Infected? Issues include Random audio for seconds, menu bar switching

Thanks for your time. Here's the TDS results. It did find one malicious, and it reported that the cure was successful. I did not see anything on the main screen of tds that said to create a report. Upon reboot, TDS did not come up again with a log file. When I started TDS, I clicked the report link, and got this information: Is there a seperate log created someplace? I do not see any reference to the malicious rootkit that it found (nor did i write it down, since I thought I would be seeing reference to it in a log file) 20:31:23.0421 4864 TDSS rootkit removing tool [removed] Jul 2 2012 20:01:08 20:31:23.0718 4864 ============================================================ 20:31:23.0718 4864 Current date / time: 2012/07/05 20:31:23.0718 20:31:23.0718 4864 SystemInfo: 20:31:23.0718 4864 20:31:23.0718 4864 OS Version: 5.1.2600 ServicePack: 3.0 20:31:23.0718 4864 Product type: Workstation 20:31:23.0718 4864 ComputerName: STEVEN-08 20:31:23.0718 4864 UserName: Steven 20:31:23.0718 4864 Windows directory: C:\WINDOWS 20:31:23.0718 4864 System windows directory: C:\WINDOWS 20:31:23.0718 4864 Processor architecture: Intel x86 20:31:23.0718 4864 Number of processors: 2 20:31:23.0718 4864 Page size: 0x1000 20:31:23.0718 4864 Boot type: Normal boot 20:31:23.0718 4864 ============================================================ 20:31:25.0531 4864 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 20:31:25.0531 4864 Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 20:31:25.0546 4864 Drive \Device\Harddisk2\DR2 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 20:31:25.0562 4864 Drive \Device\Harddisk3\DR3 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 20:31:25.0578 4864 ============================================================ 20:31:25.0578 4864 \Device\Harddisk0\DR0: 20:31:25.0578 4864 MBR partitions: 20:31:25.0578 4864 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xFFFAC05 20:31:25.0593 4864 \Device\Harddisk1\DR1: 20:31:25.0593 4864 MBR partitions: 20:31:25.0593 4864 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A384C02 20:31:25.0593 4864 \Device\Harddisk2\DR2: 20:31:25.0593 4864 MBR partitions: 20:31:25.0593 4864 \Device\Harddisk2\DR2\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A384C02 20:31:25.0593 4864 \Device\Harddisk3\DR3: 20:31:25.0593 4864 MBR partitions: 20:31:25.0593 4864 ============================================================ 20:31:25.0625 4864 C: <-> \Device\Harddisk0\DR0\Partition0 20:31:25.0656 4864 D: <-> \Device\Harddisk2\DR2\Partition0 20:31:26.0078 4864 G: <-> \Device\Harddisk1\DR1\Partition0 20:31:26.0109 4864 ============================================================ 20:31:26.0109 4864 Initialize success 20:31:26.0109 4864 ============================================================

