Spyware / Malware / Virus Removal

Google Redirect [Closed]

5 min read

Looking for the outcome? Ask AI

Gliq.Info Topic Starter

Post #1July 18, 2012, 4:57 PM UTC last edited July 19, 2012, 11:23 AM UTC

To those it concerns…

Malwarebytes did not remove an intruder. I used the latest version yesterday with quick and full scans.
Eset Antivirus 5.x also did not remove the intruder.

I will be a able to email a link to a moderater of this forum where the virus can be downloaded, if requested.

I launched the .exe malware/virus from an email but I never clicked that link to see if the site was valid.
The name of the .exe file was "webroot.exe"

Link not allowed

I've just posted that I have a new variant of Windows Security Center virus/malware.

Now I've found that, although I had no Google whatsoever yesterday, I have the Google Redirect problem where I am always directed to a website that will infect my computer with a virus.

Tomk

Post #2July 19, 2012, 3:24 PM UTC

Hi Gliq.Info,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

I need to see a log in order to try to determine what is going on.

Please download DDS by sUBs from one of the following links and save it to your desktop.

- DDS.scr
- DDS.pif
Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt report in your next reply
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

Gliq.Info

Post #3July 19, 2012, 5:51 PM UTC

Tom,

Here is the DDS.txt Post:

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_31
Run by [removed] at 11:57:39 on 2012-07-18
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.1580 [GMT -4:00]
.
AV: ESET NOD32 Antivirus 5.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
C:\WINDOWS\system32\cypherixsrv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Memeo\AutoBackup\MemeoBackgroundService.exe
C:\Program Files\BUFFALO\NASNAVI\nassvc.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Roxio 2010\5.0\CPMonitor.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Pure Networks\Network Magic\nmapp.exe
C:\Program Files\Brownie\BrstsWnd.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Roxio\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImage\TimounterMonitor.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\NewSoft\Presto! PageManager 8 for EP\PMSpeed.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Eraser\eraser.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\DAP\DAP.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\VxBlockServer.exe
C:\Program Files\Memeo\AutoBackup\MemeoBackup.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe
C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
uSearch Page =
uSearch Bar =
uInternet Settings,ProxyOverride = *.local
mSearchAssistant =
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: SearchPredictObj Class: {389943b0-c3a2-4e69-82cb-8596a84cb3dc} - c:\progra~1\search~1\SEARCH~1.DLL
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: EpicPlay Games: {56e4076b-a42b-4745-ba35-34da8ac4c2f2} - EpicPlay Games
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: SBCONVERT Class: {92a9acf4-9333-43ae-9698-db283326f87f} - c:\program files\speedbit video downloader\tbuac\tbcore3.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: Download Accelerator Plus Integration: {ff6c3cf0-4b15-11d1-abed-709549c10000} - c:\progra~1\dap\DAPIEL~1.DLL
BHO: GrabberObj Class: {ff7c3cf0-4b15-11d1-abed-709549c10000} - c:\program files\speedbit video downloader\tbuac\grabber.dll
TB: SpeedBit Video Downloader: {0329e7d6-6f54-462d-93f6-f5c3118badf2} - c:\program files\speedbit video downloader\tbuac\tbcore3.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [WorkForce 610(Network)] c:\windows\system32\spool\drivers\w32x86\3\e_fatifja.exe /fu "c:\windows\temp\E_S78.tmp" /EF "HKCU"
uRun: [PMSpeed] c:\program files\newsoft\presto! pagemanager 8 for ep\PMSpeed.EXE
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [FAST Defrag]
uRun: [MRC] "c:\program files\pc tune-up\PCTuneUp.exe" /MBRSTART
uRun: [SpeedBitVideoAccelerator] "c:\program files\speedbit video accelerator\VideoAccelerator.exe" /startup
uRun: [Eraser] c:\program files\eraser\eraser.exe -hide
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [ASUS SmartDoctor] c:\program files\asus\smartdoctor\SmartDoctor.exe /start
uRun: [DownloadAccelerator] "c:\program files\dap\DAP.EXE" /STARTUP
uRun: [ApplicationHistory] rundll32.exe "c:\documents and settings\edward\local settings\application data\arcsoft\applicationhistory\gnfni.dll",CreateInstance
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\12.0\sharedcom\RoxWatchTray12.exe"
mRun: [CPMonitor] "c:\program files\roxio 2010\5.0\CPMonitor.exe"
mRun: [EEventManager] c:\progra~1\epsons~1\eventm~1\EEventManager.exe
mRun: [FUFAXSTM] "c:\program files\epson software\fax utility\FUFAXSTM.exe"
mRun: [WrtMon.exe] c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe
mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe"
mRun: [nmapp] "c:\program files\pure networks\network magic\nmapp.exe" -autorun -nosplash
mRun: [BrStsWnd] c:\program files\brownie\BrstsWnd.exe Autorun
mRun: [Omnipage] c:\program files\scansoft\omnipagese\opware32.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Memeo Backup] c:\program files\memeo\autobackup\MemeoLauncher2.exe –silent –no_ui
mRun: [Desktop Disc Tool] "c:\program files\roxio\roxio burn\RoxioBurnLauncher.exe"
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [ASUSGamerOSD] c:\program files\asus\gamerosd\GamerOSD.exe
mRun: [TrueImageMonitor.exe] c:\program files\acronis\trueimage\TrueImageMonitor.exe
mRun: [AcronisTimounterMonitor] c:\program files\acronis\trueimage\TimounterMonitor.exe
mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
StartupFolder: c:\docume~1\edward\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
IE: &Clean Traces - c:\program files\dap\privacy package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\dap\dapextie.htm
IE: Download &all with DAP - c:\program files\dap\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: Free YouTube Download - c:\documents and settings\edward\application data\dvdvideosoftiehelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\documents and settings\edward\application data\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm
IE: {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - c:\program files\paltalk messenger\Paltalk.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\program files\speedbit video accelerator\lsp3.2.2.4\SBLSP.dll
LSP: mswsock.dll
Trusted Zone: aol.com\free
Trusted Zone: cinemanow.com
Trusted Zone: qflix.com
Trusted Zone: roxio.com
Trusted Zone: sonic.com\redirect
Trusted Zone: sonic.com\redirect2
DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.dell.com/systemprofiler/SysPro.CAB
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553530000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Name-Space Handler: ftp\FVLink.IELinkMonitor - {EE4303CB-EA2E-4020-8827-3B0C948BC5C9} - c:\program files\rhinosoft.com\ftp voyager\FVLink.dll
Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\dap\dapie.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Authentication Packages = msv1_0 relog_ap
Hosts: 127.0.0.1 www.spywareinfo.com
Hosts: 192.168.1.104 Gliq-R
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\edward\application data\mozilla\firefox\profiles\yj7bouds.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.ask.com/?l=dis&o=100000018&gct=hp
FF - prefs.js: keyword.URL - hxxp://search.speedbit.com/searchresults.asp?src=default&q=
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\canon\zoombrowser ex\program\NPCIG.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft\web platform installer\NPWPIDetector.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npaudio.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npavi32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npbeatnk.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npdrmv2.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npdsplay.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npnul32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npswf32.dll
FF - plugin: c:\program files\netscape\communicator\program\plugins\npwmsdrm.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_3_300_262.dll
.
============= SERVICES / DRIVERS ===============
.
R0 SahdIa32;HDD Filter Driver;c:\windows\system32\drivers\SahdIa32.sys [2011-2-26 21488]
R0 SaibIa32;Volume Filter Driver;c:\windows\system32\drivers\SaibIa32.sys [2011-2-26 15856]
R1 cyphxdrv;cyphxdrv;c:\windows\system32\drivers\cyphxdrv.sys [2011-3-21 97784]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-9-11 120152]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-9-11 104160]
R1 SaibVd32;Virtual Disk Driver;c:\windows\system32\drivers\SaibVd32.sys [2011-2-26 25584]
R2 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269;Roxio SAIB Service;c:\program files\roxio\backontrack\disaster recovery\SaibSVC.exe [2009-6-2 457200]
R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-4 98304]
R2 CinemaNow Service;CinemaNow Service;c:\program files\cinemanow\cinemanow media manager\CinemaNowSvc.exe [2009-6-23 127352]
R2 cypherixservice;Cypherix service;c:\windows\system32\cypherixsrv.exe [2011-3-21 1040112]
R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2012-3-7 913144]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-7-16 655944]
R2 MemeoBackgroundService;MemeoBackgroundService;c:\program files\memeo\autobackup\MemeoBackgroundService.exe [2010-7-28 25824]
R2 NasPmService;NAS PM Service;c:\program files\buffalo\nasnavi\nassvc.exe -service_execute -dcyc=60 -dto=3 -dluc=0 -dmin=1 -dmax=60 -dflc=0 -apc=0 -log=0 -pm=1 -pall=1 -phttp=0 -pbc=0 -ppro=0 -pcyc=0 -pmin=1 -pmax=60 -pflc=0 –> c:\program files\buffalo\nasnavi\nassvc.exe -Service_Execute -dcyc=60 -dto=3 -dluc=0 -dmin=1 -dmax=60 -dflc=0 -apc=0 -log=0 -pm=1 -pall=1 -phttp=0 -pbc=0 -ppro=0 -pcyc=0 -pmin=1 -pmax=60 -pflc=0 [?]
R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\adobe\photoshop elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-4 118784]
R2 ssoftnt4;ssoftnt4;c:\windows\system32\drivers\ssoftnt4.sys [2011-3-1 94080]
R2 VideoAcceleratorService;VideoAcceleratorService;c:\progra~1\speedb~1\videoacceleratorservice.exe -start -scm –> c:\progra~1\speedb~1\VideoAcceleratorService.exe -start -scm [?]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [2011-12-28 101392]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-7-16 22344]
R4 IOMap;IOMap;\??\c:\windows\system32\drivers\iomap.sys –> c:\windows\system32\drivers\IOMap.sys [?]
S0 cerc6;cerc6; [x]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-4-18 136176]
S2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files\common files\roxio shared\12.0\sharedcom\RoxWatch12.exe [2009-7-24 219632]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-2 250056]
S3 efavdrv;efavdrv;\??\c:\windows\system32\drivers\efavdrv.sys –> c:\windows\system32\drivers\efavdrv.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-4-18 136176]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.1.121\McCHSvc.exe [2010-9-3 227232]
S3 RoxMediaDB12;RoxMediaDB12;c:\program files\common files\roxio shared\12.0\sharedcom\RoxMediaDB12.exe [2009-7-24 1116656]
.
=============== Created Last 30 ================
.
2012-07-17 01:38:02 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-07-17 01:38:02 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-07-13 19:57:37 ——– d—–w- c:\documents and settings\all users\application data\WRData
2012-07-08 19:37:49 ——– d—–w- c:\program files\ESET
2012-07-08 02:26:45 ——– d—–w- c:\documents and settings\all users\application data\F4D55F3B0004096B0A4F5662D151FC4E
.
==================== Find3M ====================
.
2012-07-12 02:38:10 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-12 02:38:10 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-12 02:38:08 9822920 —-a-w- c:\windows\system32\FlashPlayerInstaller.exe
2012-06-13 13:19:59 1866112 ——w- c:\windows\system32\win32k.sys
2012-06-05 15:50:25 1372672 ——w- c:\windows\system32\msxml6.dll
2012-06-05 15:50:25 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32:08 152576 —-a-w- c:\windows\system32\schannel.dll
2012-06-02 19:19:44 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 19:19:38 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 19:19:38 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 19:19:34 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 19:19:30 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-05-31 13:22:09 599040 —-a-w- c:\windows\system32\crypt32.dll
2012-05-16 15:08:26 916992 —-a-w- c:\windows\system32\wininet.dll
2012-05-11 14:42:33 43520 ——w- c:\windows\system32\licmgr10.dll
2012-05-11 14:42:33 1469440 ——w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38:02 385024 ——w- c:\windows\system32\html.iec
2012-05-04 13:16:13 2148352 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-05-04 12:32:19 2026496 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46:36 139656 ——w- c:\windows\system32\drivers\rdpwd.sys
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD5000AAKS-75A7B2 rev.01.03B01 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys SahdIa32.sys ACPI.sys hal.dll >>UNKNOWN [0x8A5FA4B1]<<
c:\windows\system32\drivers\SahdIa32.sys Sonic Solutions
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8a60193c]; MOV EAX, [0x8a601ab0]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\Harddisk0\DR0[0x8AD3AAB8]
3 CLASSPNP[0xBA0F8FD7] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> [0x8ACF3930]
5 SahdIa32[0xBA119939] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\0000006a[0x8AD59798]
7 ACPI[0xB9F7F620] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> [0x8AD930E0]
\Driver\atapi[0x8AC0DA18] -> IRP_MJ_CREATE -> 0x8A5FA4B1
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A5FA2E2
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 12:02:26.51 ===============

Attachments:

📎attach.txt

Tomk

Post #4July 19, 2012, 6:03 PM UTC

Gliq.Info,

Yeppers. You've got a nasty in there. Let's see if it will go relatively quietly.

Download ComboFix from here: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Gliq.Info

Post #5July 19, 2012, 8:22 PM UTC

Tom,

Thanks for the info, but I did run ComboFix and it ended with the BSOD (Windows automatic shutdown).

Windows Recovery Console & Restore Point not installed/created after run:

1) During the ComboFix run, it claimed that Windows Recovery Console was successfully installed, but it is not.
2) ComboFix also indicated that a Restore Point was created, but after the BSOD, it was not.
3) The only change was that Windows was reporting No Firewall on startup.

I would like to run ComboFix again, but only after you review this message. You indicated that you did NOT want me to run any other software, but after the BSOD, I quickly went through all of your instructions again. Although I correctly interpretted your message the first time, I misinterpretted it after the BSOD and ran "SpeedyPC Pro Installer.exe" which popped up when I clicked ComboFix in your email. It indicated no viruses/malware found and has since been uninstalled. My PC is acting the same as I previously reported, except for the No Firewall message.

As it was, I decided to "sleep on it" before I emailed you and found this when I woke up:

http://www.bleepingcomputer.com/virus-remo…ecurity-renewal

It says in this article to use Malwarebytes to remove this malware. However, please note that my infection is "Windows Security CENTER" and not "Renewal" (similar, but not the same).
I will gladly run your software when you say so.

I will put more screen shots on my personal web page right after sending this email.

And importantly, I hope to hear from you soon so I can start using whatever apps are available to get to this virus.

Thank you.
Gliq.info

Tomk

Post #6July 19, 2012, 8:31 PM UTC

You may have several infections… but the main "nasty" appears to be TDSS.

Download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

🖼Click to load external image (Posted Image)
Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

🖼Click to load external image (Posted Image)
Click the Start Scan button.

🖼Click to load external image (Posted Image)
If a suspicious object is detected, the default action will be Skip, click on Continue.

🖼Click to load external image (Posted Image)
If malicious objects are found, they will show in the Scan results and offer three (3) options.
Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

🖼Click to load external image (Posted Image)
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.

