symbiosis7
hi jontom - your last reply did not include a notification to my inbox… don't know why. just started asw.mbr. will post two logs soon.
Spyware / Malware / Virus Removal
spontaneous odd behaviours: voices, web pages... [Solved]
53 min read
symbiosis7
ok, aswmbr hung the first time because i forgot to disable AVG. after a quick restart, it ran fine.
MBAM also ran fine, after updating definitions file.
each program detected problems. here are the two logs.
aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-08-28 19:24:00
—————————–
19:24:00.593 OS Version: Windows 5.1.2600 Service Pack 3
19:24:00.593 Number of processors: 2 586 0x304
19:24:00.593 ComputerName: MAIN UserName:
19:24:01.812 Initialize success
19:24:17.609 AVAST engine defs: 12082803
19:24:26.171 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17
19:24:26.171 Disk 0 Vendor: WDC_WD800JD-75HKA1 14.03G14 Size: 76293MB BusType: 3
19:24:26.203 Disk 0 MBR read successfully
19:24:26.203 Disk 0 MBR scan
19:24:26.203 Disk 0 unknown MBR code
19:24:26.203 Disk 0 Partition 1 00 DE Dell Utility Dell 4.1 31 MB offset 63
19:24:26.218 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 72669 MB offset 64260
19:24:26.250 Disk 0 Partition 3 00 DB CP/M / CTOS MSWIN4.1 3584 MB offset 148890420
19:24:26.250 Disk 0 scanning sectors +156232125
19:24:26.328 Disk 0 scanning C:\WINDOWS\system32\drivers
19:24:43.593 Service scanning
19:25:06.328 Modules scanning
19:25:15.609 Disk 0 trace - called modules:
19:25:15.625 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
19:25:15.625 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86f4aab8]
19:25:15.625 3 CLASSPNP.SYS[f774dfd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-17[0x86fd7d98]
19:25:15.921 AVAST engine scan C:\WINDOWS
19:25:52.781 AVAST engine scan C:\WINDOWS\system32
19:28:14.093 File: C:\WINDOWS\assembly\GAC\Desktop.ini **INFECTED** Win32:Sirefef-PL [Rtk]
19:29:59.500 AVAST engine scan C:\WINDOWS\system32\drivers
19:30:19.546 AVAST engine scan C:\Documents and Settings\T. Carlberg
19:49:44.015 File: C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U\80000032.@ **INFECTED** Win32:Sirefef-AHF [Trj]
19:50:47.031 AVAST engine scan C:\Documents and Settings\All Users
19:55:07.812 Scan finished successfully
19:57:41.140 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\T. Carlberg\Desktop\MBR.dat"
19:57:41.140 The log file has been saved successfully to "C:\Documents and Settings\T. Carlberg\Desktop\aswMBR_20120828.txt"
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org
Database version: v2012.08.29.02
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
T. Carlberg :: MAIN [administrator]
8/28/2012 8:29:30 PM
mbam-log-2012-08-28 (20-29-30).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 213590
Time elapsed: 8 minute(s), 48 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 1
C:\WINDOWS\ASSEMBLY\GAC\Desktop.ini (Trojan.0access) -> Quarantined and deleted successfully.
(end)
JonTom
Hello symbiosis7
No problem about the notifications.
Thank you for the logs.
Re-scan with aswMBR once you have ran Combofix as instructed.
Please post the Combofix log and the aswMBR log in your next reply.
No problem about the notifications.
Thank you for the logs.
- Please work through the following steps
- Open Notepad (Click on "Start", then on "Run" and type "notepad" (without quotations) in the Open field, then click on "OK").
- NOTE: Do not Use Wordpad or any other text editor except Notepad or the script will fail.
- Copy and Paste the text in the quotebox below into the open Notepad window:
Folder::
C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}
ClearJavaCache:: - Save this as "CFScript.txt" (including the quotation marks), change the "Save as type" to "All Files" and save it to your desktop.
- Close any open browsers.
- Disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Refering to the picture below, drag CFScript.txt into ComboFix.exe
[external image: Posted Image]
- When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
- Once the log is produced, re-engage your resident anti virus.
Re-scan with aswMBR once you have ran Combofix as instructed.
Please post the Combofix log and the aswMBR log in your next reply.
symbiosis7
hi jontom - created script in notepad. saved as your filename. disabled avg. restarted (which avg seems to require).
drag & dropped script. combofix started. update available, i authorized it.
restarted comboscript with drag & drop. got message "recycle bin corrupted - do you want to empty it?" i said no. got message "you are not connected to internet; please connect before you click 'ok' ". didn't know why this cropped up, so i restarted computer again.
drag &dropped script onto combofix. got message "recycle bin corrupted - do you want to empty it?" i said yes this time. combofix continued to install. got message "recovery console not installed"; i said to install. got a wierd message about "windows xp home editon sp2 cd boot floppies" but figured it had to do with console, so i clicked OK. got message "console install successful", and combofix started running. log follows:
ComboFix 12-08-30.05 - T. Carlberg 08/30/2012 20:17:17.9.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.438 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\T. Carlberg\Desktop\CFScript.txt
AV: AVG Anti-Virus *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((( Files Created from 2012-07-28 to 2012-08-31 )))))))))))))))))))))))))))))))
.
.
2012-08-24 16:52 . 2012-08-24 16:52 ——– d—–w- C:\TDSSKiller_Quarantine
2012-08-22 15:04 . 2012-08-22 15:04 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2012-08-22 04:50 . 2012-08-22 04:50 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2012-08-20 01:46 . 2012-08-20 01:46 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2012-08-07 16:09 . 2012-06-02 22:18 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-08-07 16:09 . 2012-06-02 22:18 214256 —-a-w- c:\windows\system32\muweb.dll
2012-08-07 06:07 . 2012-08-07 06:07 ——– d—–w- c:\program files\Microsoft Synchronization Services
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\program files\Microsoft Sync Framework
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\documents and settings\All Users\Microsoft
2012-08-07 06:03 . 2012-08-07 06:03 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2012-08-07 06:01 . 2012-08-07 06:01 ——– d—–w- c:\program files\Microsoft Analysis Services
2012-08-07 06:00 . 2012-08-07 06:00 ——– d—–w- c:\documents and settings\T. Carlberg\Local Settings\Application Data\Microsoft Help
2012-08-07 06:00 . 2012-08-26 20:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2012-08-07 05:59 . 2012-08-07 05:59 ——– d—–r- C:\MSOCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-01 01:20 . 2012-07-22 22:14 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-01 01:20 . 2012-07-22 22:14 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-06 13:58 . 2004-08-04 11:00 78336 —-a-w- c:\windows\system32\browser.dll
2012-07-04 14:05 . 2004-08-04 11:00 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 20:46 . 2010-04-12 21:56 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-07-03 13:40 . 2004-08-04 11:00 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49 . 2004-08-04 11:00 916992 —-a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2004-08-04 11:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2004-08-04 11:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2004-08-04 11:00 385024 —-a-w- c:\windows\system32\html.iec
2012-06-06 15:49 . 2012-06-06 15:49 1070152 —-a-w- c:\windows\system32\MSCOMCTL.OCX
2012-06-05 15:50 . 2008-10-19 04:34 1372672 ——w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2004-08-04 11:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2004-08-04 11:00 152576 —-a-w- c:\windows\system32\schannel.dll
2012-06-02 22:19 . 2007-06-08 01:05 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 22:19 . 2007-06-08 01:05 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 22:19 . 2004-08-04 11:00 329240 —-a-w- c:\windows\system32\wucltui.dll
2012-06-02 22:19 . 2004-08-04 11:00 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 22:19 . 2004-08-04 11:00 210968 —-a-w- c:\windows\system32\wuweb.dll
2012-06-02 22:19 . 2007-06-08 01:05 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 22:19 . 2005-05-26 11:16 45080 —-a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2004-11-30 05:43 35864 —-a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2004-08-04 11:00 97304 —-a-w- c:\windows\system32\cdm.dll
2012-06-02 22:19 . 2004-08-04 11:00 53784 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2007-06-08 01:05 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 22:19 . 2004-08-04 11:00 577048 —-a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2004-08-04 11:00 1933848 —-a-w- c:\windows\system32\wuaueng.dll
2006-10-10 21:09 . 2006-10-10 21:09 1053198 —-a-w- c:\program files\freemahjongg.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-08-21_03.55.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-08-31 02:52 . 2012-08-31 02:52 16384 c:\windows\temp\Perflib_Perfdata_a24.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-07-10 02:44 2074208 —-a-w- c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-10 2074208]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-08-24 57344]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb01.exe" [2000-08-07 192512]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Intel AppUp(SM) center"="c:\program files\Intel\IntelAppStore\bin\serviceManager.lnk" [2011-04-13 933]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-07-10 1107552]
"ROC_roc_dec12"="c:\program files\AVG Secure Search\ROC_roc_dec12.exe" [2012-01-23 928096]
"HF_G_Jul"="c:\program files\AVG Secure Search\HF_G_Jul.exe" [2012-07-19 36960]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
.
c:\documents and settings\T. Carlberg\Start Menu\Programs\Startup\
AVG Tray Icon.lnk - c:\program files\AVG\AVG9\avgtray.exe [2010-6-24 2077536]
internet explore.lnk - c:\program files\Internet Explorer\iexplore.exe [2004-8-4 638816]
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Billminder.lnk - c:\quickenw\BILLMIND.EXE [2004-11-29 36864]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2004-11-18 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Quicken Startup.lnk - c:\quickenw\QWDLLS.EXE [2004-11-29 36864]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
internet explore.lnk - c:\program files\Internet Explorer\iexplore.exe [2004-8-4 638816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-06-24 23:12 12536 —-a-w- c:\windows\SYSTEM32\avgrsstx.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Themes"=2 (0x2)
"TapiSrv"=3 (0x3)
"SysmonLog"=3 (0x3)
"Schedule"=2 (0x2)
"SCardSvr"=3 (0x3)
"mnmsrvc"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"iPod Service"=3 (0x3)
"helpsvc"=2 (0x2)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"Eventlog"=2 (0x2)
"ERSvc"=2 (0x2)
"CiSvc"=3 (0x3)
"Bonjour Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
.
R0 AvgRkx86;avgrkx86.sys;c:\windows\SYSTEM32\DRIVERS\avgrkx86.sys [4/20/2008 4:20 PM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [4/20/2008 4:20 PM 216400]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [4/20/2008 4:20 PM 243152]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [6/24/2010 4:12 PM 308136]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [8/25/2011 6:53 PM 13672]
R2 mrtRate;mrtRate;c:\windows\SYSTEM32\DRIVERS\MrtRate.sys [11/29/2004 6:18 PM 34916]
R2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [7/9/2012 7:44 PM 935008]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [10/26/2010 11:22 AM 167264]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [6/12/2011 11:15 AM 31125880]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 9:37 PM 4640000]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/17/2009 9:42 PM 135664]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [12/17/2009 9:42 PM 135664]
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 04:42]
.