apologies! here is the log file from the root directory: 20:21:27.0109 2072 TDSS rootkit removing tool [removed] Jul 2 2012 20:01:08 20:21:29.0109 2072 ============================================================ 20:21:29.0125 2072 Current date / time: 2012/07/05 20:21:29.0109 20:21:29.0125 2072 SystemInfo: 20:21:29.0125 2072 20:21:29.0125 2072 OS Version: 5.1.2600 ServicePack: 3.0 20:21:29.0125 2072 Product type: Workstation 20:21:29.0125 2072 ComputerName: STEVEN-08 20:21:29.0125 2072 UserName: Steven 20:21:29.0125 2072 Windows directory: C:\WINDOWS 20:21:29.0125 2072 System windows directory: C:\WINDOWS 20:21:29.0125 2072 Processor architecture: Intel x86 20:21:29.0125 2072 Number of processors: 2 20:21:29.0125 2072 Page size: 0x1000 20:21:29.0125 2072 Boot type: Normal boot 20:21:29.0125 2072 ============================================================ 20:21:35.0953 2072 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 20:21:35.0984 2072 Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 20:21:36.0000 2072 Drive \Device\Harddisk2\DR2 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 20:21:36.0015 2072 Drive \Device\Harddisk3\DR3 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 20:21:36.0531 2072 ============================================================ 20:21:36.0531 2072 \Device\Harddisk0\DR0: 20:21:36.0546 2072 MBR partitions: 20:21:36.0546 2072 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xFFFAC05 20:21:36.0562 2072 \Device\Harddisk1\DR1: 20:21:36.0562 2072 MBR partitions: 20:21:36.0562 2072 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A384C02 20:21:36.0562 2072 \Device\Harddisk2\DR2: 20:21:36.0562 2072 MBR partitions: 20:21:36.0562 2072 \Device\Harddisk2\DR2\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A384C02 20:21:36.0562 2072 \Device\Harddisk3\DR3: 20:21:36.0562 2072 MBR partitions: 20:21:36.0562 2072 ============================================================ 20:21:36.0656 2072 C: <-> \Device\Harddisk0\DR0\Partition0 20:21:36.0671 2072 D: <-> \Device\Harddisk2\DR2\Partition0 20:21:36.0734 2072 G: <-> \Device\Harddisk1\DR1\Partition0 20:21:36.0750 2072 ============================================================ 20:21:36.0750 2072 Initialize success 20:21:36.0750 2072 ============================================================ 20:21:46.0453 5488 ============================================================ 20:21:46.0453 5488 Scan started 20:21:46.0453 5488 Mode: Manual; 20:21:46.0453 5488 ============================================================ 20:21:47.0890 5488 61883 (914a9709fc3bf419ad2f85547f2a4832) C:\WINDOWS\system32\DRIVERS\61883.sys 20:21:47.0890 5488 61883 - ok 20:21:47.0890 5488 Abiosdsk - ok 20:21:47.0890 5488 abp480n5 - ok 20:21:47.0984 5488 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 20:21:47.0984 5488 ACPI - ok 20:21:48.0015 5488 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 20:21:48.0015 5488 ACPIEC - ok 20:21:48.0109 5488 AdobeActiveFileMonitor5.0 (177ff6608b48638d4066726f3a3f8444) C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe 20:21:48.0109 5488 AdobeActiveFileMonitor5.0 - ok 20:21:48.0109 5488 adpu160m - ok 20:21:48.0156 5488 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 20:21:48.0156 5488 aec - ok 20:21:48.0203 5488 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys 20:21:48.0218 5488 AFD - ok 20:21:48.0218 5488 Aha154x - ok 20:21:48.0218 5488 aic78u2 - ok 20:21:48.0234 5488 aic78xx - ok 20:21:48.0281 5488 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll 20:21:48.0281 5488 Alerter - ok 20:21:48.0296 5488 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe 20:21:48.0312 5488 ALG - ok 20:21:48.0312 5488 AliIde - ok 20:21:48.0328 5488 amdide (6e58654cb25730b2579e45e1fd116a47) C:\WINDOWS\system32\DRIVERS\amdide.sys 20:21:48.0343 5488 amdide - ok 20:21:48.0390 5488 AmdK8 (59301936898ae62245a6f09c0aba9475) C:\WINDOWS\system32\DRIVERS\AmdK8.sys 20:21:48.0406 5488 AmdK8 - ok 20:21:48.0406 5488 amsint - ok 20:21:48.0531 5488 Apple Mobile Device (3debbecf665dcdde3a95d9b902010817) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 20:21:48.0531 5488 Apple Mobile Device - ok 20:21:48.0578 5488 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll 20:21:48.0578 5488 AppMgmt - ok 20:21:48.0625 5488 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys 20:21:48.0625 5488 Arp1394 - ok 20:21:48.0656 5488 ASAPIW2k (4f9cbbf95e8f7a0d4c0edcfe3b78102e) C:\WINDOWS\system32\drivers\ASAPIW2k.sys 20:21:48.0671 5488 ASAPIW2k - ok 20:21:48.0671 5488 asc - ok 20:21:48.0671 5488 asc3350p - ok 20:21:48.0671 5488 asc3550 - ok 20:21:48.0781 5488 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 20:21:48.0812 5488 aspnet_state - ok 20:21:48.0828 5488 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 20:21:48.0828 5488 AsyncMac - ok 20:21:48.0859 5488 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 20:21:48.0859 5488 atapi - ok 20:21:48.0859 5488 Atdisk - ok 20:21:48.0937 5488 Ati HotKey Poller (bf2e2109982d69c5227cc09671edb5fc) C:\WINDOWS\system32\Ati2evxx.exe 20:21:48.0984 5488 Ati HotKey Poller - ok 20:21:49.0062 5488 ATI Smart (ecfaa465ec730f40dfa41e63eea06a57) C:\WINDOWS\system32\ati2sgag.exe 20:21:49.0125 5488 ATI Smart - ok 20:21:49.0437 5488 ati2mtag (3e6878df6cedcd36957cc5776335fcc5) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 20:21:49.0531 5488 ati2mtag - ok 20:21:49.0640 5488 AtiHdmiService (591a9eabb5ef5168e435c2f18b05dd76) C:\WINDOWS\system32\drivers\AtiHdmi.sys 20:21:49.0640 5488 AtiHdmiService - ok 20:21:49.0671 5488 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 20:21:49.0687 5488 Atmarpc - ok 20:21:49.0703 5488 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll 20:21:49.0703 5488 AudioSrv - ok 20:21:49.0750 5488 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 20:21:49.0750 5488 audstub - ok 20:21:49.0781 5488 Avc (f8e6956a614f15a0860474c5e2a7de6b) C:\WINDOWS\system32\DRIVERS\avc.sys 20:21:49.0781 5488 Avc - ok 20:21:49.0828 5488 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 20:21:49.0828 5488 Beep - ok 20:21:49.0859 5488 BENDER (fc6d0c2f327a5f716fdfdc24a305aceb) C:\WINDOWS\system32\drivers\bender.sys 20:21:49.0875 5488 BENDER - ok 20:21:50.0078 5488 BHDrvx86 (a9e111a358ac5f7eba7ac61e43fc6725) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20120619.001\BHDrvx86.sys 20:21:50.0093 5488 BHDrvx86 - ok 20:21:50.0187 5488 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll 20:21:50.0312 5488 BITS - ok 20:21:50.0437 5488 Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe 20:21:50.0453 5488 Bonjour Service - ok 20:21:50.0515 5488 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll 20:21:50.0515 5488 Browser - ok 20:21:50.0578 5488 btaudio (b0a533aa6c5ce5f51cf738bf7e5cb5c4) C:\WINDOWS\system32\drivers\btaudio.sys 20:21:50.0609 5488 btaudio - ok 20:21:50.0640 5488 BTDriver (58a49bd10e08d3d4333a60dedcb1ced8) C:\WINDOWS\system32\DRIVERS\btport.sys 20:21:50.0640 5488 BTDriver - ok 20:21:50.0718 5488 BTKRNL (9ba609d995f7b708c62e53168df3ed2a) C:\WINDOWS\system32\DRIVERS\btkrnl.sys 20:21:50.0734 5488 BTKRNL - ok 20:21:50.0875 5488 btwdins (e88d7c9f4c4f9de849d9e5c59954812f) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe 20:21:50.0875 5488 btwdins - ok 20:21:50.0937 5488 BTWDNDIS (80f61de965c116051614ac2f04222ff7) C:\WINDOWS\system32\DRIVERS\btwdndis.sys 20:21:50.0953 5488 BTWDNDIS - ok 20:21:50.0968 5488 btwhid (e48668b4a6a5cf68b33aecad18ee8e1e) C:\WINDOWS\system32\DRIVERS\btwhid.sys 20:21:50.0968 5488 btwhid - ok 20:21:50.0984 5488 BTWUSB (ad7f4b81a3f8d330dd8382b7cf4df341) C:\WINDOWS\system32\Drivers\btwusb.sys 20:21:51.0000 5488 BTWUSB - ok 20:21:51.0046 5488 c2scsi (56247d46756b399725c2a386f4fc3cc3) C:\WINDOWS\system32\drivers\c2scsi.sys 20:21:51.0046 5488 c2scsi - ok 20:21:51.0078 5488 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 20:21:51.0078 5488 cbidf2k - ok 20:21:51.0093 5488 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 20:21:51.0093 5488 CCDECODE - ok 20:21:51.0109 5488 cd20xrnt - ok 20:21:51.0125 5488 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 20:21:51.0140 5488 Cdaudio - ok 20:21:51.0171 5488 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 20:21:51.0171 5488 Cdfs - ok 20:21:51.0187 5488 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 20:21:51.0187 5488 Cdrom - ok 20:21:51.0187 5488 Changer - ok 20:21:51.0218 5488 cisvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\System32\cisvc.exe 20:21:51.0218 5488 cisvc - ok 20:21:51.0250 5488 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe 20:21:51.0250 5488 ClipSrv - ok 20:21:51.0312 5488 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 20:21:51.0343 5488 clr_optimization_v2.0.50727_32 - ok 20:21:51.0390 5488 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 20:21:51.0390 5488 clr_optimization_v4.0.30319_32 - ok 20:21:51.0390 5488 CmdIde - ok 20:21:51.0546 5488 cmudaxp (a4689b5ba54994bc2c9630d088fabce9) C:\WINDOWS\system32\drivers\cmudaxp.sys 20:21:51.0609 5488 cmudaxp - ok 20:21:51.0687 5488 COMSysApp - ok 20:21:51.0703 5488 Cpqarray - ok 20:21:51.0750 5488 Creative Service for CDROM Access (3c8b6609712f4ff78e521f6dcfc4032b) C:\WINDOWS\system32\CTsvcCDA.EXE 20:21:51.0750 5488 Creative Service for CDROM Access - ok 20:21:51.0812 5488 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll 20:21:51.0812 5488 CryptSvc - ok 20:21:51.0812 5488 dac2w2k - ok 20:21:51.0828 5488 dac960nt - ok 20:21:51.0875 5488 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll 20:21:51.0890 5488 DcomLaunch - ok 20:21:52.0000 5488 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll 20:21:52.0015 5488 Dhcp - ok 20:21:52.0078 5488 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 20:21:52.0078 5488 Disk - ok 20:21:52.0093 5488 dmadmin - ok 20:21:52.0140 5488 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 20:21:52.0156 5488 dmboot - ok 20:21:52.0156 5488 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 20:21:52.0171 5488 dmio - ok 20:21:52.0187 5488 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 20:21:52.0187 5488 dmload - ok 20:21:52.0218 5488 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll 20:21:52.0218 5488 dmserver - ok 20:21:52.0265 5488 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 20:21:52.0265 5488 DMusic - ok 20:21:52.0281 5488 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll 20:21:52.0296 5488 Dnscache - ok 20:21:52.0312 5488 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll 20:21:52.0312 5488 Dot3svc - ok 20:21:52.0312 5488 dpti2o - ok 20:21:52.0343 5488 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 20:21:52.0343 5488 drmkaud - ok 20:21:52.0375 5488 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll 20:21:52.0375 5488 EapHost - ok 20:21:52.0500 5488 eeCtrl (fce87ba643d5e9a8b6e0378508d1b22d) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 20:21:52.0546 5488 eeCtrl - ok 20:21:52.0578 5488 EraserUtilRebootDrv (115dc729465a8c386615207f28875255) C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 20:21:52.0593 5488 EraserUtilRebootDrv - ok 20:21:52.0625 5488 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll 20:21:52.0625 5488 ERSvc - ok 20:21:52.0671 5488 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 20:21:52.0671 5488 Eventlog - ok 20:21:52.0703 5488 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\System32\es.dll 20:21:52.0703 5488 EventSystem - ok 20:21:52.0734 5488 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 20:21:52.0734 5488 Fastfat - ok 20:21:52.0781 5488 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 20:21:52.0781 5488 FastUserSwitchingCompatibility - ok 20:21:52.0828 5488 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys 20:21:52.0828 5488 Fdc - ok 20:21:52.0859 5488 FilterService (f9183d35ad38f093d5e1aa8ba072d51b) C:\WINDOWS\system32\DRIVERS\lvuvcflt.sys 20:21:52.0859 5488 FilterService - ok 20:21:52.0875 5488 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 20:21:52.0875 5488 Fips - ok 20:21:52.0890 5488 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys 20:21:52.0890 5488 Flpydisk - ok 20:21:52.0906 5488 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys 20:21:52.0906 5488 FltMgr - ok 20:21:52.0984 5488 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 20:21:52.0984 5488 FontCache3.0.0.0 - ok 20:21:53.0000 5488 FsUsbExDisk (790a4ca68f44be35967b3df61f3e4675) C:\WINDOWS\system32\FsUsbExDisk.SYS 20:21:53.0000 5488 FsUsbExDisk - ok 20:21:53.0031 5488 FsUsbExService (d3f9205cc4cb07553f2f9472c767ea87) C:\WINDOWS\system32\FsUsbExService.Exe 20:21:53.0031 5488 FsUsbExService - ok 20:21:53.0078 5488 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 20:21:53.0078 5488 Fs_Rec - ok 20:21:53.0109 5488 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 20:21:53.0109 5488 Ftdisk - ok 20:21:53.0125 5488 FTT3 (d26d63b9f9d16f5bec184efc63192577) C:\WINDOWS\system32\DRIVERS\FTT3.sys 20:21:53.0125 5488 FTT3 - ok 20:21:53.0156 5488 GEARAspiWDM (5ae3a887ece5bbb72cfab273c2fd1cfa) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys 20:21:53.0156 5488 GEARAspiWDM - ok 20:21:53.0156 5488 GMSIPCI - ok 20:21:53.0203 5488 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 20:21:53.0203 5488 Gpc - ok 20:21:53.0281 5488 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe 20:21:53.0296 5488 gupdate - ok 20:21:53.0296 5488 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe 20:21:53.0296 5488 gupdatem - ok 20:21:53.0359 5488 HdAudAddService (56bf27d7a539f9e6bbc1de201aba0edf) C:\WINDOWS\system32\drivers\AtiHdAud.sys 20:21:53.0359 5488 HdAudAddService - ok 20:21:53.0390 5488 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 20:21:53.0406 5488 HDAudBus - ok 20:21:53.0500 5488 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 20:21:53.0500 5488 helpsvc - ok 20:21:53.0515 5488 HidServ (deb04da35cc871b6d309b77e1443c796) C:\WINDOWS\System32\hidserv.dll 20:21:53.0515 5488 HidServ - ok 20:21:53.0546 5488 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 20:21:53.0546 5488 HidUsb - ok 20:21:53.0578 5488 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll 20:21:53.0578 5488 hkmsvc - ok 20:21:53.0578 5488 hpn - ok 20:21:53.0578 5488 hpt3xx - ok 20:21:53.0625 5488 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 20:21:53.0625 5488 HTTP - ok 20:21:53.0671 5488 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll 20:21:53.0687 5488 HTTPFilter - ok 20:21:53.0687 5488 i2omgmt - ok 20:21:53.0703 5488 i2omp - ok 20:21:53.0734 5488 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 20:21:53.0734 5488 i8042prt - ok 20:21:53.0875 5488 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 20:21:53.0890 5488 idsvc - ok 20:21:54.0093 5488 IDSxpx86 (eeebf3616db90124c1c57019d39aa9a2) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20120704.001\IDSxpx86.sys 20:21:54.0109 5488 IDSxpx86 - ok 20:21:54.0203 5488 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 20:21:54.0203 5488 Imapi - ok 20:21:54.0265 5488 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\System32\imapi.exe 20:21:54.0265 5488 ImapiService - ok 20:21:54.0296 5488 ini910u - ok 20:21:54.0625 5488 IntcAzAudAddService (41bb402c2ade27b32439bb765864ab3b) C:\WINDOWS\system32\drivers\RtkHDAud.sys 20:21:55.0218 5488 IntcAzAudAddService - ok 20:21:55.0296 5488 IntelIde - ok 20:21:55.0437 5488 IntuitUpdateService (3dc635b66dd7412e1c9c3a77b8d78f25) C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe 20:21:55.0437 5488 IntuitUpdateService - ok 20:21:55.0453 5488 IntuitUpdateServiceV4 (1663a135865f0ba6e853353e98e67f2a) C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe 20:21:55.0453 5488 IntuitUpdateServiceV4 - ok 20:21:55.0484 5488 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys 20:21:55.0484 5488 ip6fw - ok 20:21:55.0515 5488 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 20:21:55.0515 5488 IpFilterDriver - ok 20:21:55.0546 5488 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 20:21:55.0546 5488 IpInIp - ok 20:21:55.0578 5488 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 20:21:55.0578 5488 IpNat - ok 20:21:55.0671 5488 iPod Service (49918803b661367023bf325cf602afdc) C:\Program Files\iPod\bin\iPodService.exe 20:21:55.0687 5488 iPod Service - ok 20:21:55.0718 5488 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 20:21:55.0734 5488 IPSec - ok 20:21:55.0765 5488 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 20:21:55.0765 5488 IRENUM - ok 20:21:55.0781 5488 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 20:21:55.0781 5488 isapnp - ok 20:21:55.0812 5488 ISODisk (96f2f5884d02535e2d4dfc849836f4a6) C:\WINDOWS\system32\drivers\ISODisk.sys 20:21:55.0812 5488 ISODisk - ok 20:21:55.0843 5488 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 20:21:55.0843 5488 Kbdclass - ok 20:21:55.0859 5488 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 20:21:55.0859 5488 kbdhid - ok 20:21:55.0906 5488 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 20:21:55.0906 5488 kmixer - ok 20:21:55.0937 5488 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 20:21:55.0937 5488 KSecDD - ok 20:21:55.0968 5488 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll 20:21:55.0968 5488 lanmanserver - ok 20:21:56.0015 5488 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll 20:21:56.0015 5488 lanmanworkstation - ok 20:21:56.0046 5488 Lbd (52320254d74ea11b6f129e7df1016975) C:\WINDOWS\system32\DRIVERS\Lbd.sys 20:21:56.0046 5488 Lbd - ok 20:21:56.0078 5488 lbrtfdc - ok 20:21:56.0187 5488 LightScribeService (c34411a244029f1c08687f7c752c4563) C:\Program Files\Common Files\LightScribe\LSSrvc.exe 20:21:56.0203 5488 LightScribeService - ok 20:21:56.0265 5488 