11.0062 3728 aolservice - ok 11:36:11.0109 3728 appdrv - ok 11:36:11.0234 3728 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll 11:36:11.0234 3728 AppMgmt - ok 11:36:11.0296 3728 Appn - ok 11:36:11.0359 3728 arcltsrv - ok 11:36:11.0406 3728 asc - ok 11:36:11.0484 3728 asc3350p - ok 11:36:11.0546 3728 asc3550 - ok 11:36:11.0625 3728 ASDR - ok 11:36:11.0671 3728 ASLDRService - ok 11:36:11.0781 3728 asusgsb - ok 11:36:11.0843 3728 ASUSVRC - ok 11:36:11.0921 3728 aswmon2 - ok 11:36:11.0968 3728 aswupdsv - ok 11:36:12.0062 3728 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 11:36:12.0062 3728 AsyncMac - ok 11:36:12.0156 3728 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 11:36:12.0171 3728 atapi - ok 11:36:12.0250 3728 Atdisk - ok 11:36:12.0312 3728 ati2mpaa - ok 11:36:12.0390 3728 ATIBTXBAR - ok 11:36:12.0453 3728 atinrvxx - ok 11:36:12.0500 3728 atixsaudio - ok 11:36:12.0578 3728 ATKGFNEXSrv - ok 11:36:12.0671 3728 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 11:36:12.0687 3728 Atmarpc - ok 11:36:12.0765 3728 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll 11:36:12.0765 3728 AudioSrv - ok 11:36:12.0828 3728 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 11:36:12.0843 3728 audstub - ok 11:36:12.0890 3728 authsyssvc - ok 11:36:13.0187 3728 avg8emc (b9ae3c63a53396cd669ef8ae9c9cbd85) C:\PROGRA~1\AVG\AVG8\avgemc.exe 11:36:13.0265 3728 avg8emc - ok 11:36:13.0390 3728 avg8wd (db338a6bd3976904eb0f8343f51e64eb) C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe 11:36:13.0421 3728 avg8wd - ok 11:36:13.0515 3728 avgfwsrv - ok 11:36:13.0593 3728 avgio - ok 11:36:13.0718 3728 AvgLdx86 (bc12f2404bb6f2b6b2ff3c4c246cb752) C:\WINDOWS\System32\Drivers\avgldx86.sys 11:36:13.0781 3728 AvgLdx86 - ok 11:36:13.0859 3728 AvgMfx86 (5903d729d4f0c5bca74123c96a1b29e0) C:\WINDOWS\System32\Drivers\avgmfx86.sys 11:36:13.0859 3728 AvgMfx86 - ok 11:36:13.0937 3728 AvgTdiX (92d8e1e8502e649b60e70074eb29c380) C:\WINDOWS\System32\Drivers\avgtdix.sys 11:36:13.0953 3728 AvgTdiX - ok 11:36:14.0031 3728 avsvcmonitor - ok 11:36:14.0125 3728 AVWLP_USB - ok 11:36:14.0203 3728 axinstsv - ok 11:36:14.0312 3728 BANTExt (5d7be7b19e827125e016325334e58ff1) C:\WINDOWS\System32\Drivers\BANTExt.sys 11:36:14.0312 3728 BANTExt - ok 11:36:14.0406 3728 basic2 - ok 11:36:14.0515 3728 bcftdi - ok 11:36:14.0578 3728 BCMModem - ok 11:36:14.0671 3728 bc_filter - ok 11:36:14.0734 3728 bc_ip_f - ok 11:36:14.0812 3728 bc_pat_f - ok 11:36:14.0875 3728 bdss - ok 11:36:14.0921 3728 beatjammusicstreamingserver - ok 11:36:15.0015 3728 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 11:36:15.0015 3728 Beep - ok 11:36:15.0203 3728 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll 11:36:15.0234 3728 BITS - ok 11:36:15.0312 3728 blueletscoaudio - ok 11:36:15.0375 3728 bridge - ok 11:36:15.0484 3728 bridgemp - ok 11:36:15.0593 3728 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll 11:36:15.0593 3728 Browser - ok 11:36:15.0703 3728 BrScnUsb - ok 11:36:15.0781 3728 BsHelpCS - ok 11:36:15.0843 3728 BTSLBCSP - ok 11:36:15.0953 3728 btwaudio - ok 11:36:15.0984 3728 bwmservice - ok 11:36:16.0062 3728 cacheserver - ok 11:36:16.0125 3728 Cam5607 - ok 11:36:16.0203 3728 CamAv - ok 11:36:16.0250 3728 CAMFLT - ok 11:36:16.0312 3728 captureservice - ok 11:36:16.0406 3728 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 11:36:16.0406 3728 cbidf2k - ok 11:36:16.0468 3728 cd20xrnt - ok 11:36:16.0531 3728 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 11:36:16.0531 3728 Cdaudio - ok 11:36:16.0656 3728 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 11:36:16.0656 3728 Cdfs - ok 11:36:16.0750 3728 cdfsvc - ok 11:36:16.0828 3728 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 11:36:16.0828 3728 Cdrom - ok 11:36:16.0890 3728 cfosspeed - ok 11:36:16.0953 3728 Changer - ok 11:36:17.0000 3728 cics.region1 - ok 11:36:17.0078 3728 cisvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe 11:36:17.0093 3728 cisvc - ok 11:36:17.0156 3728 citrixwmiservice - ok 11:36:17.0234 3728 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe 11:36:17.0250 3728 ClipSrv - ok 11:36:17.0312 3728 CmdIde - ok 11:36:17.0375 3728 cmdmon - ok 11:36:17.0453 3728 CnxtHdAudService - ok 11:36:17.0531 3728 COMSysApp - ok 11:36:17.0640 3728 Cpqarray - ok 11:36:17.0703 3728 cpqdmi - ok 11:36:17.0781 3728 cpqrcmc - ok 11:36:17.0828 3728 cpucoolserver (11028c6a84a967070cb1286550f2058f) C:\WINDOWS\system32\netw4x32.dll 11:36:17.0843 3728 cpucoolserver ( Backdoor.Multi.ZAccess.gen ) - infected 11:36:17.0843 3728 cpucoolserver - detected Backdoor.Multi.ZAccess.gen (0) 11:36:17.0906 3728 cpuz132 - ok 11:36:18.0000 3728 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll 11:36:18.0015 3728 CryptSvc - ok 11:36:18.0078 3728 CTHWIUT.DLL - ok 11:36:18.0156 3728 ctusfsyn - ok 11:36:18.0218 3728 CX88ENC - ok 11:36:18.0296 3728 dac2w2k - ok 11:36:18.0343 3728 dac960nt - ok 11:36:18.0406 3728 db2jds - ok 11:36:18.0484 3728 db2ntsecserver - ok 11:36:18.0546 3728 db2remotecmd - ok 11:36:18.0593 3728 DCamUSBGrandTek - ok 11:36:18.0671 3728 DCamUSBMke2 - ok 11:36:18.0843 3728 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll 11:36:18.0875 3728 DcomLaunch - ok 11:36:18.0984 3728 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll 11:36:18.0984 3728 Dhcp - ok 11:36:19.0062 3728 digitizer - ok 11:36:19.0156 3728 DirectUpdate - ok 11:36:19.0234 3728 dirms_defragmentation - ok 11:36:19.0328 3728 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 11:36:19.0328 3728 Disk - ok 11:36:19.0406 3728 diskeeper - ok 11:36:19.0484 3728 DKbFltr - ok 11:36:19.0578 3728 dlartl_n - ok 11:36:19.0656 3728 dmadmin - ok 11:36:19.0875 3728 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 11:36:19.0937 3728 dmboot - ok 11:36:20.0046 3728 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 11:36:20.0078 3728 dmio - ok 11:36:20.0187 3728 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 11:36:20.0187 3728 dmload - ok 11:36:20.0296 3728 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll 11:36:20.0296 3728 dmserver - ok 11:36:20.0421 3728 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 11:36:20.0421 3728 DMusic - ok 11:36:20.0500 3728 dnetc - ok 11:36:20.0656 3728 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll 11:36:20.0656 3728 Dnscache - ok 11:36:20.0796 3728 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll 11:36:20.0812 3728 Dot3svc - ok 11:36:20.0875 3728 dot4print - ok 11:36:20.0921 3728 dpti2o - ok 11:36:21.0000 3728 DritekPortIO - ok 11:36:21.0062 3728 driverhardwarev2 - ok 11:36:21.0156 3728 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 11:36:21.0156 3728 drmkaud - ok 11:36:21.0218 3728 dvd-ram_service - ok 11:36:21.0281 3728 E1000 - ok 11:36:21.0390 3728 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys 11:36:21.0390 3728 E100B - ok 11:36:21.0453 3728 EagleNT - ok 11:36:21.0531 3728 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll 11:36:21.0546 3728 EapHost - ok 11:36:21.0609 3728 easdrv - ok 11:36:21.0687 3728 EAWDMFD - ok 11:36:21.0750 3728 elnkupdateservice - ok 11:36:21.0828 3728 eloggersvc6 - ok 11:36:21.0890 3728 emupia - ok 11:36:21.0968 3728 enodpl - ok 11:36:22.0031 3728 epgspooler - ok 11:36:22.0109 3728 Eplpdx02 - ok 11:36:22.0203 3728 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll 11:36:22.0203 3728 ERSvc - ok 11:36:22.0234 3728 etoksrv - ok 11:36:22.0343 3728 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 11:36:22.0359 3728 Eventlog - ok 11:36:22.0468 3728 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\System32\es.dll 11:36:22.0515 3728 EventSystem - ok 11:36:22.0593 3728 Exportit - ok 11:36:22.0671 3728 F700iat - ok 11:36:22.0812 3728 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 11:36:22.0828 3728 Fastfat - ok 11:36:22.0906 3728 fasttrackinstallerservice - ok 11:36:22.0968 3728 fasttraksvc - ok 11:36:23.0109 