2011-11-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 04:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://login.yahoo.com/config/mail?.intl=us
mWindow Title = Humboldt Internet
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = [removed] [removed]
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-30 20:28
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(3784)
c:\windows\system32\WININET.dll
c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\progra~1\MICROS~4\Office14\1033\GrooveIntlResource.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-08-30 20:33:34
ComboFix-quarantined-files.txt 2012-08-31 03:33
ComboFix2.txt 2012-08-24 17:45
ComboFix3.txt 2012-08-21 04:00
.
Pre-Run: 10,990,587,904 bytes free
Post-Run: 11,057,037,312 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 4A034A5AA0515CCC86061D79B204C3D3
drag & dropped script. combofix started. update available, i authorized it.
restarted comboscript with drag & drop. got message "recycle bin corrupted - do you want to empty it?" i said no. got message "you are not connected to internet; please connect before you click 'ok' ". didn't know why this cropped up, so i restarted computer again.
drag &dropped script onto combofix. got message "recycle bin corrupted - do you want to empty it?" i said yes this time. combofix continued to install. got message "recovery console not installed"; i said to install. got a wierd message about "windows xp home editon sp2 cd boot floppies" but figured it had to do with console, so i clicked OK. got message "console install successful", and combofix started running. log follows:
ComboFix 12-08-30.05 - T. Carlberg 08/30/2012 20:17:17.9.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.438 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\T. Carlberg\Desktop\CFScript.txt
AV: AVG Anti-Virus *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((( Files Created from 2012-07-28 to 2012-08-31 )))))))))))))))))))))))))))))))
.
.
2012-08-24 16:52 . 2012-08-24 16:52 ——– d—–w- C:\TDSSKiller_Quarantine
2012-08-22 15:04 . 2012-08-22 15:04 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2012-08-22 04:50 . 2012-08-22 04:50 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2012-08-20 01:46 . 2012-08-20 01:46 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2012-08-07 16:09 . 2012-06-02 22:18 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-08-07 16:09 . 2012-06-02 22:18 214256 —-a-w- c:\windows\system32\muweb.dll
2012-08-07 06:07 . 2012-08-07 06:07 ——– d—–w- c:\program files\Microsoft Synchronization Services
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\program files\Microsoft Sync Framework
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\documents and settings\All Users\Microsoft
2012-08-07 06:03 . 2012-08-07 06:03 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2012-08-07 06:01 . 2012-08-07 06:01 ——– d—–w- c:\program files\Microsoft Analysis Services
2012-08-07 06:00 . 2012-08-07 06:00 ——– d—–w- c:\documents and settings\T. Carlberg\Local Settings\Application Data\Microsoft Help
2012-08-07 06:00 . 2012-08-26 20:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2012-08-07 05:59 . 2012-08-07 05:59 ——– d—–r- C:\MSOCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-01 01:20 . 2012-07-22 22:14 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-01 01:20 . 2012-07-22 22:14 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-06 13:58 . 2004-08-04 11:00 78336 —-a-w- c:\windows\system32\browser.dll
2012-07-04 14:05 . 2004-08-04 11:00 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 20:46 . 2010-04-12 21:56 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-07-03 13:40 . 2004-08-04 11:00 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49 . 2004-08-04 11:00 916992 —-a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2004-08-04 11:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2004-08-04 11:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2004-08-04 11:00 385024 —-a-w- c:\windows\system32\html.iec
2012-06-06 15:49 . 2012-06-06 15:49 1070152 —-a-w- c:\windows\system32\MSCOMCTL.OCX
2012-06-05 15:50 . 2008-10-19 04:34 1372672 ——w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2004-08-04 11:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2004-08-04 11:00 152576 —-a-w- c:\windows\system32\schannel.dll
2012-06-02 22:19 . 2007-06-08 01:05 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 22:19 . 2007-06-08 01:05 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 22:19 . 2004-08-04 11:00 329240 —-a-w- c:\windows\system32\wucltui.dll
2012-06-02 22:19 . 2004-08-04 11:00 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 22:19 . 2004-08-04 11:00 210968 —-a-w- c:\windows\system32\wuweb.dll
2012-06-02 22:19 . 2007-06-08 01:05 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 22:19 . 2005-05-26 11:16 45080 —-a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2004-11-30 05:43 35864 —-a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2004-08-04 11:00 97304 —-a-w- c:\windows\system32\cdm.dll
2012-06-02 22:19 . 2004-08-04 11:00 53784 —-a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2007-06-08 01:05 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 22:19 . 2004-08-04 11:00 577048 —-a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:19 . 2004-08-04 11:00 1933848 —-a-w- c:\windows\system32\wuaueng.dll
2006-10-10 21:09 . 2006-10-10 21:09 1053198 —-a-w- c:\program files\freemahjongg.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-08-21_03.55.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-08-31 02:52 . 2012-08-31 02:52 16384 c:\windows\temp\Perflib_Perfdata_a24.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-07-10 02:44 2074208 —-a-w- c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-10 2074208]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-08-24 57344]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb01.exe" [2000-08-07 192512]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Intel AppUp(SM) center"="c:\program files\Intel\IntelAppStore\bin\serviceManager.lnk" [2011-04-13 933]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-07-10 1107552]
"ROC_roc_dec12"="c:\program files\AVG Secure Search\ROC_roc_dec12.exe" [2012-01-23 928096]
"HF_G_Jul"="c:\program files\AVG Secure Search\HF_G_Jul.exe" [2012-07-19 36960]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
.
c:\documents and settings\T. Carlberg\Start Menu\Programs\Startup\
AVG Tray Icon.lnk - c:\program files\AVG\AVG9\avgtray.exe [2010-6-24 2077536]
internet explore.lnk - c:\program files\Internet Explorer\iexplore.exe [2004-8-4 638816]
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Billminder.lnk - c:\quickenw\BILLMIND.EXE [2004-11-29 36864]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2004-11-18 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Quicken Startup.lnk - c:\quickenw\QWDLLS.EXE [2004-11-29 36864]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
internet explore.lnk - c:\program files\Internet Explorer\iexplore.exe [2004-8-4 638816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-06-24 23:12 12536 —-a-w- c:\windows\SYSTEM32\avgrsstx.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Themes"=2 (0x2)
"TapiSrv"=3 (0x3)
"SysmonLog"=3 (0x3)
"Schedule"=2 (0x2)
"SCardSvr"=3 (0x3)
"mnmsrvc"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"iPod Service"=3 (0x3)
"helpsvc"=2 (0x2)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"Eventlog"=2 (0x2)
"ERSvc"=2 (0x2)
"CiSvc"=3 (0x3)
"Bonjour Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
.
R0 AvgRkx86;avgrkx86.sys;c:\windows\SYSTEM32\DRIVERS\avgrkx86.sys [4/20/2008 4:20 PM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [4/20/2008 4:20 PM 216400]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [4/20/2008 4:20 PM 243152]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [6/24/2010 4:12 PM 308136]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [8/25/2011 6:53 PM 13672]
R2 mrtRate;mrtRate;c:\windows\SYSTEM32\DRIVERS\MrtRate.sys [11/29/2004 6:18 PM 34916]
R2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [7/9/2012 7:44 PM 935008]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [10/26/2010 11:22 AM 167264]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [6/12/2011 11:15 AM 31125880]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 9:37 PM 4640000]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/17/2009 9:42 PM 135664]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [12/17/2009 9:42 PM 135664]
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 04:42]
.
2011-11-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 04:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://login.yahoo.com/config/mail?.intl=us
mWindow Title = Humboldt Internet
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = [removed] [removed]
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-30 20:28
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(3784)
c:\windows\system32\WININET.dll
c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\progra~1\MICROS~4\Office14\1033\GrooveIntlResource.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-08-30 20:33:34
ComboFix-quarantined-files.txt 2012-08-31 03:33
ComboFix2.txt 2012-08-24 17:45
ComboFix3.txt 2012-08-21 04:00
.
Pre-Run: 10,990,587,904 bytes free
Post-Run: 11,057,037,312 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 4A034A5AA0515CCC86061D79B204C3D3
JonTom
Hello symbiosis7
Please post the aswMBR log as requested
Please post the aswMBR log as requested
symbiosis7
sorry - missed that one. here it is:
aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-08-31 14:30:34
—————————–
14:30:34.750 OS Version: Windows 5.1.2600 Service Pack 3
14:30:34.750 Number of processors: 2 586 0x304
14:30:34.750 ComputerName: MAIN UserName:
14:30:37.406 Initialize success
14:33:29.531 AVAST engine defs: 12083101
14:34:02.906 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17
14:34:02.906 Disk 0 Vendor: WDC_WD800JD-75HKA1 14.03G14 Size: 76293MB BusType: 3
14:34:02.937 Disk 0 MBR read successfully
14:34:02.937 Disk 0 MBR scan
14:34:03.000 Disk 0 unknown MBR code
14:34:03.000 Disk 0 Partition 1 00 DE Dell Utility Dell 4.1 31 MB offset 63
14:34:03.015 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 72669 MB offset 64260
14:34:03.046 Disk 0 Partition 3 00 DB CP/M / CTOS MSWIN4.1 3584 MB offset 148890420
14:34:03.046 Disk 0 scanning sectors +156232125
14:34:03.140 Disk 0 scanning C:\WINDOWS\system32\drivers
14:34:17.453 Service scanning
14:34:39.921 Modules scanning
14:34:57.578 Disk 0 trace - called modules:
14:34:57.578 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
14:34:57.578 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86fcfab8]
14:34:57.578 3 CLASSPNP.SYS[f774dfd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-17[0x86fdd928]
14:35:09.453 AVAST engine scan C:\WINDOWS
14:35:54.546 AVAST engine scan C:\WINDOWS\system32
14:40:01.156 AVAST engine scan C:\WINDOWS\system32\drivers
14:40:21.828 AVAST engine scan C:\Documents and Settings\T. Carlberg
15:00:51.984 File: C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U\80000032.@ **INFECTED** Win32:Sirefef-AHF [Trj]
15:03:03.812 AVAST engine scan C:\Documents and Settings\All Users
15:08:51.218 Scan finished successfully
16:21:14.187 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\T. Carlberg\Desktop\MBR.dat"
16:21:14.187 The log file has been saved successfully to "C:\Documents and Settings\T. Carlberg\Desktop\aswMBR_20120830.txt"
JonTom
Hello symbiosis7
There is still evidence of the zero access infection on this machine (its being very stubborn and it can be difficult to remove as I mentioned).
Lets see what the following can tell us:
There is still evidence of the zero access infection on this machine (its being very stubborn and it can be difficult to remove as I mentioned).
Lets see what the following can tell us:
- RogueKiller
- Download RogueKiller by clicking here and save it to your desktop.
- Quit all running programs.
- Double click on RogueKiller.exe to run it.
- The RKreport.txt shall be generated next to the executable.
- If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe
- Please post the contents of the RKreport.txt in your next Reply.
- Please run the following scan
- Note:Internet Explorer is preferred for this scan, although it will run with other browsers.