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll 20:21:56.0265 5488 LmHosts - ok 20:21:56.0312 5488 lvpopflt (f61a8ff029614e403e9d001a6741981f) C:\WINDOWS\system32\DRIVERS\lvpopflt.sys 20:21:56.0312 5488 lvpopflt - ok 20:21:56.0343 5488 LVPr2Mon (8be71d7edb8c7494913722059f760dd0) C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys 20:21:56.0343 5488 LVPr2Mon - ok 20:21:56.0390 5488 LVPrcSrv (2333057542c91ae8228bdccc2e5f2632) C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe 20:21:56.0406 5488 LVPrcSrv - ok 20:21:56.0437 5488 LVRS (f01fc94eb8f39f7d6e5f5b367473381e) C:\WINDOWS\system32\DRIVERS\lvrs.sys 20:21:56.0453 5488 LVRS - ok 20:21:56.0859 5488 LVUVC (caffd79278b3d8fe75fdfe1b66c2565f) C:\WINDOWS\system32\DRIVERS\lvuvc.sys 20:21:57.0000 5488 LVUVC - ok 20:21:57.0109 5488 MarvinBus (d51e16339213898bc20c58670274ec3e) C:\WINDOWS\system32\DRIVERS\MarvinBus.sys 20:21:57.0109 5488 MarvinBus - ok 20:21:57.0140 5488 MAUSBMIDI (69bc2b743d723d1923fce50eb68003cb) C:\WINDOWS\system32\DRIVERS\MAudioUSBMIDI.sys 20:21:57.0156 5488 MAUSBMIDI - ok 20:21:57.0171 5488 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll 20:21:57.0171 5488 Messenger - ok 20:21:57.0218 5488 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 20:21:57.0218 5488 mnmdd - ok 20:21:57.0265 5488 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\System32\mnmsrvc.exe 20:21:57.0265 5488 mnmsrvc - ok 20:21:57.0281 5488 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 20:21:57.0281 5488 Modem - ok 20:21:57.0312 5488 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 20:21:57.0312 5488 Mouclass - ok 20:21:57.0343 5488 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 20:21:57.0343 5488 mouhid - ok 20:21:57.0359 5488 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 20:21:57.0359 5488 MountMgr - ok 20:21:57.0375 5488 MPE (c0f8e0c2c3c0437cf37c6781896dc3ec) C:\WINDOWS\system32\DRIVERS\MPE.sys 20:21:57.0390 5488 MPE - ok 20:21:57.0390 5488 mraid35x - ok 20:21:57.0406 5488 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 20:21:57.0406 5488 MRxDAV - ok 20:21:57.0468 5488 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 20:21:57.0484 5488 MRxSmb - ok 20:21:57.0515 5488 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\System32\msdtc.exe 20:21:57.0515 5488 MSDTC - ok 20:21:57.0562 5488 MSDV (1477849772712bac69c144dcf2c9ce81) C:\WINDOWS\system32\DRIVERS\msdv.sys 20:21:57.0562 5488 MSDV - ok 20:21:57.0578 5488 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 20:21:57.0578 5488 Msfs - ok 20:21:57.0609 5488 MSIServer - ok 20:21:57.0640 5488 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 20:21:57.0640 5488 MSKSSRV - ok 20:21:57.0687 5488 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 20:21:57.0687 5488 MSPCLOCK - ok 20:21:57.0687 5488 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 20:21:57.0703 5488 MSPQM - ok 20:21:57.0718 5488 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 20:21:57.0718 5488 mssmbios - ok 20:21:57.0734 5488 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys 20:21:57.0750 5488 MSTEE - ok 20:21:57.0781 5488 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys 20:21:57.0781 5488 Mup - ok 20:21:57.0890 5488 N360 (e78a365cc3e0fbfc018a33dce01909f8) C:\Program Files\Norton Security Suite\Engine\5.2.1.3\ccSvcHst.exe 20:21:57.0890 5488 N360 - ok 20:21:57.0953 5488 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 20:21:57.0953 5488 NABTSFEC - ok 20:21:57.0984 5488 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll 20:21:58.0015 5488 napagent - ok 20:21:58.0109 5488 NAUpdate (7f79da9e719d0774bdbc3622abd3afd9) C:\Program Files\Nero\Update\NASvc.exe 20:21:58.0125 5488 NAUpdate - ok 20:21:58.0343 5488 NAVENG (f11033730b38260b6892e837c457fb4b) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20120704.017\NAVENG.SYS 20:21:58.0343 5488 NAVENG - ok 20:21:58.0437 5488 NAVEX15 (4e4e7c0259d3bb97de24a636c0e06aba) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20120704.017\NAVEX15.SYS 20:21:58.0484 5488 NAVEX15 - ok 20:21:58.0593 5488 NBVol (e240f3204e86b7b6ccf266b2a2ad32b4) C:\WINDOWS\system32\DRIVERS\NBVol.sys 20:21:58.0593 5488 NBVol - ok 20:21:58.0609 5488 NBVolUp (c0cf3cccce3c75f7280c89029ab47866) C:\WINDOWS\system32\DRIVERS\NBVolUp.sys 20:21:58.0609 5488 NBVolUp - ok 20:21:58.0656 5488 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 20:21:58.0656 5488 NDIS - ok 20:21:58.0703 5488 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys 20:21:58.0703 5488 NdisIP - ok 20:21:58.0734 5488 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 20:21:58.0734 5488 NdisTapi - ok 20:21:58.0765 5488 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 20:21:58.0765 5488 Ndisuio - ok 20:21:58.0781 5488 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 20:21:58.0781 5488 NdisWan - ok 20:21:58.0828 5488 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys 20:21:58.0828 5488 NDProxy - ok 20:21:58.0843 5488 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 20:21:58.0843 5488 NetBIOS - ok 20:21:58.0890 5488 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 20:21:58.0890 5488 NetBT - ok 20:21:58.0921 5488 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 20:21:58.0937 5488 NetDDE - ok 20:21:58.0937 5488 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 20:21:58.0937 5488 NetDDEdsdm - ok 20:21:58.0968 5488 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\System32\lsass.exe 20:21:58.0984 5488 Netlogon - ok 20:21:59.0031 5488 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll 20:21:59.0031 5488 Netman - ok 20:21:59.0109 5488 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 20:21:59.0109 5488 NetTcpPortSharing - ok 20:21:59.0140 5488 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys 20:21:59.0156 5488 NIC1394 - ok 20:21:59.0203 5488 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll 20:21:59.0218 5488 Nla - ok 20:21:59.0281 5488 NMIndexingService - ok 20:21:59.0390 5488 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 20:21:59.0390 5488 Npfs - ok 20:21:59.0453 5488 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 20:21:59.0562 5488 Ntfs - ok 20:21:59.0625 5488 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\System32\lsass.exe 20:21:59.0625 5488 NtLmSsp - ok 20:21:59.0671 5488 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll 20:21:59.0703 5488 NtmsSvc - ok 20:21:59.0734 5488 NuidFltr (cf7e041663119e09d2e118521ada9300) C:\WINDOWS\system32\DRIVERS\NuidFltr.sys 20:21:59.0750 5488 NuidFltr - ok 20:21:59.0781 5488 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 20:21:59.0781 5488 Null - ok 20:21:59.0812 5488 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 20:21:59.0812 5488 NwlnkFlt - ok 20:21:59.0812 5488 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 20:21:59.0812 5488 NwlnkFwd - ok 20:21:59.0890 5488 odserv (e54aa592a65f317390eee386a8821692) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 20:21:59.0921 5488 odserv - ok 20:21:59.0968 5488 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys 20:21:59.0968 5488 ohci1394 - ok 20:22:00.0015 5488 ose (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 20:22:00.0015 5488 ose - ok 20:22:00.0062 5488 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys 20:22:00.0062 5488 Parport - ok 20:22:00.0078 5488 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 20:22:00.0078 5488 PartMgr - ok 20:22:00.0093 5488 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 20:22:00.0093 5488 ParVdm - ok 20:22:00.0140 5488 PbsAuDrv (2b3987963f155064fa68061e33b4b1b0) C:\WINDOWS\system32\drivers\pbsaudrv.sys 20:22:00.0140 5488 PbsAuDrv - ok 20:22:00.0171 5488 pccsmcfd (175cc28dcf819f78caa3fbd44ad9e52a) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys 20:22:00.0171 5488 pccsmcfd - ok 20:22:00.0187 5488 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 20:22:00.0203 5488 PCI - ok 20:22:00.0203 5488 PCIDump - ok 20:22:00.0218 5488 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 20:22:00.0218 5488 PCIIde - ok 20:22:00.0250 5488 PCLEPCI (1bebe7de8508a02650cdce45c664c2a2) C:\WINDOWS\system32\drivers\pclepci.sys 20:22:00.0250 5488 PCLEPCI - ok 20:22:00.0296 5488 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 20:22:00.0296 5488 Pcmcia - ok 20:22:00.0296 5488 PDCOMP - ok 20:22:00.0312 5488 PDFRAME - ok 20:22:00.0312 5488 PDRELI - ok 20:22:00.0312 5488 PDRFRAME - ok 20:22:00.0390 5488 perc2 - ok 20:22:00.0500 5488 perc2hib - ok 20:22:00.0562 5488 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 20:22:00.0562 5488 PlugPlay - ok 20:22:00.0640 5488 Pml Driver HPZ12 (2d091a99624fb9e7eef0a86d872ec0c3) C:\WINDOWS\system32\HPZipm12.exe 20:22:00.0640 5488 Pml Driver HPZ12 - ok 20:22:00.0687 5488 Point32 (dcdf0421a1c14f2923e298a30fd7636d) C:\WINDOWS\system32\DRIVERS\point32.sys 20:22:00.0687 5488 Point32 - ok 20:22:00.0734 