3728 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 11:36:23.0125 3728 FastUserSwitchingCompatibility - ok 11:36:23.0218 3728 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys 11:36:23.0218 3728 Fdc - ok 11:36:23.0312 3728 FGDSCSI - ok 11:36:23.0390 3728 filemon701 - ok 11:36:23.0468 3728 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 11:36:23.0484 3728 Fips - ok 11:36:23.0593 3728 FlexBios - ok 11:36:23.0687 3728 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys 11:36:23.0703 3728 Flpydisk - ok 11:36:23.0812 3728 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys 11:36:23.0828 3728 FltMgr - ok 11:36:23.0890 3728 fontcache3.0.0.0 - ok 11:36:23.0937 3728 FreshIO - ok 11:36:23.0984 3728 fsks - ok 11:36:24.0046 3728 fsRamDsk - ok 11:36:24.0125 3728 fsssvc - ok 11:36:24.0218 3728 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 11:36:24.0218 3728 Fs_Rec - ok 11:36:24.0296 3728 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 11:36:24.0312 3728 Ftdisk - ok 11:36:24.0375 3728 FVNETusb - ok 11:36:24.0437 3728 GENERICDRV - ok 11:36:24.0484 3728 ghostsec - ok 11:36:24.0562 3728 gmer - ok 11:36:24.0640 3728 GMSIPCI - ok 11:36:24.0718 3728 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 11:36:24.0750 3728 Gpc - ok 11:36:24.0812 3728 GT890x - ok 11:36:24.0890 3728 GTF32BUS - ok 11:36:24.0984 3728 gtndis5 - ok 11:36:25.0031 3728 HabuFltr - ok 11:36:25.0093 3728 HBtnKey - ok 11:36:25.0203 3728 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 11:36:25.0203 3728 helpsvc - ok 11:36:25.0312 3728 hf30service - ok 11:36:25.0421 3728 HidServ (deb04da35cc871b6d309b77e1443c796) C:\WINDOWS\System32\hidserv.dll 11:36:25.0421 3728 HidServ - ok 11:36:25.0531 3728 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 11:36:25.0531 3728 hidusb - ok 11:36:25.0640 3728 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll 11:36:25.0656 3728 hkmsvc - ok 11:36:25.0734 3728 hotspotshieldservice - ok 11:36:25.0828 3728 hpconfig - ok 11:36:25.0906 3728 HPFECP20 (11028c6a84a967070cb1286550f2058f) C:\WINDOWS\system32\BrPar.dll 11:36:25.0906 3728 HPFECP20 ( Backdoor.Multi.ZAccess.gen ) - infected 11:36:25.0906 3728 HPFECP20 - detected Backdoor.Multi.ZAccess.gen (0) 11:36:25.0968 3728 hpn - ok 11:36:26.0031 3728 hpt3xx - ok 11:36:26.0078 3728 hpwirelessmgr - ok 11:36:26.0171 3728 HPZid412 (9f1d80908658eb7f1bf70809e0b51470) C:\WINDOWS\system32\DRIVERS\HPZid412.sys 11:36:26.0187 3728 HPZid412 - ok 11:36:26.0250 3728 HPZipr12 (f7e3e9d50f9cd3de28085a8fdaa0a1c3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 11:36:26.0265 3728 HPZipr12 - ok 11:36:26.0359 3728 HPZius12 (cf1b7951b4ec8d13f3c93b74bb2b461b) C:\WINDOWS\system32\DRIVERS\HPZius12.sys 11:36:26.0375 3728 HPZius12 - ok 11:36:26.0421 3728 hsfhwazl - ok 11:36:26.0546 3728 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 11:36:26.0593 3728 HTTP - ok 11:36:26.0687 3728 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll 11:36:26.0718 3728 HTTPFilter - ok 11:36:26.0781 3728 i2omgmt - ok 11:36:26.0859 3728 i2omp - ok 11:36:26.0953 3728 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 11:36:26.0953 3728 i8042prt - ok 11:36:27.0078 3728 i81x (06b7ef73ba5f302eecc294cdf7e19702) C:\WINDOWS\system32\DRIVERS\i81xnt5.sys 11:36:27.0093 3728 i81x - ok 11:36:27.0171 3728 iAimFP0 (7b5b44efe5eb9dadfb8ee29700885d23) C:\WINDOWS\system32\DRIVERS\wADV01nt.sys 11:36:27.0203 3728 iAimFP0 - ok 11:36:27.0281 3728 iAimFP1 (eb1f6bab6c22ede0ba551b527475f7e9) C:\WINDOWS\system32\DRIVERS\wADV02NT.sys 11:36:27.0281 3728 iAimFP1 - ok 11:36:27.0359 3728 iAimFP2 (03ce989d846c1aa81145cb22fcb86d06) C:\WINDOWS\system32\DRIVERS\wADV05NT.sys 11:36:27.0359 3728 iAimFP2 - ok 11:36:27.0500 3728 iAimFP3 (525849b4469de021d5d61b4db9be3a9d) C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys 11:36:27.0500 3728 iAimFP3 - ok 11:36:27.0578 3728 iAimFP4 (589c2bcdb5bd602bf7b63d210407ef8c) C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys 11:36:27.0578 3728 iAimFP4 - ok 11:36:27.0718 3728 iAimFP5 (0308aef61941e4af478fa1a0f83812f5) C:\WINDOWS\system32\DRIVERS\wADV07nt.sys 11:36:27.0734 3728 iAimFP5 - ok 11:36:27.0812 3728 iAimFP6 (714038a8aa5de08e12062202cd7eaeb5) C:\WINDOWS\system32\DRIVERS\wADV08nt.sys 11:36:27.0812 3728 iAimFP6 - ok 11:36:27.0906 3728 iAimFP7 (7bb3aa595e4507a788de1cdc63f4c8c4) C:\WINDOWS\system32\DRIVERS\wADV09nt.sys 11:36:27.0906 3728 iAimFP7 - ok 11:36:28.0015 3728 iAimTV0 (d83bdd5c059667a2f647a6be5703a4d2) C:\WINDOWS\system32\DRIVERS\wATV01nt.sys 11:36:28.0031 3728 iAimTV0 - ok 11:36:28.0125 3728 iAimTV1 (ed968d23354daa0d7c621580c012a1f6) C:\WINDOWS\system32\DRIVERS\wATV02NT.sys 11:36:28.0125 3728 iAimTV1 - ok 11:36:28.0187 3728 iAimTV2 - ok 11:36:28.0296 3728 iAimTV3 (d738273f218a224c1ddac04203f27a84) C:\WINDOWS\system32\DRIVERS\wATV04nt.sys 11:36:28.0312 3728 iAimTV3 - ok 11:36:28.0390 3728 iAimTV4 (0052d118995cbab152daabe6106d1442) C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys 11:36:28.0390 3728 iAimTV4 - ok 11:36:28.0468 3728 iAimTV5 (791cc45de6e50445be72e8ad6401ff45) C:\WINDOWS\system32\DRIVERS\wATV10nt.sys 11:36:28.0468 3728 iAimTV5 - ok 11:36:28.0546 3728 iAimTV6 (352fa0e98bc461ce1ce5d41f64db558d) C:\WINDOWS\system32\DRIVERS\wATV06nt.sys 11:36:28.0593 3728 iAimTV6 - ok 11:36:28.0671 3728 ibmcicstransactiongateway - ok 11:36:28.0750 3728 IBMTPCHK - ok 11:36:28.0812 3728 iclarityqosservice - ok 11:36:28.0906 3728 id2scaps - ok 11:36:28.0984 3728 idebusdr - ok 11:36:29.0062 3728 iftpsvc - ok 11:36:29.0218 3728 IISADMIN (db3c22745c0da4666f3be31f1af36b2f) C:\WINDOWS\system32\inetsrv\inetinfo.exe 11:36:29.0234 3728 IISADMIN - ok 11:36:29.0312 3728 IJPLMSVC - ok 11:36:29.0406 3728 ikfileflt - ok 11:36:29.0500 3728 ikfilesec - ok 11:36:29.0562 3728 ikhlayer - ok 11:36:29.0671 3728 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 11:36:29.0718 3728 Imapi - ok 11:36:29.0828 3728 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\System32\imapi.exe 11:36:29.0843 3728 ImapiService - ok 11:36:30.0000 3728 ini910u - ok 11:36:30.0109 3728 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys 11:36:30.0109 3728 IntelIde - ok 11:36:30.0187 3728 InterBaseGuardian - ok 11:36:30.0312 3728 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys 11:36:30.0312 3728 ip6fw - ok 11:36:30.0421 3728 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 11:36:30.0421 3728 IpFilterDriver - ok 11:36:30.0531 3728 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 11:36:30.0546 3728 IpInIp - ok 11:36:30.0671 3728 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 11:36:30.0812 3728 IpNat - ok 11:36:30.0890 3728 ipodservice - ok 11:36:30.0953 3728 ipodsrv - ok 11:36:31.0062 3728 IPSec (91f8afe6a700fc5c98ba68b2e13ebfc3) C:\WINDOWS\system32\DRIVERS\ipsec.sys 11:36:31.0078 3728 IPSec ( Virus.Win32.ZAccess.k ) - infected 11:36:31.0078 3728 IPSec - detected Virus.Win32.ZAccess.k (0) 11:36:31.0156 3728 ipsecmon - ok 11:36:31.0218 3728 ipssvc - ok 11:36:31.0343 3728 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 11:36:31.0343 3728 IRENUM - ok 11:36:31.0468 3728 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 11:36:31.0468 3728 isapnp - ok 11:36:31.0578 3728 issm - ok 11:36:31.0656 3728 ithsgt - ok 11:36:31.0734 3728 itmrtsvc - ok 11:36:31.0812 3728 iviVD - ok 11:36:31.0984 3728 JavaQuickStarterService (1834c96fb1f9280bcf6ddfa6de8338bf) C:\Program Files\Java\jre6\bin\jqs.exe 11:36:32.0000 3728 JavaQuickStarterService - ok 11:36:32.0078 3728 JL2005C - ok 11:36:32.0140 3728 jtagserver - ok 11:36:32.0203 3728 k750obex - ok 11:36:32.0296 3728 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 11:36:32.0296 3728 Kbdclass - ok 11:36:32.0375 3728 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 11:36:32.0390 3728 kbdhid - ok 11:36:32.0437 3728 keymaestro - ok 11:36:32.0515 3728 klif - ok 11:36:32.0593 3728 KLOGNT - ok 11:36:32.0687 3728 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 