Gliq.Info

Post #7July 19, 2012, 9:33 PM UTC

filename: TDSSKiller.2.7.46.0_19.07.2012_16.34.20_log.txt … Date Modified 7/19/2012 4:42 PM (First Run) This run occurred when ESET Antivirus and Malwarebytes were running - ESET displayed messages in red about the item that was being cured. The ESET Log will be at the bottom of this TDSS Log in this reply… (The Windows Securiy Center Virus is still running after TDSS Reboot) 16:34:20.0000 1252 TDSS rootkit removing tool [removed] Jul 16 2012 22:10:11 16:34:20.0281 1252 ============================================================ 16:34:20.0281 1252 Current date / time: 2012/07/19 16:34:20.0281 16:34:20.0281 1252 SystemInfo: 16:34:20.0281 1252 16:34:20.0281 1252 OS Version: 5.1.2600 ServicePack: 3.0 16:34:20.0281 1252 Product type: Workstation 16:34:20.0281 1252 ComputerName: GLIQ-SERVICES 16:34:20.0281 1252 UserName: Edward 16:34:20.0281 1252 Windows directory: C:\WINDOWS 16:34:20.0281 1252 System windows directory: C:\WINDOWS 16:34:20.0281 1252 Processor architecture: Intel x86 16:34:20.0281 1252 Number of processors: 2 16:34:20.0281 1252 Page size: 0x1000 16:34:20.0281 1252 Boot type: Normal boot 16:34:20.0281 1252 ============================================================ 16:34:22.0203 1252 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 16:34:22.0203 1252 ============================================================ 16:34:22.0203 1252 \Device\Harddisk0\DR0: 16:34:22.0203 1252 MBR partitions: 16:34:22.0203 1252 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x14000, BlocksNum 0x38FE9828 16:34:22.0203 1252 ============================================================ 16:34:22.0250 1252 C: <-> \Device\Harddisk0\DR0\Partition0 16:34:22.0250 1252 ============================================================ 16:34:22.0250 1252 Initialize success 16:34:22.0250 1252 ============================================================ 16:37:57.0609 5668 ============================================================ 16:37:57.0609 5668 Scan started 16:37:57.0609 5668 Mode: Manual; SigCheck; TDLFS; 16:37:57.0609 5668 ============================================================ 16:37:58.0515 5668 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269 (a15069eec83ebc54150564b2585cfdba) C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe 16:37:58.0890 5668 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269 - ok 16:37:58.0984 5668 Abiosdsk - ok 16:37:59.0000 5668 abp480n5 - ok 16:37:59.0031 5668 ACDaemon (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe 16:37:59.0046 5668 ACDaemon - ok 16:37:59.0093 5668 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 16:37:59.0265 5668 ACPI - ok 16:37:59.0296 5668 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 16:37:59.0390 5668 ACPIEC - ok 16:37:59.0500 5668 AcrSch2Svc (ab25414d8ca040d1c9dae71724fe1283) C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe 16:37:59.0546 5668 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - warning 16:37:59.0546 5668 AcrSch2Svc - detected UnsignedFile.Multi.Generic (1) 16:37:59.0578 5668 AdobeActiveFileMonitor (e42f7b36b4d8866184e8df9776ca4226) C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe 16:37:59.0609 5668 AdobeActiveFileMonitor ( UnsignedFile.Multi.Generic ) - warning 16:37:59.0609 5668 AdobeActiveFileMonitor - detected UnsignedFile.Multi.Generic (1) 16:37:59.0718 5668 AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 16:37:59.0812 5668 AdobeFlashPlayerUpdateSvc - ok 16:37:59.0812 5668 adpu160m - ok 16:37:59.0859 5668 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 16:37:59.0937 5668 aec - ok 16:38:00.0000 5668 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys 16:38:00.0078 5668 AFD - ok 16:38:00.0093 5668 Aha154x - ok 16:38:00.0093 5668 aic78u2 - ok 16:38:00.0109 5668 aic78xx - ok 16:38:00.0125 5668 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll 16:38:00.0312 5668 Alerter - ok 16:38:00.0390 5668 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe 16:38:00.0421 5668 ALG - ok 16:38:00.0421 5668 AliIde - ok 16:38:00.0437 5668 amsint - ok 16:38:00.0593 5668 Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 16:38:00.0609 5668 Apple Mobile Device - ok 16:38:00.0625 5668 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll 16:38:00.0765 5668 AppMgmt - ok 16:38:00.0765 5668 asc - ok 16:38:00.0765 5668 asc3350p - ok 16:38:00.0781 5668 asc3550 - ok 16:38:00.0859 5668 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 16:38:00.0859 5668 aspnet_state - ok 16:38:00.0906 5668 asusgsb (d320732bcf5ff856120bd06855c66867) C:\WINDOWS\system32\drivers\asusgsb.sys 16:38:00.0906 5668 asusgsb ( UnsignedFile.Multi.Generic ) - warning 16:38:00.0906 5668 asusgsb - detected UnsignedFile.Multi.Generic (1) 16:38:00.0968 5668 asuskbnt (b3b881eb81013aac11594a5400ada47a) C:\WINDOWS\system32\drivers\atkkbnt.sys 16:38:00.0984 5668 asuskbnt ( UnsignedFile.Multi.Generic ) - warning 16:38:00.0984 5668 asuskbnt - detected UnsignedFile.Multi.Generic (1) 16:38:01.0015 5668 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 16:38:01.0078 5668 AsyncMac - ok 16:38:01.0140 5668 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 16:38:01.0281 5668 atapi - ok 16:38:01.0296 5668 Atdisk - ok 16:38:01.0359 5668 Ati HotKey Poller (fde5fae31394a586f9ccc7300b6ad681) C:\WINDOWS\system32\Ati2evxx.exe 16:38:01.0437 5668 Ati HotKey Poller - ok 16:38:01.0781 5668 ati2mtag (23f1a61ae7553d086ef264c72afc4e6a) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 16:38:01.0937 5668 ati2mtag - ok 16:38:02.0078 5668 AtiHDAudioService (0d6b8359677d05142b624f09c28d643a) C:\WINDOWS\system32\drivers\AtihdXP3.sys 16:38:02.0093 5668 AtiHDAudioService - ok 16:38:02.0171 5668 ATKKeyboardService (34b661d95e07149b7bd866c407a17370) C:\WINDOWS\ATKKBService.exe 16:38:02.0718 5668 ATKKeyboardService ( UnsignedFile.Multi.Generic ) - warning 16:38:02.0718 5668 ATKKeyboardService - detected UnsignedFile.Multi.Generic (1) 16:38:02.0765 5668 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 16:38:02.0859 5668 Atmarpc - ok 16:38:02.0890 5668 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll 16:38:03.0015 5668 AudioSrv - ok 16:38:03.0062 5668 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 16:38:03.0125 5668 audstub - ok 16:38:03.0171 5668 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 16:38:03.0265 5668 Beep - ok 16:38:03.0328 5668 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll 16:38:03.0500 5668 BITS - ok 16:38:03.0671 5668 Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe 16:38:03.0687 5668 Bonjour Service - ok 16:38:03.0718 5668 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll 16:38:03.0843 5668 Browser - ok 16:38:04.0000 5668 catchme - ok 16:38:04.0046 5668 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 16:38:04.0140 5668 cbidf2k - ok 16:38:04.0171 5668 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 16:38:04.0265 5668 CCDECODE - ok 16:38:04.0265 5668 cd20xrnt - ok 16:38:04.0296 5668 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 16:38:04.0375 5668 Cdaudio - ok 16:38:04.0406 5668 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 16:38:04.0484 5668 Cdfs - ok 16:38:04.0531 5668 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 16:38:04.0609 5668 Cdrom - ok 16:38:04.0609 5668 cerc6 - ok 16:38:04.0625 5668 Changer - ok 16:38:04.0656 5668 CinemaNow Service (127d4d0e9f78834ffd1eeea3fcfb47c1) C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe 16:38:04.0671 5668 CinemaNow Service - ok 16:38:04.0687 5668 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe 16:38:04.0781 5668 CiSvc - ok 16:38:04.0812 5668 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe 16:38:04.0937 5668 ClipSrv - ok 16:38:05.0046 5668 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 16:38:05.0062 5668 clr_optimization_v2.0.50727_32 - ok 16:38:05.0062 5668 CmdIde - ok 16:38:05.0078 5668 COMSysApp - ok 16:38:05.0078 5668 Cpqarray - ok 16:38:05.0140 5668 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll 16:38:05.0218 5668 CryptSvc - ok 16:38:05.0546 5668 cypherixservice (aba88a0c73f3370ab5833b3c63b0d9c8) C:\WINDOWS\system32\cypherixsrv.exe 16:38:05.0578 5668 cypherixservice - ok 16:38:05.0625 5668 cyphxdrv (dad9c8cb36dc938b7c4713b2cb232f1c) C:\WINDOWS\system32\Drivers\cyphxdrv.sys 16:38:05.0640 5668 cyphxdrv - ok 16:38:05.0640 5668 dac2w2k - ok 16:38:05.0640 5668 dac960nt - ok 16:38:05.0718 5668 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll 16:38:05.0796 5668 DcomLaunch - ok 16:38:05.0828 5668 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll 16:38:05.0953 5668 Dhcp - ok 16:38:05.0968 5668 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 16:38:06.0062 5668 Disk - ok 16:38:06.0078 5668 dmadmin - ok 16:38:06.0171 5668 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 16:38:06.0343 5668 dmboot - ok 16:38:06.0359 5668 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 16:38:06.0468 5668 dmio - ok 16:38:06.0484 5668 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 16:38:06.0593 5668 dmload - ok 16:38:06.0640 5668 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll 16:38:06.0750 5668 dmserver - ok 16:38:06.0796 5668 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 16:38:06.0890 5668 DMusic - ok 16:38:06.0937 5668 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll 16:38:07.0062 5668 Dnscache - ok 16:38:07.0109 5668 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll 16:38:07.0203 5668 Dot3svc - ok 16:38:07.0203 5668 dpti2o - ok 16:38:07.0250 5668 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 16:38:07.0343 5668 drmkaud - ok 16:38:07.0390 5668 eamon (8c2b6bbc82ad12cd9a2e73e5dcbba705) C:\WINDOWS\system32\DRIVERS\eamon.sys 16:38:07.0406 5668 eamon - ok 16:38:07.0406 5668 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll 16:38:07.0500 5668 EapHost - ok 16:38:07.0500 5668 efavdrv - ok 16:38:07.0546 5668 ehdrv (5412ed24fffca64e2f0168399b86c952) C:\WINDOWS\system32\DRIVERS\ehdrv.sys 16:38:07.0562 5668 ehdrv - ok 16:38:07.0781 5668 ekrn (ad4faade819e0da9933bea7c01d2c763) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe 16:38:07.0812 5668 ekrn - ok 16:38:07.0890 5668 epfwtdir (cf1108161dfedd82ae811307a3763e1c) C:\WINDOWS\system32\DRIVERS\epfwtdir.sys 16:38:07.0906 5668 epfwtdir - ok 16:38:07.0953 5668 EpsonBidirectionalService (abdd5ad016affd34ad40e944ce94bf59) C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe 16:38:07.0968 5668 EpsonBidirectionalService ( UnsignedFile.Multi.Generic ) - warning 16:38:07.0968 5668 EpsonBidirectionalService - detected UnsignedFile.Multi.Generic (1) 16:38:08.0000 5668 EPSON_EB_RPCV4_01 (ec6a73cd8413f68655e5e0b99c415a21) C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE 16:38:08.0093 5668 EPSON_EB_RPCV4_01 - ok 16:38:08.0156 5668 EPSON_PM_RPCV4_01 (8fe6ab59cab8f2c038fea9522a5eeba7) C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE 16:38:08.0171 5668 EPSON_PM_RPCV4_01 - ok 16:38:08.0171 5668 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll 16:38:08.0281 5668 ERSvc - ok 16:38:08.0328 5668 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 16:38:08.0343 5668 Eventlog - ok 16:38:08.0375 5668 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll 16:38:08.0453 5668 EventSystem - ok 16:38:08.0515 5668 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 16:38:08.0593 5668 Fastfat - ok 16:38:08.0640 5668 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 16:38:08.0765 5668 FastUserSwitchingCompatibility - ok 16:38:08.0828 5668 Fax (e97d6a8684466df94ff3bc24fb787a07) C:\WINDOWS\system32\fxssvc.exe 16:38:08.0968 5668 Fax - ok 16:38:09.0015 5668 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys 16:38:09.0109 5668 Fdc - ok 16:38:09.0140 5668 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 16:38:09.0218 5668 Fips - ok 16:38:09.0265 5668 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys 16:38:09.0343 5668 Flpydisk - ok 16:38:09.0406 5668 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys 16:38:09.0500 5668 FltMgr - ok 16:38:09.0640 5668 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 16:38:09.0671 5668 FontCache3.0.0.0 - ok 16:38:09.0687 5668 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 16:38:09.0750 5668 Fs_Rec - ok 16:38:09.0765 5668 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 16:38:09.0828 5668 Ftdisk - ok 16:38:09.0875 5668 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 16:38:09.0875 5668 GEARAspiWDM - ok 16:38:09.0890 5668 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 16:38:09.0984 5668 Gpc - ok 16:38:10.0125 5668 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe 16:38:10.0140 5668 gupdate - ok 16:38:10.0140 5668 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe 16:38:10.0156 5668 gupdatem - ok 16:38:10.0218 5668 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 16:38:10.0296 5668 HDAudBus - ok 16:38:10.0343 5668 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 16:38:10.0421 5668 helpsvc - ok 16:38:10.0421 5668 HidServ - ok 16:38:10.0453 5668 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 16:38:10.0531 5668 hidusb - ok 16:38:10.0546 5668 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll 16:38:10.0671 5668 hkmsvc - ok 16:38:10.0671 5668 hpn - ok 16:38:10.0750 5668 HSFHWBS2 (3e0b68288e468190a5bf4c2ef5998a18) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 16:38:10.0812 5668 HSFHWBS2 - ok 16:38:10.0890 5668 HSF_DPV (bd2abf12938a2fccc340873412c2b2ab) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys 16:38:10.0921 5668 HSF_DPV - ok 16:38:10.0984 5668 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 16:38:11.0109 5668 HTTP - ok 16:38:11.0140 5668 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll 16:38:11.0468 5668 HTTPFilter - ok 16:38:11.0468 5668 i2omgmt - ok 16:38:11.0468 5668 i2omp - ok 16:38:11.0515 5668 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\drivers\i8042prt.sys 16:38:11.0593 5668 i8042prt - ok 16:38:11.0906 5668 ialm (66a685b05066683621920bc14a45cfe8) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 16:38:12.0218 5668 ialm - ok 16:38:12.0343 5668 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe 16:38:12.0359 5668 IDriverT ( UnsignedFile.Multi.Generic ) - warning 16:38:12.0359 5668 IDriverT - detected UnsignedFile.Multi.Generic (1) 16:38:12.0609 5668 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 16:38:12.0656 5668 idsvc - ok 16:38:12.0781 5668 IISADMIN (db3c22745c0da4666f3be31f1af36b2f) C:\WINDOWS\system32\inetsrv\inetinfo.exe 16:38:12.0859 5668 IISADMIN - ok 16:38:12.0906 5668 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 16:38:13.0062 5668 Imapi - ok 16:38:13.0109 5668 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe 16:38:13.0203 5668 ImapiService - ok 16:38:13.0203 5668 ini910u - ok 16:38:13.0500 5668 IntcAzAudAddService (2feb5bf0312e1cb76cd2caa875cbaa5d) C:\WINDOWS\system32\drivers\RtkHDAud.sys 16:38:13.0703 5668 IntcAzAudAddService - ok 16:38:13.0765 5668 IntelIde - ok 16:38:13.0828 5668 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys 16:38:13.0921 5668 intelppm - ok 16:38:13.0921 5668 IOMap - ok 16:38:13.0953 5668 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 16:38:14.0156 5668 Ip6Fw - ok 16:38:14.0171 5668 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 16:38:14.0296 5668 IpFilterDriver - ok 16:38:14.0312 5668 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 16:38:14.0390 5668 IpInIp - ok 16:38:14.0421 5668 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 16:38:14.0515 5668 IpNat - ok 16:38:14.0640 5668 iPod Service (57edb35ea2feca88f8b17c0c095c9a56) C:\Program Files\iPod\bin\iPodService.exe 16:38:14.0687 5668 iPod Service - ok 16:38:14.0734 5668 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 16:38:14.0796 5668 IPSec - ok 16:38:14.0843 5668 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 16:38:14.0875 5668 IRENUM - ok 16:38:14.0921 5668 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 16:38:15.0000 5668 isapnp - ok 16:38:15.0140 5668 JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Program Files\Java\jre6\bin\jqs.exe 16:38:15.0156 5668 JavaQuickStarterService - ok 16:38:15.0234 5668 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 16:38:15.0359 5668 Kbdclass - ok 16:38:15.0421 5668 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 16:38:15.0562 5668 kbdhid - ok 16:38:15.0625 5668 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 16:38:15.0734 5668 kmixer - ok 16:38:15.0765 5668 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 16:38:15.0875 5668 KSecDD - ok 16:38:15.0921 5668 LanmanServer (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll 16:38:16.0015 5668 LanmanServer - ok 16:38:16.0125 5668 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll 16:38:16.0218 5668 lanmanworkstation - ok 16:38:16.0265 5668 lbrtfdc - ok 16:38:16.0328 5668 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll 16:38:16.0531 5668 LmHosts - ok 16:38:16.0546 5668 MBAMProtector (6dfe7f2e8e8a337263aa5c92a215f161) C:\WINDOWS\system32\drivers\mbam.sys 16:38:16.0546 5668 MBAMProtector - ok 16:38:16.0656 5668 MBAMService (43683e970f008c93c9429ef428147a54) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 16:38:16.0671 5668 MBAMService - ok 16:38:16.0781 5668 McComponentHostService (fd3ad5e1ecdaa94a89d6697f5c5465d6) C:\Program Files\McAfee Security Scan\2.1.121\McCHSvc.exe 16:38:16.0796 5668 McComponentHostService - ok 16:38:16.0859 5668 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 16:38:16.0875 5668 mdmxsdk - ok 16:38:16.0906 5668 MemeoBackgroundService (10b012345f08d4d82a8ec41736e3d5ba) C:\Program Files\Memeo\AutoBackup\MemeoBackgroundService.exe 16:38:16.0921 5668 MemeoBackgroundService - ok 16:38:16.0921 5668 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll 16:38:17.0000 5668 Messenger - ok 16:38:17.0031 5668 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 16:38:17.0125 5668 mnmdd - ok 16:38:17.0156 5668 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe 16:38:17.0234 5668 mnmsrvc - ok 16:38:17.0281 5668 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 16:38:17.0375 5668 Modem - ok 16:38:17.0437 5668 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys 16:38:17.0500 5668 MODEMCSA - ok 16:38:17.0546 5668 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 16:38:17.0640 5668 Mouclass - ok 16:38:17.0656 5668 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 16:38:17.0734 5668 mouhid - ok 16:38:17.0750 5668 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 16:38:17.0828 5668 MountMgr - ok 16:38:17.0828 5668 mraid35x - ok 16:38:17.0843 5668 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 16:38:17.0937 5668 MRxDAV - ok 16:38:18.0015 5668 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 16:38:18.0078 5668 MRxSmb - ok 16:38:18.0125 5668 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe 16:38:18.0203 5668 MSDTC - ok 16:38:18.0203 5668 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 16:38:18.0312 5668 Msfs - ok 16:38:18.0312 5668 MSIServer - ok 16:38:18.0359 5668 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 16:38:18.0437 5668 MSKSSRV - ok 16:38:18.0453 5668 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 16:38:18.0531 5668 MSPCLOCK - ok 16:38:18.0546 5668 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 16:38:18.0625 5668 MSPQM - ok 16:38:18.0687 5668 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16:38:18.0796 5668 mssmbios - ok 16:38:18.0828 5668 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys 16:38:18.0906 5668 MSTEE - ok 16:38:18.0921 5668 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys 16:38:18.0984 5668 Mup - ok 16:38:19.0031 5668 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 16:38:19.0109 5668 NABTSFEC - ok 16:38:19.0171 5668 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll 16:38:19.0296 5668 napagent - ok 16:38:19.0359 5668 NasPmService - ok 16:38:19.0390 5668 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 16:38:19.0484 5668 NDIS - ok 16:38:19.0500 5668 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys 16:38:19.0593 5668 NdisIP - ok 16:38:19.0640 5668 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 16:38:19.0718 5668 NdisTapi - ok 16:38:19.0765 5668 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16:38:19.0843 5668 Ndisuio - ok 16:38:19.0875 5668 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 16:38:19.0968 5668 NdisWan - ok 16:38:20.0000 5668 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys 16:38:20.0031 5668 NDProxy - ok 16:38:20.0062 5668 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 16:38:20.0156 5668 NetBIOS - ok 16:38:20.0203 5668 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 16:38:20.0281 5668 NetBT - ok 16:38:20.0296 5668 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 16:38:20.0406 5668 NetDDE - ok 16:38:20.0421 5668 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 16:38:20.0515 5668 NetDDEdsdm - ok 16:38:20.0531 5668 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 16:38:21.0046 5668 Netlogon - ok 16:38:21.0062 5668 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll 16:38:21.0187 5668 Netman - ok 16:38:21.0281 5668 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 16:38:21.0296 5668 NetTcpPortSharing - ok 16:38:21.0390 5668 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll 16:38:21.0453 5668 Nla - ok 16:38:21.0625 5668 nmservice (cd569fa91ec6f59d045c19d0d3850f44) C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe 16:38:21.0640 5668 nmservice - ok 16:38:21.0703 5668 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 16:38:21.0796 5668 Npfs - ok 16:38:21.0843 5668 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 16:38:21.0968 5668 Ntfs - ok 16:38:21.0984 5668 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 16:38:22.0078 5668 NtLmSsp - ok 16:38:22.0125 5668 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll 16:38:22.0203 5668 NtmsSvc - ok 16:38:22.0250 5668 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 16:38:22.0312 5668 Null - ok 16:38:22.0375 5668 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 16:38:22.0468 5668 NwlnkFlt - ok 16:38:22.0484 5668 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 16:38:22.0593 5668 NwlnkFwd - ok 16:38:22.0609 5668 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 16:38:22.0625 5668 