5488 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\System32\lsass.exe 20:22:00.0734 5488 PolicyAgent - ok 20:22:00.0765 5488 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 20:22:00.0765 5488 PptpMiniport - ok 20:22:00.0781 5488 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys 20:22:00.0781 5488 Processor - ok 20:22:00.0781 5488 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 20:22:00.0781 5488 ProtectedStorage - ok 20:22:00.0796 5488 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 20:22:00.0796 5488 PSched - ok 20:22:00.0859 5488 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 20:22:00.0859 5488 Ptilink - ok 20:22:00.0906 5488 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\WINDOWS\system32\Drivers\PxHelp20.sys 20:22:00.0906 5488 PxHelp20 - ok 20:22:00.0906 5488 ql1080 - ok 20:22:00.0921 5488 Ql10wnt - ok 20:22:00.0921 5488 ql12160 - ok 20:22:00.0937 5488 ql1240 - ok 20:22:00.0937 5488 ql1280 - ok 20:22:00.0953 5488 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 20:22:00.0968 5488 RasAcd - ok 20:22:01.0000 5488 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll 20:22:01.0000 5488 RasAuto - ok 20:22:01.0015 5488 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 20:22:01.0015 5488 Rasl2tp - ok 20:22:01.0078 5488 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll 20:22:01.0078 5488 RasMan - ok 20:22:01.0093 5488 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 20:22:01.0093 5488 RasPppoe - ok 20:22:01.0125 5488 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 20:22:01.0125 5488 Raspti - ok 20:22:01.0140 5488 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 20:22:01.0140 5488 Rdbss - ok 20:22:01.0171 5488 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 20:22:01.0171 5488 RDPCDD - ok 20:22:01.0203 5488 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 20:22:01.0218 5488 rdpdr - ok 20:22:01.0250 5488 RDPWD (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys 20:22:01.0265 5488 RDPWD - ok 20:22:01.0296 5488 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe 20:22:01.0296 5488 RDSessMgr - ok 20:22:01.0328 5488 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 20:22:01.0343 5488 redbook - ok 20:22:01.0375 5488 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll 20:22:01.0375 5488 RemoteAccess - ok 20:22:01.0437 5488 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll 20:22:01.0437 5488 RemoteRegistry - ok 20:22:01.0546 5488 Roxio UPnP Renderer 11 (805393d80291c53085bce10868e54ad5) C:\Program Files\Roxio Creator 2009 Special Edition\Digital Home 11\RoxioUPnPRenderer11.exe 20:22:01.0593 5488 Roxio UPnP Renderer 11 - ok 20:22:01.0609 5488 Roxio Upnp Server 11 (96a3d9197f4d8a7e456018b809bf2ac1) C:\Program Files\Roxio Creator 2009 Special Edition\Digital Home 11\RoxioUpnpService11.exe 20:22:01.0625 5488 Roxio Upnp Server 11 - ok 20:22:01.0734 5488 RoxLiveShare11 (8af842f4c84bdaa882216a01f8825402) C:\Program Files\Common Files\Roxio Shared\11.0\SharedCOM\RoxLiveShare11.exe 20:22:01.0750 5488 RoxLiveShare11 - ok 20:22:01.0843 5488 RoxMediaDB11 (c6394df3055601b11964b075c811f03c) C:\Program Files\Common Files\Roxio Shared\11.0\SharedCOM\RoxMediaDB11.exe 20:22:01.0890 5488 RoxMediaDB11 - ok 20:22:01.0937 5488 RoxWatch11 (3e8df3dd655cce064cf952066ddff248) C:\Program Files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatch11.exe 20:22:01.0937 5488 RoxWatch11 - ok 20:22:02.0062 5488 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\System32\locator.exe 20:22:02.0062 5488 RpcLocator - ok 20:22:02.0140 5488 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll 20:22:02.0140 5488 RpcSs - ok 20:22:02.0187 5488 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\System32\rsvp.exe 20:22:02.0203 5488 RSVP - ok 20:22:02.0296 5488 RTLE8023xp (3400495f5b219d5153c770a95499579c) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys 20:22:02.0296 5488 RTLE8023xp - ok 20:22:02.0359 5488 RxFilter (0501074a2f29250932e34ca4a844a0f5) C:\WINDOWS\system32\DRIVERS\RxFilter.sys 20:22:02.0375 5488 RxFilter - ok 20:22:02.0406 5488 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 20:22:02.0406 5488 SamSs - ok 20:22:02.0468 5488 SANDRA (230fd3749904ca045ea5ec0aa14006e9) C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010c\WNt500x86\Sandra.sys 20:22:02.0468 5488 SANDRA - ok 20:22:02.0484 5488 SandraAgentSrv (6e72b22d71a62b7c9162361e5fd0de9d) C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2010c\RpcAgentSrv.exe 20:22:02.0484 5488 SandraAgentSrv - ok 20:22:02.0515 5488 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe 20:22:02.0515 5488 SCardSvr - ok 20:22:02.0562 5488 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll 20:22:02.0578 5488 Schedule - ok 20:22:02.0671 5488 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 20:22:02.0671 5488 Secdrv - ok 20:22:02.0703 5488 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll 20:22:02.0703 5488 seclogon - ok 20:22:02.0734 5488 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll 20:22:02.0734 5488 SENS - ok 20:22:02.0781 5488 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys 20:22:02.0781 5488 serenum - ok 20:22:02.0796 5488 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys 20:22:02.0796 5488 Serial - ok 20:22:02.0859 5488 ServiceLayer (9d38320bb32230349379df5ddbbf7fce) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe 20:22:02.0890 5488 ServiceLayer - ok 20:22:02.0953 5488 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 20:22:02.0953 5488 Sfloppy - ok 20:22:03.0015 5488 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll 20:22:03.0046 5488 SharedAccess - ok 20:22:03.0078 5488 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 20:22:03.0078 5488 ShellHWDetection - ok 20:22:03.0125 5488 Si3132r5 (f6dd3f9474afd65acd4861f57d40b8ab) C:\WINDOWS\system32\DRIVERS\Si3132r5.sys 20:22:03.0140 5488 Si3132r5 - ok 20:22:03.0140 5488 SiFilter (e853c341bbf4ac0007a8db0858dbb09d) C:\WINDOWS\system32\DRIVERS\SiWinAcc.sys 20:22:03.0140 5488 SiFilter - ok 20:22:03.0140 5488 Simbad - ok 20:22:03.0156 5488 SiRemFil (d80e6f142eb4963e82a8537dd745f51b) C:\WINDOWS\system32\DRIVERS\SiRemFil.sys 20:22:03.0156 5488 SiRemFil - ok 20:22:03.0187 5488 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys 20:22:03.0187 5488 SLIP - ok 20:22:03.0203 5488 Sparrow - ok 20:22:03.0515 5488 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 20:22:03.0515 5488 splitter - ok 20:22:03.0546 5488 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe 20:22:03.0546 5488 Spooler - ok 20:22:03.0578 5488 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 20:22:03.0578 5488 sr - ok 20:22:03.0640 5488 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\System32\srsvc.dll 20:22:03.0656 5488 srservice - ok 20:22:03.0750 5488 SRTSP (83726cf02eced69138948083e06b6eac) C:\WINDOWS\System32\Drivers\N360\0502010.003\SRTSP.SYS 20:22:03.0781 5488 SRTSP - ok 20:22:03.0828 5488 SRTSPX (4e7eab2e5615d39cf1f1df9c71e5e225) C:\WINDOWS\system32\drivers\N360\0502010.003\SRTSPX.SYS 20:22:03.0843 5488 SRTSPX - ok 20:22:03.0890 5488 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys 20:22:03.0906 5488 Srv - ok 20:22:03.0921 5488 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll 20:22:03.0937 5488 SSDPSRV - ok 20:22:03.0953 5488 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys 20:22:03.0953 5488 StillCam - ok 20:22:04.0015 5488 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll 20:22:04.0062 5488 stisvc - ok 20:22:04.0156 5488 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys 20:22:04.0156 5488 streamip - ok 20:22:04.0484 5488 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 20:22:04.0500 5488 swenum - ok 20:22:04.0500 5488 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 20:22:04.0500 5488 swmidi - ok 20:22:04.0515 5488 SwPrv - ok 20:22:04.0515 5488 symc810 - ok 20:22:04.0515 5488 symc8xx - ok 20:22:04.0578 5488 SymDS (9bbeb8c6258e72d62e7560e6667aad39) C:\WINDOWS\system32\drivers\N360\0502010.003\SYMDS.SYS 20:22:04.0593 5488 SymDS - ok 20:22:04.0703 5488 SymEFA (d5c02629c02a820a7e71bca3d44294a3) C:\WINDOWS\system32\drivers\N360\0502010.003\SYMEFA.SYS 20:22:04.0734 5488 SymEFA - ok 20:22:04.0781 5488 SymEvent (ab33c3b196197ca467cbdda717860dba) C:\WINDOWS\system32\Drivers\SYMEVENT.SYS 20:22:04.0781 5488 SymEvent - ok 20:22:04.0812 5488 SymIM (94a2459242a6dd0daf3baa99e96784ff) C:\WINDOWS\system32\DRIVERS\SymIM.sys 20:22:04.0828 5488 SymIM - ok 20:22:04.0828 5488 SymIMMP (94a2459242a6dd0daf3baa99e96784ff) C:\WINDOWS\system32\DRIVERS\SymIM.sys 20:22:04.0828 5488 SymIMMP - ok 20:22:04.0859 5488 SymIRON (a73399804d5d4a8b20ba60fcf70c9f1f) C:\WINDOWS\system32\drivers\N360\0502010.003\Ironx86.SYS 20:22:04.0875 5488 SymIRON - ok 20:22:04.0937 5488 SYMTDI (336cace58f0359d5cbb1ae6b8a2fb205) C:\WINDOWS\System32\Drivers\N360\0502010.003\SYMTDI.SYS 