11:36:32.0703 3728 kmixer - ok 11:36:32.0828 3728 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 11:36:32.0828 3728 KSecDD - ok 11:36:32.0875 3728 L8042mou - ok 11:36:32.0968 3728 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll 11:36:32.0984 3728 lanmanserver - ok 11:36:33.0062 3728 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll 11:36:33.0078 3728 lanmanworkstation - ok 11:36:33.0140 3728 lbrtfdc - ok 11:36:33.0203 3728 lexbces - ok 11:36:33.0281 3728 LEX_AS_NIC_SERVICE_YNOS - ok 11:36:33.0359 3728 LHidFilt - ok 11:36:33.0421 3728 licensemanagersocket - ok 11:36:33.0500 3728 liveupdate - ok 11:36:33.0578 3728 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll 11:36:33.0593 3728 LmHosts - ok 11:36:33.0750 3728 LMIInfo (4f69faaabb7db0d43e327c0b6aab40fc) C:\Program Files\LogMeIn\x86\x86\RaInfo.sys 11:36:33.0781 3728 LMIInfo - ok 11:36:33.0890 3728 LMIMaint (490e370b6343caaec2a1bf1ea712e495) C:\Program Files\LogMeIn\x86\x86\RaMaint.exe 11:36:33.0906 3728 LMIMaint - ok 11:36:34.0031 3728 lmimirr (4477689e2d8ae6b78ba34c9af4cc1ed1) C:\WINDOWS\system32\DRIVERS\lmimirr.sys 11:36:34.0046 3728 lmimirr - ok 11:36:34.0109 3728 LMIRfsClientNP - ok 11:36:34.0187 3728 LMIRfsDriver (3faa563ddf853320f90259d455a01d79) C:\WINDOWS\system32\drivers\LMIRfsDriver.sys 11:36:34.0218 3728 LMIRfsDriver - ok 11:36:34.0265 3728 lockmgr - ok 11:36:34.0359 3728 LogMeIn (9015122d04c195bdab88febcbae229db) C:\Program Files\LogMeIn\x86\x86\LogMeIn.exe 11:36:34.0375 3728 LogMeIn - ok 11:36:34.0453 3728 lp6nds35 - ok 11:36:34.0515 3728 LVBulk - ok 11:36:34.0593 3728 lvcomser - ok 11:36:34.0671 3728 lvmvdrv - ok 11:36:34.0750 3728 lvpopflt - ok 11:36:34.0812 3728 lvsrvlauncher - ok 11:36:34.0859 3728 lxby_device - ok 11:36:34.0937 3728 lxcz_device - ok 11:36:35.0000 3728 lxrjd31d - ok 11:36:35.0093 3728 m4301a (763a50ce71f03df16fe3c74a9531f85f) C:\WINDOWS\system32\DRIVERS\m4301A.sys 11:36:35.0140 3728 m4301a - ok 11:36:35.0203 3728 ma763004 - ok 11:36:35.0281 3728 Maplom - ok 11:36:35.0375 3728 mcafeeantispyware - ok 11:36:35.0453 3728 McciCMService - ok 11:36:35.0531 3728 mcproxy - ok 11:36:35.0593 3728 mcrdsvc - ok 11:36:35.0703 3728 mcusrmgr - ok 11:36:35.0812 3728 MDM (11f714f85530a2bd134074dc30e99fca) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 11:36:35.0843 3728 MDM - ok 11:36:35.0937 3728 mdmxsdk - ok 11:36:35.0984 3728 mdvrmng - ok 11:36:36.0078 3728 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll 11:36:36.0078 3728 Messenger - ok 11:36:36.0140 3728 mfetdik - ok 11:36:36.0187 3728 mhndrv - ok 11:36:36.0265 3728 mindretrieve - ok 11:36:36.0343 3728 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 11:36:36.0359 3728 mnmdd - ok 11:36:36.0421 3728 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\System32\mnmsrvc.exe 11:36:36.0437 3728 mnmsrvc - ok 11:36:36.0484 3728 mod7700 - ok 11:36:36.0578 3728 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 11:36:36.0593 3728 Modem - ok 11:36:36.0656 3728 monfilt - ok 11:36:36.0750 3728 MOSUMAC (67cc0dab6a9f15c73560018671f0fe2e) C:\WINDOWS\system32\DRIVERS\MOSUMAC.SYS 11:36:36.0765 3728 MOSUMAC - ok 11:36:36.0843 3728 motmodem - ok 11:36:36.0921 3728 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 11:36:36.0921 3728 Mouclass - ok 11:36:37.0046 3728 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 11:36:37.0046 3728 mouhid - ok 11:36:37.0140 3728 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 11:36:37.0156 3728 MountMgr - ok 11:36:37.0218 3728 mozybackup - ok 11:36:37.0328 3728 mozyFilter - ok 11:36:37.0390 3728 mpe - ok 11:36:37.0468 3728 mqdmserd - ok 11:36:37.0562 3728 mr2kserv - ok 11:36:37.0656 3728 mraid35x - ok 11:36:37.0796 3728 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 11:36:37.0812 3728 MRxDAV - ok 11:36:37.0984 3728 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 11:36:38.0046 3728 MRxSmb - ok 11:36:38.0125 3728 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\System32\msdtc.exe 11:36:38.0140 3728 MSDTC - ok 11:36:38.0234 3728 msdv - ok 11:36:38.0359 3728 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 11:36:38.0359 3728 Msfs - ok 11:36:38.0437 3728 MSICPL - ok 11:36:38.0515 3728 MSIRCOMM - ok 11:36:38.0625 3728 MSIServer - ok 11:36:38.0687 3728 msk80service - ok 11:36:38.0796 3728 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 11:36:38.0796 3728 MSKSSRV - ok 11:36:38.0875 3728 msloop - ok 11:36:38.0953 3728 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 11:36:38.0953 3728 MSPCLOCK - ok 11:36:39.0031 3728 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 11:36:39.0046 3728 MSPQM - ok 11:36:39.0171 3728 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 11:36:39.0171 3728 mssmbios - ok 11:36:39.0234 3728 mssql$microsoftbcm - ok 11:36:39.0328 3728 MTDVC2_ENUM - ok 11:36:39.0406 3728 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys 11:36:39.0421 3728 Mup - ok 11:36:39.0484 3728 mysqlinventime (11028c6a84a967070cb1286550f2058f) C:\WINDOWS\system32\WINIO.dll 11:36:39.0500 3728 mysqlinventime ( Backdoor.Multi.ZAccess.gen ) - infected 11:36:39.0500 3728 mysqlinventime - detected Backdoor.Multi.ZAccess.gen (0) 11:36:39.0656 3728 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll 11:36:39.0687 3728 napagent - ok 11:36:39.0765 3728 nchssvad - ok 11:36:39.0859 3728 Ncrc710 - ok 11:36:39.0953 3728 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 11:36:39.0968 3728 NDIS - ok 11:36:40.0093 3728 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 11:36:40.0093 3728 NdisTapi - ok 11:36:40.0171 3728 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 11:36:40.0187 3728 Ndisuio - ok 11:36:40.0265 3728 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 11:36:40.0281 3728 NdisWan - ok 11:36:40.0390 3728 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys 11:36:40.0390 3728 NDProxy - ok 11:36:40.0515 3728 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 11:36:40.0515 3728 NetBIOS - ok 11:36:40.0625 3728 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 11:36:40.0640 3728 NetBT - ok 11:36:40.0781 3728 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 11:36:40.0796 3728 NetDDE - ok 11:36:40.0859 3728 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 11:36:40.0875 3728 NetDDEdsdm - ok 11:36:41.0000 3728 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\System32\lsass.exe 11:36:41.0000 3728 Netlogon - ok 11:36:41.0109 3728 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll 11:36:41.0125 3728 Netman - ok 11:36:41.0218 3728 netmdsb - ok 11:36:41.0296 3728 NETMDUSB - ok 11:36:41.0375 3728 netmnt - ok 11:36:41.0484 3728 nettcpportsharing - ok 11:36:41.0531 3728 ngserver - ok 11:36:41.0593 3728 nim32 - ok 11:36:41.0765 3728 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll 11:36:41.0781 3728 Nla - ok 11:36:41.0859 3728 nmap - ok 11:36:41.0921 3728 nmsaccess - ok 11:36:42.0031 3728 NMSCFG - ok 11:36:42.0093 3728 nmwcd - ok 11:36:42.0171 3728 nmwcdcj - ok 11:36:42.0250 3728 npfmntor - ok 11:36:42.0343 3728 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 11:36:42.0343 3728 Npfs - ok 11:36:42.0406 3728 nsctop - ok 11:36:42.0468 3728 nsengine - ok 11:36:42.0546 3728 nsm1bus - ok 11:36:42.0625 3728 nsvclog - ok 11:36:42.0765 3728 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 11:36:42.0828 3728 Ntfs - ok 11:36:42.0937 3728 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\System32\lsass.exe 11:36:42.0937 3728 NtLmSsp - ok 11:36:43.0125 3728 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll 11:36:43.0187 3728 NtmsSvc - ok 11:36:43.0296 3728 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 11:36:43.0296 3728 Null - ok 11:36:43.0375 3728 nv - ok 11:36:43.0468 3728 NvNdis - ok 11:36:43.0546 3728 NVNET - ok 11:36:43.0625 3728 nwcworkstation - ok 11:36:43.0734 3728 NWHOST - ok 11:36:43.0828 3728 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 