ose - ok 16:38:22.0656 5668 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys 16:38:22.0734 5668 Parport - ok 16:38:22.0734 5668 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 16:38:22.0828 5668 PartMgr - ok 16:38:22.0843 5668 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 16:38:22.0906 5668 ParVdm - ok 16:38:22.0906 5668 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 16:38:23.0015 5668 PCI - ok 16:38:23.0015 5668 PCIDump - ok 16:38:23.0031 5668 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 16:38:23.0093 5668 PCIIde - ok 16:38:23.0140 5668 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 16:38:23.0218 5668 Pcmcia - ok 16:38:23.0218 5668 PDCOMP - ok 16:38:23.0218 5668 PDFRAME - ok 16:38:23.0234 5668 PDRELI - ok 16:38:23.0234 5668 PDRFRAME - ok 16:38:23.0234 5668 perc2 - ok 16:38:23.0250 5668 perc2hib - ok 16:38:23.0500 5668 PEVSystemStart (f042ee4c8d66248d9b86dcf52abae416) C:\ComboFix\pev.3XE 16:38:23.0546 5668 PEVSystemStart ( UnsignedFile.Multi.Generic ) - warning 16:38:23.0546 5668 PEVSystemStart - detected UnsignedFile.Multi.Generic (1) 16:38:23.0625 5668 PhotoshopElementsDeviceConnect (d0f9f362023bf94cf58a1c3cdbbebe06) C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe 16:38:23.0640 5668 PhotoshopElementsDeviceConnect ( UnsignedFile.Multi.Generic ) - warning 16:38:23.0640 5668 PhotoshopElementsDeviceConnect - detected UnsignedFile.Multi.Generic (1) 16:38:23.0703 5668 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 16:38:23.0718 5668 PlugPlay - ok 16:38:23.0781 5668 pnarp (36fcac4fa28b462ca867742dea59b0d0) C:\WINDOWS\system32\DRIVERS\pnarp.sys 16:38:23.0781 5668 pnarp - ok 16:38:23.0812 5668 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 16:38:24.0015 5668 PolicyAgent - ok 16:38:24.0046 5668 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 16:38:24.0187 5668 PptpMiniport - ok 16:38:24.0187 5668 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 16:38:24.0312 5668 ProtectedStorage - ok 16:38:24.0328 5668 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 16:38:24.0437 5668 PSched - ok 16:38:24.0468 5668 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 16:38:24.0593 5668 Ptilink - ok 16:38:24.0593 5668 purendis (d8ac00388262b1a4878a7ee12f31d376) C:\WINDOWS\system32\DRIVERS\purendis.sys 16:38:24.0609 5668 purendis - ok 16:38:24.0671 5668 PxHelp20 (40fedd328f98245ad201cf5f9f311724) C:\WINDOWS\system32\Drivers\PxHelp20.sys 16:38:24.0671 5668 PxHelp20 - ok 16:38:24.0671 5668 ql1080 - ok 16:38:24.0687 5668 Ql10wnt - ok 16:38:24.0687 5668 ql12160 - ok 16:38:24.0687 5668 ql1240 - ok 16:38:24.0687 5668 ql1280 - ok 16:38:24.0703 5668 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 16:38:24.0781 5668 RasAcd - ok 16:38:24.0843 5668 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll 16:38:24.0906 5668 RasAuto - ok 16:38:24.0937 5668 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 16:38:25.0015 5668 Rasl2tp - ok 16:38:25.0031 5668 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll 16:38:25.0125 5668 RasMan - ok 16:38:25.0140 5668 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 16:38:25.0281 5668 RasPppoe - ok 16:38:25.0281 5668 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 16:38:25.0375 5668 Raspti - ok 16:38:25.0406 5668 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 16:38:25.0484 5668 Rdbss - ok 16:38:25.0484 5668 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 16:38:25.0546 5668 RDPCDD - ok 16:38:25.0593 5668 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 16:38:25.0656 5668 rdpdr - ok 16:38:25.0687 5668 RDPWD (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys 16:38:25.0750 5668 RDPWD - ok 16:38:25.0750 5668 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe 16:38:25.0828 5668 RDSessMgr - ok 16:38:25.0859 5668 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 16:38:25.0937 5668 redbook - ok 16:38:25.0968 5668 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll 16:38:26.0046 5668 RemoteAccess - ok 16:38:26.0078 5668 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll 16:38:26.0171 5668 RemoteRegistry - ok 16:38:26.0343 5668 RoxMediaDB12 (ff578453d3b3adaab22d7151d7f9e592) C:\Program Files\Common Files\Roxio Shared\12.0\SharedCOM\RoxMediaDB12.exe 16:38:26.0375 5668 RoxMediaDB12 - ok 16:38:26.0406 5668 RoxWatch12 (71b38b8df1a9b55fc0fb64958cc7b9dd) C:\Program Files\Common Files\Roxio Shared\12.0\SharedCOM\RoxWatch12.exe 16:38:26.0421 5668 RoxWatch12 - ok 16:38:26.0531 5668 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe 16:38:26.0640 5668 RpcLocator - ok 16:38:26.0703 5668 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll 16:38:26.0734 5668 RpcSs - ok 16:38:26.0781 5668 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe 16:38:27.0062 5668 RSVP - ok 16:38:27.0109 5668 RTLE8023xp (839141088ad7ee90f5b441b2d1afd22c) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys 16:38:27.0171 5668 RTLE8023xp - ok 16:38:27.0218 5668 SahdIa32 (0b2d5d2341437d7d7e1a6c7bbce3786a) C:\WINDOWS\system32\Drivers\SahdIa32.sys 16:38:27.0250 5668 SahdIa32 - ok 16:38:27.0281 5668 SaibIa32 (7a5f65b16249af2bc9d18d815f5d7172) C:\WINDOWS\system32\Drivers\SaibIa32.sys 16:38:27.0281 5668 SaibIa32 - ok 16:38:27.0328 5668 SaibVd32 (e333c9515822de586a3ff759a0c9b7bf) C:\WINDOWS\system32\Drivers\SaibVd32.sys 16:38:27.0328 5668 SaibVd32 - ok 16:38:27.0390 5668 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 16:38:27.0468 5668 SamSs - ok 16:38:27.0500 5668 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe 16:38:27.0671 5668 SCardSvr - ok 16:38:27.0718 5668 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll 16:38:27.0796 5668 Schedule - ok 16:38:27.0812 5668 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 16:38:27.0859 5668 Secdrv - ok 16:38:27.0906 5668 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll 16:38:27.0984 5668 seclogon - ok 16:38:27.0984 5668 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll 16:38:28.0062 5668 SENS - ok 16:38:28.0125 5668 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys 16:38:28.0187 5668 Serial - ok 16:38:28.0218 5668 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 16:38:28.0296 5668 Sfloppy - ok 16:38:28.0359 5668 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 16:38:28.0359 5668 ShellHWDetection - ok 16:38:28.0359 5668 Simbad - ok 16:38:28.0437 5668 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys 16:38:28.0546 5668 SLIP - ok 16:38:28.0640 5668 SMTPSVC (db3c22745c0da4666f3be31f1af36b2f) C:\WINDOWS\system32\inetsrv\inetinfo.exe 16:38:28.0671 5668 SMTPSVC - ok 16:38:28.0718 5668 snapman (01080d3a58ba5b6167849a3307e61d1a) C:\WINDOWS\system32\DRIVERS\snapman.sys 16:38:28.0765 5668 snapman ( UnsignedFile.Multi.Generic ) - warning 16:38:28.0765 5668 snapman - detected UnsignedFile.Multi.Generic (1) 16:38:28.0812 5668 SNMP (60c377be6b3cc83f6a8584934b181d2e) C:\WINDOWS\System32\snmp.exe 16:38:28.0906 5668 SNMP - ok 16:38:28.0937 5668 SNMPTRAP (80a050795a107a76c2b1cd4cfbe010e6) C:\WINDOWS\System32\snmptrap.exe 16:38:29.0031 5668 SNMPTRAP - ok 16:38:29.0031 5668 Sparrow - ok 16:38:29.0078 5668 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 16:38:29.0265 5668 splitter - ok 16:38:29.0312 5668 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe 16:38:29.0375 5668 Spooler - ok 16:38:29.0406 5668 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 16:38:29.0453 5668 sr - ok 16:38:29.0468 5668 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll 16:38:29.0531 5668 srservice - ok 16:38:29.0578 5668 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys 16:38:29.0609 5668 Srv - ok 16:38:29.0671 5668 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll 16:38:29.0703 5668 SSDPSRV - ok 16:38:29.0718 5668 ssoftnt4 (9c6e560f2de42102550f77b8914e6b88) C:\WINDOWS\system32\Drivers\ssoftnt4.sys 16:38:29.0734 5668 ssoftnt4 ( UnsignedFile.Multi.Generic ) - warning 16:38:29.0734 5668 ssoftnt4 - detected UnsignedFile.Multi.Generic (1) 16:38:29.0734 5668 ssoftservice - ok 16:38:29.0781 5668 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll 16:38:29.0843 5668 stisvc - ok 16:38:29.0875 5668 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys 16:38:29.0968 5668 streamip - ok 16:38:30.0015 5668 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 16:38:30.0093 5668 swenum - ok 16:38:30.0171 5668 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 16:38:30.0265 5668 swmidi - ok 16:38:30.0265 5668 SwPrv - ok 16:38:30.0265 5668 symc810 - ok 16:38:30.0281 5668 symc8xx - ok 16:38:30.0281 5668 sym_hi - ok 16:38:30.0281 5668 sym_u3 - ok 16:38:30.0328 5668 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 16:38:30.0421 5668 sysaudio - ok 16:38:30.0453 5668 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe 16:38:30.0578 5668 SysmonLog - ok 16:38:30.0578 5668 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll 16:38:30.0687 5668 TapiSrv - ok 16:38:30.0750 5668 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 16:38:30.0781 5668 Tcpip - ok 16:38:30.0812 5668 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 16:38:30.0906 5668 TDPIPE - ok 16:38:30.0921 5668 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 16:38:31.0015 5668 TDTCP - ok 16:38:31.0078 5668 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 16:38:31.0171 5668 TermDD - ok 16:38:31.0203 5668 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll 16:38:31.0328 5668 TermService - ok 16:38:31.0390 5668 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 16:38:31.0406 5668 Themes - ok 16:38:31.0437 5668 tifsfilter (304e188496ec723c369e3b27da82f992) C:\WINDOWS\system32\DRIVERS\tifsfilt.sys 16:38:31.0453 5668 tifsfilter ( UnsignedFile.Multi.Generic ) - warning 16:38:31.0453 5668 tifsfilter - detected UnsignedFile.Multi.Generic (1) 16:38:31.0531 5668 timounter (ac0a6126138403b5913a6d819343034b) C:\WINDOWS\system32\DRIVERS\timntr.sys 16:38:31.0625 5668 timounter ( UnsignedFile.Multi.Generic ) - warning 16:38:31.0625 5668 timounter - detected UnsignedFile.Multi.Generic (1) 16:38:31.0625 5668 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\system32\tlntsvr.exe 16:38:31.0734 5668 TlntSvr - ok 16:38:31.0734 5668 TosIde - ok 16:38:31.0765 5668 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll 16:38:31.0968 5668 TrkWks - ok 16:38:32.0000 5668 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 16:38:32.0109 5668 Udfs - ok 16:38:32.0109 5668 ultra - ok 16:38:32.0187 5668 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 16:38:32.0265 5668 Update - ok 16:38:32.0312 5668 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll 16:38:32.0359 5668 upnphost - ok 16:38:32.0359 5668 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe 16:38:32.0437 5668 UPS - ok 16:38:32.0484 5668 USBAAPL (eafe1e00739afe6c51487a050e772e17) C:\WINDOWS\system32\Drivers\usbaapl.sys 16:38:32.0500 5668 USBAAPL - ok 16:38:32.0546 5668 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 16:38:32.0625 5668 usbehci - ok 16:38:32.0687 5668 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 16:38:32.0750 5668 usbhub - ok 16:38:32.0796 5668 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys 16:38:32.0937 5668 usbprint - ok 16:38:32.0968 5668 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 16:38:33.0046 5668 usbscan - ok 16:38:33.0078 5668 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 16:38:33.0156 5668 usbstor - ok 16:38:33.0203 5668 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 16:38:33.0296 5668 usbuhci - ok 16:38:33.0343 5668 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 16:38:33.0406 5668 VgaSave - ok 16:38:33.0406 5668 ViaIde - ok 16:38:33.0468 5668 Video3D (8643da4a6c83da6c10fcab1e5ab6632d) C:\WINDOWS\system32\Drivers\Video3D32.sys 16:38:33.0468 5668 Video3D ( UnsignedFile.Multi.Generic ) - warning 16:38:33.0468 5668 Video3D - detected UnsignedFile.Multi.Generic (1) 16:38:33.0562 5668 VideoAcceleratorService - ok 16:38:33.0593 5668 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 16:38:33.0687 5668 VolSnap - ok 16:38:33.0734 5668 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe 16:38:33.0796 5668 VSS - ok 16:38:33.0843 5668 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll 16:38:33.0921 5668 W32Time - ok 16:38:34.0031 5668 W3SVC (db3c22745c0da4666f3be31f1af36b2f) C:\WINDOWS\system32\inetsrv\inetinfo.exe 16:38:34.0062 5668 W3SVC - ok 16:38:34.0078 5668 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 16:38:34.0156 5668 Wanarp - ok 16:38:34.0156 5668 WDICA - ok 16:38:34.0203 5668 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 16:38:34.0343 5668 wdmaud - ok 16:38:34.0406 5668 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll 16:38:34.0500 5668 WebClient - ok 16:38:34.0546 5668 winachsf (ea2ab3c94b1aee6aa22d543f1f0c62aa) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 16:38:34.0656 5668 winachsf - ok 16:38:34.0765 5668 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll 16:38:34.0843 5668 winmgmt - ok 16:38:34.0875 5668 WmdmPmSN (051b1bdecd6dee18c771b5d5ec7f044d) C:\WINDOWS\system32\MsPMSNSv.dll 16:38:34.0984 5668 WmdmPmSN - ok 16:38:35.0062 5668 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll 16:38:35.0078 5668 Wmi - ok 16:38:35.0140 5668 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe 16:38:35.0281 5668 WmiApSrv - ok 16:38:35.0453 5668 WMPNetworkSvc (6bab4dc65515a098505f8b3d01fb6fe5) C:\Program Files\Windows Media Player\WMPNetwk.exe 16:38:35.0546 5668 WMPNetworkSvc - ok 16:38:35.0671 5668 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys 16:38:35.0781 5668 WS2IFSL - ok 16:38:35.0843 5668 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll 16:38:36.0015 5668 wscsvc - ok 16:38:36.0046 5668 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 16:38:36.0140 5668 WSTCODEC - ok 16:38:36.0203 5668 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll 16:38:36.0296 5668 wuauserv - ok 16:38:36.0328 5668 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 16:38:36.0375 5668 WudfPf - ok 16:38:36.0375 5668 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 16:38:36.0406 5668 WudfRd - ok 16:38:36.0421 5668 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll 16:38:36.0437 5668 WudfSvc - ok 16:38:36.0468 5668 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll 16:38:36.0656 5668 WZCSVC - ok 16:38:36.0656 5668 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll 16:38:36.0796 5668 xmlprov - ok 16:38:36.0796 5668 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0 16:38:36.0812 5668 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected 16:38:36.0812 5668 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0) 16:38:36.0843 5668 \Device\Harddisk0\DR0 ( TDSS File System ) - warning 16:38:36.0843 5668 \Device\Harddisk0\DR0 - detected TDSS File System (1) 16:38:36.0875 5668 Boot (0x1200) (b6ba39df77540bc511cf1fe05d5d9398) \Device\Harddisk0\DR0\Partition0 16:38:36.0875 5668 \Device\Harddisk0\DR0\Partition0 - ok 16:38:36.0875 5668 ============================================================ 16:38:36.0875 5668 Scan finished 16:38:36.0875 5668 ============================================================ 16:38:36.0984 1084 Detected object count: 16 16:38:36.0984 1084 Actual detected object count: 16 16:41:59.0875 1084 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - skipped by user 16:41:59.0875 1084 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - User select action: Skip 16:41:59.0875 1084 AdobeActiveFileMonitor ( UnsignedFile.Multi.Generic ) - skipped by user 16:41:59.0875 1084 AdobeActiveFileMonitor ( UnsignedFile.Multi.Generic ) - User select action: Skip 16:41:59.0875 1084 asusgsb ( UnsignedFile.Multi.Generic ) - skipped by user 16:41:59.0875 1084 asusgsb ( UnsignedFile.Multi.Generic ) - User select action: Skip 16:41:59.0875 1084 asuskbnt ( UnsignedFile.Multi.Generic ) - skipped by user 16:41:59.0875 1084 asuskbnt ( UnsignedFile.Multi.Generic ) - User select action: Skip 16:41:59.0875 1084 ATKKeyboardService ( UnsignedFile.Multi.Generic ) - skipped by user 16:41:59.0875 1084 ATKKeyboardService ( UnsignedFile.Multi.Generic ) - User select action: Skip 16:41:59.0875 1084 EpsonBidirectionalService ( UnsignedFile.Multi.Generic ) - skipped by user 16:41:59.0875 1084 EpsonBidirectionalService ( UnsignedFile.Multi.Generic ) - User select action: Skip 16:41:59.0875 1084 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user 16:41:59.0875 1084 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 16:41:59.0875 1084 PEVSystemStart ( UnsignedFile.Multi.Generic ) - skipped by user 16:41:59.0875 1084 PEVSystemStart ( UnsignedFile.Multi.Generic ) - User select action: Skip 16:41:59.0890 1084 PhotoshopElementsDeviceConnect ( UnsignedFile.Multi.Generic ) - skipped by user 16:41:59.0890 1084 PhotoshopElementsDeviceConnect ( UnsignedFile.Multi.Generic ) - User select action: Skip 16:41:59.0890 1084 snapman ( UnsignedFile.Multi.Generic ) - skipped by user 16:41:59.0890 1084 snapman ( UnsignedFile.Multi.Generic ) - User select action: Skip 16:41:59.0890 1084 ssoftnt4 ( UnsignedFile.Multi.Generic ) - skipped by user 16:41:59.0890 1084 ssoftnt4 ( UnsignedFile.Multi.Generic ) - User select action: Skip 16:41:59.0890 1084 tifsfilter ( UnsignedFile.Multi.Generic ) - skipped by user 16:41:59.0890 1084 tifsfilter ( UnsignedFile.Multi.Generic ) - User select action: Skip 16:41:59.0890 1084 timounter ( UnsignedFile.Multi.Generic ) - skipped by user 16:41:59.0890 1084 timounter ( UnsignedFile.Multi.Generic ) - User select action: Skip 16:41:59.0890 1084 Video3D ( UnsignedFile.Multi.Generic ) - skipped by user 16:41:59.0890 1084 Video3D ( UnsignedFile.Multi.Generic ) - User select action: Skip 16:42:00.0625 1084 \Device\Harddisk0\DR0\# - copied to quarantine 16:42:00.0640 1084 \Device\Harddisk0\DR0 - copied to quarantine 16:42:00.0656 1084 \Device\Harddisk0\DR0\TDLFS\ldrm - copied to quarantine 16:42:00.0687 1084 \Device\Harddisk0\DR0\TDLFS\cmd.dll - copied to quarantine 16:42:12.0296 1084 \Device\Harddisk0\DR0\TDLFS\cmd64.dll - copied to quarantine 16:42:14.0906 1084 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine 16:42:16.0015 1084 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine 16:42:16.0921 1084 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine 16:42:17.0812 1084 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine 16:42:18.0671 1084 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine 16:42:18.0671 1084 \Device\Harddisk0\DR0\TDLFS\servers.dat - copied to quarantine 16:42:18.0671 1084 \Device\Harddisk0\DR0\TDLFS\ldr16 - copied to quarantine 16:42:18.0718 1084 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine 16:42:20.0015 1084 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine 16:42:20.0859 1084 \Device\Harddisk0\DR0\TDLFS\s - copied to quarantine 16:42:20.0859 1084 \Device\Harddisk0\DR0\TDLFS\u - copied to quarantine 16:42:20.0921 1084 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine 16:42:21.0828 1084 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - will be cured on reboot 16:42:21.0843 1084 \Device\Harddisk0\DR0 - ok 16:42:21.0875 1084 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Cure 16:42:21.0875 1084 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user 16:42:21.0875 1084 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip 16:42:44.0515 5740 Deinitialize success —— ESET Log of the first TDSS Run: 7/19/2012 4:42:21 PM Real-time file system protection file C:\TDSSKiller_Quarantine\19.07.2012_16.34.20\mbr0000\tdlfs0000\tsk0006.dta a variant of Win32/Olmarik.AYI trojan cleaned by deleting - quarantined GLIQ-SERVICES\Edward Event occurred on a new file created by the application: C:\Documents and Settings\Edward\Desktop\tdsskiller.exe. 7/19/2012 4:42:20 PM Real-time file system protection file C:\TDSSKiller_Quarantine\19.07.2012_16.34.20\mbr0000\tdlfs0000\tsk0004.dta Win64/Olmarik.AK trojan cleaned by deleting - quarantined GLIQ-SERVICES\Edward Event occurred on a new file created by the application: C:\Documents and Settings\Edward\Desktop\tdsskiller.exe. 7/19/2012 4:42:19 PM Real-time file system protection file C:\TDSSKiller_Quarantine\19.07.2012_16.34.20\mbr0000\tdlfs0000\tsk0004.dta Win32/Olmarik.AFK trojan cleaned by deleting - quarantined GLIQ-SERVICES\Edward Event occurred on a new file created by the application: C:\Documents and Settings\Edward\Desktop\tdsskiller.exe. 7/19/2012 4:42:18 PM Real-time file system protection file C:\TDSSKiller_Quarantine\19.07.2012_16.34.20\mbr0000\tdlfs0000\tsk0001.dta Win64/Olmarik.AK trojan cleaned by deleting - quarantined GLIQ-SERVICES\Edward Event occurred on a new file created by the application: C:\Documents and Settings\Edward\Desktop\tdsskiller.exe. 7/19/2012 4:42:17 PM Real-time file system protection file C:\TDSSKiller_Quarantine\19.07.2012_16.34.20\mbr0000\tdlfs0000\tsk0001.dta a variant of Win32/Rootkit.Kryptik.MY trojan cleaned by deleting - quarantined GLIQ-SERVICES\Edward Event occurred on a new file created by the application: C:\Documents and Settings\Edward\Desktop\tdsskiller.exe. 7/19/2012 4:42:16 PM Real-time file system protection file C:\TDSSKiller_Quarantine\19.07.2012_16.34.20\mbr0000\tdlfs0000\tsk0001.dta Win64/Olmarik.AL trojan cleaned by deleting - quarantined GLIQ-SERVICES\Edward Event occurred on a new file created by the application: C:\Documents and Settings\Edward\Desktop\tdsskiller.exe. 7/19/2012 4:42:15 PM Real-time file system protection file C:\TDSSKiller_Quarantine\19.07.2012_16.34.20\mbr0000\tdlfs0000\tsk0001.dta Win32/Olmarik.AYH trojan cleaned by deleting - quarantined GLIQ-SERVICES\Edward Event occurred on a new file created by the application: C:\Documents and Settings\Edward\Desktop\tdsskiller.exe. 7/19/2012 4:42:14 PM Real-time file system protection file C:\TDSSKiller_Quarantine\19.07.2012_16.34.20\mbr0000\tdlfs0000\tsk0001.dta a variant of Win32/Olmarik.AYI trojan cleaned by deleting - quarantined GLIQ-SERVICES\Edward Event occurred on a new file created by the application: C:\Documents and Settings\Edward\Desktop\tdsskiller.exe. 7/19/2012 4:42:14 PM Real-time file system protection file C:\TDSSKiller_Quarantine\19.07.2012_16.34.20\mbr0000\tdlfs0000\tsk0002.dta Win64/Olmarik.AK trojan cleaned by deleting - quarantined GLIQ-SERVICES\Edward Event occurred on a new file created by the application: C:\Documents and Settings\Edward\Desktop\tdsskiller.exe.