20:22:04.0937 5488 SYMTDI - ok 20:22:04.0937 5488 sym_hi - ok 20:22:04.0953 5488 sym_u3 - ok 20:22:04.0968 5488 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 20:22:04.0968 5488 sysaudio - ok 20:22:05.0000 5488 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe 20:22:05.0000 5488 SysmonLog - ok 20:22:05.0046 5488 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll 20:22:05.0046 5488 TapiSrv - ok 20:22:05.0125 5488 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 20:22:05.0125 5488 Tcpip - ok 20:22:05.0156 5488 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 20:22:05.0156 5488 TDPIPE - ok 20:22:05.0171 5488 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 20:22:05.0171 5488 TDTCP - ok 20:22:05.0203 5488 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 20:22:05.0203 5488 TermDD - ok 20:22:05.0250 5488 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll 20:22:05.0250 5488 TermService - ok 20:22:05.0312 5488 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 20:22:05.0312 5488 Themes - ok 20:22:05.0375 5488 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\System32\tlntsvr.exe 20:22:05.0375 5488 TlntSvr - ok 20:22:05.0390 5488 TosIde - ok 20:22:05.0421 5488 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll 20:22:05.0421 5488 TrkWks - ok 20:22:05.0468 5488 TVICHW32 (e266683fc95abdec17cd378564e1b54b) C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS 20:22:05.0468 5488 TVICHW32 - ok 20:22:05.0500 5488 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 20:22:05.0500 5488 Udfs - ok 20:22:05.0500 5488 ultra - ok 20:22:05.0562 5488 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 20:22:05.0578 5488 Update - ok 20:22:05.0609 5488 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll 20:22:05.0625 5488 upnphost - ok 20:22:05.0640 5488 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe 20:22:05.0640 5488 UPS - ok 20:22:05.0703 5488 USB28xxBGA (f0e0bd77c255c95d317cd69c2e8efb92) C:\WINDOWS\system32\DRIVERS\emBDA.sys 20:22:05.0718 5488 USB28xxBGA - ok 20:22:05.0750 5488 USB28xxOEM (925e82ffe06a37799e5cb486528ed835) C:\WINDOWS\system32\DRIVERS\emOEM.sys 20:22:05.0750 5488 USB28xxOEM - ok 20:22:05.0765 5488 USBAAPL (83cafcb53201bbac04d822f32438e244) C:\WINDOWS\system32\Drivers\usbaapl.sys 20:22:05.0781 5488 USBAAPL - ok 20:22:05.0843 5488 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys 20:22:05.0843 5488 usbaudio - ok 20:22:05.0875 5488 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 20:22:05.0875 5488 usbccgp - ok 20:22:05.0906 5488 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 20:22:05.0906 5488 usbehci - ok 20:22:05.0937 5488 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 20:22:05.0953 5488 usbhub - ok 20:22:06.0125 5488 USBMIDIAudioDevMon (8d557006bb327c29cdd6a01ba49e0e4e) C:\Program Files\M-Audio\USB MIDI Series\AudioDevMon.exe 20:22:06.0156 5488 USBMIDIAudioDevMon - ok 20:22:06.0281 5488 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys 20:22:06.0281 5488 usbohci - ok 20:22:06.0328 5488 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 20:22:06.0328 5488 usbscan - ok 20:22:06.0359 5488 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 20:22:06.0359 5488 USBSTOR - ok 20:22:06.0406 5488 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys 20:22:06.0406 5488 usbvideo - ok 20:22:06.0421 5488 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 20:22:06.0421 5488 VgaSave - ok 20:22:06.0437 5488 ViaIde - ok 20:22:06.0453 5488 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 20:22:06.0453 5488 VolSnap - ok 20:22:06.0515 5488 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe 20:22:06.0546 5488 VSS - ok 20:22:06.0593 5488 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\System32\w32time.dll 20:22:06.0593 5488 W32Time - ok 20:22:06.0640 5488 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 20:22:06.0640 5488 Wanarp - ok 20:22:06.0687 5488 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys 20:22:06.0703 5488 Wdf01000 - ok 20:22:06.0703 5488 WDICA - ok 20:22:06.0750 5488 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 20:22:06.0750 5488 wdmaud - ok 20:22:06.0781 5488 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll 20:22:06.0781 5488 WebClient - ok 20:22:06.0859 5488 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll 20:22:06.0859 5488 winmgmt - ok 20:22:06.0921 5488 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll 20:22:06.0921 5488 WmdmPmSN - ok 20:22:06.0968 5488 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll 20:22:07.0015 5488 Wmi - ok 20:22:07.0062 5488 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys 20:22:07.0062 5488 WmiAcpi - ok 20:22:07.0093 5488 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\System32\wbem\wmiapsrv.exe 20:22:07.0093 5488 WmiApSrv - ok 20:22:07.0218 5488 WMPNetworkSvc (f74e3d9a7fa9556c3bbb14d4e5e63d3b) C:\Program Files\Windows Media Player\WMPNetwk.exe 20:22:07.0234 5488 WMPNetworkSvc - ok 20:22:07.0265 5488 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\Drivers\wpdusb.sys 20:22:07.0265 5488 WpdUsb - ok 20:22:07.0421 5488 WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe 20:22:07.0468 5488 WPFFontCache_v0400 - ok 20:22:07.0515 5488 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll 20:22:07.0515 5488 wscsvc - ok 20:22:07.0531 5488 WSearch - ok 20:22:07.0593 5488 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 20:22:07.0593 5488 WSTCODEC - ok 20:22:07.0625 5488 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll 20:22:07.0625 5488 wuauserv - ok 20:22:07.0656 5488 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 20:22:07.0656 5488 WudfPf - ok 20:22:07.0671 5488 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 20:22:07.0671 5488 WudfRd - ok 20:22:07.0687 5488 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll 20:22:07.0703 5488 WudfSvc - ok 20:22:07.0765 5488 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll 20:22:07.0812 5488 WZCSVC - ok 20:22:07.0875 5488 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll 20:22:07.0937 5488 xmlprov - ok 20:22:07.0968 5488 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0 20:22:08.0000 5488 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected 20:22:08.0000 5488 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0) 20:22:08.0000 5488 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR1 20:22:08.0578 5488 \Device\Harddisk1\DR1 - ok 20:22:08.0578 5488 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk2\DR2 20:22:08.0593 5488 \Device\Harddisk2\DR2 - ok 20:22:08.0609 5488 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk3\DR3 20:22:08.0609 5488 \Device\Harddisk3\DR3 - ok 20:22:08.0609 5488 Boot (0x1200) (4cf63c071e281c71f3360137650e9ee6) \Device\Harddisk0\DR0\Partition0 20:22:08.0609 5488 \Device\Harddisk0\DR0\Partition0 - ok 20:22:08.0609 5488 Boot (0x1200) (c2366330f36391bb85f943d0d33fe9ca) \Device\Harddisk1\DR1\Partition0 20:22:08.0609 5488 \Device\Harddisk1\DR1\Partition0 - ok 20:22:08.0625 5488 Boot (0x1200) (a44295230c675fe626b33cd2f1d175fa) \Device\Harddisk2\DR2\Partition0 20:22:08.0625 5488 \Device\Harddisk2\DR2\Partition0 - ok 20:22:08.0625 5488 ============================================================ 20:22:08.0625 5488 Scan finished 20:22:08.0625 5488 ============================================================ 20:22:08.0640 4868 Detected object count: 1 20:22:08.0640 4868 Actual detected object count: 1 20:22:22.0296 4868 \Device\Harddisk0\DR0\# - copied to quarantine 20:22:22.0296 4868 \Device\Harddisk0\DR0 - copied to quarantine 20:22:22.0531 4868 \Device\Harddisk0\DR0\TDLFS\ldrm - copied to quarantine 20:22:22.0593 4868 \Device\Harddisk0\DR0\TDLFS\cmd.dll - copied to quarantine 20:22:22.0593 4868 \Device\Harddisk0\DR0\TDLFS\cmd64.dll - copied to quarantine 20:22:22.0609 4868 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine 20:22:22.0625 4868 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine 20:22:22.0625 4868 \Device\Harddisk0\DR0\TDLFS\servers.dat - copied to quarantine 20:22:22.0625 4868 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine 20:22:22.0625 4868 \Device\Harddisk0\DR0\TDLFS\ldr16 - copied to quarantine 20:22:22.0640 4868 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine 20:22:22.0640 4868 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine 20:22:22.0687 4868 \Device\Harddisk0\DR0\TDLFS\s - copied to quarantine 20:22:22.0687 4868 \Device\Harddisk0\DR0\TDLFS\u - copied to quarantine 20:22:22.0703 4868 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine 20:22:22.0718 4868 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - will be cured on reboot 20:22:22.0718 4868 \Device\Harddisk0\DR0 - ok 20:22:28.0343 4868 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Cure 20:22:35.0250 2184 Deinitialize success