- Note for Vista/Windows 7 Users: ESET is compatible but Internet Explorer must be run as Administrator. To do this, right-click on your Internet Explorer icon and select "Run as Administrator".
- Please disable your real time security programs before performing the scan.
- Scan your system with Eset Online Scanner
- Place a check mark in the box YES, I accept the Terms Of Use.
- Click the [external image: Posted Image] button.
- For alternate browsers only: (Microsoft Internet Explorer users can skip these steps).
- Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
- Double click on the [external image: Posted Image] icon on your desktop.
- Check [external image: Posted Image]
- Click the [external image: Posted Image] button.
- Accept any security warnings from your browser.
- Check [external image: Posted Image]
- Make sure that the option to "Remove Found Threats" is UN checked.
- Push the "Start" button.
- ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
- When the scan completes, push [external image: Posted Image]
- Push [external image: Posted Image], and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
- Push the [external image: Posted Image] button.
- Push [external image: Posted Image]
Please post the RogueKiller log and the ESET log in your next reply.
JonTom
Hello symbiosis7
A quick change of plan - do not run RogueKiller or ESET just yet. Lets try the following first instead:
Drag the copy of Combofix that is on your desktop to the recycle bin and then get a fresh copy from
Here
Disable your security programs, run the new copy and post the log created in your next reply.
A quick change of plan - do not run RogueKiller or ESET just yet. Lets try the following first instead:
Drag the copy of Combofix that is on your desktop to the recycle bin and then get a fresh copy from
Here
Disable your security programs, run the new copy and post the log created in your next reply.
symbiosis7
ok. already ran roguekiller, was just prepping for eset online scanner, but will submit combofix log instead.
symbiosis7
hi jontom - thanks for all of your efforts to date. i appreciate the detailed instructions.
here is the latest combofix log.
ComboFix 12-08-31.08 - T. Carlberg 09/01/2012 10:19:29.10.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.334 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((( Files Created from 2012-08-01 to 2012-09-01 )))))))))))))))))))))))))))))))
.
.
2012-08-24 16:52 . 2012-08-24 16:52 ——– d—–w- C:\TDSSKiller_Quarantine
2012-08-22 15:04 . 2012-08-22 15:04 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2012-08-22 04:50 . 2012-08-22 04:50 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2012-08-20 01:46 . 2012-08-20 01:46 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2012-08-07 16:09 . 2012-06-02 22:18 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-08-07 16:09 . 2012-06-02 22:18 214256 —-a-w- c:\windows\system32\muweb.dll
2012-08-07 06:07 . 2012-08-07 06:07 ——– d—–w- c:\program files\Microsoft Synchronization Services
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\program files\Microsoft Sync Framework
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\documents and settings\All Users\Microsoft
2012-08-07 06:03 . 2012-08-07 06:03 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2012-08-07 06:01 . 2012-08-07 06:01 ——– d—–w- c:\program files\Microsoft Analysis Services
2012-08-07 06:00 . 2012-08-07 06:00 ——– d—–w- c:\documents and settings\T. Carlberg\Local Settings\Application Data\Microsoft Help
2012-08-07 06:00 . 2012-09-01 06:00 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2012-08-07 05:59 . 2012-08-07 05:59 ——– d—–r- C:\MSOCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-01 01:20 . 2012-07-22 22:14 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-01 01:20 . 2012-07-22 22:14 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-06 13:58 . 2004-08-04 11:00 78336 —-a-w- c:\windows\system32\browser.dll
2012-07-04 14:05 . 2004-08-04 11:00 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 20:46 . 2010-04-12 21:56 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-07-03 13:40 . 2004-08-04 11:00 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49 . 2004-08-04 11:00 916992 —-a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2004-08-04 11:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2004-08-04 11:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2004-08-04 11:00 385024 —-a-w- c:\windows\system32\html.iec
2012-06-06 15:49 . 2012-06-06 15:49 1070152 —-a-w- c:\windows\system32\MSCOMCTL.OCX
2012-06-05 15:50 . 2008-10-19 04:34 1372672 ——w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2004-08-04 11:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2004-08-04 11:00 152576 —-a-w- c:\windows\system32\schannel.dll
2006-10-10 21:09 . 2006-10-10 21:09 1053198 —-a-w- c:\program files\freemahjongg.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-08-21_03.55.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-09-01 17:12 . 2012-09-01 17:12 16384 c:\windows\temp\Perflib_Perfdata_a34.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-07-10 02:44 2074208 —-a-w- c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-10 2074208]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-08-24 57344]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb01.exe" [2000-08-07 192512]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Intel AppUp(SM) center"="c:\program files\Intel\IntelAppStore\bin\serviceManager.lnk" [2011-04-13 933]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-07-10 1107552]
"ROC_roc_dec12"="c:\program files\AVG Secure Search\ROC_roc_dec12.exe" [2012-01-23 928096]
"HF_G_Jul"="c:\program files\AVG Secure Search\HF_G_Jul.exe" [2012-07-19 36960]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
.
c:\documents and settings\T. Carlberg\Start Menu\Programs\Startup\
AVG Tray Icon.lnk - c:\program files\AVG\AVG9\avgtray.exe [2010-6-24 2077536]
internet explore.lnk - c:\program files\Internet Explorer\iexplore.exe [2004-8-4 638816]
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Billminder.lnk - c:\quickenw\BILLMIND.EXE [2004-11-29 36864]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2004-11-18 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Quicken Startup.lnk - c:\quickenw\QWDLLS.EXE [2004-11-29 36864]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
internet explore.lnk - c:\program files\Internet Explorer\iexplore.exe [2004-8-4 638816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-06-24 23:12 12536 —-a-w- c:\windows\SYSTEM32\avgrsstx.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Themes"=2 (0x2)
"TapiSrv"=3 (0x3)
"SysmonLog"=3 (0x3)
"Schedule"=2 (0x2)
"SCardSvr"=3 (0x3)
"mnmsrvc"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"iPod Service"=3 (0x3)
"helpsvc"=2 (0x2)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"Eventlog"=2 (0x2)
"ERSvc"=2 (0x2)
"CiSvc"=3 (0x3)
"Bonjour Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
.
R0 AvgRkx86;avgrkx86.sys;c:\windows\SYSTEM32\DRIVERS\avgrkx86.sys [4/20/2008 4:20 PM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [4/20/2008 4:20 PM 216400]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [4/20/2008 4:20 PM 243152]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [6/24/2010 4:12 PM 308136]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [8/25/2011 6:53 PM 13672]
R2 mrtRate;mrtRate;c:\windows\SYSTEM32\DRIVERS\MrtRate.sys [11/29/2004 6:18 PM 34916]
R2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [7/9/2012 7:44 PM 935008]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 9:37 PM 4640000]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [10/26/2010 11:22 AM 167264]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [6/12/2011 11:15 AM 31125880]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/17/2009 9:42 PM 135664]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [12/17/2009 9:42 PM 135664]
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 04:42]
.
2011-11-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 04:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://login.yahoo.com/config/mail?.intl=us
mWindow Title = Humboldt Internet
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = [removed] [removed]
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-01 10:31
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(1668)
c:\windows\system32\WININET.dll
c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\progra~1\MICROS~4\Office14\1033\GrooveIntlResource.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-09-01 10:35:40
ComboFix-quarantined-files.txt 2012-09-01 17:35
ComboFix2.txt 2012-08-31 03:33
ComboFix3.txt 2012-08-24 17:45
ComboFix4.txt 2012-08-21 04:00
.
Pre-Run: 10,926,010,368 bytes free
Post-Run: 11,034,746,880 bytes free
.
- - End Of File - - 943E38B65FFA43625EABD158D526D664
here is the latest combofix log.
ComboFix 12-08-31.08 - T. Carlberg 09/01/2012 10:19:29.10.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.334 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((( Files Created from 2012-08-01 to 2012-09-01 )))))))))))))))))))))))))))))))
.
.
2012-08-24 16:52 . 2012-08-24 16:52 ——– d—–w- C:\TDSSKiller_Quarantine
2012-08-22 15:04 . 2012-08-22 15:04 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2012-08-22 04:50 . 2012-08-22 04:50 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Apple Computer
2012-08-20 01:46 . 2012-08-20 01:46 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2012-08-07 16:09 . 2012-06-02 22:18 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-08-07 16:09 . 2012-06-02 22:18 214256 —-a-w- c:\windows\system32\muweb.dll
2012-08-07 06:07 . 2012-08-07 06:07 ——– d—–w- c:\program files\Microsoft Synchronization Services
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\program files\Microsoft Sync Framework
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2012-08-07 06:05 . 2012-08-07 06:05 ——– d—–w- c:\documents and settings\All Users\Microsoft
2012-08-07 06:03 . 2012-08-07 06:03 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2012-08-07 06:01 . 2012-08-07 06:01 ——– d—–w- c:\program files\Microsoft Analysis Services
2012-08-07 06:00 . 2012-08-07 06:00 ——– d—–w- c:\documents and settings\T. Carlberg\Local Settings\Application Data\Microsoft Help
2012-08-07 06:00 . 2012-09-01 06:00 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2012-08-07 05:59 . 2012-08-07 05:59 ——– d—–r- C:\MSOCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-01 01:20 . 2012-07-22 22:14 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-01 01:20 . 2012-07-22 22:14 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-06 13:58 . 2004-08-04 11:00 78336 —-a-w- c:\windows\system32\browser.dll
2012-07-04 14:05 . 2004-08-04 11:00 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 20:46 . 2010-04-12 21:56 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-07-03 13:40 . 2004-08-04 11:00 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49 . 2004-08-04 11:00 916992 —-a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2004-08-04 11:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2004-08-04 11:00 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2004-08-04 11:00 385024 —-a-w- c:\windows\system32\html.iec
2012-06-06 15:49 . 2012-06-06 15:49 1070152 —-a-w- c:\windows\system32\MSCOMCTL.OCX
2012-06-05 15:50 . 2008-10-19 04:34 1372672 ——w- c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2004-08-04 11:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2012-06-04 04:32 . 2004-08-04 11:00 152576 —-a-w- c:\windows\system32\schannel.dll
2006-10-10 21:09 . 2006-10-10 21:09 1053198 —-a-w- c:\program files\freemahjongg.exe
.
.