11:36:43.0828 3728 NwlnkFlt - ok 11:36:43.0906 3728 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 11:36:43.0906 3728 NwlnkFwd - ok 11:36:44.0015 3728 nwlnkspx - ok 11:36:44.0078 3728 NWSAP - ok 11:36:44.0156 3728 NWUSBModem - ok 11:36:44.0265 3728 omniinet - ok 11:36:44.0328 3728 omniusbl - ok 11:36:44.0406 3728 OneCareMP - ok 11:36:44.0500 3728 oracleorahome92tnslistener - ok 11:36:44.0546 3728 oracleservicelocalora - ok 11:36:44.0625 3728 oraclexeclragent - ok 11:36:44.0750 3728 P3 (c90018bafdc7098619a4a95b046b30f3) C:\WINDOWS\system32\DRIVERS\p3.sys 11:36:44.0765 3728 P3 - ok 11:36:44.0828 3728 Packet - ok 11:36:44.0890 3728 pae_1394 - ok 11:36:44.0968 3728 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys 11:36:44.0984 3728 Parport - ok 11:36:45.0062 3728 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 11:36:45.0078 3728 PartMgr - ok 11:36:45.0156 3728 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 11:36:45.0156 3728 ParVdm - ok 11:36:45.0203 3728 pavfnsvr - ok 11:36:45.0281 3728 pavsrv - ok 11:36:45.0328 3728 PBADRV - ok 11:36:45.0390 3728 Pcatip - ok 11:36:45.0468 3728 pccsmcfd - ok 11:36:45.0546 3728 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 11:36:45.0562 3728 PCI - ok 11:36:45.0640 3728 PCIDump - ok 11:36:45.0703 3728 PCIIde - ok 11:36:45.0812 3728 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 11:36:45.0812 3728 Pcmcia - ok 11:36:45.0875 3728 pcnet - ok 11:36:45.0953 3728 pcouffin - ok 11:36:46.0015 3728 pcradminserver - ok 11:36:46.0093 3728 PCTINDIS5 - ok 11:36:46.0140 3728 PD0620VID - ok 11:36:46.0203 3728 PDCOMP - ok 11:36:46.0281 3728 PDExchange - ok 11:36:46.0343 3728 PDFRAME - ok 11:36:46.0390 3728 pdlndsdl - ok 11:36:46.0468 3728 pdlnemap - ok 11:36:46.0531 3728 pdlnemsg - ok 11:36:46.0609 3728 pdlnsx25 - ok 11:36:46.0656 3728 PDRELI - ok 11:36:46.0734 3728 PDRFRAME - ok 11:36:46.0812 3728 penrendezvous - ok 11:36:46.0875 3728 perc2 - ok 11:36:46.0921 3728 perc2hib - ok 11:36:47.0109 3728 pgpserv - ok 11:36:47.0187 3728 pinnaclesys.mediaserver - ok 11:36:47.0265 3728 pktfilter - ok 11:36:47.0359 3728 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 11:36:47.0375 3728 PlugPlay - ok 11:36:47.0484 3728 pmj151la - ok 11:36:47.0593 3728 Pml Driver HPZ12 (9d84376931440f3679beef2a414fa493) C:\WINDOWS\system32\HPZipm12.exe 11:36:47.0593 3728 Pml Driver HPZ12 - ok 11:36:47.0671 3728 Pnp680r - ok 11:36:47.0781 3728 PolarUSB - ok 11:36:47.0859 3728 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\System32\lsass.exe 11:36:47.0859 3728 PolicyAgent - ok 11:36:47.0906 3728 portio - ok 11:36:47.0984 3728 PPPoEWin - ok 11:36:48.0046 3728 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 11:36:48.0062 3728 PptpMiniport - ok 11:36:48.0140 3728 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys 11:36:48.0140 3728 Processor - ok 11:36:48.0203 3728 procexp111 - ok 11:36:48.0265 3728 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 11:36:48.0265 3728 ProtectedStorage - ok 11:36:48.0312 3728 proxyhostmirrordisplay - ok 11:36:48.0390 3728 psadd - ok 11:36:48.0468 3728 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 11:36:48.0468 3728 PSched - ok 11:36:48.0546 3728 ptbsync - ok 11:36:48.0656 3728 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 11:36:48.0656 3728 Ptilink - ok 11:36:48.0703 3728 puscsrvc - ok 11:36:48.0781 3728 qbposdbservices - ok 11:36:48.0859 3728 qhwscsvc (6ae16e3191823e1af2ddce6d759864a1) C:\WINDOWS\system32\LPDSVC.dll 11:36:48.0875 3728 qhwscsvc - ok 11:36:48.0937 3728 qkbfiltr - ok 11:36:49.0015 3728 ql1080 - ok 11:36:49.0078 3728 Ql10wnt - ok 11:36:49.0125 3728 ql12160 - ok 11:36:49.0203 3728 ql1240 - ok 11:36:49.0265 3728 ql1280 - ok 11:36:49.0343 3728 qmofiltr - ok 11:36:49.0390 3728 QV2KUX - ok 11:36:49.0453 3728 raidmsvr - ok 11:36:49.0546 3728 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 11:36:49.0546 3728 RasAcd - ok 11:36:49.0671 3728 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll 11:36:49.0703 3728 RasAuto - ok 11:36:49.0796 3728 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 11:36:49.0796 3728 Rasl2tp - ok 11:36:49.0890 3728 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll 11:36:49.0937 3728 RasMan - ok 11:36:50.0015 3728 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 11:36:50.0015 3728 RasPppoe - ok 11:36:50.0109 3728 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 11:36:50.0109 3728 Raspti - ok 11:36:50.0203 3728 Rawwan - ok 11:36:50.0281 3728 rca - ok 11:36:50.0406 3728 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 11:36:50.0421 3728 Rdbss - ok 11:36:50.0515 3728 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 11:36:50.0515 3728 RDPCDD - ok 11:36:50.0671 3728 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 11:36:50.0687 3728 rdpdr - ok 11:36:50.0890 3728 RDPWD (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys 11:36:50.0890 3728 RDPWD - ok 11:36:51.0031 3728 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe 11:36:51.0046 3728 RDSessMgr - ok 11:36:51.0140 3728 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 11:36:51.0156 3728 redbook - ok 11:36:51.0265 3728 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll 11:36:51.0296 3728 RemoteAccess - ok 11:36:51.0375 3728 remotelyanywhere - ok 11:36:51.0453 3728 remoterecord - ok 11:36:51.0593 3728 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll 11:36:51.0593 3728 RemoteRegistry - ok 11:36:51.0656 3728 REVO - ok 11:36:51.0718 3728 REVOSENS - ok 11:36:51.0796 3728 rfcomm - ok 11:36:51.0843 3728 risdptsk - ok 11:36:51.0906 3728 rnadiagnosticsservice - ok 11:36:51.0984 3728 rnadirectory - ok 11:36:52.0062 3728 roxmediadb - ok 11:36:52.0093 3728 roxwatch9 - ok 11:36:52.0171 3728 rp32service - ok 11:36:52.0265 3728 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\System32\locator.exe 11:36:52.0281 3728 RpcLocator - ok 11:36:52.0421 3728 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll 11:36:52.0453 3728 RpcSs - ok 11:36:52.0562 3728 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\System32\rsvp.exe 11:36:52.0578 3728 RSVP - ok 11:36:52.0796 3728 RT73 (c7bcf9808e2a1b4cabe16ff7fbce5fab) C:\WINDOWS\system32\DRIVERS\rt73.sys 11:36:52.0828 3728 RT73 - ok 11:36:52.0937 3728 rtl8187Se - ok 11:36:53.0000 3728 rtport - ok 11:36:53.0078 3728 RTSTOR - ok 11:36:53.0156 3728 RushTopDevice - ok 11:36:53.0218 3728 s117unic - ok 11:36:53.0296 3728 s616unic - ok 11:36:53.0375 3728 SaiNtHid - ok 11:36:53.0437 3728 SaiNtSub - ok 11:36:53.0500 3728 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 11:36:53.0500 3728 SamSs - ok 11:36:53.0593 3728 SANDRA - ok 11:36:53.0687 3728 savscan - ok 11:36:53.0781 3728 SbcpHid - ok 11:36:53.0859 3728 scanexplicit - ok 11:36:54.0031 3728 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe 11:36:54.0046 3728 SCardSvr - ok 11:36:54.0140 3728 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll 11:36:54.0156 3728 Schedule - ok 11:36:54.0234 3728 screadspool - ok 11:36:54.0343 3728 scsiaccess - ok 11:36:54.0406 3728 scsk4 - ok 11:36:54.0484 3728 Scutum50 - ok 11:36:54.0531 3728 SE27obex - ok 11:36:54.0593 3728 SE2Dbus - ok 11:36:54.0687 3728 SE2Emdm - ok 11:36:54.0750 3728 se44bus - ok 11:36:54.0796 3728 se45bus - ok 11:36:54.0875 3728 se45obex - ok 11:36:54.0937 3728 se45unic - ok 11:36:55.0015 3728 se59mgmt - ok 11:36:55.0109 3728 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 11:36:55.0109 3728 Secdrv - ok 11:36:55.0187 3728 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll 11:36:55.0203 3728 seclogon - ok 11:36:55.0296 3728 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll 11:36:55.0312 3728 SENS - ok 11:36:55.0406 3728 sentinelprotectionserver - ok 11:36:55.0531 3728 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys 11:36:55.0531 3728 serenum - ok 11:36:55.0640 3728 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys 11:36:55.0640 3728 Serial - ok 11:36:55.0734 3728 sermouse (1f16931c722c69e4a7866244796c66a0) C:\WINDOWS\system32\DRIVERS\sermouse.sys 11:36:55.0750 3728 sermouse - ok 11:36:55.0953 3728 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys 11:36:55.0953 3728 Sfloppy - ok 11:36:56.0031 3728 sfusvc - ok 11:36:56.0093 3728 sgectl - ok 11:36:56.0250 3728 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll 11:36:56.0281 3728 SharedAccess - ok 11:36:56.0421 3728 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 11:36:56.0437 3728 ShellHWDetection - ok 11:36:56.0500 3728 SI3112 - ok 11:36:56.0578 3728 si3114r - ok 11:36:56.0656 3728 SilverLink - ok 11:36:56.0734 3728 Simbad - ok 11:36:56.0843 3728 SISNICXP - ok 11:36:56.0906 3728 sit_bus - ok 11:36:56.0984 3728 sit_prt - ok 11:36:57.0078 3728 slave - ok 11:36:57.0156 3728 slpmonx - ok 11:36:57.0234 3728 Slpsvdr - ok 11:36:57.0328 3728 slservice - ok 11:36:57.0515 3728 SMTPSVC (db3c22745c0da4666f3be31f1af36b2f) C:\WINDOWS\system32\inetsrv\inetinfo.exe 11:36:57.0515 3728 SMTPSVC - ok 11:36:57.0656 3728 soma - ok 11:36:57.0718 3728 sonicwall_netextender - ok 11:36:57.0796 3728 Sparrow - ok 11:36:57.0875 3728 SPFDRV - ok 11:36:57.0953 3728 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 11:36:57.0953 3728 splitter - ok 11:36:58.0015 3728 spmgr - ok 11:36:58.0125 3728 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe 11:36:58.0140 3728 Spooler - ok 11:36:58.0203 3728 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 11:36:58.0218 3728 sr - ok 11:36:58.0312 3728 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\System32\srsvc.dll 11:36:58.0343 3728 srservice - ok 11:36:58.0500 3728 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys 11:36:58.0546 3728 Srv - ok 11:36:58.0625 3728 SRVLOC - ok 11:36:58.0671 3728 sscdserd - ok 11:36:58.0765 3728 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll 11:36:58.0765 3728 SSDPSRV - ok 11:36:58.0828 3728 ssrtln - ok 11:36:58.0906 3728 ss_mdm - ok 11:36:59.0031 3728 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll 11:36:59.0078 3728 stisvc - ok 11:36:59.0140 3728 susbser - ok 11:36:59.0218 3728 svcwmu - ok 11:36:59.0312 3728 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 11:36:59.0312 3728 swenum - ok 11:36:59.0453 3728 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 11:36:59.0453 3728 swmidi - ok 11:36:59.0531 3728 SWNC8U51 - ok 11:36:59.0578 3728 SwPrv - ok 11:36:59.0687 3728 symappcore - ok 11:36:59.0718 3728 symc810 - ok 11:36:59.0796 3728 symc8xx - ok 11:36:59.0875 3728 symredrv - ok 11:36:59.0937 3728 symsecureport - ok 11:36:59.0984 3728 symtdi - ok 11:37:00.0062 3728 sym_hi - ok 11:37:00.0125 3728 sym_u3 - ok 11:37:00.0234 3728 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 11:37:00.0234 3728 sysaudio - ok 11:37:00.0859 3728 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe 11:37:00.0875 3728 SysmonLog - ok 11:37:00.0953 3728 sysplant - ok 11:37:01.0046 3728 Tablet2k - ok 11:37:01.0171 3728 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll 11:37:01.0203 3728 TapiSrv - ok 11:37:01.0375 3728 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 11:37:01.0406 3728 Tcpip - ok 11:37:01.0531 3728 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 11:37:01.0531 3728 TDPIPE - ok 11:37:01.0656 3728 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 11:37:01.0656 3728 TDTCP - ok 11:37:01.0750 3728 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 11:37:01.0750 3728 TermDD - ok 11:37:01.0921 3728 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll 11:37:01.0953 3728 TermService - ok 11:37:02.0031 3728 tga - ok 11:37:02.0171 3728 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 11:37:02.0171 3728 Themes - ok 11:37:02.0250 3728 thpsrv - ok 11:37:02.0390 3728 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\System32\tlntsvr.exe 11:37:02.0390 3728 TlntSvr - ok 11:37:02.0468 3728 tmtdi - ok 11:37:02.0546 3728 tomcatcws3 - ok 11:37:02.0640 3728 TosIde - ok 11:37:02.0703 3728 tosrfbd - ok 11:37:02.0765 3728 tpkd - ok 11:37:02.0859 3728 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll 11:37:02.0875 3728 TrkWks - ok 11:37:02.0968 3728 tsscoreservice - ok 11:37:03.0031 3728 twotrack - ok 11:37:03.0140 3728 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 11:37:03.0140 3728 Udfs - ok 11:37:03.0187 3728 ulcdrhlp - ok 11:37:03.0265 3728 UlSata - ok 11:37:03.0343 3728 ultra - ok 11:37:03.0406 3728 ultra66 - ok 11:37:03.0546 3728 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 11:37:03.0578 3728 Update - ok 11:37:03.0703 3728 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll 11:37:03.0734 3728 upnphost - ok 11:37:03.0812 3728 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe 11:37:03.0828 3728 UPS - ok 11:37:03.0906 3728 upsmonservice - ok 11:37:04.0031 3728 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 11:37:04.0031 3728 usbccgp - ok 11:37:04.0109 3728 USBCCID - ok 11:37:04.0187 3728 UsbDiag - ok 11:37:04.0265 3728 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 11:37:04.0281 3728 usbehci - ok 11:37:04.0359 3728 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 11:37:04.0359 3728 usbhub - ok 11:37:04.0421 3728 usbmate - ok 11:37:04.0515 3728 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys 11:37:04.0515 3728 usbohci - ok 11:37:04.0593 3728 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys 11:37:04.0593 3728 usbprint - ok 11:37:04.0671 3728 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 11:37:04.0671 3728 usbscan - ok 11:37:04.0750 3728 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 11:37:04.0750 3728 USBSTOR - ok 11:37:04.0859 3728 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 11:37:04.0859 3728 usbuhci - ok 11:37:04.0906 3728 USBVCD - ok 11:37:04.0968 3728 VAIOMediaPlatform-PhotoServer-UPnP - ok 11:37:05.0031 3728 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 11:37:05.0031 3728 VgaSave - ok 11:37:05.0093 3728 viaagp - ok 11:37:05.0171 3728 viaagp1 - ok 11:37:05.0250 3728 ViaIde - ok 11:37:05.0328 3728 vmount2 (11028c6a84a967070cb1286550f2058f) C:\WINDOWS\system32\bc_tdi_f.dll 11:37:05.0343 3728 vmount2 ( Backdoor.Multi.ZAccess.gen ) - infected 11:37:05.0343 3728 vmount2 - detected Backdoor.Multi.ZAccess.gen (0) 11:37:05.0453 3728 VNUWL5B (41506ca8c333371634717ae3767cc336) C:\WINDOWS\system32\DRIVERS\VNUWL5B.SYS 11:37:05.0468 3728 VNUWL5B - ok 11:37:05.0578 3728 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 11:37:05.0578 3728 VolSnap - ok 11:37:05.0671 3728 vpcusb - ok 11:37:05.0734 3728 vpn5000service - ok 11:37:05.0843 3728 vrfwsvc - ok 11:37:05.0906 3728 vsbus - ok 11:37:05.0968 3728 vsdatant - ok 11:37:06.0125 3728 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe 11:37:06.0156 3728 VSS - ok 11:37:06.0265 3728 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\System32\w32time.dll 11:37:06.0281 3728 W32Time - ok 11:37:06.0390 3728 w39n51 - ok 11:37:06.0515 3728 W3SVC (db3c22745c0da4666f3be31f1af36b2f) C:\WINDOWS\system32\inetsrv\inetinfo.exe 11:37:06.0531 3728 W3SVC - ok 11:37:06.0625 3728 W700bus - ok 11:37:06.0687 3728 W8100PCI - ok 11:37:06.0750 3728 w810mdfl - ok 11:37:06.0828 3728 wampapache - ok 11:37:06.0921 3728 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 11:37:06.0921 3728 Wanarp - ok 11:37:06.0984 3728 wanatw - ok 11:37:07.0046 3728 wanusb - ok 11:37:07.0125 3728 WavxDMgr - ok 11:37:07.0171 3728 WcesComm - ok 11:37:07.0250 3728 WDICA - ok 11:37:07.0343 3728 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 11:37:07.0359 3728 wdmaud - ok 11:37:07.0484 3728 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll 11:37:07.0500 3728 WebClient - ok 11:37:07.0578 3728 websenseusagemonitor - ok 11:37:07.0671 3728 websenseuserservice - ok 11:37:07.0734 3728 webupdate - ok 11:37:07.0796 3728 wfxsvc - ok 11:37:07.0875 3728 winachcf - ok 11:37:07.0953 3728 winachsf - ok 11:37:08.0015 3728 windowblinds - ok 11:37:08.0125 3728 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll 11:37:08.0140 3728 winmgmt - ok 11:37:08.0234 3728 winpower - ok 11:37:08.0296 3728 winproxy - ok 11:37:08.0453 3728 WmaCDriverV32 - ok 11:37:08.0546 3728 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll 11:37:08.0546 3728 WmdmPmSN - ok 11:37:08.0734 3728 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll 11:37:08.0796 3728 Wmi - ok 11:37:08.0953 3728 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\System32\wbem\wmiapsrv.exe 11:37:08.0968 3728 WmiApSrv - ok 11:37:09.0234 3728 WMPNetworkSvc (f74e3d9a7fa9556c3bbb14d4e5e63d3b) C:\Program Files\Windows Media Player\WMPNetwk.exe 11:37:09.0312 3728 WMPNetworkSvc - ok 11:37:09.0359 3728 WmUsbHid - ok 11:37:09.0421 3728 WNCPKT - ok 11:37:09.0500 3728 WSIMD - ok 11:37:09.0578 3728 wstcodec - ok 11:37:09.0671 3728 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll 11:37:09.0687 3728 wuauserv - ok 11:37:09.0796 3728 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 11:37:09.0828 3728 WudfPf - ok 11:37:09.0953 3728 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 11:37:09.0953 3728 WudfRd - ok 11:37:10.0062 3728 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll 11:37:10.0062 3728 WudfSvc - ok 11:37:10.0265 3728 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll 11:37:10.0312 3728 WZCSVC - ok 11:37:10.0390 3728 XBCD - ok 11:37:10.0484 3728 XDva004 - ok 11:37:10.0562 3728 XFX_program - ok 11:37:10.0703 3728 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll 11:37:10.0718 3728 xmlprov - ok 11:37:10.0796 3728 XUIF - ok 11:37:10.0859 3728 z525mdm - ok 11:37:10.0921 3728 z800mdm - ok 11:37:10.0984 3728 zd1211u(zydas) - ok 11:37:11.0062 3728 zdeviceservice - ok 11:37:11.0125 3728 zmxpzip - ok 11:37:11.0203 3728 zpaction - ok 11:37:11.0250 3728 zppinger - ok 11:37:11.0328 3728 ZY202_XP - ok 11:37:11.0921 3728 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0 11:37:12.0125 3728 \Device\Harddisk0\DR0 - ok 11:37:12.0187 3728 Boot (0x1200) (288e33756ede90b7febddffb7bea98d7) \Device\Harddisk0\DR0\Partition0 11:37:12.0187 3728 \Device\Harddisk0\DR0\Partition0 - ok 11:37:12.0218 3728 ============================================================ 11:37:12.0218 3728 Scan finished 11:37:12.0218 3728 ============================================================ 11:37:12.0328 3540 Detected object count: 5 11:37:12.0328 3540 Actual detected object count: 5 11:51:42.0500 3540 C:\WINDOWS\system32\netw4x32.dll - copied to quarantine 11:51:42.0500 3540 HKLM\SYSTEM\ControlSet001\services\cpucoolserver - will be deleted on reboot 11:51:42.0500 3540 HKLM\SYSTEM\ControlSet002\services\cpucoolserver - will be deleted on reboot 11:51:42.0625 3540 C:\WINDOWS\system32\netw4x32.dll - will be deleted on reboot 11:51:42.0625 3540 cpucoolserver ( Backdoor.Multi.ZAccess.gen ) - User select action: Delete 11:51:42.0718 3540 C:\WINDOWS\system32\BrPar.dll - copied to quarantine 11:51:42.0718 3540 HKLM\SYSTEM\ControlSet001\services\HPFECP20 - will be deleted on reboot 11:51:42.0750 3540 C:\WINDOWS\system32\BrPar.dll - will be deleted on reboot 11:51:42.0750 3540 HPFECP20 ( Backdoor.Multi.ZAccess.gen ) - User select action: Delete 11:51:42.0906 3540 C:\WINDOWS\system32\DRIVERS\ipsec.sys - copied to quarantine 11:51:43.0703 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\@ - copied to quarantine 11:51:43.0734 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\cfg.ini - copied to quarantine 11:51:43.0765 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\Desktop.ini - copied to quarantine 11:51:43.0796 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\L\akygdmgo - copied to quarantine 11:51:43.0812 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\oemid - copied to quarantine 11:51:43.0828 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\U\00000001.@ - copied to quarantine 11:51:43.0906 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\U\00000002.@ - copied to quarantine 11:51:43.0921 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\U\00000004.@ - copied to quarantine 11:51:43.0953 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\U\80000000.@ - copied to quarantine 11:51:44.0015 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\U\80000004.@ - copied to quarantine 11:51:44.0046 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\U\80000032.@ - copied to quarantine 11:51:44.0062 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\version - copied to quarantine 11:51:45.0859 3540 VerifyFileNameVersionInfo: GetFileVersionInfoSizeW(C:\WINDOWS\system32\drivers\ipsec.sys) error 1813 11:51:49.0203 3540 Backup copy found, using it.. 11:51:49.0234 3540 C:\WINDOWS\system32\DRIVERS\ipsec.sys - will be cured on reboot 11:51:53.0890 3540 C:\WINDOWS\$NtUninstallKB54927$\1266066912 - will be deleted on reboot 11:51:53.0890 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\@ - will be deleted on reboot 11:51:53.0890 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\cfg.ini - will be deleted on reboot 11:51:53.0890 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\Desktop.ini - will be deleted on reboot 11:51:53.0953 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\oemid - will be deleted on reboot 11:51:53.0953 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\U\00000001.@ - will be deleted on reboot 11:51:53.0968 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\U\00000002.@ - will be deleted on reboot 11:51:53.0968 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\U\00000004.@ - will be deleted on reboot 11:51:53.0984 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\U\80000000.@ - will be deleted on reboot 11:51:53.0984 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\U\80000004.@ - will be deleted on reboot 11:51:53.0984 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\U\80000032.@ - will be deleted on reboot 11:51:53.0984 3540 C:\WINDOWS\$NtUninstallKB54927$\3415547162\version - will be deleted on reboot 11:51:54.0015 3540 IPSec ( Virus.Win32.ZAccess.k ) - User select action: Cure 11:51:54.0125 3540 C:\WINDOWS\system32\WINIO.dll - copied to quarantine 11:51:54.0140 3540 HKLM\SYSTEM\ControlSet001\services\mysqlinventime - will be deleted on reboot 11:51:54.0140 3540 HKLM\SYSTEM\ControlSet002\services\mysqlinventime - will be deleted on reboot 11:51:54.0156 3540 C:\WINDOWS\system32\WINIO.dll - will be deleted on reboot 11:51:54.0156 3540 mysqlinventime ( Backdoor.Multi.ZAccess.gen ) - User select action: Delete 11:51:54.0250 3540 C:\WINDOWS\system32\bc_tdi_f.dll - copied to quarantine 11:51:54.0250 3540 HKLM\SYSTEM\ControlSet001\services\vmount2 - will be deleted on reboot 11:51:54.0250 3540 HKLM\SYSTEM\ControlSet002\services\vmount2 - will be deleted on reboot 11:51:54.0265 3540 C:\WINDOWS\system32\bc_tdi_f.dll - will be deleted on reboot 11:51:54.0265 3540 vmount2 ( Backdoor.Multi.ZAccess.gen ) - User select action: Delete 11:52:14.0125 2504 Deinitialize success