Have a look on the C drive, it should be something like C:/tdsskiller + time and date

You found it, post the OTL logs next.

My last post for tonight.



Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• See this Link for programs that need to be disabled and instruction on how to disable them.
• Remember to re-enable them when we're done.
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Mowman, Problems here. History: Ran combo fix per instructions Recovery console was not installed, so I was given the choice to install before. I chose Yes, and agreed to the EULA. Watched the progress bars for downloading. Got the screen that Congrats, the recovery console was successfully installed, click yes to continue scanning. Clicked yes, and stayed for a few of the Stages as they showed completed on screen, then walked away for coffee. Came back, my system was at the XP login screen, so I logged in. When the system finished booting, there was a dialog box: Title: Microsoft Windows Text (paraphrased): The system has recovered from a serious error. Please tell Microsoft about this problem. I chose to send it to my buds in Redmond When it was done sending the results to Redmond, I looked for the log file, which was not in the root dir. Also, did a search for it on all hard drives, and no luck. So I ran combofix again. Again, it reported that the recovery console needed to be installed. Again, I chose yes, got the success dialog, chose continue to scan. Then waited, and watched as the stages completed, through 50. Then, after successfully completing Stage 50, there was a line space, then something flashed on screen for a half second (I couldn't read), then the system rebooted. Saw the 2 second pause to decide whether to go into the management console, or continue to load xp. I let it go to normal boot (XP) Once logged in, I got the same error dialog box. This time, I took notes. When it asked me to click to obtain more data, I chose yes.Here's what it said: BCCode:100000c5; BCP1: 00000004; BCP2: 00000002; BCP3: 0000001; BCP4: 8054BFD2; OS Ver: 5_1_2600; SP: 3.0; Product: 256_1. Then there was a "for more tech data, click here: I did, and got this: C\DOCUME~1\Steven\Locals!1\Temp\WER2b1f.dir00\mini1070512-02.dmp C:\DOCUME~1\Steven\Locals!1\Temp\WER2b1f.dir00\sysdata.xml. Again, no combofix to be found, on any of my hard drives. Some symptoms seem to have gone. Haven't heard the random audio in a while, and I don't have a svchost.exe that keeps climbing in memory or CPU. Thanks! Steve