((((((((((((((((((((((((((((( SnapShot@2012-08-21_03.55.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-09-01 17:12 . 2012-09-01 17:12 16384 c:\windows\temp\Perflib_Perfdata_a34.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-07-10 02:44 2074208 —-a-w- c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll" [2012-07-10 2074208]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-08-24 57344]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb01.exe" [2000-08-07 192512]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-14 114688]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"Intel AppUp(SM) center"="c:\program files\Intel\IntelAppStore\bin\serviceManager.lnk" [2011-04-13 933]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-07-10 1107552]
"ROC_roc_dec12"="c:\program files\AVG Secure Search\ROC_roc_dec12.exe" [2012-01-23 928096]
"HF_G_Jul"="c:\program files\AVG Secure Search\HF_G_Jul.exe" [2012-07-19 36960]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
.
c:\documents and settings\T. Carlberg\Start Menu\Programs\Startup\
AVG Tray Icon.lnk - c:\program files\AVG\AVG9\avgtray.exe [2010-6-24 2077536]
internet explore.lnk - c:\program files\Internet Explorer\iexplore.exe [2004-8-4 638816]
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Billminder.lnk - c:\quickenw\BILLMIND.EXE [2004-11-29 36864]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2004-11-18 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Quicken Startup.lnk - c:\quickenw\QWDLLS.EXE [2004-11-29 36864]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
internet explore.lnk - c:\program files\Internet Explorer\iexplore.exe [2004-8-4 638816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-06-24 23:12 12536 —-a-w- c:\windows\SYSTEM32\avgrsstx.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Themes"=2 (0x2)
"TapiSrv"=3 (0x3)
"SysmonLog"=3 (0x3)
"Schedule"=2 (0x2)
"SCardSvr"=3 (0x3)
"mnmsrvc"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"iPod Service"=3 (0x3)
"helpsvc"=2 (0x2)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"Eventlog"=2 (0x2)
"ERSvc"=2 (0x2)
"CiSvc"=3 (0x3)
"Bonjour Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
.
R0 AvgRkx86;avgrkx86.sys;c:\windows\SYSTEM32\DRIVERS\avgrkx86.sys [4/20/2008 4:20 PM 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [4/20/2008 4:20 PM 216400]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [4/20/2008 4:20 PM 243152]
R2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [6/24/2010 4:12 PM 308136]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [8/25/2011 6:53 PM 13672]
R2 mrtRate;mrtRate;c:\windows\SYSTEM32\DRIVERS\MrtRate.sys [11/29/2004 6:18 PM 34916]
R2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [7/9/2012 7:44 PM 935008]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 9:37 PM 4640000]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG9\Toolbar\ToolbarBroker.exe [10/26/2010 11:22 AM 167264]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [6/12/2011 11:15 AM 31125880]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/17/2009 9:42 PM 135664]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [12/17/2009 9:42 PM 135664]
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 04:42]
.
2011-11-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-18 04:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://login.yahoo.com/config/mail?.intl=us
mWindow Title = Humboldt Internet
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
Trusted Zone: intuit.com\ttlc
TCP: DhcpNameServer = [removed] [removed]
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-01 10:31
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(1668)
c:\windows\system32\WININET.dll
c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\progra~1\MICROS~4\Office14\1033\GrooveIntlResource.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-09-01 10:35:40
ComboFix-quarantined-files.txt 2012-09-01 17:35
ComboFix2.txt 2012-08-31 03:33
ComboFix3.txt 2012-08-24 17:45
ComboFix4.txt 2012-08-21 04:00
.
Pre-Run: 10,926,010,368 bytes free
Post-Run: 11,034,746,880 bytes free
.
- - End Of File - - 943E38B65FFA43625EABD158D526D664
JonTom
Hello symbiosis7
Thank you for the Combofix log.
Did you receive the "recycle bin corrupted - do you want to empty it?" message from Combofix this time?
I would also like you to re-scan with aswMBR and then follow with ESET as you were preparing to do.
Please post the roguekiller, aswMBR and ESET logs in your next reply and let me know exactly how the machine is running.
Thank you for the Combofix log.
Did you receive the "recycle bin corrupted - do you want to empty it?" message from Combofix this time?
Thats not a problem. Please post the roguekiller log if you still have it.ok. already ran roguekiller
I would also like you to re-scan with aswMBR and then follow with ESET as you were preparing to do.
Please post the roguekiller, aswMBR and ESET logs in your next reply and let me know exactly how the machine is running.
symbiosis7
hi jontom - there was no message about a "corrupted recycle bin" when combofix ran this morning.
ran aswMBR after downloading updated files. no problems. ran eset - took a long time.
here is the log from roguekiller, followed by aswmbr and eset logs. the roguekiller log is from your first instruction today, *before* i ran combofix:
RogueKiller V8.0.2 [08/31/2012] by Tigzy
mail: tigzyRKgmailcom
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com
Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : T. Carlberg [Admin rights]
Mode : Scan – Date : 09/01/2012 10:02:28
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 2 ¤¤¤
[HJPOL] HKLM\[…]\System : DisableRegistryTools (0) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FOLDER] U : C:\WINDOWS\Installer\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U –> FOUND
[ZeroAccess][FOLDER] L : C:\WINDOWS\Installer\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\L –> FOUND
[ZeroAccess][FILE] @ : C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\@ –> FOUND
[ZeroAccess][FOLDER] U : C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U –> FOUND
[ZeroAccess][FOLDER] L : C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\L –> FOUND
¤¤¤ Driver : [LOADED] ¤¤¤
¤¤¤ Infection : ZeroAccess ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
–> C:\WINDOWS\system32\drivers\etc\hosts
127.0.0.1 localhost
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: WDC WD800JD-75HKA1 +++++
— User —
[MBR] 8619264307cbb6692b78859d78e78512
[BSP] b72667633f4c7c2babf1970635a88ab8 : MBR Code unknown
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 31 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 64260 | Size: 72669 Mo
2 - [XXXXXX] UNKNOWN (0xdb) [VISIBLE] Offset (sectors): 148890420 | Size: 3584 Mo
User = LL1 … OK!
User = LL2 … OK!
+++++ PhysicalDrive1: Seagate GoFlex Desk USB Device +++++
— User —
[MBR] d8396c52bb9d0767a3921c44e806e419
[BSP] 236eadc3104d23a9359a28a975cfcdc4 : MBR Code unknown
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 1907726 Mo
User = LL1 … OK!
Error reading LL2 MBR!
Finished : << RKreport[1].txt >>
RKreport[1].txt
aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-09-01 10:54:24
—————————–
10:54:24.890 OS Version: Windows 5.1.2600 Service Pack 3
10:54:24.890 Number of processors: 2 586 0x304
10:54:24.890 ComputerName: MAIN UserName:
10:54:26.312 Initialize success
10:57:17.234 AVAST engine defs: 12090100
10:58:51.890 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17
10:58:51.890 Disk 0 Vendor: WDC_WD800JD-75HKA1 14.03G14 Size: 76293MB BusType: 3
10:58:51.921 Disk 0 MBR read successfully
10:58:51.921 Disk 0 MBR scan
10:58:51.984 Disk 0 unknown MBR code
10:58:51.984 Disk 0 Partition 1 00 DE Dell Utility Dell 4.1 31 MB offset 63
10:58:52.000 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 72669 MB offset 64260
10:58:52.031 Disk 0 Partition 3 00 DB CP/M / CTOS MSWIN4.1 3584 MB offset 148890420
10:58:52.031 Disk 0 scanning sectors +156232125
10:58:52.125 Disk 0 scanning C:\WINDOWS\system32\drivers
10:59:07.093 Service scanning
10:59:29.765 Modules scanning
10:59:38.187 Disk 0 trace - called modules:
10:59:38.203 ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
10:59:38.203 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86f4cab8]
10:59:38.203 3 CLASSPNP.SYS[f774dfd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-17[0x86fa1a88]
10:59:39.875 AVAST engine scan C:\WINDOWS
11:00:12.265 AVAST engine scan C:\WINDOWS\system32
11:04:20.031 AVAST engine scan C:\WINDOWS\system32\drivers
11:04:42.375 AVAST engine scan C:\Documents and Settings\T. Carlberg
11:25:30.265 File: C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U\80000032.@ **INFECTED** Win32:Sirefef-AHF [Trj]
11:27:12.062 AVAST engine scan C:\Documents and Settings\All Users
11:32:38.000 Scan finished successfully
11:33:56.156 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\T. Carlberg\Desktop\MBR.dat"
11:33:56.171 The log file has been saved successfully to "C:\Documents and Settings\T. Carlberg\Desktop\aswMBR_20120901.txt"
C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U\80000032.@ a variant of Win32/Sirefef.FD trojan
C:\Qoobox\Quarantine\C\WINDOWS\Installer\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U\80000032.@.vir a variant of Win32/Sirefef.FD trojan
C:\TDSSKiller_Quarantine\24.08.2012_09.49.59\mbr0000\tdlfs0000\tsk0006.dta a variant of Win32/Rootkit.Kryptik.NP trojan
ran aswMBR after downloading updated files. no problems. ran eset - took a long time.
here is the log from roguekiller, followed by aswmbr and eset logs. the roguekiller log is from your first instruction today, *before* i ran combofix:
RogueKiller V8.0.2 [08/31/2012] by Tigzy
mail: tigzyRKgmailcom
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Blog: http://tigzyrk.blogspot.com
Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : T. Carlberg [Admin rights]
Mode : Scan – Date : 09/01/2012 10:02:28
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 2 ¤¤¤
[HJPOL] HKLM\[…]\System : DisableRegistryTools (0) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FOLDER] U : C:\WINDOWS\Installer\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U –> FOUND
[ZeroAccess][FOLDER] L : C:\WINDOWS\Installer\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\L –> FOUND
[ZeroAccess][FILE] @ : C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\@ –> FOUND
[ZeroAccess][FOLDER] U : C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U –> FOUND
[ZeroAccess][FOLDER] L : C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\L –> FOUND
¤¤¤ Driver : [LOADED] ¤¤¤
¤¤¤ Infection : ZeroAccess ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
–> C:\WINDOWS\system32\drivers\etc\hosts
127.0.0.1 localhost
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: WDC WD800JD-75HKA1 +++++
— User —
[MBR] 8619264307cbb6692b78859d78e78512
[BSP] b72667633f4c7c2babf1970635a88ab8 : MBR Code unknown
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 31 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 64260 | Size: 72669 Mo
2 - [XXXXXX] UNKNOWN (0xdb) [VISIBLE] Offset (sectors): 148890420 | Size: 3584 Mo
User = LL1 … OK!
User = LL2 … OK!
+++++ PhysicalDrive1: Seagate GoFlex Desk USB Device +++++
— User —
[MBR] d8396c52bb9d0767a3921c44e806e419
[BSP] 236eadc3104d23a9359a28a975cfcdc4 : MBR Code unknown
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 1907726 Mo
User = LL1 … OK!
Error reading LL2 MBR!