5th and last TDSSKiller scan ———————————————————— 14:45:05.0703 3876 TDSS rootkit removing tool 2.7.34.0 May 2 2012 09:59:18 14:45:07.0734 3876 ============================================================ 14:45:07.0734 3876 Current date / time: 2012/05/12 14:45:07.0734 14:45:07.0734 3876 SystemInfo: 14:45:07.0734 3876 14:45:07.0734 3876 OS Version: 5.1.2600 ServicePack: 3.0 14:45:07.0734 3876 Product type: Workstation 14:45:07.0734 3876 ComputerName: SERVER 14:45:07.0734 3876 UserName: Jerry 14:45:07.0765 3876 Windows directory: C:\WINDOWS 14:45:07.0765 3876 System windows directory: C:\WINDOWS 14:45:07.0765 3876 Processor architecture: Intel x86 14:45:07.0765 3876 Number of processors: 1 14:45:07.0765 3876 Page size: 0x1000 14:45:07.0765 3876 Boot type: Normal boot 14:45:07.0765 3876 ============================================================ 14:45:23.0281 3876 Drive \Device\Harddisk0\DR0 - Size: 0x4A94F0000 (18.65 Gb), SectorSize: 0x200, Cylinders: 0xA1A, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000054 14:45:23.0312 3876 ============================================================ 14:45:23.0343 3876 \Device\Harddisk0\DR0: 14:45:23.0359 3876 MBR partitions: 14:45:23.0359 3876 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2546451 14:45:23.0359 3876 ============================================================ 14:45:23.0390 3876 C: <-> \Device\Harddisk0\DR0\Partition0 14:45:23.0421 3876 ============================================================ 14:45:23.0421 3876 Initialize success 14:45:23.0421 3876 ============================================================ 14:45:30.0296 3056 ============================================================ 14:45:30.0296 3056 Scan started 14:45:30.0296 3056 Mode: Manual; 14:45:30.0296 3056 ============================================================ 14:45:31.0796 3056 2wirepcp - ok 14:45:31.0875 3056 3compxe - ok 14:45:31.0968 3056 a016mdfl - ok 14:45:32.0078 3056 a016obex - ok 14:45:32.0187 3056 Abiosdsk - ok 14:45:32.0296 3056 abnetmon - ok 14:45:32.0406 3056 abp480n5 - ok 14:45:32.0562 3056 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) C:\WINDOWS\system32\drivers\ac97intc.sys 14:45:32.0578 3056 ac97intc - ok 14:45:32.0765 3056 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 14:45:32.0781 3056 ACPI - ok 14:45:32.0890 3056 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 14:45:32.0890 3056 ACPIEC - ok 14:45:32.0984 3056 adpu160m - ok 14:45:33.0078 3056 AEAudioService - ok 14:45:33.0250 3056 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 14:45:33.0296 3056 aec - ok 14:45:33.0468 3056 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys 14:45:33.0515 3056 AFD - ok 14:45:33.0609 3056 AFGMp50 - ok 14:45:33.0734 3056 AgereModemAudio (6416f9b6b220f0a890525c38235afad7) C:\Program Files\LSI SoftModem\agrsmsvc.exe 14:45:33.0750 3056 AgereModemAudio - ok 14:45:34.0484 3056 AgereSoftModem (7560f465f1ce69c53bf17559ee195548) C:\WINDOWS\system32\DRIVERS\AGRSM.sys 14:45:34.0546 3056 AgereSoftModem - ok 14:45:34.0687 3056 Aha154x - ok 14:45:34.0750 3056 aic78u2 - ok 14:45:34.0812 3056 aic78xx - ok 14:45:34.0937 3056 aksusb - ok 14:45:35.0046 3056 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll 14:45:35.0046 3056 Alerter - ok 14:45:35.0187 3056 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe 14:45:35.0187 3056 ALG - ok 14:45:35.0359 3056 ALIEHCD (bcfe73d1867912f8dd08e4169218f6ee) C:\WINDOWS\system32\Drivers\ALIEHCI.sys 14:45:35.0359 3056 ALIEHCD - ok 14:45:35.0500 3056 alihub (d44a1471ca776ef8d0740f53f1fdc757) C:\WINDOWS\system32\DRIVERS\AliHub.sys 14:45:35.0500 3056 alihub - ok 14:45:35.0562 3056 AliIde - ok 14:45:35.0640 3056 aliroothub (940be3324d504d36dab84a6bb0db4465) C:\WINDOWS\system32\DRIVERS\AliRtHub.sys 14:45:35.0656 3056 aliroothub - ok 14:45:35.0734 3056 AlteraByteBlaster - ok 14:45:35.0828 3056 amoagent - ok 14:45:35.0937 3056 amsint - ok 14:45:36.0015 3056 Anydlc - ok 14:45:36.0125 3056 aolservice - ok 14:45:36.0234 3056 appdrv - ok 14:45:36.0453 3056 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll 14:45:36.0468 3056 AppMgmt - ok 14:45:36.0593 3056 Appn - ok 14:45:36.0656 3056 arcltsrv - ok 14:45:36.0718 3056 asc - ok 14:45:36.0843 3056 asc3350p - ok 14:45:36.0906 3056 asc3550 - ok 14:45:37.0000 3056 ASDR - ok 14:45:37.0093 3056 ASLDRService - ok 14:45:37.0218 3056 asusgsb - ok 14:45:37.0296 3056 ASUSVRC - ok 14:45:37.0390 3056 aswmon2 - ok 14:45:37.0453 3056 aswupdsv - ok 14:45:37.0593 3056 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 14:45:37.0593 3056 AsyncMac - ok 14:45:37.0734 3056 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 14:45:37.0734 3056 atapi - ok 14:45:37.0781 3056 Atdisk - ok 14:45:37.0906 3056 ati2mpaa - ok 14:45:37.0984 3056 ATIBTXBAR - ok 14:45:38.0078 3056 atinrvxx - ok 14:45:38.0187 3056 atixsaudio - ok 14:45:38.0265 3056 ATKGFNEXSrv - ok 14:45:38.0437 3056 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 14:45:38.0453 3056 Atmarpc - ok 14:45:38.0625 3056 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll 14:45:38.0625 3056 AudioSrv - ok 14:45:38.0750 3056 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 14:45:38.0750 3056 audstub - ok 14:45:38.0796 3056 authsyssvc - ok 14:45:39.0765 3056 avg8emc (b9ae3c63a53396cd669ef8ae9c9cbd85) C:\PROGRA~1\AVG\AVG8\avgemc.exe 14:45:39.0953 3056 avg8emc - ok 14:45:40.0000 3056 Scan interrupted by user! 14:45:40.0000 3056 Scan interrupted by user! 14:45:40.0000 3056 Scan interrupted by user! 14:45:40.0000 3056 ============================================================ 14:45:40.0000 3056 Scan finished 14:45:40.0000 3056 ============================================================ 14:45:40.0140 2904 Detected object count: 0 14:45:40.0140 2904 Actual detected object count: 0 14:46:31.0562 3648 Deinitialize success

Here's the ComboFix log

————————————————————-


ComboFix 12-05-11.03 - Jerry 05/13/2012 19:20:51.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.203 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\Cache
c:\windows\system32\dds_trash_log.cmd
c:\windows\system32\incdpass.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_GENERICDRV
——-\Service_GENERICDRV
——-\Legacy_ulcdrhlp
——-\Service_ulcdrhlp
.
.
((((((((((((((((((((((((( Files Created from 2012-04-13 to 2012-05-13 )))))))))))))))))))))))))))))))
.
.
2012-05-12 15:51 . 2012-05-12 15:51 ——– d—–w- C:\TDSSKiller_Quarantine
2012-05-11 19:58 . 2012-05-11 19:58 ——– d—–w- c:\documents and settings\Jerry\Local Settings\Application Data\PCHealth
2012-05-10 01:53 . 2012-05-10 01:53 388096 —-a-r- c:\documents and settings\Jerry\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-05-10 01:53 . 2012-05-10 01:53 ——– d—–w- c:\program files\Trend Micro
2012-05-04 01:15 . 2012-05-04 01:15 ——– d—–w- c:\documents and settings\All Users\Application Data\IObit
2012-04-26 22:15 . 2012-05-13 22:49 ——– d—–w- c:\program files\Spybot - Search & Destroy
2012-04-26 22:15 . 2012-05-12 02:44 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2012-04-21 04:57 . 2012-04-21 04:57 ——– d—–w- c:\documents and settings\Jerry\Application Data\Malwarebytes
2012-04-21 04:56 . 2012-04-21 04:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-04-19 15:38 . 2012-04-21 06:29 ——– d—–w- c:\program files\Common Files\DXSurface
2012-04-19 15:37 . 2012-04-19 18:17 ——– d—–w- c:\documents and settings\All Users\Application Data\529C5063000166F200015441D151FC4E
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-12 16:20 . 2001-08-18 14:00 75264 —-a-w- c:\windows\system32\drivers\ipsec.sys
2012-04-11 13:12 . 2001-08-18 14:00 1862272 —-a-w- c:\windows\system32\win32k.sys
2012-04-11 13:10 . 2001-08-18 14:00 2192640 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-04-11 12:35 . 2001-08-17 13:48 2069120 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-01 11:01 . 2004-01-08 19:23 916992 —-a-w- c:\windows\system32\wininet.dll
2012-03-01 11:01 . 2001-08-18 14:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-03-01 11:01 . 2001-08-18 14:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2012-02-29 14:10 . 2001-08-18 14:00 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-02-29 14:10 . 2001-08-18 14:00 148480 —-a-w- c:\windows\system32\imagehlp.dll
2012-02-29 12:17 . 2004-08-04 05:59 385024 —-a-w- c:\windows\system32\html.iec
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2011-10-17 2042208]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-11-03 06:19 11952 —-a-w- c:\windows\system32\avgrsstx.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-10-17 14:53 87352 —-a-w- c:\windows\system32\LMIinit.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
2007-08-03 20:09 63048 -c—-w- c:\program files\LogMeIn\x86\x86\LogMeInSystray.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgtray.exe"=
.