Please download Malwarebytes Free from Here or Here

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
  [external image: Posted Image]
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected .
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Post the log please














Next

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
• Click the [external image: Posted Image] button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the [external image: Posted Image] icon on your desktop.
• Check [external image: Posted Image]
• Click the Start button.
• Accept any security warnings from your browser.
• Check [external image: Posted Image]
• Make sure that the option "Remove found threats" is not checked
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin
  scanning your computer. Please be patient as this can take some time.
• When the scan completes, push [external image: Posted Image]
• Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
  ESETScan. Include the contents of this report in your next reply.
• Push the Back button.
• Push Finish

http://www.eset.com/onlinescan/





Also tell me how the computer is running now.

System is getting more reliable: I have played videos with sound, and I haven't heard the random audio from whereever popping in for a few seconds, since I ran the tds Also, since the tds, I have not had the one svchost that climbs in mem and cpu usage when idle. So these symptoms seem to be resolved for the moment. Concerning that the malwarebytes found additional issues. I will do the eset when I come back from work tonight, but here is the malwarebytes log. Thanks again for your time and guidance. Steve Malwarebytes Anti-Malware (Trial) 1.61.0.1400 www.malwarebytes.org Database version: v2012.07.06.05 Windows XP Service Pack 3 x86 NTFS Internet Explorer 7.0.5730.13 Steven :: STEVEN-08 [administrator] Protection: Enabled 7/6/2012 7:51:22 AM mbam-log-2012-07-06 (07-51-22).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 274725 Time elapsed: 11 minute(s), 38 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 6 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{597A9974-8CB0-4F41-B61F-ED065738A397} (PUP.RewardsArcade) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{597A9974-8CB0-4F41-B61F-ED065738A397} (PUP.RewardsArcade) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{97E74A14-E5F1-40CC-9B0F-0D11946E5469} (PUP.MightyMagoo) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{97E74A14-E5F1-40CC-9B0F-0D11946E5469} (PUP.MightyMagoo) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEAD004E-7E2D-49F8-831C-A01647E85B53} (PUP.MightyMagoo) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEAD004E-7E2D-49F8-831C-A01647E85B53} (PUP.MightyMagoo) -> Quarantined and deleted successfully. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\WINDOWS\system32\3D7RFGuT.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully. (end)

Those files are quarantined by tdsskiller so if you right click on its icon and select delete they will be removed.

You appear clean of infections,please do the following.



ComboFix - Cleanup
Time for some housekeeping

• Click Start…select Run from the menu.
• Copy and paste the following into the text entry box:
  Combofix /Uninstall
• Click the OK button. (See image below as reference.)

🖼Click to load external image (Posted Image)









Clean up with OTL:

• Double-click OTL.exe to start the program.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CLEANUP button
• Say Yes to the prompt and then allow the program to reboot your computer.

Here are some recommendations to help you stay clean.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/



Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

• So How did I get infected?
• Miekies' prevention suggestions
• Hardening Windows Security - Part 1 & Part 2.

• Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.


Thats it you are good to go.Safe surfing

Mowman, Many thanks. All seems to be proper now. Am still reviewing the safe practices in your last post, and updating accordingly, but all signs / symptoms are cleared at this time. While of course, all of these programs that I ran are freely available for download, knowing how to run and in what order to run these is knowledge that I appreciate. Thanks again!