Finished : << RKreport[1].txt >>
RKreport[1].txt
aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-09-01 10:54:24
—————————–
10:54:24.890 OS Version: Windows 5.1.2600 Service Pack 3
10:54:24.890 Number of processors: 2 586 0x304
10:54:24.890 ComputerName: MAIN UserName:
10:54:26.312 Initialize success
10:57:17.234 AVAST engine defs: 12090100
10:58:51.890 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17
10:58:51.890 Disk 0 Vendor: WDC_WD800JD-75HKA1 14.03G14 Size: 76293MB BusType: 3
10:58:51.921 Disk 0 MBR read successfully
10:58:51.921 Disk 0 MBR scan
10:58:51.984 Disk 0 unknown MBR code
10:58:51.984 Disk 0 Partition 1 00 DE Dell Utility Dell 4.1 31 MB offset 63
10:58:52.000 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 72669 MB offset 64260
10:58:52.031 Disk 0 Partition 3 00 DB CP/M / CTOS MSWIN4.1 3584 MB offset 148890420
10:58:52.031 Disk 0 scanning sectors +156232125
10:58:52.125 Disk 0 scanning C:\WINDOWS\system32\drivers
10:59:07.093 Service scanning
10:59:29.765 Modules scanning
10:59:38.187 Disk 0 trace - called modules:
10:59:38.203 ntoskrnl.exe catchme.sys CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
10:59:38.203 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86f4cab8]
10:59:38.203 3 CLASSPNP.SYS[f774dfd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-17[0x86fa1a88]
10:59:39.875 AVAST engine scan C:\WINDOWS
11:00:12.265 AVAST engine scan C:\WINDOWS\system32
11:04:20.031 AVAST engine scan C:\WINDOWS\system32\drivers
11:04:42.375 AVAST engine scan C:\Documents and Settings\T. Carlberg
11:25:30.265 File: C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U\80000032.@ **INFECTED** Win32:Sirefef-AHF [Trj]
11:27:12.062 AVAST engine scan C:\Documents and Settings\All Users
11:32:38.000 Scan finished successfully
11:33:56.156 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\T. Carlberg\Desktop\MBR.dat"
11:33:56.171 The log file has been saved successfully to "C:\Documents and Settings\T. Carlberg\Desktop\aswMBR_20120901.txt"
C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U\80000032.@ a variant of Win32/Sirefef.FD trojan
C:\Qoobox\Quarantine\C\WINDOWS\Installer\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U\80000032.@.vir a variant of Win32/Sirefef.FD trojan
C:\TDSSKiller_Quarantine\24.08.2012_09.49.59\mbr0000\tdlfs0000\tsk0006.dta a variant of Win32/Rootkit.Kryptik.NP trojan
symbiosis7
btw, the computer has been running normally, as far as i can tell, since tdss killer was run using the "cure" option. i know there's still an infection, and more work to do, but i'm relieved to be able to work more-or-less normally.
at what point might i safely take care of financial matters?
JonTom
Hello symbiosis7
Thank you for the logs.
The infection is indeed still present.
As for doing any financial transactions using the infected machine, don't. If you type any passwords into the infected machine they may be compromised.
Please make sure that you have changed all of your passwords using a different computer.
Lets see if TDSSKiller is able to remove the detection. If the file still resists removal we may have to explore other options.
Please run TDSSKiller and if updates are available for the tool please allow them to be installed.
If anything malicious is detected allow it to be cured.
Post the TDSSKiller log in your next reply.
Thank you for the logs.
The infection is indeed still present.
As for doing any financial transactions using the infected machine, don't. If you type any passwords into the infected machine they may be compromised.
Please make sure that you have changed all of your passwords using a different computer.
Lets see if TDSSKiller is able to remove the detection. If the file still resists removal we may have to explore other options.
Please run TDSSKiller and if updates are available for the tool please allow them to be installed.
If anything malicious is detected allow it to be cured.
Post the TDSSKiller log in your next reply.
symbiosis7
hi jontom - tdsskiller detected only "suspicious" file, nothing malicious, so cure was not offered as an option. here is the log:
11:06:08.0515 2440 TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
11:06:08.0984 2440 ============================================================
11:06:08.0984 2440 Current date / time: 2012/09/02 11:06:08.0984
11:06:08.0984 2440 SystemInfo:
11:06:08.0984 2440
11:06:08.0984 2440 OS Version: 5.1.2600 ServicePack: 3.0
11:06:08.0984 2440 Product type: Workstation
11:06:08.0984 2440 ComputerName: MAIN
11:06:08.0984 2440 UserName: T. Carlberg
11:06:08.0984 2440 Windows directory: C:\WINDOWS
11:06:08.0984 2440 System windows directory: C:\WINDOWS
11:06:08.0984 2440 Processor architecture: Intel x86
11:06:08.0984 2440 Number of processors: 2
11:06:08.0984 2440 Page size: 0x1000
11:06:08.0984 2440 Boot type: Normal boot
11:06:08.0984 2440 ============================================================
11:06:10.0515 2440 Drive \Device\Harddisk0\DR0 - Size: 0x12A05F2000 (74.51 Gb), SectorSize: 0x200, Cylinders: 0x25FE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
11:06:10.0515 2440 Drive \Device\Harddisk1\DR4 - Size: 0x1D1C1115E00 (1863.02 Gb), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
11:06:10.0515 2440 ============================================================
11:06:10.0515 2440 \Device\Harddisk0\DR0:
11:06:10.0515 2440 MBR partitions:
11:06:10.0515 2440 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xFB04, BlocksNum 0x8DEE830
11:06:10.0515 2440 \Device\Harddisk1\DR4:
11:06:10.0531 2440 MBR partitions:
11:06:10.0531 2440 \Device\Harddisk1\DR4\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xE8E074C1
11:06:10.0531 2440 ============================================================
11:06:10.0562 2440 C: <-> \Device\Harddisk0\DR0\Partition1
11:06:10.0562 2440 F: <-> \Device\Harddisk1\DR4\Partition1
11:06:10.0562 2440 ============================================================
11:06:10.0562 2440 Initialize success
11:06:10.0562 2440 ============================================================
11:06:22.0843 2580 ============================================================
11:06:22.0843 2580 Scan started
11:06:22.0843 2580 Mode: Manual; TDLFS;
11:06:22.0843 2580 ============================================================
11:06:23.0531 2580 ================ Scan system memory ========================
11:06:23.0531 2580 System memory - ok
11:06:23.0531 2580 ================ Scan services =============================
11:06:23.0671 2580 Abiosdsk - ok
11:06:23.0703 2580 [ 6ABB91494FE6C59089B9336452AB2EA3 ] abp480n5 C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
11:06:23.0703 2580 abp480n5 - ok
11:06:23.0750 2580 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
11:06:23.0765 2580 ACPI - ok
11:06:23.0781 2580 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
11:06:23.0781 2580 ACPIEC - ok
11:06:23.0828 2580 [ 9A11864873DA202C996558B2106B0BBC ] adpu160m C:\WINDOWS\system32\DRIVERS\adpu160m.sys
11:06:23.0828 2580 adpu160m - ok
11:06:23.0843 2580 [ 11C04B17ED2ABBB4833694BCD644AC90 ] aeaudio C:\WINDOWS\system32\drivers\aeaudio.sys
11:06:23.0843 2580 aeaudio - ok
11:06:23.0890 2580 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
11:06:23.0890 2580 aec - ok
11:06:23.0953 2580 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
11:06:23.0953 2580 AFD - ok
11:06:23.0984 2580 [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440 C:\WINDOWS\system32\DRIVERS\agp440.sys
11:06:23.0984 2580 agp440 - ok
11:06:24.0000 2580 [ 03A7E0922ACFE1B07D5DB2EEB0773063 ] agpCPQ C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
11:06:24.0000 2580 agpCPQ - ok
11:06:24.0000 2580 [ C23EA9B5F46C7F7910DB3EAB648FF013 ] Aha154x C:\WINDOWS\system32\DRIVERS\aha154x.sys
11:06:24.0000 2580 Aha154x - ok
11:06:24.0015 2580 [ 19DD0FB48B0C18892F70E2E7D61A1529 ] aic78u2 C:\WINDOWS\system32\DRIVERS\aic78u2.sys
11:06:24.0015 2580 aic78u2 - ok
11:06:24.0015 2580 [ B7FE594A7468AA0132DEB03FB8E34326 ] aic78xx C:\WINDOWS\system32\DRIVERS\aic78xx.sys
11:06:24.0031 2580 aic78xx - ok
11:06:24.0062 2580 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll
11:06:24.0062 2580 Alerter - ok
11:06:24.0078 2580 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe
11:06:24.0078 2580 ALG - ok
11:06:24.0093 2580 [ 1140AB9938809700B46BB88E46D72A96 ] AliIde C:\WINDOWS\system32\DRIVERS\aliide.sys
11:06:24.0093 2580 AliIde - ok
11:06:24.0093 2580 [ CB08AED0DE2DD889A8A820CD8082D83C ] alim1541 C:\WINDOWS\system32\DRIVERS\alim1541.sys
11:06:24.0093 2580 alim1541 - ok
11:06:24.0125 2580 [ 95B4FB835E28AA1336CEEB07FD5B9398 ] amdagp C:\WINDOWS\system32\DRIVERS\amdagp.sys
11:06:24.0125 2580 amdagp - ok
11:06:24.0140 2580 [ 79F5ADD8D24BD6893F2903A3E2F3FAD6 ] amsint C:\WINDOWS\system32\DRIVERS\amsint.sys
11:06:24.0140 2580 amsint - ok
11:06:24.0140 2580 AppMgmt - ok
11:06:24.0156 2580 [ 62D318E9A0C8FC9B780008E724283707 ] asc C:\WINDOWS\system32\DRIVERS\asc.sys
11:06:24.0156 2580 asc - ok
11:06:24.0156 2580 [ 69EB0CC7714B32896CCBFD5EDCBEA447 ] asc3350p C:\WINDOWS\system32\DRIVERS\asc3350p.sys
11:06:24.0156 2580 asc3350p - ok
11:06:24.0171 2580 [ 5D8DE112AA0254B907861E9E9C31D597 ] asc3550 C:\WINDOWS\system32\DRIVERS\asc3550.sys
11:06:24.0171 2580 asc3550 - ok
11:06:24.0343 2580 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
11:06:24.0390 2580 aspnet_state - ok
11:06:24.0437 2580 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
11:06:24.0437 2580 AsyncMac - ok
11:06:24.0437 2580 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
11:06:24.0437 2580 atapi - ok
11:06:24.0453 2580 Atdisk - ok
11:06:24.0500 2580 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
11:06:24.0515 2580 Atmarpc - ok
11:06:24.0546 2580 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
11:06:24.0546 2580 AudioSrv - ok
11:06:24.0546 2580 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
11:06:24.0546 2580 audstub - ok
11:06:24.0718 2580 [ D45B7995761253A92AB071D576114F28 ] AVG Security Toolbar Service C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe
11:06:24.0718 2580 AVG Security Toolbar Service - ok
11:06:24.0781 2580 [ C4D15594DB5BE042D3346EA58DF87D89 ] avg9wd C:\Program Files\AVG\AVG9\avgwdsvc.exe
11:06:24.0781 2580 avg9wd - ok
11:06:24.0828 2580 [ B8C187439D27ABA430DD69FDCF1FA657 ] AvgLdx86 C:\WINDOWS\System32\Drivers\avgldx86.sys
11:06:24.0843 2580 AvgLdx86 - ok
11:06:24.0875 2580 [ 80FF2B1B7EEDA966394F0BAA895BBF4B ] AvgMfx86 C:\WINDOWS\System32\Drivers\avgmfx86.sys