Gliq.Info

Post #8July 19, 2012, 9:37 PM UTC

This is the Log File of the 2nd run of TDSS… filename: TDSSKiller.2.7.46.0_19.07.2012_17.09.06_log.txt - 7/19/2012 5:16 PM ESET and Malwarebytes were shut down so there is no ESET Logfile 17:09:06.0906 5540 TDSS rootkit removing tool 2.7.46.0 Jul 16 2012 22:10:11 17:09:07.0187 5540 ============================================================ 17:09:07.0187 5540 Current date / time: 2012/07/19 17:09:07.0187 17:09:07.0187 5540 SystemInfo: 17:09:07.0187 5540 17:09:07.0187 5540 OS Version: 5.1.2600 ServicePack: 3.0 17:09:07.0187 5540 Product type: Workstation 17:09:07.0187 5540 ComputerName: GLIQ-SERVICES 17:09:07.0187 5540 UserName: Edward 17:09:07.0187 5540 Windows directory: C:\WINDOWS 17:09:07.0187 5540 System windows directory: C:\WINDOWS 17:09:07.0187 5540 Processor architecture: Intel x86 17:09:07.0187 5540 Number of processors: 2 17:09:07.0187 5540 Page size: 0x1000 17:09:07.0187 5540 Boot type: Normal boot 17:09:07.0187 5540 ============================================================ 17:09:09.0390 5540 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 17:09:09.0406 5540 ============================================================ 17:09:09.0406 5540 \Device\Harddisk0\DR0: 17:09:09.0406 5540 MBR partitions: 17:09:09.0406 5540 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x14000, BlocksNum 0x38FE9828 17:09:09.0406 5540 ============================================================ 17:09:09.0437 5540 C: <-> \Device\Harddisk0\DR0\Partition0 17:09:09.0437 5540 ============================================================ 17:09:09.0437 5540 Initialize success 17:09:09.0437 5540 ============================================================ 17:09:33.0140 5676 ============================================================ 17:09:33.0140 5676 Scan started 17:09:33.0140 5676 Mode: Manual; 17:09:33.0140 5676 ============================================================ 17:09:34.0250 5676 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269 (a15069eec83ebc54150564b2585cfdba) C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe 17:09:34.0250 5676 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269 - ok 17:09:34.0343 5676 Abiosdsk - ok 17:09:34.0343 5676 abp480n5 - ok 17:09:34.0390 5676 ACDaemon (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe 17:09:34.0390 5676 ACDaemon - ok 17:09:34.0437 5676 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 17:09:34.0437 5676 ACPI - ok 17:09:34.0484 5676 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 17:09:34.0484 5676 ACPIEC - ok 17:09:34.0578 5676 AcrSch2Svc (ab25414d8ca040d1c9dae71724fe1283) C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe 17:09:34.0578 5676 AcrSch2Svc - ok 17:09:34.0625 5676 AdobeActiveFileMonitor (e42f7b36b4d8866184e8df9776ca4226) C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe 17:09:34.0625 5676 AdobeActiveFileMonitor - ok 17:09:34.0703 5676 AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 17:09:34.0703 5676 AdobeFlashPlayerUpdateSvc - ok 17:09:34.0718 5676 adpu160m - ok 17:09:34.0765 5676 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 17:09:34.0781 5676 aec - ok 17:09:34.0828 5676 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys 17:09:34.0843 5676 AFD - ok 17:09:34.0843 5676 Aha154x - ok 17:09:34.0843 5676 aic78u2 - ok 17:09:34.0859 5676 aic78xx - ok 17:09:34.0890 5676 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll 17:09:34.0890 5676 Alerter - ok 17:09:34.0921 5676 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe 17:09:34.0921 5676 ALG - ok 17:09:34.0937 5676 AliIde - ok 17:09:34.0937 5676 amsint - ok 17:09:35.0046 5676 Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 17:09:35.0046 5676 Apple Mobile Device - ok 17:09:35.0062 5676 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll 17:09:35.0062 5676 AppMgmt - ok 17:09:35.0062 5676 asc - ok 17:09:35.0078 5676 asc3350p - ok 17:09:35.0078 5676 asc3550 - ok 17:09:35.0171 5676 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 17:09:35.0171 5676 aspnet_state - ok 17:09:35.0218 5676 asusgsb (d320732bcf5ff856120bd06855c66867) C:\WINDOWS\system32\drivers\asusgsb.sys 17:09:35.0218 5676 asusgsb - ok 17:09:35.0265 5676 asuskbnt (b3b881eb81013aac11594a5400ada47a) C:\WINDOWS\system32\drivers\atkkbnt.sys 17:09:35.0265 5676 asuskbnt - ok 17:09:35.0281 5676 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 17:09:35.0281 5676 AsyncMac - ok 17:09:35.0328 5676 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 17:09:35.0328 5676 atapi - ok 17:09:35.0343 5676 Atdisk - ok 17:09:35.0406 5676 Ati HotKey Poller (fde5fae31394a586f9ccc7300b6ad681) C:\WINDOWS\system32\Ati2evxx.exe 17:09:35.0468 5676 Ati HotKey Poller - ok 17:09:35.0843 5676 ati2mtag (23f1a61ae7553d086ef264c72afc4e6a) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 17:09:35.0906 5676 ati2mtag - ok 17:09:36.0046 5676 AtiHDAudioService (0d6b8359677d05142b624f09c28d643a) C:\WINDOWS\system32\drivers\AtihdXP3.sys 17:09:36.0046 5676 AtiHDAudioService - ok 17:09:36.0109 5676 ATKKeyboardService (34b661d95e07149b7bd866c407a17370) C:\WINDOWS\ATKKBService.exe 17:09:36.0703 5676 ATKKeyboardService - ok 17:09:36.0750 5676 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 17:09:36.0750 5676 Atmarpc - ok 17:09:36.0796 5676 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll 17:09:36.0812 5676 AudioSrv - ok 17:09:36.0859 5676 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 17:09:36.0859 5676 audstub - ok 17:09:36.0921 5676 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 17:09:36.0921 5676 Beep - ok 17:09:36.0984 5676 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll 17:09:37.0046 5676 BITS - ok 17:09:37.0203 5676 Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe 17:09:37.0250 5676 Bonjour Service - ok 17:09:37.0265 5676 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll 17:09:37.0281 5676 Browser - ok 17:09:37.0421 5676 catchme - ok 17:09:37.0468 5676 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 17:09:37.0468 5676 cbidf2k - ok 17:09:37.0468 5676 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 17:09:37.0468 5676 CCDECODE - ok 17:09:37.0468 5676 cd20xrnt - ok 17:09:37.0515 5676 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 17:09:37.0531 5676 Cdaudio - ok 17:09:37.0562 5676 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 17:09:37.0562 5676 Cdfs - ok 17:09:37.0625 5676 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 17:09:37.0625 5676 Cdrom - ok 17:09:37.0640 5676 cerc6 - ok 17:09:37.0640 5676 Changer - ok 17:09:37.0687 5676 CinemaNow Service (127d4d0e9f78834ffd1eeea3fcfb47c1) C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe 17:09:37.0687 5676 CinemaNow Service - ok 17:09:37.0718 5676 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe 17:09:37.0718 5676 CiSvc - ok 17:09:37.0734 5676 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe 17:09:37.0734 5676 ClipSrv - ok 17:09:37.0843 5676 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 17:09:37.0843 5676 clr_optimization_v2.0.50727_32 - ok 17:09:37.0843 5676 CmdIde - ok 17:09:37.0859 5676 COMSysApp - ok 17:09:37.0859 5676 Cpqarray - ok 17:09:37.0875 5676 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll 17:09:37.0875 5676 CryptSvc - ok 17:09:37.0984 5676 cypherixservice (aba88a0c73f3370ab5833b3c63b0d9c8) C:\WINDOWS\system32\cypherixsrv.exe 17:09:37.0984 5676 cypherixservice - ok 17:09:38.0000 5676 cyphxdrv (dad9c8cb36dc938b7c4713b2cb232f1c) C:\WINDOWS\system32\Drivers\cyphxdrv.sys 17:09:38.0000 5676 cyphxdrv - ok 17:09:38.0000 5676 dac2w2k - ok 17:09:38.0015 5676 dac960nt - ok 17:09:38.0093 5676 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll 17:09:38.0093 5676 DcomLaunch - ok 17:09:38.0156 5676 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll 17:09:38.0156 5676 Dhcp - ok 17:09:38.0187 5676 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 17:09:38.0187 5676 Disk - ok 17:09:38.0187 5676 dmadmin - ok 17:09:38.0281 5676 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 17:09:38.0296 5676 dmboot - ok 17:09:38.0312 5676 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 17:09:38.0312 5676 dmio - ok 17:09:38.0328 5676 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 17:09:38.0328 5676 dmload - ok 17:09:38.0359 5676 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll 17:09:38.0359 5676 dmserver - ok 17:09:38.0421 5676 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 17:09:38.0421 5676 DMusic - ok 17:09:38.0468 5676 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll 17:09:38.0484 5676 Dnscache - ok 17:09:38.0500 5676 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll 17:09:38.0500 5676 Dot3svc - ok 17:09:38.0515 5676 dpti2o - ok 17:09:38.0562 5676 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 17:09:38.0562 5676 drmkaud - ok 17:09:38.0609 5676 eamon (8c2b6bbc82ad12cd9a2e73e5dcbba705) C:\WINDOWS\system32\DRIVERS\eamon.sys 17:09:38.0609 5676 eamon - ok 17:09:38.0609 5676 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll 17:09:38.0609 5676 EapHost - ok 17:09:38.0625 5676 efavdrv - ok 17:09:38.0656 5676 ehdrv (5412ed24fffca64e2f0168399b86c952) C:\WINDOWS\system32\DRIVERS\ehdrv.sys 17:09:38.0656 5676 ehdrv - ok 17:09:38.0875 5676 ekrn (ad4faade819e0da9933bea7c01d2c763) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe 17:09:38.0875 5676 ekrn - ok 17:09:38.0937 5676 epfwtdir (cf1108161dfedd82ae811307a3763e1c) C:\WINDOWS\system32\DRIVERS\epfwtdir.sys 17:09:38.0937 5676 epfwtdir - ok 17:09:39.0000 5676 EpsonBidirectionalService (abdd5ad016affd34ad40e944ce94bf59) C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe 17:09:39.0000 5676 EpsonBidirectionalService - ok 17:09:39.0093 5676 EPSON_EB_RPCV4_01 (ec6a73cd8413f68655e5e0b99c415a21) C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE 17:09:39.0093 5676 EPSON_EB_RPCV4_01 - ok 17:09:39.0140 5676 EPSON_PM_RPCV4_01 (8fe6ab59cab8f2c038fea9522a5eeba7) C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE 17:09:39.0140 5676 EPSON_PM_RPCV4_01 - ok 17:09:39.0140 5676 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll 17:09:39.0140 5676 ERSvc - ok 17:09:39.0203 5676 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 17:09:39.0203 5676 Eventlog - ok 17:09:39.0250 5676 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll 17:09:39.0250 5676 EventSystem - ok 17:09:39.0281 5676 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 17:09:39.0296 5676 Fastfat - ok 17:09:39.0343 5676 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 17:09:39.0375 5676 FastUserSwitchingCompatibility - ok 17:09:39.0421 5676 Fax (e97d6a8684466df94ff3bc24fb787a07) C:\WINDOWS\system32\fxssvc.exe 17:09:39.0421 5676 Fax - ok 17:09:39.0484 5676 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys 17:09:39.0484 5676 Fdc - ok 17:09:39.0500 5676 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 17:09:39.0500 5676 Fips - ok 17:09:39.0500 5676 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys 17:09:39.0500 5676 Flpydisk - ok 17:09:39.0562 5676 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys 17:09:39.0562 5676 FltMgr - ok 17:09:39.0718 5676 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 17:09:39.0718 5676 FontCache3.0.0.0 - ok 17:09:39.0750 5676 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 17:09:39.0750 5676 Fs_Rec - ok 17:09:39.0765 5676 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 17:09:39.0765 5676 Ftdisk - ok 17:09:39.0812 5676 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 17:09:39.0812 5676 GEARAspiWDM - ok 17:09:39.0812 5676 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 17:09:39.0812 5676 Gpc - ok 17:09:39.0953 5676 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe 17:09:39.0953 5676 gupdate - ok 17:09:39.0968 5676 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe 17:09:39.0968 5676 gupdatem - ok 17:09:40.0015 5676 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 17:09:40.0015 5676 HDAudBus - ok 17:09:40.0062 5676 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 17:09:40.0062 5676 helpsvc - ok 17:09:40.0078 5676 HidServ - ok 17:09:40.0125 5676 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 17:09:40.0125 5676 hidusb - ok 17:09:40.0187 5676 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll 17:09:40.0187 5676 hkmsvc - ok 17:09:40.0187 5676 hpn - ok 17:09:40.0281 5676 HSFHWBS2 (3e0b68288e468190a5bf4c2ef5998a18) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 17:09:40.0296 5676 HSFHWBS2 - ok 17:09:40.0375 5676 HSF_DPV (bd2abf12938a2fccc340873412c2b2ab) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys 17:09:40.0390 5676 HSF_DPV - ok 17:09:40.0453 5676 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 17:09:40.0453 5676 HTTP - ok 17:09:40.0484 5676 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll 17:09:40.0531 5676 HTTPFilter - ok 17:09:40.0531 5676 i2omgmt - ok 17:09:40.0531 5676 i2omp - ok 17:09:40.0578 5676 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\drivers\i8042prt.sys 17:09:40.0578 5676 i8042prt - ok 17:09:40.0921 5676 ialm (66a685b05066683621920bc14a45cfe8) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 17:09:41.0031 5676 ialm - ok 17:09:41.0156 5676 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe 17:09:41.0171 5676 IDriverT - ok 17:09:41.0328 5676 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 17:09:41.0343 5676 idsvc - ok 17:09:41.0468 5676 IISADMIN (db3c22745c0da4666f3be31f1af36b2f) C:\WINDOWS\system32\inetsrv\inetinfo.exe 17:09:41.0484 5676 IISADMIN - ok 17:09:41.0531 5676 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 17:09:41.0531 5676 Imapi - ok 17:09:41.0593 5676 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe 17:09:41.0609 5676 ImapiService - ok 17:09:41.0609 5676 ini910u - ok 17:09:41.0906 5676 IntcAzAudAddService (2feb5bf0312e1cb76cd2caa875cbaa5d) C:\WINDOWS\system32\drivers\RtkHDAud.sys 17:09:41.0953 5676 IntcAzAudAddService - ok 17:09:41.0984 5676 IntelIde - ok 17:09:42.0031 5676 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys 17:09:42.0031 5676 intelppm - ok 17:09:42.0031 5676 IOMap - ok 17:09:42.0062 5676 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 17:09:42.0062 5676 Ip6Fw - ok 17:09:42.0093 5676 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 17:09:42.0093 5676 IpFilterDriver - ok 17:09:42.0093 5676 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 17:09:42.0093 5676 IpInIp - ok 17:09:42.0125 5676 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 17:09:42.0125 5676 IpNat - ok 17:09:42.0265 5676 iPod Service (57edb35ea2feca88f8b17c0c095c9a56) C:\Program Files\iPod\bin\iPodService.exe 17:09:42.0281 5676 iPod Service - ok 17:09:42.0359 5676 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 17:09:42.0359 5676 IPSec - ok 17:09:42.0406 5676 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 17:09:42.0421 5676 IRENUM - ok 17:09:42.0453 5676 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 17:09:42.0468 5676 isapnp - ok 17:09:42.0562 5676 JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Program Files\Java\jre6\bin\jqs.exe 17:09:42.0562 5676 JavaQuickStarterService - ok 17:09:42.0609 5676 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 17:09:42.0609 5676 Kbdclass - ok 17:09:42.0656 5676 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 17:09:42.0671 5676 kbdhid - ok 17:09:42.0718 5676 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 17:09:42.0734 5676 kmixer - ok 17:09:42.0750 5676 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 17:09:42.0750 5676 KSecDD - ok 17:09:42.0796 5676 LanmanServer (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll 17:09:42.0796 5676 LanmanServer - ok 17:09:42.0843 5676 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll 17:09:42.0859 5676 lanmanworkstation - ok 17:09:42.0859 5676 lbrtfdc - ok 17:09:42.0906 5676 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll 17:09:42.0906 5676 LmHosts - ok 17:09:42.0937 5676 MBAMProtector (6dfe7f2e8e8a337263aa5c92a215f161) C:\WINDOWS\system32\drivers\mbam.sys 17:09:42.0937 5676 MBAMProtector - ok 17:09:43.0015 5676 MBAMService (43683e970f008c93c9429ef428147a54) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 17:09:43.0062 5676 MBAMService - ok 17:09:43.0140 5676 McComponentHostService (fd3ad5e1ecdaa94a89d6697f5c5465d6) C:\Program Files\McAfee Security Scan\2.1.121\McCHSvc.exe 17:09:43.0156 5676 McComponentHostService - ok 17:09:43.0203 5676 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 17:09:43.0203 5676 mdmxsdk - ok 17:09:43.0234 5676 MemeoBackgroundService (10b012345f08d4d82a8ec41736e3d5ba) C:\Program Files\Memeo\AutoBackup\MemeoBackgroundService.exe 17:09:43.0234 5676 MemeoBackgroundService - ok 17:09:43.0234 5676 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll 17:09:43.0250 5676 Messenger - ok 17:09:43.0265 5676 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 17:09:43.0265 5676 mnmdd - ok 17:09:43.0281 5676 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe 17:09:43.0281 5676 mnmsrvc - ok 17:09:43.0296 5676 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 17:09:43.0296 5676 Modem - ok 17:09:43.0359 5676 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys 17:09:43.0359 5676 MODEMCSA - ok 17:09:43.0359 5676 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 17:09:43.0359 5676 Mouclass - ok 17:09:43.0375 5676 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 17:09:43.0375 5676 mouhid - ok 17:09:43.0375 5676 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 17:09:43.0375 5676 MountMgr - ok 17:09:43.0375 5676 mraid35x - ok 17:09:43.0390 5676 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 17:09:43.0390 5676 MRxDAV - ok 17:09:43.0468 5676 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 17:09:43.0484 5676 MRxSmb - ok 17:09:43.0515 5676 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe 17:09:43.0531 5676 MSDTC - ok 17:09:43.0531 5676 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 17:09:43.0531 5676 Msfs - ok 17:09:43.0531 5676 MSIServer - ok 17:09:43.0593 5676 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 17:09:43.0593 5676 MSKSSRV - ok 17:09:43.0609 5676 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 17:09:43.0625 5676 MSPCLOCK - ok 17:09:43.0640 5676 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 17:09:43.0640 5676 MSPQM - ok 17:09:43.0703 5676 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 17:09:43.0703 5676 mssmbios - ok 17:09:43.0734 5676 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys 17:09:43.0734 5676 MSTEE - ok 17:09:43.0750 5676 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys 17:09:43.0750 5676 Mup - ok 17:09:43.0796 5676 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 17:09:43.0796 5676 NABTSFEC - ok 17:09:43.0843 5676 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll 17:09:43.0843 5676 napagent - ok 17:09:43.0906 5676 NasPmService - ok 17:09:43.0953 5676 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 17:09:43.0953 5676 NDIS - ok 17:09:44.0000 5676 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys 17:09:44.0000 5676 NdisIP - ok 17:09:44.0015 5676 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 17:09:44.0015 5676 NdisTapi - ok 17:09:44.0046 5676 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 17:09:44.0046 5676 Ndisuio - ok 17:09:44.0062 5676 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 17:09:44.0062 5676 NdisWan - ok 17:09:44.0093 5676 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys 17:09:44.0093 5676 NDProxy - ok 17:09:44.0093 5676 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 17:09:44.0093 5676 NetBIOS - ok 17:09:44.0140 5676 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 17:09:44.0140 5676 NetBT - ok 17:09:44.0156 5676 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 17:09:44.0171 5676 NetDDE - ok 17:09:44.0171 5676 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 17:09:44.0171 5676 NetDDEdsdm - ok 17:09:44.0187 5676 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 17:09:44.0187 5676 Netlogon - ok 17:09:44.0218 5676 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll 17:09:44.0218 5676 Netman - ok 17:09:44.0312 5676 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 17:09:44.0312 5676 NetTcpPortSharing - ok 17:09:44.0406 5676 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll 17:09:44.0406 5676 Nla - ok 17:09:44.0531 5676 nmservice (cd569fa91ec6f59d045c19d0d3850f44) C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe 17:09:44.0546 5676 nmservice - ok 17:09:44.0562 5676 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 17:09:44.0562 5676 Npfs - ok 17:09:44.0578 5676 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 17:09:44.0593 5676 Ntfs - ok 17:09:44.0593 5676 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 17:09:44.0593 5676 NtLmSsp - ok 17:09:44.0656 5676 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll 17:09:44.0671 5676 NtmsSvc - ok 17:09:44.0718 5676 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 17:09:44.0718 5676 Null - ok 17:09:44.0781 5676 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 17:09:44.0781 5676 NwlnkFlt - ok 17:09:44.0781 5676 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 17:09:44.0781 5676 NwlnkFwd - ok 17:09:44.0812 5676 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 17:09:44.0812 5676 ose - ok 17:09:44.0828 5676 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys 17:09:44.0843 5676 Parport - ok 17:09:44.0843 5676 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 17:09:44.0843 5676 PartMgr - ok 17:09:44.0875 5676 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 17:09:44.0875 5676 ParVdm - ok 17:09:44.0875 5676 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 17:09:44.0875 5676 PCI - ok 17:09:44.0890 5676 PCIDump - ok 17:09:44.0890 5676 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 17:09:44.0890 5676 PCIIde - ok 17:09:44.0890 5676 