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/24/2009 1:00 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/24/2009 1:00 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [11/3/2009 2:17 AM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [11/3/2009 2:17 AM 297752]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\x86\rainfo.sys [4/1/2008 5:53 PM 12856]
S2 ALIEHCD;ALi PCI to USB Enhanced Host Controller;c:\windows\system32\drivers\AliEhci.sys [9/5/2009 4:04 AM 112835]
S2 pcouffin;SRTSPL;c:\windows\system32\svchost.exe -k netsvcs [8/18/2001 10:00 AM 14336]
S2 Scutum50;Scutum50 NDIS Protocol Driver;c:\windows\system32\Drivers\Scutum50.sys –> c:\windows\system32\Drivers\Scutum50.sys [?]
S3 alihub;Generic Hub on USB 2.0 Bus;c:\windows\system32\drivers\AliHub.sys [9/5/2009 4:04 AM 17823]
S3 aliroothub;USB 2.0 Root Hub;c:\windows\system32\drivers\AliRtHub.sys [9/5/2009 4:04 AM 5325]
S3 m4301a;Linksys Wireless-B USB Network Adapter v4.0 Driver;c:\windows\system32\drivers\m4301A.sys [11/3/2009 1:34 AM 83552]
S3 MOSUMAC;USB-Ethernet Driver;c:\windows\system32\drivers\MOSUMAC.SYS [12/27/2010 3:57 PM 40448]
S3 VNUWL5B;VIA Networking Technologies USB Wireless LAN Adapter Driver Service;c:\windows\system32\drivers\VNUWL5B.SYS [9/24/2010 3:02 PM 145408]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ikfileflt
bcftdi
AlteraByteBlaster
penrendezvous
amoagent
tga
se45bus
Rawwan
emupia
Eplpdx02
tpkd
fsssvc
si3114r
motmodem
eloggersvc6
REVOSENS
mqdmserd
sgectl
NMSCFG
se44bus
Tablet2k
iviVD
webupdate
rtport
tsscoreservice
SWNC8U51
pdlnsx25
pmj151la
EagleNT
sonicwall_netextender
nsengine
itmrtsvc
netmnt
dnetc
nchssvad
mssql$microsoftbcm
atixsaudio
z525mdm
UlSata
BTSLBCSP
SE2Emdm
QV2KUX
lp6nds35
twotrack
omniinet
SilverLink
svcwmu
lexbces
nim32
hpwirelessmgr
proxyhostmirrordisplay
abnetmon
ipsecmon
oraclexeclragent
ATIBTXBAR
FGDSCSI
AVWLP_USB
F700iat
fasttrackinstallerservice
tomcatcws3
bc_pat_f
JL2005C
mod7700
slservice
XBCD
pae_1394
se45obex
CTHWIUT.DLL
aswupdsv
issm
winpower
a016obex
lvcomser
McciCMService
nsctop
NWUSBModem
pktfilter
lxcz_device
CAMFLT
msloop
pavfnsvr
id2scaps
rp32service
screadspool
qkbfiltr
mindretrieve
symappcore
pdlndsdl
citrixwmiservice
bwmservice
Packet
ultra66
XUIF
soma
GT890x
wampapache
LEX_AS_NIC_SERVICE_YNOS
pgpserv
a016mdfl
MSIRCOMM
CamAv
DCamUSBGrandTek
pcradminserver
LVBulk
SISNICXP
DCamUSBMke2
L8042mou
RushTopDevice
Pcatip
appdrv
roxwatch9
s117unic
sit_prt
hpconfig
Cam5607
w810mdfl
WSIMD
gtndis5
iftpsvc
CnxtHdAudService
AEAudioService
nmap
tmtdi
pdlnemap
psadd
mfetdik
BrScnUsb
spmgr
Maplom
authsyssvc
usbmate
dlartl_n
slpmonx
E1000
UsbDiag
ma763004
ASLDRService
InterBaseGuardian
NWSAP
GMSIPCI
db2ntsecserver
ipodsrv
qbposdbservices
sentinelprotectionserver
raidmsvr
oracleorahome92tnslistener
susbser
idebusdr
SE27obex
ipssvc
ati2mpaa
cpqrcmc
btwaudio
aolservice
viaagp
pinnaclesys.mediaserver
puscsrvc
etoksrv
blueletscoaudio
mcrdsvc
wanatw
licensemanagersocket
SRVLOC
PPPoEWin
filemon701
jtagserver
Pnp680r
Ncrc710
thpsrv
PD0620VID
mpe
fontcache3.0.0.0
VAIOMediaPlatform-PhotoServer-UPnP
USBVCD
PCTINDIS5
LHidFilt
PBADRV
lvpopflt
risdptsk
cpucoolserver
DirectUpdate
cacheserver
qhwscsvc
lxrjd31d
fsks
basic2
ghostsec
avgio
RTSTOR
mysqlinventime
bc_ip_f
kerbkey
HPFECP20
SaiNtSub
nmsaccess
sysplant
vmount2
XDva004
SI3112
BCMModem
w39n51
scsiaccess
winachsf
mozybackup
ikhlayer
netmdsb
MTDVC2_ENUM
WNCPKT
db2jds
dvd-ram_service
k750obex
nmwcdcj
db2remotecmd
upsmonservice
ssrtln
KLOGNT
Slpsvdr
mdmxsdk
NvNdis
mcusrmgr
nmwcd
Exportit
lockmgr
W700bus
epgspooler
pccsmcfd
ibmcicstransactiongateway
cpuz132
AFGMp50
cfosspeed
ptbsync
mozyFilter
2wirepcp
z800mdm
wfxsvc
REVO
remotelyanywhere
fsRamDsk
captureservice
bridgemp
driverhardwarev2
bridge
asusgsb
scsk4
hotspotshieldservice
bc_filter
NVNET
nv
OneCareMP
XFX_program
arcltsrv
ngserver
enodpl
IJPLMSVC
rnadirectory
WmUsbHid
vpn5000service
HBtnKey
bdss
dot4print
winproxy
CX88ENC
s616unic
scanexplicit
symtdi
ASUSVRC
vpcusb
ulcdrhlp
PolarUSB
hsfhwazl
lxby_device
cpqdmi
SE2Dbus
digitizer
FlexBios
viaagp1
zd1211u(zydas)
aksusb
fasttraksvc
ithsgt
3compxe
GTF32BUS
atinrvxx
FVNETusb
remoterecord
monfilt
klif
nsm1bus
omniusbl
mhndrv
ss_mdm
msk80service
cdfsvc
sfusvc
wstcodec
pcouffin
SPFDRV
slave
IBMTPCHK
USBCCID
keymaestro
se59mgmt
cics.region1
vrfwsvc
oracleservicelocalora
zppinger
avsvcmonitor
nsvclog
savscan
sit_bus
websenseuserservice
DritekPortIO
lvmvdrv
symredrv
diskeeper
EAWDMFD
MSICPL
se45unic
liveupdate
nwlnkspx
zdeviceservice
aswmon2
NWHOST
PDExchange
cmdmon
Anydlc
ikfilesec
iclarityqosservice
qmofiltr
dirms_defragmentation
Appn
zpaction
rtl8187Se
tosrfbd
procexp111
elnkupdateservice
portio
BsHelpCS
zmxpzip
ctusfsyn
ZY202_XP
gmer
SANDRA
axinstsv
SbcpHid
pavsrv
wanusb
WcesComm
mcproxy
hf30service
avgfwsrv
symsecureport
pcnet
msdv
websenseusagemonitor
ipodservice
NETMDUSB
ATKGFNEXSrv
roxmediadb
mr2kserv
ASDR
pdlnemsg
WavxDMgr
rnadiagnosticsservice
sscdserd
mdvrmng
FreshIO
W8100PCI
SaiNtHid
HabuFltr
DKbFltr
beatjammusicstreamingserver
lvsrvlauncher
windowblinds
npfmntor
mcafeeantispyware
winachcf
rca
rfcomm
nettcpportsharing
vsbus
easdrv
WmaCDriverV32
.
Contents of the 'Scheduled Tasks' folder
.
.
——- Supplementary Scan ——-
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: Interfaces\{349877E2-08A5-4885-9F71-527556531BD9}: NameServer = 216.220.230.24 216.220.230.25
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-DXSurfaceModifier - c:\program files\Common Files\DXSurface\DXSurfaceModifier.dll
Notify-NavLogon - (no file)
SafeBoot-82382033.sys
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-13 19:38
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]
"ImagePath"="a"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-789336058-2025429265-725345543-1015\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(660)
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
.
- - - - - - - > 'explorer.exe'(2172)
c:\windows\system32\WININET.dll
c:\progra~1\WINDOW~3\wmpband.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\LMIRfsClientNP.dll
.
———————— Other Running Processes ————————
.
c:\program files\LSI SoftModem\agrsmsvc.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\HPZipm12.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2012-05-13 19:45:44 - machine was rebooted
ComboFix-quarantined-files.txt 2012-05-13 23:45
.
Pre-Run: 8,909,389,824 bytes free
Post-Run: 9,983,320,064 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 1D19FB8B35FC775F7743352D9D0ECDDF