11:06:24.0875 2580 AvgMfx86 - ok
11:06:24.0906 2580 [ 5BBCD8646074A3AF4EE9B321D12C2B64 ] AvgRkx86 C:\WINDOWS\system32\Drivers\avgrkx86.sys
11:06:24.0921 2580 AvgRkx86 - ok
11:06:24.0968 2580 [ 9A7A93388F503A34E7339AE7F9997449 ] AvgTdiX C:\WINDOWS\System32\Drivers\avgtdix.sys
11:06:24.0968 2580 AvgTdiX - ok
11:06:25.0000 2580 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
11:06:25.0000 2580 Beep - ok
11:06:25.0093 2580 [ 673CF4F6BB1FBE09331B526802FBB892 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
11:06:25.0109 2580 Bonjour Service - ok
11:06:25.0125 2580 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll
11:06:25.0125 2580 Browser - ok
11:06:25.0156 2580 [ C945DC4EEE3F624DFD07788EA7F0DB0A ] bvrp_pci C:\WINDOWS\system32\drivers\bvrp_pci.sys
11:06:25.0171 2580 bvrp_pci - ok
11:06:25.0312 2580 catchme - ok
11:06:25.0328 2580 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
11:06:25.0328 2580 cbidf - ok
11:06:25.0343 2580 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
11:06:25.0343 2580 cbidf2k - ok
11:06:25.0375 2580 [ F3EC03299634490E97BBCE94CD2954C7 ] cd20xrnt C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
11:06:25.0375 2580 cd20xrnt - ok
11:06:25.0390 2580 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
11:06:25.0390 2580 Cdaudio - ok
11:06:25.0421 2580 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
11:06:25.0421 2580 Cdfs - ok
11:06:25.0453 2580 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
11:06:25.0453 2580 Cdrom - ok
11:06:25.0453 2580 Changer - ok
11:06:25.0500 2580 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe
11:06:25.0531 2580 CiSvc - ok
11:06:25.0609 2580 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
11:06:25.0656 2580 ClipSrv - ok
11:06:25.0687 2580 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:06:26.0390 2580 clr_optimization_v2.0.50727_32 - ok
11:06:27.0140 2580 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
11:06:27.0171 2580 clr_optimization_v4.0.30319_32 - ok
11:06:27.0218 2580 [ E5DCB56C533014ECBC556A8357C929D5 ] CmdIde C:\WINDOWS\system32\DRIVERS\cmdide.sys
11:06:27.0234 2580 CmdIde - ok
11:06:27.0250 2580 COMSysApp - ok
11:06:27.0281 2580 [ 3EE529119EED34CD212A215E8C40D4B6 ] Cpqarray C:\WINDOWS\system32\DRIVERS\cpqarray.sys
11:06:27.0281 2580 Cpqarray - ok
11:06:27.0359 2580 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
11:06:27.0359 2580 CryptSvc - ok
11:06:27.0468 2580 [ E550E7418984B65A78299D248F0A7F36 ] dac2w2k C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
11:06:27.0500 2580 dac2w2k - ok
11:06:27.0500 2580 [ 683789CAA3864EB46125AE86FF677D34 ] dac960nt C:\WINDOWS\system32\DRIVERS\dac960nt.sys
11:06:27.0515 2580 dac960nt - ok
11:06:27.0640 2580 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
11:06:27.0765 2580 DcomLaunch - ok
11:06:27.0812 2580 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
11:06:27.0828 2580 Dhcp - ok
11:06:27.0875 2580 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
11:06:27.0875 2580 Disk - ok
11:06:27.0890 2580 dmadmin - ok
11:06:28.0187 2580 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
11:06:28.0218 2580 dmboot - ok
11:06:28.0250 2580 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys
11:06:28.0250 2580 dmio - ok
11:06:28.0312 2580 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
11:06:28.0312 2580 dmload - ok
11:06:28.0359 2580 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll
11:06:28.0359 2580 dmserver - ok
11:06:28.0406 2580 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
11:06:28.0406 2580 DMusic - ok
11:06:28.0453 2580 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
11:06:28.0453 2580 Dnscache - ok
11:06:28.0484 2580 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
11:06:28.0484 2580 Dot3svc - ok
11:06:28.0500 2580 [ 40F3B93B4E5B0126F2F5C0A7A5E22660 ] dpti2o C:\WINDOWS\system32\DRIVERS\dpti2o.sys
11:06:28.0500 2580 dpti2o - ok
11:06:28.0546 2580 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
11:06:28.0546 2580 drmkaud - ok
11:06:28.0578 2580 [ B15F9E526BA511A48B1B1B8537815740 ] drvmcdb C:\WINDOWS\system32\drivers\drvmcdb.sys
11:06:28.0578 2580 drvmcdb - ok
11:06:28.0578 2580 [ FA4670CAE95AE2BB857C68E535661145 ] drvnddm C:\WINDOWS\system32\drivers\drvnddm.sys
11:06:28.0578 2580 drvnddm - ok
11:06:28.0640 2580 [ 7D91DC6342248369F94D6EBA0CF42E99 ] E100B C:\WINDOWS\system32\DRIVERS\e100b325.sys
11:06:28.0640 2580 E100B - ok
11:06:28.0687 2580 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll
11:06:28.0687 2580 EapHost - ok
11:06:28.0734 2580 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll
11:06:28.0734 2580 ERSvc - ok
11:06:28.0781 2580 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe
11:06:28.0781 2580 Eventlog - ok
11:06:28.0828 2580 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll
11:06:28.0843 2580 EventSystem - ok
11:06:28.0890 2580 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
11:06:28.0890 2580 Fastfat - ok
11:06:28.0937 2580 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
11:06:28.0937 2580 FastUserSwitchingCompatibility - ok
11:06:28.0937 2580 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys
11:06:28.0937 2580 Fdc - ok
11:06:28.0968 2580 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
11:06:28.0968 2580 Fips - ok
11:06:29.0000 2580 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys
11:06:29.0000 2580 Flpydisk - ok
11:06:29.0046 2580 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
11:06:29.0062 2580 FltMgr - ok
11:06:29.0140 2580 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
11:06:29.0140 2580 FontCache3.0.0.0 - ok
11:06:29.0156 2580 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
11:06:29.0156 2580 Fs_Rec - ok
11:06:29.0171 2580 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
11:06:29.0171 2580 Ftdisk - ok
11:06:29.0218 2580 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
11:06:29.0218 2580 GEARAspiWDM - ok
11:06:29.0265 2580 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
11:06:29.0265 2580 Gpc - ok
11:06:29.0328 2580 gupdate - ok
11:06:29.0328 2580 gupdatem - ok
11:06:29.0421 2580 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
11:06:29.0421 2580 helpsvc - ok
11:06:29.0421 2580 HidServ - ok
11:06:29.0453 2580 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
11:06:29.0453 2580 HidUsb - ok
11:06:29.0515 2580 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
11:06:29.0515 2580 hkmsvc - ok
11:06:29.0531 2580 [ B028377DEA0546A5FCFBA928A8AEFAE0 ] hpn C:\WINDOWS\system32\DRIVERS\hpn.sys
11:06:29.0531 2580 hpn - ok
11:06:29.0593 2580 [ 77E4FF0B73BC0AEAAF39BF0C8104231F ] HSFHWBS2 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys
11:06:29.0593 2580 HSFHWBS2 - ok
11:06:29.0640 2580 [ 60E1604729A15EF4A3B05F298427B3B1 ] HSF_DP C:\WINDOWS\system32\DRIVERS\HSF_DP.sys
11:06:29.0671 2580 HSF_DP - ok
11:06:29.0718 2580 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
11:06:29.0718 2580 HTTP - ok
11:06:29.0781 2580 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
11:06:29.0781 2580 HTTPFilter - ok
11:06:29.0781 2580 [ 9368670BD426EBEA5E8B18A62416EC28 ] i2omgmt C:\WINDOWS\system32\drivers\i2omgmt.sys
11:06:29.0781 2580 i2omgmt - ok
11:06:29.0812 2580 [ F10863BF1CCC290BABD1A09188AE49E0 ] i2omp C:\WINDOWS\system32\DRIVERS\i2omp.sys
11:06:29.0812 2580 i2omp - ok
11:06:29.0843 2580 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
11:06:29.0843 2580 i8042prt - ok
11:06:29.0921 2580 [ 5A8E05F1D5C36ABD58CFFA111EB325EA ] ialm C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
11:06:29.0953 2580 ialm - ok
11:06:30.0046 2580 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
11:06:30.0109 2580 idsvc - ok
11:06:30.0171 2580 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
11:06:30.0171 2580 Imapi - ok
11:06:30.0218 2580 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe
11:06:30.0218 2580 ImapiService - ok
11:06:30.0234 2580 [ 4A40E045FAEE58631FD8D91AFC620719 ] ini910u C:\WINDOWS\system32\DRIVERS\ini910u.sys
11:06:30.0234 2580 ini910u - ok
11:06:30.0250 2580 [ B5466A9250342A7AA0CD1FBA13420678 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys
11:06:30.0250 2580 IntelIde - ok
11:06:30.0296 2580 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
11:06:30.0296 2580 intelppm - ok
11:06:30.0468 2580 [ 7BDB4E00E1CB174B56E5B2C31DDE68A7 ] IntuitUpdateService C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
11:06:30.0468 2580 IntuitUpdateService - ok
11:06:30.0562 2580 [ 1663A135865F0BA6E853353E98E67F2A ] IntuitUpdateServiceV4 C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
11:06:30.0562 2580 IntuitUpdateServiceV4 - ok
11:06:30.0593 2580 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
11:06:30.0593 2580 Ip6Fw - ok
11:06:30.0656 2580 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
11:06:30.0656 2580 IpFilterDriver - ok
11:06:30.0671 2580 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
11:06:30.0687 2580 IpInIp - ok
11:06:30.0687 2580 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
11:06:30.0687 2580 IpNat - ok
11:06:30.0750 2580 [ 32CDEDD15E2D1A557CD54552AE78FF86 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
11:06:30.0781 2580 iPod Service - ok
11:06:30.0828 2580 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
11:06:30.0828 2580 IPSec - ok
11:06:30.0859 2580 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
11:06:30.0859 2580 IRENUM - ok
11:06:30.0921 2580 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
11:06:30.0921 2580 isapnp - ok
11:06:31.0046 2580 [ 381B25DC8E958D905B33130D500BBF29 ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe
11:06:31.0046 2580 JavaQuickStarterService - ok
11:06:31.0062 2580 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
11:06:31.0062 2580 Kbdclass - ok
11:06:31.0078 2580 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
11:06:31.0078 2580 kmixer - ok
11:06:31.0140 2580 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
11:06:31.0140 2580 KSecDD - ok
11:06:31.0187 2580 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
11:06:31.0187 2580 lanmanserver - ok
11:06:31.0234 2580 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
11:06:31.0234 2580 lanmanworkstation - ok
11:06:31.0234 2580 lbrtfdc - ok
11:06:31.0265 2580 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
11:06:31.0265 2580 LmHosts - ok
11:06:31.0281 2580 [ EEAEA6514BA7C9D273B5E87C4E1AAB30 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