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 17:09:44.0906 5676 Pcmcia - ok 17:09:44.0906 5676 PDCOMP - ok 17:09:44.0906 5676 PDFRAME - ok 17:09:44.0906 5676 PDRELI - ok 17:09:44.0906 5676 PDRFRAME - ok 17:09:44.0921 5676 perc2 - ok 17:09:44.0921 5676 perc2hib - ok 17:09:45.0125 5676 PEVSystemStart (f042ee4c8d66248d9b86dcf52abae416) C:\ComboFix\pev.3XE 17:09:45.0187 5676 PEVSystemStart - ok 17:09:45.0265 5676 PhotoshopElementsDeviceConnect (d0f9f362023bf94cf58a1c3cdbbebe06) C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe 17:09:45.0265 5676 PhotoshopElementsDeviceConnect - ok 17:09:45.0343 5676 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 17:09:45.0343 5676 PlugPlay - ok 17:09:45.0406 5676 pnarp (36fcac4fa28b462ca867742dea59b0d0) C:\WINDOWS\system32\DRIVERS\pnarp.sys 17:09:45.0406 5676 pnarp - ok 17:09:45.0437 5676 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 17:09:45.0437 5676 PolicyAgent - ok 17:09:45.0468 5676 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 17:09:45.0468 5676 PptpMiniport - ok 17:09:45.0468 5676 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 17:09:45.0468 5676 ProtectedStorage - ok 17:09:45.0484 5676 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 17:09:45.0484 5676 PSched - ok 17:09:45.0515 5676 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 17:09:45.0515 5676 Ptilink - ok 17:09:45.0546 5676 purendis (d8ac00388262b1a4878a7ee12f31d376) C:\WINDOWS\system32\DRIVERS\purendis.sys 17:09:45.0546 5676 purendis - ok 17:09:45.0578 5676 PxHelp20 (40fedd328f98245ad201cf5f9f311724) C:\WINDOWS\system32\Drivers\PxHelp20.sys 17:09:45.0578 5676 PxHelp20 - ok 17:09:45.0578 5676 ql1080 - ok 17:09:45.0593 5676 Ql10wnt - ok 17:09:45.0593 5676 ql12160 - ok 17:09:45.0609 5676 ql1240 - ok 17:09:45.0609 5676 ql1280 - ok 17:09:45.0656 5676 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 17:09:45.0671 5676 RasAcd - ok 17:09:45.0718 5676 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll 17:09:45.0718 5676 RasAuto - ok 17:09:45.0750 5676 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 17:09:45.0750 5676 Rasl2tp - ok 17:09:45.0796 5676 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll 17:09:45.0812 5676 RasMan - ok 17:09:45.0828 5676 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 17:09:45.0828 5676 RasPppoe - ok 17:09:45.0828 5676 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 17:09:45.0828 5676 Raspti - ok 17:09:45.0890 5676 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 17:09:45.0890 5676 Rdbss - ok 17:09:45.0937 5676 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 17:09:45.0937 5676 RDPCDD - ok 17:09:45.0984 5676 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 17:09:45.0984 5676 rdpdr - ok 17:09:46.0015 5676 RDPWD (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys 17:09:46.0031 5676 RDPWD - ok 17:09:46.0031 5676 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe 17:09:46.0046 5676 RDSessMgr - ok 17:09:46.0078 5676 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 17:09:46.0078 5676 redbook - ok 17:09:46.0109 5676 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll 17:09:46.0109 5676 RemoteAccess - ok 17:09:46.0140 5676 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll 17:09:46.0140 5676 RemoteRegistry - ok 17:09:46.0390 5676 RoxMediaDB12 (ff578453d3b3adaab22d7151d7f9e592) C:\Program Files\Common Files\Roxio Shared\12.0\SharedCOM\RoxMediaDB12.exe 17:09:46.0437 5676 RoxMediaDB12 - ok 17:09:46.0484 5676 RoxWatch12 (71b38b8df1a9b55fc0fb64958cc7b9dd) C:\Program Files\Common Files\Roxio Shared\12.0\SharedCOM\RoxWatch12.exe 17:09:46.0484 5676 RoxWatch12 - ok 17:09:46.0593 5676 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe 17:09:46.0609 5676 RpcLocator - ok 17:09:46.0671 5676 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll 17:09:46.0671 5676 RpcSs - ok 17:09:46.0734 5676 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe 17:09:46.0734 5676 RSVP - ok 17:09:46.0796 5676 RTLE8023xp (839141088ad7ee90f5b441b2d1afd22c) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys 17:09:46.0796 5676 RTLE8023xp - ok 17:09:46.0843 5676 SahdIa32 (0b2d5d2341437d7d7e1a6c7bbce3786a) C:\WINDOWS\system32\Drivers\SahdIa32.sys 17:09:46.0843 5676 SahdIa32 - ok 17:09:46.0875 5676 SaibIa32 (7a5f65b16249af2bc9d18d815f5d7172) C:\WINDOWS\system32\Drivers\SaibIa32.sys 17:09:46.0875 5676 SaibIa32 - ok 17:09:46.0921 5676 SaibVd32 (e333c9515822de586a3ff759a0c9b7bf) C:\WINDOWS\system32\Drivers\SaibVd32.sys 17:09:46.0921 5676 SaibVd32 - ok 17:09:46.0921 5676 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 17:09:46.0921 5676 SamSs - ok 17:09:46.0953 5676 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe 17:09:46.0953 5676 SCardSvr - ok 17:09:47.0000 5676 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll 17:09:47.0000 5676 Schedule - ok 17:09:47.0031 5676 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 17:09:47.0031 5676 Secdrv - ok 17:09:47.0046 5676 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll 17:09:47.0046 5676 seclogon - ok 17:09:47.0062 5676 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll 17:09:47.0062 5676 SENS - ok 17:09:47.0109 5676 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys 17:09:47.0109 5676 Serial - ok 17:09:47.0125 5676 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 17:09:47.0125 5676 Sfloppy - ok 17:09:47.0187 5676 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 17:09:47.0187 5676 ShellHWDetection - ok 17:09:47.0187 5676 Simbad - ok 17:09:47.0234 5676 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys 17:09:47.0234 5676 SLIP - ok 17:09:47.0265 5676 SMTPSVC (db3c22745c0da4666f3be31f1af36b2f) C:\WINDOWS\system32\inetsrv\inetinfo.exe 17:09:47.0265 5676 SMTPSVC - ok 17:09:47.0296 5676 snapman (01080d3a58ba5b6167849a3307e61d1a) C:\WINDOWS\system32\DRIVERS\snapman.sys 17:09:47.0296 5676 snapman - ok 17:09:47.0343 5676 SNMP (60c377be6b3cc83f6a8584934b181d2e) C:\WINDOWS\System32\snmp.exe 17:09:47.0343 5676 SNMP - ok 17:09:47.0375 5676 SNMPTRAP (80a050795a107a76c2b1cd4cfbe010e6) C:\WINDOWS\System32\snmptrap.exe 17:09:47.0375 5676 SNMPTRAP - ok 17:09:47.0375 5676 Sparrow - ok 17:09:47.0421 5676 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 17:09:47.0421 5676 splitter - ok 17:09:47.0468 5676 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe 17:09:47.0468 5676 Spooler - ok 17:09:47.0484 5676 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 17:09:47.0484 5676 sr - ok 17:09:47.0484 5676 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll 17:09:47.0500 5676 srservice - ok 17:09:47.0562 5676 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys 17:09:47.0562 5676 Srv - ok 17:09:47.0609 5676 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll 17:09:47.0609 5676 SSDPSRV - ok 17:09:47.0640 5676 ssoftnt4 (9c6e560f2de42102550f77b8914e6b88) C:\WINDOWS\system32\Drivers\ssoftnt4.sys 17:09:47.0640 5676 ssoftnt4 - ok 17:09:47.0640 5676 ssoftservice - ok 17:09:47.0703 5676 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll 17:09:47.0703 5676 stisvc - ok 17:09:47.0734 5676 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys 17:09:47.0734 5676 streamip - ok 17:09:47.0750 5676 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 17:09:47.0750 5676 swenum - ok 17:09:47.0812 5676 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 17:09:47.0812 5676 swmidi - ok 17:09:47.0812 5676 SwPrv - ok 17:09:47.0812 5676 symc810 - ok 17:09:47.0828 5676 symc8xx - ok 17:09:47.0828 5676 sym_hi - ok 17:09:47.0828 5676 sym_u3 - ok 17:09:47.0875 5676 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 17:09:47.0875 5676 sysaudio - ok 17:09:47.0937 5676 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe 17:09:47.0937 5676 SysmonLog - ok 17:09:47.0953 5676 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll 17:09:47.0953 5676 TapiSrv - ok 17:09:48.0015 5676 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 17:09:48.0031 5676 Tcpip - ok 17:09:48.0062 5676 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 17:09:48.0078 5676 TDPIPE - ok 17:09:48.0093 5676 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 17:09:48.0093 5676 TDTCP - ok 17:09:48.0140 5676 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 17:09:48.0140 5676 TermDD - ok 17:09:48.0203 5676 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll 17:09:48.0203 5676 TermService - ok 17:09:48.0265 5676 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 17:09:48.0265 5676 Themes - ok 17:09:48.0265 5676 tifsfilter (304e188496ec723c369e3b27da82f992) C:\WINDOWS\system32\DRIVERS\tifsfilt.sys 17:09:48.0265 5676 tifsfilter - ok 17:09:48.0281 5676 timounter (ac0a6126138403b5913a6d819343034b) C:\WINDOWS\system32\DRIVERS\timntr.sys 17:09:48.0281 5676 timounter - ok 17:09:48.0296 5676 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\system32\tlntsvr.exe 17:09:48.0296 5676 TlntSvr - ok 17:09:48.0296 5676 TosIde - ok 17:09:48.0343 5676 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll 17:09:48.0343 5676 TrkWks - ok 17:09:48.0375 5676 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 17:09:48.0375 5676 Udfs - ok 17:09:48.0375 5676 ultra - ok 17:09:48.0437 5676 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 17:09:48.0437 5676 Update - ok 17:09:48.0468 5676 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll 17:09:48.0468 5676 upnphost - ok 17:09:48.0468 5676 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe 17:09:48.0468 5676 UPS - ok 17:09:48.0546 5676 USBAAPL (eafe1e00739afe6c51487a050e772e17) C:\WINDOWS\system32\Drivers\usbaapl.sys 17:09:48.0546 5676 USBAAPL - ok 17:09:48.0593 5676 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 17:09:48.0593 5676 usbehci - ok 17:09:48.0640 5676 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 17:09:48.0656 5676 usbhub - ok 17:09:48.0687 5676 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys 17:09:48.0687 5676 usbprint - ok 17:09:48.0718 5676 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 17:09:48.0718 5676 usbscan - ok 17:09:48.0750 5676 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 17:09:48.0750 5676 usbstor - ok 17:09:48.0796 5676 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 17:09:48.0796 5676 usbuhci - ok 17:09:48.0843 5676 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 17:09:48.0843 5676 VgaSave - ok 17:09:48.0843 5676 ViaIde - ok 17:09:48.0890 5676 Video3D (8643da4a6c83da6c10fcab1e5ab6632d) C:\WINDOWS\system32\Drivers\Video3D32.sys 17:09:48.0890 5676 Video3D - ok 17:09:49.0000 5676 VideoAcceleratorService - ok 17:09:49.0031 5676 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 17:09:49.0031 5676 VolSnap - ok 17:09:49.0078 5676 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe 17:09:49.0078 5676 VSS - ok 17:09:49.0156 5676 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll 17:09:49.0171 5676 W32Time - ok 17:09:49.0265 5676 W3SVC (db3c22745c0da4666f3be31f1af36b2f) C:\WINDOWS\system32\inetsrv\inetinfo.exe 17:09:49.0265 5676 W3SVC - ok 17:09:49.0281 5676 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 17:09:49.0281 5676 Wanarp - ok 17:09:49.0281 5676 WDICA - ok 17:09:49.0343 5676 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 17:09:49.0343 5676 wdmaud - ok 17:09:49.0390 5676 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll 17:09:49.0390 5676 WebClient - ok 17:09:49.0484 5676 winachsf (ea2ab3c94b1aee6aa22d543f1f0c62aa) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 17:09:49.0484 5676 winachsf - ok 17:09:49.0609 5676 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll 17:09:49.0609 5676 winmgmt - ok 17:09:49.0656 5676 WmdmPmSN (051b1bdecd6dee18c771b5d5ec7f044d) C:\WINDOWS\system32\MsPMSNSv.dll 17:09:49.0656 5676 WmdmPmSN - ok 17:09:49.0718 5676 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll 17:09:49.0718 5676 Wmi - ok 17:09:49.0765 5676 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe 17:09:49.0765 5676 WmiApSrv - ok 17:09:49.0859 5676 WMPNetworkSvc (6bab4dc65515a098505f8b3d01fb6fe5) C:\Program Files\Windows Media Player\WMPNetwk.exe 17:09:49.0875 5676 WMPNetworkSvc - ok 17:09:49.0937 5676 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys 17:09:49.0937 5676 WS2IFSL - ok 17:09:49.0984 5676 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll 17:09:49.0984 5676 wscsvc - ok 17:09:50.0015 5676 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 17:09:50.0015 5676 WSTCODEC - ok 17:09:50.0046 5676 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll 17:09:50.0046 5676 wuauserv - ok 17:09:50.0078 5676 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 17:09:50.0078 5676 WudfPf - ok 17:09:50.0093 5676 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 17:09:50.0093 5676 WudfRd - ok 17:09:50.0093 5676 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll 17:09:50.0093 5676 WudfSvc - ok 17:09:50.0171 5676 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll 17:09:50.0218 5676 WZCSVC - ok 17:09:50.0218 5676 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll 17:09:50.0234 5676 xmlprov - ok 17:09:50.0250 5676 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0 17:09:50.0609 5676 \Device\Harddisk0\DR0 - ok 17:09:50.0609 5676 Boot (0x1200) (b6ba39df77540bc511cf1fe05d5d9398) \Device\Harddisk0\DR0\Partition0 17:09:50.0609 5676 \Device\Harddisk0\DR0\Partition0 - ok 17:09:50.0609 5676 ============================================================ 17:09:50.0609 5676 Scan finished 17:09:50.0609 5676 ============================================================ 17:09:50.0625 4608 Detected object count: 0 17:09:50.0625 4608 Actual detected object count: 0 17:10:01.0328 5788 ============================================================ 17:10:01.0328 5788 Scan started 17:10:01.0328 5788 Mode: Manual; SigCheck; TDLFS; 17:10:01.0328 5788 ============================================================ 17:10:02.0140 5788 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269 (a15069eec83ebc54150564b2585cfdba) C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe 17:10:02.0375 5788 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269 - ok 17:10:02.0375 5788 Abiosdsk - ok 17:10:02.0375 5788 abp480n5 - ok 17:10:02.0421 5788 ACDaemon (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe 17:10:02.0437 5788 ACDaemon - ok 17:10:02.0484 5788 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 17:10:03.0375 5788 ACPI - ok 17:10:03.0421 5788 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 17:10:03.0593 5788 ACPIEC - ok 17:10:03.0687 5788 AcrSch2Svc (ab25414d8ca040d1c9dae71724fe1283) C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe 17:10:03.0703 5788 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - warning 17:10:03.0703 5788 AcrSch2Svc - detected UnsignedFile.Multi.Generic (1) 17:10:03.0843 5788 AdobeActiveFileMonitor (e42f7b36b4d8866184e8df9776ca4226) C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe 17:10:03.0859 5788 AdobeActiveFileMonitor ( UnsignedFile.Multi.Generic ) - warning 17:10:03.0859 5788 AdobeActiveFileMonitor - detected UnsignedFile.Multi.Generic (1) 17:10:03.0953 5788 AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 17:10:03.0968 5788 AdobeFlashPlayerUpdateSvc - ok 17:10:03.0968 5788 adpu160m - ok 17:10:04.0031 5788 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 17:10:04.0093 5788 aec - ok 17:10:04.0171 5788 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys 17:10:04.0250 5788 AFD - ok 17:10:04.0250 5788 Aha154x - ok 17:10:04.0265 5788 aic78u2 - ok 17:10:04.0265 5788 aic78xx - ok 17:10:04.0296 5788 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll 17:10:04.0453 5788 Alerter - ok 17:10:04.0468 5788 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe 17:10:04.0515 5788 ALG - ok 17:10:04.0515 5788 AliIde - ok 17:10:04.0515 5788 amsint - ok 17:10:04.0671 5788 Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 17:10:04.0687 5788 Apple Mobile Device - ok 17:10:04.0687 5788 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll 17:10:04.0718 5788 AppMgmt - ok 17:10:04.0718 5788 asc - ok 17:10:04.0734 5788 asc3350p - ok 17:10:04.0734 5788 asc3550 - ok 17:10:04.0812 5788 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 17:10:04.0828 5788 aspnet_state - ok 17:10:04.0859 5788 asusgsb (d320732bcf5ff856120bd06855c66867) C:\WINDOWS\system32\drivers\asusgsb.sys 17:10:04.0875 5788 asusgsb ( UnsignedFile.Multi.Generic ) - warning 17:10:04.0875 5788 asusgsb - detected UnsignedFile.Multi.Generic (1) 17:10:04.0921 5788 asuskbnt (b3b881eb81013aac11594a5400ada47a) C:\WINDOWS\system32\drivers\atkkbnt.sys 17:10:04.0921 5788 asuskbnt ( UnsignedFile.Multi.Generic ) - warning 17:10:04.0921 5788 asuskbnt - detected UnsignedFile.Multi.Generic (1) 17:10:04.0937 5788 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 17:10:05.0000 5788 AsyncMac - ok 17:10:05.0062 5788 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 17:10:05.0140 5788 atapi - ok 17:10:05.0140 5788 Atdisk - ok 17:10:05.0218 5788 Ati HotKey Poller (fde5fae31394a586f9ccc7300b6ad681) C:\WINDOWS\system32\Ati2evxx.exe 17:10:05.0265 5788 Ati HotKey Poller - ok 17:10:05.0656 5788 ati2mtag (23f1a61ae7553d086ef264c72afc4e6a) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 17:10:05.0859 5788 ati2mtag - ok 17:10:05.0968 5788 AtiHDAudioService (0d6b8359677d05142b624f09c28d643a) C:\WINDOWS\system32\drivers\AtihdXP3.sys 17:10:06.0000 5788 AtiHDAudioService - ok 17:10:06.0046 5788 ATKKeyboardService (34b661d95e07149b7bd866c407a17370) C:\WINDOWS\ATKKBService.exe 17:10:06.0062 5788 ATKKeyboardService ( UnsignedFile.Multi.Generic ) - warning 17:10:06.0062 5788 ATKKeyboardService - detected UnsignedFile.Multi.Generic (1) 17:10:06.0062 5788 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 17:10:06.0218 5788 Atmarpc - ok 17:10:06.0265 5788 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll 17:10:06.0359 5788 AudioSrv - ok 17:10:06.0421 5788 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 17:10:06.0500 5788 audstub - ok 17:10:06.0546 5788 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 17:10:06.0625 5788 Beep - ok 17:10:06.0718 5788 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll 17:10:06.0796 5788 BITS - ok 17:10:06.0953 5788 Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe 17:10:06.0968 5788 Bonjour Service - ok 17:10:07.0015 5788 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll 17:10:07.0140 5788 Browser - ok 17:10:07.0281 5788 catchme - ok 17:10:07.0328 5788 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 17:10:07.0500 5788 cbidf2k - ok 17:10:07.0515 5788 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 17:10:07.0609 5788 CCDECODE - ok 17:10:07.0609 5788 cd20xrnt - ok 17:10:07.0640 5788 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 17:10:07.0718 5788 Cdaudio - ok 17:10:07.0734 5788 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 17:10:07.0828 5788 Cdfs - ok 17:10:07.0890 5788 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 17:10:07.0953 5788 Cdrom - ok 17:10:07.0953 5788 cerc6 - ok 17:10:07.0968 5788 Changer - ok 17:10:08.0000 5788 CinemaNow Service (127d4d0e9f78834ffd1eeea3fcfb47c1) C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe 17:10:08.0000 5788 CinemaNow Service - ok 17:10:08.0015 5788 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe 17:10:08.0093 5788 CiSvc - ok 17:10:08.0125 5788 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe 17:10:08.0203 5788 ClipSrv - ok 17:10:08.0296 5788 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 17:10:08.0312 5788 clr_optimization_v2.0.50727_32 - ok 17:10:08.0312 5788 CmdIde - ok 17:10:08.0312 5788 COMSysApp - ok 17:10:08.0328 5788 Cpqarray - ok 17:10:08.0328 5788 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll 17:10:08.0406 5788 CryptSvc - ok 17:10:08.0500 5788 cypherixservice (aba88a0c73f3370ab5833b3c63b0d9c8) C:\WINDOWS\system32\cypherixsrv.exe 17:10:08.0531 5788 cypherixservice - ok 17:10:08.0578 5788 cyphxdrv (dad9c8cb36dc938b7c4713b2cb232f1c) C:\WINDOWS\system32\Drivers\cyphxdrv.sys 17:10:08.0593 5788 cyphxdrv - ok 17:10:08.0593 5788 dac2w2k - ok 17:10:08.0593 5788 dac960nt - ok 17:10:08.0671 5788 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll 17:10:08.0734 5788 DcomLaunch - ok 17:10:08.0796 5788 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll 17:10:08.0937 5788 Dhcp - ok 17:10:08.0968 5788 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 17:10:09.0078 5788 Disk - ok 17:10:09.0078 5788 dmadmin - ok 17:10:09.0140 5788 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 17:10:09.0546 5788 dmboot - ok 17:10:09.0562 5788 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 17:10:09.0718 5788 dmio - ok 17:10:09.0750 5788 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 17:10:09.0937 5788 dmload - ok 17:10:09.0953 5788 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll 17:10:10.0046 5788 dmserver - ok 17:10:10.0093 5788 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 17:10:10.0171 5788 DMusic - ok 17:10:10.0250 5788 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll 17:10:10.0281 5788 Dnscache - ok 17:10:10.0296 5788 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll 17:10:10.0390 5788 Dot3svc - ok 17:10:10.0390 5788 dpti2o - ok 17:10:10.0453 5788 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 17:10:10.0515 5788 drmkaud - ok 17:10:10.0531 5788 eamon (8c2b6bbc82ad12cd9a2e73e5dcbba705) C:\WINDOWS\system32\DRIVERS\eamon.sys 17:10:10.0578 5788 eamon - ok 17:10:10.0578 5788 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll 17:10:10.0656 5788 EapHost - ok 17:10:10.0656 5788 efavdrv - ok 17:10:10.0718 5788 ehdrv (5412ed24fffca64e2f0168399b86c952) C:\WINDOWS\system32\DRIVERS\ehdrv.sys 17:10:10.0734 5788 ehdrv - ok 17:10:10.0953 5788 ekrn (ad4faade819e0da9933bea7c01d2c763) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe 17:10:10.0984 5788 ekrn - ok 17:10:11.0062 5788 epfwtdir (cf1108161dfedd82ae811307a3763e1c) C:\WINDOWS\system32\DRIVERS\epfwtdir.sys 17:10:11.0078 5788 epfwtdir - ok 17:10:11.0125 5788 EpsonBidirectionalService (abdd5ad016affd34ad40e944ce94bf59) C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe 17:10:11.0140 5788 EpsonBidirectionalService ( UnsignedFile.Multi.Generic ) - warning 17:10:11.0140 5788 EpsonBidirectionalService - detected UnsignedFile.Multi.Generic (1) 17:10:11.0171 5788 EPSON_EB_RPCV4_01 (ec6a73cd8413f68655e5e0b99c415a21) C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE 17:10:11.0281 5788 EPSON_EB_RPCV4_01 - ok 17:10:11.0296 5788 EPSON_PM_RPCV4_01 (8fe6ab59cab8f2c038fea9522a5eeba7) C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE 17:10:11.0328 5788 EPSON_PM_RPCV4_01 - ok 17:10:11.0343 5788 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll 17:10:11.0468 5788 ERSvc - ok 17:10:11.0515 5788 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 17:10:11.0531 5788 Eventlog - ok 17:10:11.0578 5788 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll 17:10:11.0609 5788 EventSystem - ok 17:10:11.0671 5788 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 17:10:11.0750 5788 Fastfat - ok 17:10:11.0796 5788 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 17:10:11.0875 5788 FastUserSwitchingCompatibility - ok 17:10:11.0968 5788 Fax (e97d6a8684466df94ff3bc24fb787a07) C:\WINDOWS\system32\fxssvc.exe 17:10:12.0031 5788 Fax - ok 17:10:12.0093 5788 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys 17:10:12.0218 5788 Fdc - ok 17:10:12.0218 5788 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 17:10:12.0312 5788 Fips - ok 17:10:12.0328 5788 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys 17:10:12.0421 5788 Flpydisk - ok 17:10:12.0484 5788 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys 17:10:12.0562 5788 FltMgr - ok 17:10:12.0703 5788 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 17:10:12.0703 5788 FontCache3.0.0.0 - ok 17:10:12.0734 5788 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 17:10:12.0796 5788 Fs_Rec - ok 17:10:12.0812 5788 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 17:10:12.0875 5788 Ftdisk - ok 17:10:12.0953 5788 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 17:10:12.0953 5788 GEARAspiWDM - ok 17:10:12.0984 5788 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 17:10:13.0062 5788 Gpc - ok 17:10:13.0203 5788 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe 17:10:13.0203 5788 gupdate - ok 17:10:13.0218 5788 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe 17:10:13.0218 5788 gupdatem - ok 17:10:13.0281 5788 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 17:10:13.0375 5788 HDAudBus - ok 17:10:13.0421 5788 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 17:10:13.0484 5788 helpsvc - ok 17:10:13.0484 5788 HidServ - ok 17:10:13.0515 5788 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 17:10:13.0625 5788 hidusb - ok 17:10:13.0687 5788 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll 17:10:13.0750 5788 hkmsvc - ok 17:10:13.0750 5788 hpn - ok 17:10:13.0812 5788 HSFHWBS2 (3e0b68288e468190a5bf4c2ef5998a18) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 17:10:13.0875 5788 HSFHWBS2 - ok 17:10:13.0953 5788 HSF_DPV (bd2abf12938a2fccc340873412c2b2ab) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys 17:10:13.0984 5788 HSF_DPV - ok 17:10:14.0062 5788 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 17:10:14.0125 5788 HTTP - ok 17:10:14.0156 5788 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll 17:10:14.0250 5788 HTTPFilter - ok 17:10:14.0250 5788 i2omgmt - ok 17:10:14.0265 5788 i2omp - ok 17:10:14.0312 5788 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\drivers\i8042prt.sys 17:10:14.0390 5788 i8042prt - ok 17:10:14.0656 5788 ialm (66a685b05066683621920bc14a45cfe8) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 17:10:14.0843 5788 ialm - ok 17:10:14.0984 5788 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe 17:10:15.0015 5788 IDriverT ( UnsignedFile.Multi.Generic ) - warning 17:10:15.0015 5788 IDriverT - detected UnsignedFile.Multi.Generic (1) 17:10:15.0203 5788 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 17:10:15.0234 5788 idsvc - ok 17:10:15.0328 5788 IISADMIN (db3c22745c0da4666f3be31f1af36b2f) C:\WINDOWS\system32\inetsrv\inetinfo.exe 17:10:15.0390 5788 IISADMIN - ok 17:10:15.0468 5788 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 17:10:15.0625 5788 Imapi - ok 17:10:15.0671 5788 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe 17:10:15.0750 5788 ImapiService - ok 17:10:15.0765 5788 ini910u - ok 17:10:16.0031 5788 IntcAzAudAddService (2feb5bf0312e1cb76cd2caa875cbaa5d) C:\WINDOWS\system32\drivers\RtkHDAud.sys 17:10:16.0250 5788 IntcAzAudAddService - ok 17:10:16.0328 5788 IntelIde - ok 17:10:16.0390 5788 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys 17:10:16.0468 5788 intelppm - ok 17:10:16.0468 5788 IOMap - ok 17:10:16.0515 5788 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 17:10:16.0640 5788 Ip6Fw - ok 17:10:16.0671 5788 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 17:10:16.0843 5788 IpFilterDriver - ok 17:10:16.0859 5788 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 17:10:16.0937 5788 IpInIp - ok 17:10:16.0968 5788 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 17:10:17.0046 5788 IpNat - ok 17:10:17.0187 5788 iPod Service (57edb35ea2feca88f8b17c0c095c9a56) C:\Program Files\iPod\bin\iPodService.exe 17:10:17.0203 5788 iPod Service - ok 17:10:17.0250 5788 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 17:10:17.0343 5788 IPSec - ok 17:10:17.0375 5788 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 17:10:17.0421 5788 IRENUM - ok 17:10:17.0468 5788 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 17:10:17.0562 5788 isapnp - ok 17:10:17.0671 5788 JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Program Files\Java\jre6\bin\jqs.exe 17:10:17.0687 5788 JavaQuickStarterService - ok 17:10:17.0734 5788 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 17:10:17.0843 5788 Kbdclass - ok 17:10:17.0890 5788 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 17:10:18.0031 5788 kbdhid - ok 17:10:18.0093 5788 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 17:10:18.0250 5788 kmixer - ok 17:10:18.0265 5788 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 17:10:18.0343 5788 KSecDD - ok 17:10:18.0375 5788 LanmanServer (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll 17:10:18.0453 5788 LanmanServer - ok 17:10:18.0515 5788 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll 17:10:18.0578 5788 lanmanworkstation - ok 17:10:18.0578 5788 lbrtfdc - ok 17:10:18.0640 5788 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll 17:10:18.0703 5788 LmHosts - ok 17:10:18.0734 5788 MBAMProtector (6dfe7f2e8e8a337263aa5c92a215f161) C:\WINDOWS\system32\drivers\mbam.sys 17:10:18.0750 5788 MBAMProtector - ok 17:10:18.0828 5788 MBAMService (43683e970f008c93c9429ef428147a54) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 17:10:18.0875 5788 MBAMService - ok 17:10:18.0953 5788 McComponentHostService (fd3ad5e1ecdaa94a89d6697f5c5465d6) C:\Program Files\McAfee Security Scan\2.1.121\McCHSvc.exe 17:10:18.0984 5788 McComponentHostService - ok 17:10:19.0031 5788 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 17:10:19.0046 5788 mdmxsdk - ok 17:10:19.0078 5788 MemeoBackgroundService (10b012345f08d4d82a8ec41736e3d5ba) C:\Program Files\Memeo\AutoBackup\MemeoBackgroundService.exe 17:10:19.0093 5788 MemeoBackgroundService - ok 17:10:19.0109 5788 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll 17:10:19.0250 5788 Messenger - ok 17:10:19.0281 5788 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 17:10:19.0406 5788 mnmdd - ok 17:10:19.0437 5788 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe 17:10:19.0500 5788 mnmsrvc - ok 17:10:19.0531 5788 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 17:10:19.0625 5788 Modem - ok 17:10:19.0671 5788 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys 17:10:19.0750 5788 MODEMCSA - ok 17:10:19.0796 5788 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 17:10:19.0875 5788 Mouclass - ok 17:10:19.0906 5788 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 17:10:19.0968 5788 mouhid - ok 17:10:19.0968 5788 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 17:10:20.0046 5788 MountMgr - ok 17:10:20.0062 5788 mraid35x - ok 17:10:20.0078 5788 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 17:10:20.0140 5788 MRxDAV - ok 17:10:20.0187 5788 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 17:10:20.0250 5788 MRxSmb - ok 17:10:20.0296 5788 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe 17:10:20.0359 5788 MSDTC - ok 17:10:20.0375 5788 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 17:10:20.0484 5788 Msfs - ok 17:10:20.0484 5788 MSIServer - ok 17:10:20.0515 5788 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 17:10:20.0609 5788 MSKSSRV - ok 17:10:20.0625 5788 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 17:10:20.0703 5788 MSPCLOCK - ok 17:10:20.0734 5788 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 17:10:20.0812 5788 MSPQM - ok 17:10:20.0875 5788 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 17:10:20.0984 5788 mssmbios - ok 17:10:21.0015 5788 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys 17:10:21.0109 5788 MSTEE - ok 17:10:21.0125 5788 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys 17:10:21.0156 5788 Mup - ok 17:10:21.0203 5788 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 17:10:21.0312 5788 NABTSFEC - ok 17:10:21.0343 5788 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll 17:10:21.0421 5788 napagent - ok 17:10:21.0484 5788 NasPmService - ok 17:10:21.0484 5788 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 17:10:21.0640 5788 NDIS - ok 17:10:21.0656 5788 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys 17:10:21.0781 5788 NdisIP - ok 17:10:21.0828 5788 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 17:10:21.0875 5788 NdisTapi - ok 17:10:21.0906 5788 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 17:10:21.0984 5788 Ndisuio - ok 17:10:21.0984 5788 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 17:10:22.0078 5788 NdisWan - ok 17:10:22.0203 5788 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys 17:10:22.0281 5788 NDProxy - ok 17:10:22.0390 5788 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 17:10:22.0453 5788 NetBIOS - ok 17:10:22.0500 5788 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 17:10:22.0578 5788 NetBT - ok 17:10:22.0703 5788 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 17:10:22.0812 5788 NetDDE - ok 17:10:22.0812 5788 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 17:10:22.0890 5788 NetDDEdsdm - ok 17:10:22.0921 5788 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 17:10:23.0000 5788 Netlogon - ok 17:10:23.0015 5788 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll 17:10:23.0109 5788 Netman - ok 17:10:23.0218 5788 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 17:10:23.0234 5788 NetTcpPortSharing - ok 17:10:23.0515 5788 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll 17:10:23.0546 5788 Nla - ok 17:10:23.0687 5788 nmservice (cd569fa91ec6f59d045c19d0d3850f44) C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe 17:10:23.0703 5788 nmservice - ok 17:10:24.0046 5788 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 17:10:24.0140 5788 Npfs - ok 17:10:25.0578 5788 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 17:10:25.0734 5788 Ntfs - ok 17:10:25.0828 5788 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 17:10:25.0937 5788 NtLmSsp - ok 17:10:26.0546 5788 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll 17:10:26.0640 5788 NtmsSvc - ok 17:10:26.0703 5788 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 17:10:26.0812 5788 Null - ok 17:10:26.0875 5788 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 17:10:26.0984 5788 NwlnkFlt - ok 17:10:27.0046 5788 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 17:10:27.0156 5788 NwlnkFwd - ok 17:10:28.0187 5788 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 17:10:28.0203 5788 ose - ok 17:10:28.0265 5788 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys 17:10:28.0359 5788 Parport - ok 17:10:28.0437 5788 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 17:10:28.0515 5788 PartMgr - ok 17:10:28.0593 5788 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 17:10:28.0703 5788 ParVdm - ok 17:10:28.0921 5788 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 17:10:29.0031 5788 PCI - ok 17:10:29.0031 5788 PCIDump - ok 17:10:29.0078 5788 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 17:10:29.0140 5788 PCIIde - ok 17:10:29.0609 5788 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 17:10:29.0734 5788 Pcmcia - ok 17:10:29.0750 5788 PDCOMP - ok 17:10:29.0750 5788 PDFRAME - ok 17:10:29.0750 5788 PDRELI - ok 17:10:29.0750 5788 PDRFRAME - ok 17:10:29.0765 5788 perc2 - ok 17:10:29.0765 5788 perc2hib - ok 17:10:30.0781 5788 PEVSystemStart (f042ee4c8d66248d9b86dcf52abae416) C:\ComboFix\pev.3XE 17:10:30.0828 5788 PEVSystemStart ( UnsignedFile.Multi.Generic ) - warning 17:10:30.0828 5788 PEVSystemStart - detected UnsignedFile.Multi.Generic (1) 17:10:31.0109 5788 PhotoshopElementsDeviceConnect (d0f9f362023bf94cf58a1c3cdbbebe06) C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe 17:10:31.0109 5788 PhotoshopElementsDeviceConnect ( UnsignedFile.Multi.Generic ) - warning 17:10:31.0109 5788 PhotoshopElementsDeviceConnect - detected UnsignedFile.Multi.Generic (1) 17:10:31.0421 5788 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 17:10:31.0437 5788 PlugPlay - ok 17:10:31.0609 5788 pnarp (36fcac4fa28b462ca867742dea59b0d0) C:\WINDOWS\system32\DRIVERS\pnarp.sys 17:10:31.0625 5788 pnarp - ok 17:10:31.0687 5788 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 17:10:31.0765 5788 PolicyAgent - ok 17:10:31.0906 5788 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 17:10:32.0031 5788 PptpMiniport - ok 17:10:32.0031 5788 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 17:10:32.0109 5788 ProtectedStorage - ok 17:10:32.0171 5788 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 17:10:32.0296 5788 PSched - ok 17:10:32.0328 5788 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 17:10:32.0437 5788 Ptilink - ok 17:10:32.0546 5788 purendis (d8ac00388262b1a4878a7ee12f31d376) C:\WINDOWS\system32\DRIVERS\purendis.sys 17:10:32.0546 5788 purendis - ok 17:10:32.0781 5788 PxHelp20 (40fedd328f98245ad201cf5f9f311724) C:\WINDOWS\system32\Drivers\PxHelp20.sys 17:10:32.0796 5788 PxHelp20 - ok 17:10:32.0796 5788 ql1080 - ok 17:10:32.0796 5788 Ql10wnt - ok 17:10:32.0796 5788 ql12160 - ok 17:10:32.0812 5788 ql1240 - ok 17:10:32.0812 5788 ql1280 - ok 17:10:32.0875 5788 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 17:10:32.0953 5788 RasAcd - ok 17:10:33.0234 5788 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll 17:10:33.0421 5788 RasAuto - ok 17:10:33.0625 5788 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 17:10:33.0734 5788 Rasl2tp - ok 17:10:34.0140 5788 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll 17:10:34.0218 5788 RasMan - ok 17:10:34.0375 5788 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 17:10:34.0484 5788 RasPppoe - ok 17:10:34.0578 5788 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 17:10:34.0671 5788 Raspti - ok 17:10:34.0906 5788 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 17:10:34.0984 5788 Rdbss - ok 17:10:35.0031 5788 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 17:10:35.0109 5788 RDPCDD - ok 17:10:35.0187 5788 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 17:10:35.0265 5788 rdpdr - ok 17:10:35.0328 5788 RDPWD (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys 17:10:35.0421 5788 RDPWD - ok 17:10:35.0468 5788 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe 17:10:35.0562 5788 RDSessMgr - ok 17:10:35.0625 5788 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 17:10:35.0703 5788 redbook - ok 17:10:35.0734 5788 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll 17:10:35.0843 5788 RemoteAccess - ok 17:10:35.0890 5788 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll 17:10:35.0984 5788 RemoteRegistry - ok 17:10:36.0234 5788 RoxMediaDB12 (ff578453d3b3adaab22d7151d7f9e592) C:\Program Files\Common Files\Roxio Shared\12.0\SharedCOM\RoxMediaDB12.exe 17:10:36.0265 5788 RoxMediaDB12 - ok 17:10:36.0296 5788 RoxWatch12 (71b38b8df1a9b55fc0fb64958cc7b9dd) C:\Program Files\Common Files\Roxio Shared\12.0\SharedCOM\RoxWatch12.exe 17:10:36.0312 5788 RoxWatch12 - ok 17:10:36.0859 5788 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe 17:10:36.0953 5788 RpcLocator - ok 17:10:37.0078 5788 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll 17:10:37.0109 5788 RpcSs - ok 17:10:37.0171 5788 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe 17:10:37.0265 5788 RSVP - ok 17:10:37.0343 5788 RTLE8023xp (839141088ad7ee90f5b441b2d1afd22c) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys 17:10:37.0687 5788 RTLE8023xp - ok 17:10:37.0734 5788 SahdIa32 (0b2d5d2341437d7d7e1a6c7bbce3786a) C:\WINDOWS\system32\Drivers\SahdIa32.sys 17:10:37.0734 5788 SahdIa32 - ok 17:10:37.0734 5788 SaibIa32 (7a5f65b16249af2bc9d18d815f5d7172) C:\WINDOWS\system32\Drivers\SaibIa32.sys 17:10:37.0750 5788 SaibIa32 - ok 17:10:37.0796 5788 SaibVd32 (e333c9515822de586a3ff759a0c9b7bf) C:\WINDOWS\system32\Drivers\SaibVd32.sys 17:10:37.0796 5788 SaibVd32 - ok 17:10:37.0859 5788 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 17:10:38.0000 5788 SamSs - ok 17:10:38.0031 5788 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe 17:10:38.0203 5788 SCardSvr - ok 17:10:38.0312 5788 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll 17:10:38.0390 5788 Schedule - ok 17:10:38.0453 5788 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 17:10:38.0515 5788 Secdrv - ok 17:10:38.0562 5788 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll 17:10:38.0671 5788 seclogon - ok 17:10:38.0671 5788 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll 17:10:38.0765 5788 SENS - ok 17:10:38.0812 5788 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys 17:10:38.0890 5788 Serial - ok 17:10:38.0906 5788 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 17:10:39.0015 5788 Sfloppy - ok 17:10:39.0078 5788 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 17:10:39.0093 5788 ShellHWDetection - ok 17:10:39.0093 5788 Simbad - ok 17:10:39.0140 5788 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys 17:10:39.0234 5788 SLIP - ok 17:10:39.0328 5788 SMTPSVC (db3c22745c0da4666f3be31f1af36b2f) C:\WINDOWS\system32\inetsrv\inetinfo.exe 17:10:39.0359 5788 SMTPSVC - ok 17:10:39.0437 5788 snapman (01080d3a58ba5b6167849a3307e61d1a) C:\WINDOWS\system32\DRIVERS\snapman.sys 17:10:39.0437 5788 snapman ( UnsignedFile.Multi.Generic ) - warning 17:10:39.0437 5788 snapman - detected UnsignedFile.Multi.Generic (1) 17:10:39.0484 5788 SNMP (60c377be6b3cc83f6a8584934b181d2e) C:\WINDOWS\System32\snmp.exe 17:10:39.0593 5788 SNMP - ok 17:10:39.0625 5788 SNMPTRAP (80a050795a107a76c2b1cd4cfbe010e6) C:\WINDOWS\System32\snmptrap.exe 17:10:39.0718 5788 SNMPTRAP - ok 17:10:39.0718 5788 Sparrow - ok 17:10:39.0796 5788 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 17:10:39.0890 5788 splitter - ok 17:10:39.0953 5788 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe 17:10:40.0031 5788 Spooler - ok 17:10:40.0093 5788 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 17:10:40.0203 5788 sr - ok 17:10:40.0250 5788 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll 17:10:40.0296 5788 srservice - ok 17:10:40.0343 5788 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys 17:10:40.0437 5788 Srv - ok 17:10:40.0562 5788 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll 17:10:40.0625 5788 SSDPSRV - ok 17:10:40.0640 5788 ssoftnt4 (9c6e560f2de42102550f77b8914e6b88) C:\WINDOWS\system32\Drivers\ssoftnt4.sys 17:10:40.0656 5788 ssoftnt4 ( UnsignedFile.Multi.Generic ) - warning 17:10:40.0656 5788 ssoftnt4 - detected UnsignedFile.Multi.Generic (1) 17:10:40.0656 5788 ssoftservice - ok 17:10:40.0734 5788 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll 17:10:40.0828 5788 stisvc - ok 17:10:40.0859 5788 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys 17:10:40.0968 5788 streamip - ok 17:10:41.0015 5788 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 17:10:41.0093 5788 swenum - ok 17:10:41.0140 5788 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 17:10:41.0234 5788 swmidi - ok 17:10:41.0234 5788 SwPrv - ok 17:10:41.0234 5788 symc810 - ok 17:10:41.0250 5788 symc8xx - ok 17:10:41.0250 5788 sym_hi - ok 17:10:41.0250 5788 sym_u3 - ok 17:10:41.0296 5788 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 17:10:41.0375 5788 sysaudio - ok 17:10:41.0421 5788 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe 17:10:41.0562 5788 SysmonLog - ok 17:10:41.0562 5788 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll 17:10:41.0671 5788 TapiSrv - ok 17:10:41.0750 5788 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 17:10:41.0765 5788 Tcpip - ok 17:10:41.0812 5788 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 17:10:41.0875 5788 TDPIPE - ok 17:10:41.0890 5788 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 17:10:41.0968 5788 TDTCP - ok 17:10:42.0015 5788 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 17:10:42.0093 5788 TermDD - ok 17:10:42.0109 5788 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll 17:10:42.0187 5788 TermService - ok 17:10:42.0234 5788 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 17:10:42.0250 5788 Themes - ok 17:10:42.0312 5788 tifsfilter (304e188496ec723c369e3b27da82f992) C:\WINDOWS\system32\DRIVERS\tifsfilt.sys 17:10:42.0328 5788 tifsfilter ( UnsignedFile.Multi.Generic ) - warning 17:10:42.0328 5788 tifsfilter - detected UnsignedFile.Multi.Generic (1) 17:10:42.0546 5788 timounter (ac0a6126138403b5913a6d819343034b) C:\WINDOWS\system32\DRIVERS\timntr.sys 17:10:42.0562 5788 timounter ( UnsignedFile.Multi.Generic ) - warning 17:10:42.0562 5788 timounter - detected UnsignedFile.Multi.Generic (1) 17:10:42.0718 5788 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\system32\tlntsvr.exe 17:10:42.0765 5788 TlntSvr - ok 17:10:42.0765 5788 TosIde - ok 17:10:42.0828 5788 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll 17:10:42.0937 5788 TrkWks - ok 17:10:42.0984 5788 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 17:10:43.0109 5788 Udfs - ok 17:10:43.0109 5788 ultra - ok 17:10:43.0187 5788 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 17:10:43.0343 5788 Update - ok 17:10:43.0390 5788 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll 17:10:43.0437 5788 upnphost - ok 17:10:43.0468 5788 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe 17:10:43.0562 5788 UPS - ok 17:10:43.0656 5788 USBAAPL (eafe1e00739afe6c51487a050e772e17) C:\WINDOWS\system32\Drivers\usbaapl.sys 17:10:43.0687 5788 USBAAPL - ok 17:10:43.0765 5788 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 17:10:43.0875 5788 usbehci - ok 17:10:43.0953 5788 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 17:10:44.0062 5788 usbhub - ok 17:10:44.0109 5788 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys 17:10:44.0218 5788 usbprint - ok 17:10:44.0250 5788 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 17:10:44.0390 5788 usbscan - ok 17:10:44.0437 5788 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 17:10:44.0515 5788 usbstor - ok 17:10:44.0562 5788 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 17:10:44.0640 5788 usbuhci - ok 17:10:44.0703 5788 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 17:10:44.0765 5788 VgaSave - ok 17:10:44.0765 5788 ViaIde - ok 17:10:44.0828 5788 Video3D (8643da4a6c83da6c10fcab1e5ab6632d) C:\WINDOWS\system32\Drivers\Video3D32.sys 17:10:44.0828 5788 Video3D ( UnsignedFile.Multi.Generic ) - warning 17:10:44.0828 5788 Video3D - detected UnsignedFile.Multi.Generic (1) 17:10:44.0937 5788 VideoAcceleratorService - ok 17:10:44.0984 5788 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 17:10:45.0062 5788 VolSnap - ok 17:10:45.0125 5788 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe 17:10:45.0171 5788 VSS - ok 17:10:45.0187 5788 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll 17:10:45.0281 5788 W32Time - ok 17:10:45.0406 5788 W3SVC (db3c22745c0da4666f3be31f1af36b2f) C:\WINDOWS\system32\inetsrv\inetinfo.exe 17:10:45.0453 5788 W3SVC - ok 17:10:45.0468 5788 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 17:10:45.0578 5788 Wanarp - ok 17:10:45.0578 5788 WDICA - ok 17:10:45.0640 5788 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 17:10:45.0765 5788 wdmaud - ok 17:10:45.0796 5788 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll 17:10:45.0906 5788 WebClient - ok 17:10:45.0984 5788 winachsf (ea2ab3c94b1aee6aa22d543f1f0c62aa) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 17:10:46.0062 5788 winachsf - ok 17:10:46.0140 5788 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll 17:10:46.0250 5788 winmgmt - ok 17:10:46.0281 5788 WmdmPmSN (051b1bdecd6dee18c771b5d5ec7f044d) C:\WINDOWS\system32\MsPMSNSv.dll 17:10:46.0375 5788 WmdmPmSN - ok 17:10:46.0453 5788 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll 17:10:46.0484 5788 Wmi - ok 17:10:46.0531 5788 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe 17:10:46.0703 5788 WmiApSrv - ok 17:10:46.0812 5788 WMPNetworkSvc (6bab4dc65515a098505f8b3d01fb6fe5) C:\Program Files\Windows Media Player\WMPNetwk.exe 17:10:46.0828 5788 WMPNetworkSvc - ok 17:10:46.0906 5788 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys 17:10:46.0968 5788 WS2IFSL - ok 17:10:47.0000 5788 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll 17:10:47.0078 5788 wscsvc - ok 17:10:47.0125 5788 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 17:10:47.0187 5788 WSTCODEC - ok 17:10:47.0187 5788 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll 17:10:47.0265 5788 wuauserv - ok 17:10:47.0296 5788 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 17:10:47.0328 5788 WudfPf - ok 17:10:47.0343 5788 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 17:10:47.0375 5788 WudfRd - ok 17:10:47.0375 5788 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll 17:10:47.0437 5788 WudfSvc - ok 17:10:47.0515 5788 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll 17:10:47.0578 5788 WZCSVC - ok 17:10:47.0593 5788 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll 17:10:47.0656 5788 xmlprov - ok 17:10:47.0687 5788 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0 17:10:48.0187 5788 \Device\Harddisk0\DR0 ( TDSS File System ) - warning 17:10:48.0187 5788 \Device\Harddisk0\DR0 - detected TDSS File System (1) 17:10:48.0187 5788 Boot (0x1200) (b6ba39df77540bc511cf1fe05d5d9398) \Device\Harddisk0\DR0\Partition0 17:10:48.0187 5788 \Device\Harddisk0\DR0\Partition0 - ok 17:10:48.0187 5788 ============================================================ 17:10:48.0187 5788 Scan finished 17:10:48.0187 5788 ============================================================ 17:10:48.0296 6052 Detected object count: 15 17:10:48.0296 6052 Actual detected object count: 15 17:14:00.0203 6052 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - skipped by user 17:14:00.0203 6052 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - User select action: Skip 17:14:00.0203 6052 AdobeActiveFileMonitor ( UnsignedFile.Multi.Generic ) - skipped by user 17:14:00.0203 6052 AdobeActiveFileMonitor ( UnsignedFile.Multi.Generic ) - User select action: Skip 17:14:00.0203 6052 asusgsb ( UnsignedFile.Multi.Generic ) - skipped by user 17:14:00.0203 6052 asusgsb ( UnsignedFile.Multi.Generic ) - User select action: Skip 17:14:00.0203 6052 asuskbnt ( UnsignedFile.Multi.Generic ) - skipped by user 17:14:00.0203 6052 asuskbnt ( UnsignedFile.Multi.Generic ) - User select action: Skip 17:14:00.0203 6052 ATKKeyboardService ( UnsignedFile.Multi.Generic ) - skipped by user 17:14:00.0203 6052 ATKKeyboardService ( UnsignedFile.Multi.Generic ) - User select action: Skip 17:14:00.0203 6052 EpsonBidirectionalService ( UnsignedFile.Multi.Generic ) - skipped by user 17:14:00.0203 6052 EpsonBidirectionalService ( UnsignedFile.Multi.Generic ) - User select action: Skip 17:14:00.0218 6052 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user 17:14:00.0218 6052 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 17:14:00.0218 6052 PEVSystemStart ( UnsignedFile.Multi.Generic ) - skipped by user 17:14:00.0218 6052 PEVSystemStart ( UnsignedFile.Multi.Generic ) - User select action: Skip 17:14:00.0218 6052 PhotoshopElementsDeviceConnect ( UnsignedFile.Multi.Generic ) - skipped by user 17:14:00.0218 6052 PhotoshopElementsDeviceConnect ( UnsignedFile.Multi.Generic ) - User select action: Skip 17:14:00.0218 6052 snapman ( UnsignedFile.Multi.Generic ) - skipped by user 17:14:00.0218 6052 snapman ( UnsignedFile.Multi.Generic ) - User select action: Skip 17:14:00.0218 6052 ssoftnt4 ( UnsignedFile.Multi.Generic ) - skipped by user 17:14:00.0218 6052 ssoftnt4 ( UnsignedFile.Multi.Generic ) - User select action: Skip 17:14:00.0218 6052 tifsfilter ( UnsignedFile.Multi.Generic ) - skipped by user 17:14:00.0218 6052 tifsfilter ( UnsignedFile.Multi.Generic ) - User select action: Skip 17:14:00.0218 6052 timounter ( UnsignedFile.Multi.Generic ) - skipped by user 17:14:00.0218 6052 timounter ( UnsignedFile.Multi.Generic ) - User select action: Skip 17:14:00.0218 6052 Video3D ( UnsignedFile.Multi.Generic ) - skipped by user 17:14:00.0218 6052 Video3D ( UnsignedFile.Multi.Generic ) - User select action: Skip 17:14:00.0234 6052 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user 17:14:00.0234 6052 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip 17:16:16.0906 5516 ============================================================ 17:16:16.0906 5516 Scan started 17:16:16.0906 5516 Mode: Manual; SigCheck; TDLFS; 17:16:16.0906 5516 ============================================================ 17:16:17.0828 5516 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269 (a15069eec83ebc54150564b2585cfdba) C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe 17:16:17.0890 5516 9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269 - ok 17:16:17.0890 5516 Abiosdsk - ok 17:16:17.0890 5516 abp480n5 - ok 17:16:17.0968 5516 ACDaemon (adc420616c501b45d26c0fd3ef1e54e4) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe 17:16:17.0984 5516 ACDaemon - ok 17:16:18.0031 5516 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 17:16:18.0156 5516 ACPI - ok 17:16:18.0187 5516 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 17:16:18.0281 5516 ACPIEC - ok 17:16:18.0375 5516 AcrSch2Svc (ab25414d8ca040d1c9dae71724fe1283) C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe 17:16:18.0390 5516 AcrSch2Svc ( UnsignedFile.Multi.Generic ) - warning 17:16:18.0390 5516 AcrSch2Svc - detected UnsignedFile.Multi.Generic (1) 17:16:18.0421 5516 AdobeActiveFileMonitor (e42f7b36b4d8866184e8df9776ca4226) C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe 17:16:18.0453 5516 AdobeActiveFileMonitor ( UnsignedFile.Multi.Generic ) - warning 17:16:18.0453 5516 AdobeActiveFileMonitor - detected UnsignedFile.Multi.Generic (1) 17:16:18.0546 5516 AdobeFlashPlayerUpdateSvc (5e1a953c6472e7bb644892a4d0df5e72) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 17:16:18.0578 5516 AdobeFlashPlayerUpdateSvc - ok 17:16:18.0578 5516 adpu160m - ok 17:16:18.0625 5516 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 17:16:18.0765 5516 aec - ok 17:16:18.0828 5516 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys 17:16:18.0843 5516 AFD - ok 17:16:18.0843 5516 Aha154x - ok 17:16:18.0859 5516 aic78u2 - ok 17:16:18.0859 5516 aic78xx - ok 17:16:18.0890 5516 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll 17:16:18.0968 5516 Alerter - ok 17:16:18.0984 5516 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe 17:16:19.0031 5516 ALG - ok 17:16:19.0031 5516 AliIde - ok 17:16:19.0031 5516 amsint - ok 17:16:19.0140 5516 Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 17:16:19.0140 5516 Apple Mobile Device - ok 17:16:19.0156 5516 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll 17:16:19.0203 5516 AppMgmt - ok 17:16:19.0203 5516 asc - ok 17:16:19.0203 5516 asc3350p - ok 17:16:19.0203 5516 asc3550 - ok 17:16:19.0281 5516 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 17:16:19.0296 5516 aspnet_state - ok 17:16:19.0343 5516 asusgsb (d320732bcf5ff856120bd06855c66867) C:\WINDOWS\system32\drivers\asusgsb.sys 17:16:19.0343 5516 asusgsb ( UnsignedFile.Multi.Generic ) - warning 17:16:19.0343 5516 asusgsb - detected UnsignedFile.Multi.Generic (1) 17:16:19.0390 5516 asuskbnt (b3b881eb81013aac11594a5400ada47a) C:\WINDOWS\system32\drivers\atkkbnt.sys 17:16:19.0390 5516 asuskbnt ( UnsignedFile.Multi.Generic ) - warning 17:16:19.0390 5516 asuskbnt - detected UnsignedFile.Multi.Generic (1) 17:16:19.0421 5516 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 17:16:19.0531 5516 AsyncMac - ok 17:16:19.0578 5516 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 17:16:19.0656 5516 atapi - ok 17:16:19.0671 5516 Atdisk - ok 17:16:19.0734 5516 Ati HotKey Poller (fde5fae31394a586f9ccc7300b6ad681) C:\WINDOWS\system32\Ati2evxx.exe 17:16:19.0750 5516 Ati HotKey Poller - ok 17:16:20.0109 5516 ati2mtag (23f1a61ae7553d086ef264c72afc4e6a) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 17:16:20.0250 5516 ati2mtag - ok 17:16:20.0375 5516 AtiHDAudioService (0d6b8359677d05142b624f09c28d643a) C:\WINDOWS\system32\drivers\AtihdXP3.sys 17:16:20.0390 5516 AtiHDAudioService - ok 17:16:20.0437 5516 ATKKeyboardService (34b661d95e07149b7bd866c407a17370) C:\WINDOWS\ATKKBService.exe 17:16:20.0437 5516 ATKKeyboardService ( UnsignedFile.Multi.Generic ) - warning 17:16:20.0437 5516 ATKKeyboardService - detected UnsignedFile.Multi.Generic (1) 17:16:20.0484 5516 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 17:16:20.0578 5516 Atmarpc - ok 17:16:20.0625 5516 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll 17:16:20.0703 5516 AudioSrv - ok 17:16:20.0765 5516 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 17:16:20.0828 5516 audstub - ok 17:16:20.0875 5516 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 17:16:20.0953 5516 Beep - ok 17:16:21.0031 5516 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll 17:16:21.0093 5516 BITS - ok 17:16:21.0265 5516 Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) C:\Program Files\Bonjour\mDNSResponder.exe 17:16:21.0281 5516 Bonjour Service - ok 17:16:21.0328 5516 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll 17:16:21.0406 5516 Browser - ok 17:16:21.0531 5516 catchme - ok 17:16:21.0578 5516 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 17:16:21.0671 5516 cbidf2k - ok 17:16:21.0687 5516 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 17:16:21.0765 5516 CCDECODE - ok 17:16:21.0765 5516 cd20xrnt - ok 17:16:21.0796 5516 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 17:16:21.0859 5516 Cdaudio - ok 17:16:21.0875 5516 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 17:16:21.0937 5516 Cdfs - ok 17:16:21.0984 5516 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 17:16:22.0062 5516 Cdrom - ok 17:16:22.0062 5516 cerc6 - ok 17:16:22.0062 5516 Changer - ok 17:16:22.0109 5516 CinemaNow Service (127d4d0e9f78834ffd1eeea3fcfb47c1) C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe 17:16:22.0125 5516 CinemaNow Service - ok 17:16:22.0156 5516 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe 17:16:22.0218 5516 CiSvc - ok 17:16:22.0250 5516 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe 17:16:22.0328 5516 ClipSrv - ok 17:16:22.0437 5516 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 17:16:22.0437 5516 clr_optimization_v2.0.50727_32 - ok 17:16:22.0453 5516 CmdIde - ok 17:16:22.0453 5516 COMSysApp - ok 17:16:22.0453 5516 Cpqarray - ok 17:16:22.0468 5516 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll 17:16:22.0546 5516 CryptSvc - ok 17:16:22.0656 5516 cypherixservice (aba88a0c73f3370ab5833b3c63b0d9c8) C:\WINDOWS\system32\cypherixsrv.exe 17:16:22.0687 5516 cypherixservice - ok 17:16:22.0718 5516 cyphxdrv (dad9c8cb36dc938b7c4713b2cb232f1c) C:\WINDOWS\system32\Drivers\cyphxdrv.sys 17:16:22.0734 5516 cyphxdrv - ok 17:16:22.0734 5516 dac2w2k - ok 17:16:22.0750 5516 dac960nt - ok 17:16:22.0843 5516 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll 17:16:22.0859 5516 DcomLaunch - ok 17:16:22.0921 5516 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll 17:16:23.0015 5516 Dhcp - ok 17:16:23.0046 5516 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 17:16:23.0125 5516 Disk - ok 17:16:23.0125 5516 dmadmin - ok 17:16:23.0203 5516 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 17:16:23.0296 5516 dmboot - ok 17:16:23.0312 5516 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 17:16:23.0406 5516 dmio - ok 17:16:23.0421 5516 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 17:16:23.0515 5516 dmload - ok 17:16:23.0531 5516 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll 17:16:23.0593 5516 dmserver - ok 17:16:23.0640 5516 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 17:16:23.0796 5516 DMusic - ok 17:16:23.0843 5516 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll 17:16:23.0843 5516 Dnscache - ok 17:16:23.0875 5516 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll 17:16:23.0953 5516 Dot3svc - ok 17:16:23.0953 5516 dpti2o - ok 17:16:24.0015 5516 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 17:16:24.0078 5516 drmkaud - ok 17:16:24.0140 5516 eamon (8c2b6bbc82ad12cd9a2e73e5dcbba705) C:\WINDOWS\system32\DRIVERS\eamon.sys 17:16:24.0140 5516 eamon - ok 17:16:24.0156 5516 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll 17:16:24.0218 5516 EapHost - ok 17:16:24.0218 5516 efavdrv - ok 17:16:24.0265 5516 ehdrv (5412ed24fffca64e2f0168399b86c952) C:\WINDOWS\system32\DRIVERS\ehdrv.sys 17:16:24.0265 5516 ehdrv - ok 17:16:24.0453 5516 ekrn (ad4faade819e0da9933bea7c01d2c763) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe 17:16:24.0484 5516 ekrn - ok 17:16:24.0546 5516 epfwtdir (cf1108161dfedd82ae811307a3763e1c) C:\WINDOWS\system32\DRIVERS\epfwtdir.sys 17:16:24.0562 5516 epfwtdir - ok 17:16:24.0609 5516 EpsonBidirectionalService (abdd5ad016affd34ad40e944ce94bf59) C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe 17:16:24.0609 5516 EpsonBidirectionalService ( UnsignedFile.Multi.Generic ) - warning 17:16:24.0609 5516 EpsonBidirectionalService - detected UnsignedFile.Multi.Generic (1) 17:16:24.0703 5516 EPSON_EB_RPCV4_01 (ec6a73cd8413f68655e5e0b99c415a21) C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE 17:16:24.0718 5516 EPSON_EB_RPCV4_01 - ok 17:16:24.0781 5516 EPSON_PM_RPCV4_01 (8fe6ab59cab8f2c038fea9522a5eeba7) C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE 17:16:24.0796 5516 EPSON_PM_RPCV4_01 - ok 17:16:24.0812 5516 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll 17:16:24.0921 5516 ERSvc - ok 17:16:24.0968 5516 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 17:16:24.0984 5516 Eventlog - ok 17:16:25.0062 5516 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll 17:16:25.0078 5516 EventSystem - ok 17:16:25.0125 5516 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 17:16:25.0281 5516 Fastfat - ok 17:16:25.0328 5516 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 17:16:25.0343 5516 FastUserSwitchingCompatibility - ok 17:16:25.0406 5516 Fax (e97d6a8684466df94ff3bc24fb787a07) C:\WINDOWS\system32\fxssvc.exe 17:16:25.0468 5516 Fax - ok 17:16:25.0531 5516 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys 17:16:25.0609 5516 Fdc - ok 17:16:25.0625 5516 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 17:16:25.0687 5516 Fips - ok 17:16:25.0703 5516 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys 17:16:25.0765 5516 Flpydisk - ok 17:16:25.0828 5516 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys 17:16:25.0921 5516 FltMgr - ok 17:16:26.0078 5516 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 17:16:26.0093 5516 FontCache3.0.0.0 - ok 17:16:26.0140 5516 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 17:16:26.0218 5516 Fs_Rec - ok 17:16:26.0250 5516 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 17:16:26.0375 5516 Ftdisk - ok 17:16:26.0406 5516 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 17:16:26.0406 5516 GEARAspiWDM - ok 17:16:26.0437 5516 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 17:16:26.0562 5516 Gpc - ok 17:16:26.0703 5516 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe 17:16:26.0718 5516 gupdate - ok 17:16:26.0718 5516 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe 17:16:26.0734 5516 gupdatem - ok 17:16:26.0750 5516 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 17:16:26.0843 5516 HDAudBus - ok 17:16:26.0906 5516 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 17:16:26.0984 5516 helpsvc - ok 17:16:26.0984 5516 HidServ - ok 17:16:27.0015 5516 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 17:16:27.0109 5516 hidusb - ok 17:16:27.0156 5516 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll 17:16:27.0234 5516 hkmsvc - ok 17:16:27.0234 5516 hpn - ok 17:16:27.0296 5516 HSFHWBS2 (3e0b68288e468190a5bf4c2ef5998a18) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 17:16:27.0328 5516 HSFHWBS2 - ok 17:16:27.0390 5516 HSF_DPV (bd2abf12938a2fccc340873412c2b2ab) C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys 17:16:27.0406 5516 HSF_DPV - ok 17:16:27.0484 5516 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 17:16:27.0500 5516 HTTP - ok 17:16:27.0531 5516 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll 17:16:27.0625 5516 HTTPFilter - ok 17:16:27.0625 5516 i2omgmt - ok 17:16:27.0640 5516 i2omp - ok 17:16:27.0656 5516 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\drivers\i8042prt.sys 17:16:27.0750 5516 i8042prt - ok 17:16:28.0078 5516 ialm (66a685b05066683621920bc14a45cfe8) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 17:16:28.0250 5516 ialm - ok 17:16:28.0375 5516 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe 17:16:28.0390 5516 IDriverT ( UnsignedFile.Multi.Generic ) - warning 17:16:28.0390 5516 IDriverT - detected UnsignedFile.Multi.Generic (1) 17:16:28.0578 5516 idsvc (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 17:16:28.0593 5516 idsvc - ok 17:16:28.0718 5516 IISADMIN (db3c22745c0da4666f3be31f1af36b2f) C:\WINDOWS\system32\inetsrv\inetinfo.exe 17:16:28.0781 5516 IISADMIN - ok 17:16:28.0828 5516 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 17:16:28.0906 5516 Imapi - ok 17:16:28.0984 5516 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe 17:16:29.0062 5516 ImapiService - ok 17:16:29.0062 5516 ini910u - ok 17:16:29.0359 5516 IntcAzAudAddService (2feb5bf0312e1cb76cd2caa875cbaa5d) C:\WINDOWS\system32\drivers\RtkHDAud.sys 17:16:29.0515 5516 IntcAzAudAddService - ok 17:16:29.0593 5516 IntelIde - ok 17:16:29.0656 5516 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys 17:16:29.0781 5516 intelppm - ok 17:16:29.0781 5516 IOMap - ok 17:16:29.0796 5516 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 17:16:29.0875 5516 Ip6Fw - ok 17:16:29.0906 5516 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 17:16:30.0000 5516 IpFilterDriver - ok 17:16:30.0000 5516 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 17:16:30.0062 5516 IpInIp - ok 17:16:30.0125 5516 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 17:16:30.0203 5516 IpNat - ok 17:16:30.0343 5516 iPod Service (57edb35ea2feca88f8b17c0c095c9a56) C:\Program Files\iPod\bin\iPodService.exe 17:16:30.0359 5516 iPod Service - ok 17:16:30.0421 5516 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 17:16:30.0484 5516 IPSec - ok 17:16:30.0531 5516 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 17:16:30.0578 5516 IRENUM - ok 17:16:30.0625 5516 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 17:16:30.0734 5516 isapnp - ok 17:16:30.0843 5516 JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Program Files\Java\jre6\bin\jqs.exe 17:16:30.0859 5516 JavaQuickStarterService - ok 17:16:30.0921 5516 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 17:16:31.0031 5516 Kbdclass - ok 17:16:31.0093 5516 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 17:16:31.0203 5516 kbdhid - ok 17:16:31.0250 5516 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 17:16:31.0359 5516 kmixer - ok 17:16:31.0390 5516 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 17:16:31.0406 5516 KSecDD - ok 17:16:31.0437 5516 LanmanServer (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll 17:16:31.0468 5516 LanmanServer - ok 17:16:31.0531 5516 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll 17:16:31.0546 5516 lanmanworkstation - ok 17:16:31.0562 5516 lbrtfdc - ok 17:16:31.0625 5516 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll 17:16:31.0734 5516 LmHosts - ok 17:16:31.0765 5516 MBAMProtector (6dfe7f2e8e8a337263aa5c92a215f161) C:\WINDOWS\system32\drivers\mbam.sys 17:16:31.0781 5516 MBAMProtector - ok 17:16:31.0859 5516 MBAMService (43683e970f008c93c9429ef428147a54) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 17:16:31.0890 5516 MBAMService - ok 17:16:31.0984 5516 McComponentHostService (fd3ad5e1ecdaa94a89d6697f5c5465d6) C:\Program Files\McAfee Security Scan\2.1.121\McCHSvc.exe 17:16:32.0000 5516 McComponentHostService - ok 17:16:32.0046 5516 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 17:16:32.0062 5516 mdmxsdk - ok 17:16:32.0109 5516 MemeoBackgroundService (10b012345f08d4d82a8ec41736e3d5ba) C:\Program Files\Memeo\AutoBackup\MemeoBackgroundService.exe 17:16:32.0140 5516 MemeoBackgroundService - ok 17:16:32.0140 5516 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll 17:16:32.0281 5516 Messenger - ok 17:16:32.0296 5516 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 17:16:32.0359 5516 mnmdd - ok 17:16:32.0359 5516 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe 17:16:32.0453 5516 mnmsrvc - ok 17:16:32.0468 5516 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 17:16:32.0546 5516 Modem - ok 17:16:32.0578 5516 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys 17:16:32.0656 5516 MODEMCSA - ok 17:16:32.0671 5516 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 17:16:32.0750 5516 Mouclass - ok 17:16:32.0781 5516 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 17:16:32.0843 5516 mouhid - ok 17:16:32.0843 5516 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 17:16:32.0921 5516 MountMgr - ok 17:16:32.0921 5516 mraid35x - ok 17:16:32.0937 5516 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 17:16:33.0000 5516 MRxDAV - ok 17:16:33.0046 5516 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 17:16:33.0062 5516 MRxSmb - ok 17:16:33.0109 5516 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe 17:16:33.0187 5516 MSDTC - ok 17:16:33.0187 5516 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 17:16:33.0281 5516 Msfs - ok 17:16:33.0281 5516 MSIServer - ok 17:16:33.0328 5516 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 17:16:33.0406 5516 MSKSSRV - ok 17:16:33.0453 5516 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 17:16:33.0515 5516 MSPCLOCK - ok 17:16:33.0546 5516 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 17:16:33.0609 5516 MSPQM - ok 17:16:33.0640 5516 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 17:16:33.0734 5516 mssmbios - ok 17:16:33.0765 5516 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys 17:16:33.0843 5516 MSTEE - ok 17:16:33.0859 5516 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys 17:16:33.0875 5516 Mup - ok 17:16:33.0906 5516 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 17:16:33.0984 5516 NABTSFEC - ok 17:16:33.0984 5516 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll 17:16:34.0062 5516 napagent - ok 17:16:34.0140 5516 NasPmService - ok 17:16:34.0140 5516 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 17:16:34.0250 5516 NDIS - ok 17:16:34.0265 5516 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys 17:16:34.0359 5516 NdisIP - ok 17:16:34.0390 5516 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 17:16:34.0406 5516 NdisTapi - ok 17:16:34.0453 5516 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 17:16:34.0546 5516 Ndisuio - ok 17:16:34.0546 5516 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 17:16:34.0609 5516 NdisWan - ok 17:16:34.0625 5516 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys 17:16:34.0640 5516 NDProxy - ok 17:16:34.0640 5516 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 17:16:34.0703 5516 NetBIOS - ok 17:16:34.0750 5516 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 17:16:34.0812 5516 NetBT - ok 17:16:34.0843 5516 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 17:16:34.0921 5516 NetDDE - ok 17:16:34.0921 5516 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 17:16:34.0984 5516 NetDDEdsdm - ok 17:16:35.0000 5516 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 17:16:35.0062 5516 Netlogon - ok 17:16:35.0125 5516 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll 17:16:35.0203 5516 Netman - ok 17:16:35.0281 5516 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 17:16:35.0281 5516 NetTcpPortSharing - ok 17:16:35.0343 5516 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll 17:16:35.0359 5516 Nla - ok 17:16:35.0515 5516 nmservice (cd569fa91ec6f59d045c19d0d3850f44) C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe 17:16:35.0531 5516 nmservice - ok 17:16:35.0593 5516 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 17:16:35.0703 5516 Npfs - ok 17:16:35.0750 5516 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 17:16:35.0843 5516 Ntfs - ok 17:16:35.0875 5516 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 17:16:35.0953 5516 NtLmSsp - ok 17:16:35.0968 5516 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll 17:16:36.0046 5516 NtmsSvc - ok 17:16:36.0078 5516 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 17:16:36.0140 5516 Null - ok 17:16:36.0187 5516 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 17:16:36.0281 5516 NwlnkFlt - ok 17:16:36.0296 5516 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 17:16:36.0359 5516 NwlnkFwd - ok 17:16:36.0453 5516 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 17:16:36.0468 5516 ose - ok 17:16:36.0484 5516 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys 17:16:36.0562 5516 Parport - ok 17:16:36.0578 5516 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 17:16:36.0640 5516 PartMgr - ok 17:16:36.0671 5516 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 17:16:36.0734 5516 ParVdm - ok 17:16:36.0750 5516 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 17:16:36.0843 5516 PCI - ok 17:16:36.0843 5516 PCIDump - ok 17:16:36.0843 5516 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 17:16:36.0921 5516 PCIIde - ok 17:16:36.0921 5516 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 17:16:36.0984 5516 Pcmcia - ok 17:16:37.0000 5516 PDCOMP - ok 17:16:37.0000 5516 PDFRAME - ok 17:16:37.0000 5516 PDRELI - ok 17:16:37.0000 5516 PDRFRAME - ok 17:16:37.0015 5516 perc2 - ok 17:16:37.0015 5516 perc2hib - ok 17:16:37.0265 5516 PEVSystemStart (f042ee4c8d66248d9b86dcf52abae416) C:\ComboFix\pev.3XE 17:16:37.0265 5516 PEVSystemStart ( UnsignedFile.Multi.Generic ) - warning 17:16:37.0265 5516 PEVSystemStart - detected UnsignedFile.Multi.Generic (1) 17:16:37.0359 5516 PhotoshopElementsDeviceConnect (d0f9f362023bf94cf58a1c3cdbbebe06) C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe 17:16:37.0359 5516 PhotoshopElementsDeviceConnect ( UnsignedFile.Multi.Generic ) - warning 17:16:37.0359 5516 PhotoshopElementsDeviceConnect - detected UnsignedFile.Multi.Generic (1) 17:16:37.0421 5516 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 17:16:37.0437 5516 PlugPlay - ok 17:16:37.0515 5516 pnarp (36fcac4fa28b462ca867742dea59b0d0) C:\WINDOWS\system32\DRIVERS\pnarp.sys 17:16:37.0515 5516 pnarp - ok 17:16:37.0562 5516 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 17:16:37.0703 5516 PolicyAgent - ok 17:16:37.0734 5516 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 17:16:37.0875 5516 PptpMiniport - ok 17:16:37.0875 5516 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 17:16:38.0000 5516 ProtectedStorage - ok 17:16:38.0015 5516 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 17:16:38.0078 5516 PSched - ok 17:16:38.0109 5516 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 17:16:38.0203 5516 Ptilink - ok 17:16:38.0218 5516 purendis (d8ac00388262b1a4878a7ee12f31d376) C:\WINDOWS\system32\DRIVERS\purendis.sys 17:16:38.0218 5516 purendis - ok 17:16:38.0265 5516 PxHelp20 (40fedd328f98245ad201cf5f9f311724) C:\WINDOWS\system32\Drivers\PxHelp20.sys 17:16:38.0265 5516 PxHelp20 - ok 17:16:38.0265 5516 ql1080 - ok 17:16:38.0281 5516 Ql10wnt - ok 17:16:38.0281 5516 ql12160 - ok 17:16:38.0296 5516 ql1240 - ok 17:16:38.0296 5516 ql1280 - ok 17:16:38.0312 5516 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 17:16:38.0375 5516 RasAcd - ok 17:16:38.0437 5516 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll 17:16:38.0515 5516 RasAuto - ok 17:16:38.0531 5516 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 17:16:38.0609 5516 Rasl2tp - ok 17:16:38.0625 5516 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll 17:16:38.0687 5516 RasMan - ok 17:16:38.0703 5516 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 17:16:38.0781 5516 RasPppoe - ok 17:16:38.0781 5516 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 17:16:38.0843 5516 Raspti - ok 17:16:38.0859 5516 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 17:16:38.0937 5516 Rdbss - ok 17:16:38.0953 5516 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 17:16:39.0000 5516 RDPCDD - ok 17:16:39.0046 5516 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 17:16:39.0109 5516 rdpdr - ok 17:16:39.0156 5516 RDPWD (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys 17:16:39.0156 5516 RDPWD - ok 17:16:39.0171 5516 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe 17:16:39.0234 5516 RDSessMgr - ok 17:16:39.0265 5516 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 17:16:39.0343 5516 redbook - ok 17:16:39.0359 5516 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll 17:16:39.0421 5516 RemoteAccess - ok 17:16:39.0468 5516 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll 17:16:39.0718 5516 RemoteRegistry - ok 17:16:39.0937 5516 RoxMediaDB12 (ff578453d3b3adaab22d7151d7f9e592) C:\Program Files\Common Files\Roxio Shared\12.0\SharedCOM\RoxMediaDB12.exe 17:16:39.0968 5516 RoxMediaDB12 - ok 17:16:40.0015 5516 RoxWatch12 (71b38b8df1a9b55fc0fb64958cc7b9dd) C:\Program Files\Common Files\Roxio Shared\12.0\SharedCOM\RoxWatch12.exe 17:16:40.0046 5516 RoxWatch12 - ok 17:16:40.0156 5516 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe 17:16:40.0296 5516 RpcLocator - ok 17:16:40.0359 5516 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll 17:16:40.0390 5516 RpcSs - ok 17:16:40.0453 5516 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe 17:16:40.0593 5516 RSVP - ok 17:16:40.0671 5516 RTLE8023xp (839141088ad7ee90f5b441b2d1afd22c) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys 17:16:40.0687 5516 RTLE8023xp - ok 17:16:40.0734 5516 SahdIa32 (0b2d5d2341437d7d7e1a6c7bbce3786a) C:\WINDOWS\system32\Drivers\SahdIa32.sys 17:16:40.0750 5516 SahdIa32 - ok 17:16:40.0781 5516 SaibIa32 (7a5f65b16249af2bc9d18d815f5d7172) C:\WINDOWS\system32\Drivers\SaibIa32.sys 17:16:40.0781 5516 SaibIa32 - ok 17:16:40.0812 5516 SaibVd32 (e333c9515822de586a3ff759a0c9b7bf) C:\WINDOWS\system32\Drivers\SaibVd32.sys 17:16:40.0828 5516 SaibVd32 - ok 17:16:40.0843 5516 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 17:16:40.0921 5516 SamSs - ok 17:16:40.0953 5516 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe 17:16:41.0015 5516 SCardSvr - ok 17:16:41.0062 5516 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll 17:16:41.0140 5516 Schedule - ok 17:16:41.0187 5516 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 17:16:41.0218 5516 Secdrv - ok 17:16:41.0265 5516 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll 17:16:41.0328 5516 seclogon - ok 17:16:41.0343 5516 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll 17:16:41.0406 5516 SENS - ok 17:16:41.0453 5516 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys 17:16:41.0531 5516 Serial - ok 17:16:41.0546 5516 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 17:16:41.0625 5516 Sfloppy - ok 17:16:41.0703 5516 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 17:16:41.0703 5516 ShellHWDetection - ok 17:16:41.0718 5516 Simbad - ok 17:16:41.0750 5516 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys 17:16:41.0812 5516 SLIP - ok 17:16:41.0859 5516 SMTPSVC (db3c22745c0da4666f3be31f1af36b2f) C:\WINDOWS\system32\inetsrv\inetinfo.exe 17:16:41.0890 5516 SMTPSVC - ok 17:16:41.0921 5516 snapman (01080d3a58ba5b6167849a3307e61d1a) C:\WINDOWS\system32\DRIVERS\snapman.sys 17:16:41.0921 5516 snapman ( UnsignedFile.Multi.Generic ) - warning 17:16:41.0921 5516 snapman - detected UnsignedFile.Multi.Generic (1) 17:16:41.0984 5516 SNMP (60c377be6b3cc83f6a8584934b181d2e) C:\WINDOWS\System32\snmp.exe 17:16:42.0062 5516 SNMP - ok 17:16:42.0109 5516 SNMPTRAP (80a050795a107a76c2b1cd4cfbe010e6) C:\WINDOWS\System32\snmptrap.exe 17:16:42.0203 5516 SNMPTRAP - ok 17:16:42.0203 5516 Sparrow - ok 17:16:42.0250 5516 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 17:16:42.0359 5516 splitter - ok 17:16:42.0406 5516 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe 17:16:42.0421 5516 Spooler - ok 17:16:42.0453 5516 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 17:16:42.0500 5516 sr - ok 17:16:42.0515 5516 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll 17:16:42.0562 5516 srservice - ok 17:16:42.0593 5516 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys 17:16:42.0609 5516 Srv - ok 17:16:42.0656 5516 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll 17:16:42.0718 5516 SSDPSRV - ok 17:16:42.0750 5516 ssoftnt4 (9c6e560f2de42102550f77b8914e6b88) C:\WINDOWS\system32\Drivers\ssoftnt4.sys 17:16:42.0750 5516 ssoftnt4 ( UnsignedFile.Multi.Generic ) - warning 17:16:42.0750 5516 ssoftnt4 - detected UnsignedFile.Multi.Generic (1) 17:16:42.0750 5516 ssoftservice - ok 17:16:42.0812 5516 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll 17:16:42.0921 5516 stisvc - ok 17:16:42.0953 5516 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys 17:16:43.0093 5516 streamip - ok 17:16:43.0140 5516 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 17:16:43.0218 5516 swenum - ok 17:16:43.0281 5516 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 17:16:43.0343 5516 swmidi - ok 17:16:43.0359 5516 SwPrv - ok 17:16:43.0359 5516 symc810 - ok 17:16:43.0359 5516 symc8xx - ok 17:16:43.0375 5516 sym_hi - ok 17:16:43.0375 5516 sym_u3 - ok 17:16:43.0421 5516 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 17:16:43.0500 5516 sysaudio - ok 17:16:43.0515 5516 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe 17:16:43.0578 5516 SysmonLog - ok 17:16:43.0593 5516 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll 17:16:43.0656 5516 TapiSrv - ok 17:16:43.0734 5516 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 17:16:43.0750 5516 Tcpip - ok 17:16:43.0781 5516 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 17:16:43.0875 5516 TDPIPE - ok 17:16:43.0890 5516 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 17:16:43.0953 5516 TDTCP - ok 17:16:44.0015 5516 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 17:16:44.0078 5516 TermDD - ok 17:16:44.0125 5516 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll 17:16:44.0187 5516 TermService - ok 17:16:44.0250 5516 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 17:16:44.0265 5516 Themes - ok 17:16:44.0312 5516 tifsfilter (304e188496ec723c369e3b27da82f992) C:\WINDOWS\system32\DRIVERS\tifsfilt.sys 17:16:44.0328 5516 tifsfilter ( UnsignedFile.Multi.Generic ) - warning 17:16:44.0328 5516 tifsfilter - detected UnsignedFile.Multi.Generic (1) 17:16:44.0390 5516 timounter (ac0a6126138403b5913a6d819343034b) C:\WINDOWS\system32\DRIVERS\timntr.sys 17:16:44.0406 5516 timounter ( UnsignedFile.Multi.Generic ) - warning 17:16:44.0406 5516 timounter - detected UnsignedFile.Multi.Generic (1) 17:16:44.0421 5516 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\system32\tlntsvr.exe 17:16:44.0453 5516 TlntSvr - ok 17:16:44.0468 5516 TosIde - ok 17:16:44.0484 5516 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll 17:16:44.0578 5516 TrkWks - ok 17:16:44.0593 5516 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 17:16:44.0703 5516 Udfs - ok 17:16:44.0703 5516 ultra - ok 17:16:44.0781 5516 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 17:16:44.0859 5516 Update - ok 17:16:44.0906 5516 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll 17:16:44.0968 5516 upnphost - ok 17:16:44.0968 5516 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe 17:16:45.0046 5516 UPS - ok 17:16:45.0109 5516 USBAAPL (eafe1e00739afe6c51487a050e772e17) C:\WINDOWS\system32\Drivers\usbaapl.sys 17:16:45.0125 5516 USBAAPL - ok 17:16:45.0171 5516 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 17:16:45.0250 5516 usbehci - ok 17:16:45.0328 5516 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 17:16:45.0421 5516 usbhub - ok 17:16:45.0453 5516 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys 17:16:45.0593 5516 usbprint - ok 17:16:45.0609 5516 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 17:16:45.0734 5516 usbscan - ok 17:16:45.0765 5516 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 17:16:45.0828 5516 usbstor - ok 17:16:45.0890 5516 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 17:16:45.0953 5516 usbuhci - ok 17:16:46.0000 5516 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 17:16:46.0062 5516 VgaSave - ok 17:16:46.0062 5516 ViaIde - ok 17:16:46.0125 5516 Video3D (8643da4a6c83da6c10fcab1e5ab6632d) C:\WINDOWS\system32\Drivers\Video3D32.sys 17:16:46.0140 5516 Video3D ( UnsignedFile.Multi.Generic ) - warning 17:16:46.0140 5516 Video3D - detected UnsignedFile.Multi.Generic (1) 17:16:46.0250 5516 VideoAcceleratorService - ok 17:16:46.0296 5516 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 17:16:46.0359 5516 VolSnap - ok 17:16:46.0421 5516 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe 17:16:46.0484 5516 VSS - ok 17:16:46.0531 5516 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll 17:16:46.0593 5516 W32Time - ok 17:16:46.0703 5516 W3SVC (db3c22745c0da4666f3be31f1af36b2f) C:\WINDOWS\system32\inetsrv\inetinfo.exe 17:16:46.0734 5516 W3SVC - ok 17:16:46.0750 5516 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 17:16:46.0843 5516 Wanarp - ok 17:16:46.0843 5516 WDICA - ok 17:16:46.0890 5516 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 17:16:47.0000 5516 wdmaud - ok 17:16:47.0046 5516 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll 17:16:47.0140 5516 WebClient - ok 17:16:47.0203 5516 winachsf (ea2ab3c94b1aee6aa22d543f1f0c62aa) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 17:16:47.0281 5516 winachsf - ok 17:16:47.0406 5516 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll 17:16:47.0515 5516 winmgmt - ok 17:16:47.0546 5516 WmdmPmSN (051b1bdecd6dee18c771b5d5ec7f044d) C:\WINDOWS\system32\MsPMSNSv.dll 17:16:47.0609 5516 WmdmPmSN - ok 17:16:47.0687 5516 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll 17:16:47.0718 5516 Wmi - ok 17:16:47.0781 5516 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe 17:16:47.0937 5516 WmiApSrv - ok 17:16:48.0046 5516 WMPNetworkSvc (6bab4dc65515a098505f8b3d01fb6fe5) C:\Program Files\Windows Media Player\WMPNetwk.exe 17:16:48.0078 5516 WMPNetworkSvc - ok 17:16:48.0156 5516 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys 17:16:48.0218 5516 WS2IFSL - ok 17:16:48.0265 5516 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll 17:16:48.0343 5516 wscsvc - ok 17:16:48.0375 5516 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 17:16:48.0437 5516 WSTCODEC - ok 17:16:48.0453 5516 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll 17:16:48.0515 5516 wuauserv - ok 17:16:48.0546 5516 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 17:16:48.0562 5516 WudfPf - ok 17:16:48.0562 5516 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 17:16:48.0593 5516 WudfRd - ok 17:16:48.0593 5516 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll 17:16:48.0609 5516 WudfSvc - ok 17:16:48.0640 5516 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll 17:16:48.0718 5516 WZCSVC - ok 17:16:48.0718 5516 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll 17:16:48.0781 5516 xmlprov - ok 17:16:48.0796 5516 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0 17:16:49.0203 5516 \Device\Harddisk0\DR0 ( TDSS File System ) - warning 17:16:49.0203 5516 \Device\Harddisk0\DR0 - detected TDSS File System (1) 17:16:49.0203 5516 Boot (0x1200) (b6ba39df77540bc511cf1fe05d5d9398) \Device\Harddisk0\DR0\Partition0 17:16:49.0203 5516 \Device\Harddisk0\DR0\Partition0 - ok 17:16:49.0203 5516 ============================================================ 17:16:49.0203 5516 Scan finished 17:16:49.0203 5516 ============================================================ 17:16:49.0218 3912 Detected object count: 15 17:16:49.0218 3912 Actual detected object count: 15

Gliq.Info

Post #9July 19, 2012, 10:07 PM UTC

Some good news! Google Redirect is GONE! So a big thanks for that!~

Tomk

Post #10July 20, 2012, 12:42 AM UTC

Great. It looks like we killer the Pihar infection… but TDSS is still there - but weakened. Please try running ComboFix now.

Tomk

Post #11July 24, 2012, 1:50 PM UTC

Are you still with me?

Tomk

Post #12July 29, 2012, 7:59 PM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Google Redirect [Closed]

✨ Ask AI

Ask AI