11:06:31.0281 2580 mdmxsdk - ok
11:06:31.0312 2580 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll
11:06:31.0312 2580 Messenger - ok
11:06:31.0593 2580 Microsoft SharePoint Workspace Audit Service - ok
11:06:31.0625 2580 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
11:06:31.0625 2580 mnmdd - ok
11:06:31.0671 2580 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
11:06:31.0671 2580 mnmsrvc - ok
11:06:31.0718 2580 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
11:06:31.0718 2580 Modem - ok
11:06:31.0765 2580 [ 1992E0D143B09653AB0F9C5E04B0FD65 ] MODEMCSA C:\WINDOWS\system32\drivers\MODEMCSA.sys
11:06:31.0765 2580 MODEMCSA - ok
11:06:31.0765 2580 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
11:06:31.0781 2580 Mouclass - ok
11:06:31.0796 2580 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
11:06:31.0796 2580 MountMgr - ok
11:06:31.0843 2580 [ 3F4BB95E5A44F3BE34824E8E7CAF0737 ] mraid35x C:\WINDOWS\system32\DRIVERS\mraid35x.sys
11:06:31.0843 2580 mraid35x - ok
11:06:31.0890 2580 [ 6075DE2AD531F6E30C9995DFDA22001F ] mrtRate C:\WINDOWS\system32\drivers\mrtRate.sys
11:06:31.0890 2580 mrtRate - ok
11:06:31.0906 2580 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
11:06:31.0906 2580 MRxDAV - ok
11:06:31.0953 2580 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
11:06:31.0968 2580 MRxSmb - ok
11:06:32.0031 2580 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe
11:06:32.0031 2580 MSDTC - ok
11:06:32.0078 2580 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
11:06:32.0078 2580 Msfs - ok
11:06:32.0093 2580 MSIServer - ok
11:06:32.0109 2580 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
11:06:32.0109 2580 MSKSSRV - ok
11:06:32.0125 2580 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
11:06:32.0125 2580 MSPCLOCK - ok
11:06:32.0171 2580 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
11:06:32.0171 2580 MSPQM - ok
11:06:32.0187 2580 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
11:06:32.0187 2580 mssmbios - ok
11:06:32.0234 2580 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
11:06:32.0234 2580 Mup - ok
11:06:32.0281 2580 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll
11:06:32.0281 2580 napagent - ok
11:06:32.0312 2580 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
11:06:32.0312 2580 NDIS - ok
11:06:32.0359 2580 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
11:06:32.0359 2580 NdisTapi - ok
11:06:32.0375 2580 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
11:06:32.0375 2580 Ndisuio - ok
11:06:32.0406 2580 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
11:06:32.0421 2580 NdisWan - ok
11:06:32.0453 2580 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
11:06:32.0453 2580 NDProxy - ok
11:06:32.0484 2580 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
11:06:32.0484 2580 NetBIOS - ok
11:06:32.0500 2580 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
11:06:32.0500 2580 NetBT - ok
11:06:32.0546 2580 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe
11:06:32.0562 2580 NetDDE - ok
11:06:32.0562 2580 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
11:06:32.0562 2580 NetDDEdsdm - ok
11:06:32.0593 2580 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe
11:06:32.0593 2580 Netlogon - ok
11:06:32.0625 2580 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll
11:06:32.0640 2580 Netman - ok
11:06:32.0750 2580 [ 02D0798F376FCBD0210EDA58476D0B1B ] NetSvc C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
11:06:32.0750 2580 NetSvc - ok
11:06:32.0796 2580 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
11:06:32.0796 2580 NetTcpPortSharing - ok
11:06:32.0843 2580 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll
11:06:32.0843 2580 Nla - ok
11:06:32.0859 2580 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
11:06:32.0859 2580 Npfs - ok
11:06:32.0890 2580 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
11:06:32.0890 2580 Ntfs - ok
11:06:32.0906 2580 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
11:06:32.0906 2580 NtLmSsp - ok
11:06:32.0937 2580 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
11:06:32.0953 2580 NtmsSvc - ok
11:06:32.0968 2580 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
11:06:32.0968 2580 Null - ok
11:06:33.0046 2580 [ 2B298519EDBFCF451D43E0F1E8F1006D ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
11:06:33.0093 2580 nv - ok
11:06:33.0140 2580 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
11:06:33.0140 2580 NwlnkFlt - ok
11:06:33.0140 2580 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
11:06:33.0140 2580 NwlnkFwd - ok
11:06:33.0171 2580 [ 53D5F1278D9EDB21689BBBCECC09108D ] omci C:\WINDOWS\system32\DRIVERS\omci.sys
11:06:33.0171 2580 omci - ok
11:06:33.0250 2580 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
11:06:33.0250 2580 ose - ok
11:06:33.0578 2580 [ 358A9CCA612C68EB2F07DDAD4CE1D8D7 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
11:06:33.0781 2580 osppsvc - ok
11:06:33.0828 2580 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys
11:06:33.0828 2580 Parport - ok
11:06:33.0843 2580 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
11:06:33.0843 2580 PartMgr - ok
11:06:33.0859 2580 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
11:06:33.0859 2580 ParVdm - ok
11:06:33.0875 2580 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
11:06:33.0875 2580 PCI - ok
11:06:33.0875 2580 PCIDump - ok
11:06:33.0906 2580 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
11:06:33.0906 2580 PCIIde - ok
11:06:33.0937 2580 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
11:06:33.0937 2580 Pcmcia - ok
11:06:33.0937 2580 PDCOMP - ok
11:06:33.0953 2580 PDFRAME - ok
11:06:33.0953 2580 PDRELI - ok
11:06:33.0968 2580 PDRFRAME - ok
11:06:33.0968 2580 [ 6C14B9C19BA84F73D3A86DBA11133101 ] perc2 C:\WINDOWS\system32\DRIVERS\perc2.sys
11:06:33.0968 2580 perc2 - ok
11:06:34.0000 2580 [ F50F7C27F131AFE7BEBA13E14A3B9416 ] perc2hib C:\WINDOWS\system32\DRIVERS\perc2hib.sys
11:06:34.0000 2580 perc2hib - ok
11:06:34.0062 2580 [ 444F122E68DB44C0589227781F3C8B3F ] pfc C:\WINDOWS\system32\drivers\pfc.sys
11:06:34.0062 2580 pfc - ok
11:06:34.0078 2580 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe
11:06:34.0078 2580 PlugPlay - ok
11:06:34.0093 2580 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
11:06:34.0093 2580 PolicyAgent - ok
11:06:34.0109 2580 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
11:06:34.0109 2580 PptpMiniport - ok
11:06:34.0109 2580 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
11:06:34.0109 2580 ProtectedStorage - ok
11:06:34.0125 2580 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
11:06:34.0125 2580 PSched - ok
11:06:34.0171 2580 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
11:06:34.0171 2580 Ptilink - ok
11:06:34.0187 2580 [ 1962166E0CEB740704F30FA55AD3D509 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys
11:06:34.0187 2580 PxHelp20 - ok
11:06:34.0218 2580 [ 0A63FB54039EB5662433CABA3B26DBA7 ] ql1080 C:\WINDOWS\system32\DRIVERS\ql1080.sys
11:06:34.0218 2580 ql1080 - ok
11:06:34.0218 2580 [ 6503449E1D43A0FF0201AD5CB1B8C706 ] Ql10wnt C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
11:06:34.0218 2580 Ql10wnt - ok
11:06:34.0234 2580 [ 156ED0EF20C15114CA097A34A30D8A01 ] ql12160 C:\WINDOWS\system32\DRIVERS\ql12160.sys
11:06:34.0234 2580 ql12160 - ok
11:06:34.0234 2580 [ 70F016BEBDE6D29E864C1230A07CC5E6 ] ql1240 C:\WINDOWS\system32\DRIVERS\ql1240.sys
11:06:34.0250 2580 ql1240 - ok
11:06:34.0250 2580 [ 907F0AEEA6BC451011611E732BD31FCF ] ql1280 C:\WINDOWS\system32\DRIVERS\ql1280.sys
11:06:34.0250 2580 ql1280 - ok
11:06:34.0281 2580 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
11:06:34.0281 2580 RasAcd - ok
11:06:34.0328 2580 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll
11:06:34.0328 2580 RasAuto - ok
11:06:34.0343 2580 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
11:06:34.0343 2580 Rasl2tp - ok
11:06:34.0390 2580 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll
11:06:34.0406 2580 RasMan - ok
11:06:34.0406 2580 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
11:06:34.0406 2580 RasPppoe - ok
11:06:34.0421 2580 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
11:06:34.0421 2580 Raspti - ok
11:06:34.0437 2580 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
11:06:34.0437 2580 Rdbss - ok
11:06:34.0453 2580 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
11:06:34.0453 2580 RDPCDD - ok
11:06:34.0500 2580 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
11:06:34.0500 2580 rdpdr - ok
11:06:34.0546 2580 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
11:06:34.0546 2580 RDPWD - ok
11:06:34.0593 2580 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
11:06:34.0609 2580 RDSessMgr - ok
11:06:34.0625 2580 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
11:06:34.0625 2580 redbook - ok
11:06:34.0671 2580 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
11:06:34.0671 2580 RemoteAccess - ok
11:06:34.0703 2580 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe
11:06:34.0718 2580 RpcLocator - ok
11:06:34.0734 2580 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll
11:06:34.0750 2580 RpcSs - ok
11:06:34.0781 2580 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe
11:06:34.0781 2580 RSVP - ok
11:06:34.0781 2580 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe
11:06:34.0781 2580 SamSs - ok
11:06:34.0812 2580 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
11:06:34.0812 2580 SCardSvr - ok
11:06:34.0859 2580 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll
11:06:34.0859 2580 Schedule - ok
11:06:34.0921 2580 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
11:06:34.0921 2580 Secdrv - ok
11:06:34.0968 2580 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll
11:06:34.0968 2580 seclogon - ok
11:06:35.0031 2580 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll
11:06:35.0031 2580 SENS - ok
11:06:35.0078 2580 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
11:06:35.0078 2580 serenum - ok
11:06:35.0093 2580 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
11:06:35.0093 2580 Serial - ok
11:06:35.0125 2580 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
11:06:35.0125 2580 Sfloppy - ok
11:06:35.0187 2580 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
11:06:35.0203 2580 SharedAccess - ok
11:06:35.0203 2580 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
11:06:35.0203 2580 ShellHWDetection - ok
11:06:35.0218 2580 Simbad - ok
11:06:35.0281 2580 [ 6B33D0EBD30DB32E27D1D78FE946A754 ] sisagp C:\WINDOWS\system32\DRIVERS\sisagp.sys
11:06:35.0281 2580 sisagp - ok
11:06:35.0312 2580 [ 4AA922332433CDEB8B82C072C212E32E ] smwdm C:\WINDOWS\system32\drivers\smwdm.sys
11:06:35.0328 2580 smwdm - ok
11:06:35.0343 2580 [ 83C0F71F86D3BDAF915685F3D568B20E ] Sparrow C:\WINDOWS\system32\DRIVERS\sparrow.sys
11:06:35.0343 2580 Sparrow - ok
11:06:35.0406 2580 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
11:06:35.0406 2580 splitter - ok
11:06:35.0453 2580 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
11:06:35.0453 2580 Spooler - ok
11:06:35.0500 2580 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
11:06:35.0515 2580 sr - ok
11:06:35.0546 2580 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll
11:06:35.0562 2580 srservice - ok
11:06:35.0609 2580 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
11:06:35.0609 2580 Srv - ok
11:06:35.0656 2580 [ D7968049BE0ADBB6A57CEE3960320911 ] sscdbhk5 C:\WINDOWS\system32\drivers\sscdbhk5.sys
11:06:35.0671 2580 sscdbhk5 - ok
11:06:35.0718 2580 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
11:06:35.0718 2580 SSDPSRV - ok
11:06:35.0718 2580 [ C3FFD65ABFB6441E7606CF74F1155273 ] ssrtln C:\WINDOWS\system32\drivers\ssrtln.sys
11:06:35.0718 2580 ssrtln - ok
11:06:35.0781 2580 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll
11:06:35.0796 2580 stisvc - ok
11:06:35.0843 2580 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
11:06:35.0843 2580 swenum - ok
11:06:35.0890 2580 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
11:06:35.0890 2580 swmidi - ok
11:06:35.0906 2580 SwPrv - ok
11:06:35.0906 2580 [ 1FF3217614018630D0A6758630FC698C ] symc810 C:\WINDOWS\system32\DRIVERS\symc810.sys
11:06:35.0906 2580 symc810 - ok
11:06:35.0921 2580 [ 070E001D95CF725186EF8B20335F933C ] symc8xx C:\WINDOWS\system32\DRIVERS\symc8xx.sys
11:06:35.0921 2580 symc8xx - ok
11:06:35.0921 2580 [ 80AC1C4ABBE2DF3B738BF15517A51F2C ] sym_hi C:\WINDOWS\system32\DRIVERS\sym_hi.sys
11:06:35.0921 2580 sym_hi - ok
11:06:35.0937 2580 [ BF4FAB949A382A8E105F46EBB4937058 ] sym_u3 C:\WINDOWS\system32\DRIVERS\sym_u3.sys
11:06:35.0937 2580 sym_u3 - ok
11:06:35.0968 2580 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
11:06:35.0968 2580 sysaudio - ok
11:06:36.0015 2580 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
11:06:36.0015 2580 SysmonLog - ok
11:06:36.0078 2580 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
11:06:36.0078 2580 TapiSrv - ok
11:06:36.0140 2580 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
11:06:36.0156 2580 Tcpip - ok
11:06:36.0203 2580 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
11:06:36.0203 2580 TDPIPE - ok
11:06:36.0250 2580 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
11:06:36.0250 2580 TDTCP - ok
11:06:36.0296 2580 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
11:06:36.0296 2580 TermDD - ok
11:06:36.0359 2580 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll
11:06:36.0359 2580 TermService - ok
11:06:36.0437 2580 [ 1D265CD2FB1673A0873BF8CEC19DDC7F ] tfsnboio C:\WINDOWS\system32\dla\tfsnboio.sys
11:06:36.0437 2580 tfsnboio - ok
11:06:36.0437 2580 [ 62E4901295E0467CAC78E5B4B131AE5C ] tfsncofs C:\WINDOWS\system32\dla\tfsncofs.sys
11:06:36.0437 2580 tfsncofs - ok
11:06:36.0453 2580 [ A2F380F9252AB3464C859ADF91EEAD9C ] tfsndrct C:\WINDOWS\system32\dla\tfsndrct.sys
11:06:36.0453 2580 tfsndrct - ok
11:06:36.0468 2580 [ EEE79BBEFE9C6A2A3CE6C8753CFEA950 ] tfsndres C:\WINDOWS\system32\dla\tfsndres.sys
11:06:36.0468 2580 tfsndres - ok
11:06:36.0484 2580 [ 9D644EB11FEC9487450C4CFCD63A5DF4 ] tfsnifs C:\WINDOWS\system32\dla\tfsnifs.sys
11:06:36.0484 2580 tfsnifs - ok
11:06:36.0484 2580 [ E656AF05C67EDB7C0E9230A5DF71ED1B ] tfsnopio C:\WINDOWS\system32\dla\tfsnopio.sys
11:06:36.0484 2580 tfsnopio - ok
11:06:36.0500 2580 [ 64FCCB9CCE703CA507DFFC3CEBF6B2CB ] tfsnpool C:\WINDOWS\system32\dla\tfsnpool.sys
11:06:36.0500 2580 tfsnpool - ok
11:06:36.0515 2580 [ 48BC9D8AB4E4B9BFF70FB18E55CEC3D6 ] tfsnudf C:\WINDOWS\system32\dla\tfsnudf.sys
11:06:36.0515 2580 tfsnudf - ok
11:06:36.0531 2580 [ 79F60822224256B49BFC855DA8D651D5 ] tfsnudfa C:\WINDOWS\system32\dla\tfsnudfa.sys
11:06:36.0531 2580 tfsnudfa - ok
11:06:36.0546 2580 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll
11:06:36.0546 2580 Themes - ok
11:06:36.0562 2580 [ F2790F6AF01321B172AA62F8E1E187D9 ] TosIde C:\WINDOWS\system32\DRIVERS\toside.sys
11:06:36.0562 2580 TosIde - ok
11:06:36.0609 2580 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll
11:06:36.0609 2580 TrkWks - ok
11:06:36.0656 2580 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
11:06:36.0656 2580 Udfs - ok
11:06:36.0671 2580 [ 1B698A51CD528D8DA4FFAED66DFC51B9 ] ultra C:\WINDOWS\system32\DRIVERS\ultra.sys
11:06:36.0671 2580 ultra - ok
11:06:36.0734 2580 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
11:06:36.0750 2580 Update - ok
11:06:36.0796 2580 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll
11:06:36.0812 2580 upnphost - ok
11:06:36.0859 2580 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe
11:06:36.0859 2580 UPS - ok
11:06:36.0890 2580 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
11:06:36.0890 2580 usbccgp - ok
11:06:36.0890 2580 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
11:06:36.0890 2580 usbehci - ok
11:06:36.0921 2580 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
11:06:36.0937 2580 usbhub - ok
11:06:36.0968 2580 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
11:06:36.0968 2580 usbscan - ok
11:06:37.0015 2580 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
11:06:37.0015 2580 USBSTOR - ok
11:06:37.0062 2580 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
11:06:37.0062 2580 usbuhci - ok
11:06:37.0093 2580 [ B6CC50279D6CD28E090A5D33244ADC9A ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys
11:06:37.0093 2580 usb_rndisx - ok
11:06:37.0140 2580 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
11:06:37.0140 2580 VgaSave - ok
11:06:37.0156 2580 [ 754292CE5848B3738281B4F3607EAEF4 ] viaagp C:\WINDOWS\system32\DRIVERS\viaagp.sys
11:06:37.0156 2580 viaagp - ok
11:06:37.0171 2580 [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde C:\WINDOWS\system32\DRIVERS\viaide.sys
11:06:37.0171 2580 ViaIde - ok
11:06:37.0187 2580 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
11:06:37.0187 2580 VolSnap - ok
11:06:37.0234 2580 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe
11:06:37.0250 2580 VSS - ok
11:06:37.0406 2580 [ 8ED347BAD8D1FB7C40B593BFB01786D2 ] vToolbarUpdater11.2.0 C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
11:06:37.0421 2580 vToolbarUpdater11.2.0 - ok
11:06:37.0453 2580 [ 54AF4B1D5459500EF0937F6D33B1914F ] w32time C:\WINDOWS\system32\w32time.dll
11:06:37.0468 2580 w32time - ok
11:06:37.0484 2580 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
11:06:37.0484 2580 Wanarp - ok
11:06:37.0484 2580 wanatw - ok
11:06:37.0500 2580 WDICA - ok
11:06:37.0515 2580 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
11:06:37.0515 2580 wdmaud - ok
11:06:37.0531 2580 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll
11:06:37.0531 2580 WebClient - ok
11:06:37.0593 2580 [ F59ED5A43B988A18EF582BB07B2327A7 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
11:06:37.0609 2580 winachsf - ok
11:06:37.0687 2580 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
11:06:37.0687 2580 winmgmt - ok
11:06:37.0750 2580 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
11:06:37.0750 2580 WmdmPmSN - ok
11:06:37.0781 2580 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
11:06:37.0781 2580 WmiApSrv - ok
11:06:37.0875 2580 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
11:06:37.0890 2580 WMPNetworkSvc - ok
11:06:38.0125 2580 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
11:06:38.0156 2580 WPFFontCache_v0400 - ok
11:06:38.0187 2580 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys
11:06:38.0187 2580 WS2IFSL - ok
11:06:38.0234 2580 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
11:06:38.0250 2580 wscsvc - ok
11:06:38.0281 2580 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll
11:06:38.0281 2580 wuauserv - ok
11:06:38.0312 2580 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
11:06:38.0312 2580 WudfPf - ok
11:06:38.0343 2580 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
11:06:38.0343 2580 WudfRd - ok
11:06:38.0375 2580 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
11:06:38.0375 2580 WudfSvc - ok
11:06:38.0421 2580 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
11:06:38.0437 2580 WZCSVC - ok
11:06:38.0484 2580 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
11:06:38.0484 2580 xmlprov - ok
11:06:38.0500 2580 ================ Scan global ===============================
11:06:38.0546 2580 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll
11:06:38.0593 2580 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
11:06:38.0625 2580 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
11:06:38.0640 2580 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe
11:06:38.0640 2580 [Global] - ok
11:06:38.0640 2580 ================ Scan MBR ==================================
11:06:38.0656 2580 [ B16A2359F4962B0C622D81A1C1F4B703 ] \Device\Harddisk0\DR0
11:06:38.0937 2580 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
11:06:38.0937 2580 \Device\Harddisk0\DR0 - detected TDSS File System (1)
11:06:38.0984 2580 [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk1\DR4
11:06:39.0171 2580 \Device\Harddisk1\DR4 - ok
11:06:39.0171 2580 ================ Scan VBR ==================================
11:06:39.0171 2580 [ 6755AC694578A40EB27944F7DDA2B76B ] \Device\Harddisk0\DR0\Partition1
11:06:39.0171 2580 \Device\Harddisk0\DR0\Partition1 - ok
11:06:39.0171 2580 [ EF5F60B8846206442E7EC7340E1D509D ] \Device\Harddisk1\DR4\Partition1
11:06:39.0187 2580 \Device\Harddisk1\DR4\Partition1 - ok
11:06:39.0187 2580 ============================================================
11:06:39.0187 2580 Scan finished
11:06:39.0187 2580 ============================================================
11:06:39.0187 2552 Detected object count: 1
11:06:39.0187 2552 Actual detected object count: 1
11:06:59.0250 2552 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
11:06:59.0250 2552 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI