Multiple file infections? [Solved]

I am working with a work computer that is on a domain. We are using Trend Micro and Malwarebytes to detect and remove potential viruses. However, I am stumped with this one and neither Trend nor Malwarebytes seems to help.

The problem is Trend keeps finding/reporting the following sites it considers 'Dangerous':

cosmosfivex.com
ipanemastorex.com
79.143.186.50

And to top it all off, Google isn't working properly also. When you go to their site and try to search for anything, it completes the search, but nothing displays. Other search engines work fine - just not Google. Is it a result of these 'Dangerous' sites - I don't know. Just seems awfully coincidental.

Anyway, here is the HijackThis report form the laptop:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:25:43 AM, on 8/24/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\dellxpm09b_6159v043\wdm\stacsv.exe
C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
C:\Program Files\Lotus\Notes\nslsvice.exe
C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Lotus\Notes\nsd.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Citrix\ICA Client\ssonsvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\Altiris\Altiris Agent\AeXAgentUIHost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\OfficeScan Client\Temp\pccntupd.exe
C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro NSC BHO - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\OfficeScan Client\TmIEPlg.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [AeXAgentLogon] C:\Program Files\Altiris\Altiris Agent\AeXAgentActivate.exe /logon
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [RIMBBLaunchAgent.exe] C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1271351467187
O16 - DPF: {8CFCF42C-1C64-47D6-AEEC-F9D001832ED3} (DellSystem.Scanner) - http://xserv.dell.com/DellDriverScanner/DellSystem.CAB
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://akamaicdn.webex.com/client/WBXclien…bex/ieatgpc.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {FDF527BA-DDDA-11D3-AA82-006094EB09CB} (Altiris Clipboard Helper) - http://dc-altiris01:8085/aspnet_client/Alt…eXClipboard.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = corp.vesuvius.com
O17 - HKLM\Software\..\Telephony: DomainName = corp.vesuvius.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = corp.vesuvius.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = corp.vesuvius.com
O18 - Protocol: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\OfficeScan Client\TmIEPlg.dll
O20 - AppInit_DLLs: AMINIT32.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Altiris Agent (AeXNSClient) - Altiris, Inc. - C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Credential Vault Host Control Service - Broadcom Corporation - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
O23 - Service: Credential Vault Host Storage - Broadcom Corporation - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lotus Notes Diagnostics - IBM - C:\Program Files\Lotus\Notes\nsd.exe
O23 - Service: Lotus Notes Single Logon - IBM Corp - C:\Program Files\Lotus\Notes\nslsvice.exe
O23 - Service: OfficeScan NT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\program files\idt\dellxpm09b_6159v043\wdm\stacsv.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 10341 bytes

DDS.TXT:


DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by [removed] at 7:23:01 on 2012-08-29
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2000.1480 [GMT -4:00]
.
AV: Trend Micro OfficeScan Antivirus *Enabled/Updated* {4CA5B9AB-4295-4D4C-9664-0EBE85AE0525}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\idt\dellxpm09b_6159v043\wdm\stacsv.exe
C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
C:\Program Files\Lotus\Notes\nslsvice.exe
svchost.exe
C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Lotus\Notes\nsd.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe
C:\Program Files\Citrix\ICA Client\ssonsvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Altiris\Altiris Agent\AeXAgentUIHost.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\iPod\bin\iPodService.exe
.
============== Pseudo HJT Report ===============
.
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: TmIEPlugInBHO Class: {1ca1377b-dc1d-4a52-9585-6e06050fac53} - c:\program files\trend micro\officescan client\TmIEPlg.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\Wcescomm.exe"
uRun: [MoneyAgent] "c:\program files\microsoft money\system\Money Express.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
mRun: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg
mRun: [OfficeScanNT Monitor] "c:\program files\trend micro\officescan client\pccntmon.exe" -HideWindow
mRun: [AeXAgentLogon] c:\program files\altiris\altiris agent\AeXAgentActivate.exe /logon
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Apoint] c:\program files\delltpad\Apoint.exe
mRun: [RIMBBLaunchAgent.exe] c:\program files\common files\research in motion\usb drivers\RIMBBLaunchAgent.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{14fcfe7c-ab86-428a-9d2e-bfb6f5a7aa6e}\Icon3E5562ED7.ico
mPolicies-system: consentpromptbehavioradmin = 0 (0x0)
mPolicies-system: consentpromptbehavioruser = 3 (0x3)
mPolicies-system: enablelua = 0 (0x0)
mPolicies-system: promptonsecuredesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~3\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1271351467187
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_34-windows-i586.cab
DPF: {8CFCF42C-1C64-47D6-AEEC-F9D001832ED3} - hxxp://xserv.dell.com/DellDriverScanner/DellSystem.CAB
DPF: {CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_34-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_34-windows-i586.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://akamaicdn.webex.com/client/WBXclient-T27L10NSP25-10481/webex/ieatgpc.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {FDF527BA-DDDA-11D3-AA82-006094EB09CB} - hxxp://dc-altiris01:8085/aspnet_client/Altiris_AppWeaver/6_0_sp3/lib/AeXClipboard.CAB
TCP: Interfaces\{1C4B528A-5394-43BB-BFC0-EE0F575AA573} : DhcpNameServer = [removed] [removed]
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - c:\program files\trend micro\officescan client\TmIEPlg.dll
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: AMINIT32.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
============= SERVICES / DRIVERS ===============
.
R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostControlService.exe [2009-6-26 812392]
R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\broadcom corporation\broadcom ush host components\cv\bin\HostStorageService.exe [2009-6-26 26984]
R2 Lotus Notes Diagnostics;Lotus Notes Diagnostics;c:\program files\lotus\notes\nsd.exe [2010-8-11 3417480]
R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2010-4-22 60648]
R2 TmFilter;Trend Micro Filter;c:\program files\trend micro\officescan client\TmXPFlt.sys [2009-9-30 262416]
R2 TmPreFilter;Trend Micro PreFilter;c:\program files\trend micro\officescan client\tmpreflt.sys [2009-9-30 36624]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2010-4-15 112512]
R3 cvusbdrv;Dell ControlVault;c:\windows\system32\drivers\cvusbdrv.sys [2010-4-15 33832]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [2010-4-15 240344]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2010-4-15 109568]
R3 TmProxy;OfficeScan NT Proxy Service;c:\program files\trend micro\officescan client\TmProxy.exe [2012-8-24 689680]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-8-28 253600]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\verizo~1\vzacce~1\SMSIVZAM5.SYS [2009-10-29 32408]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== File Associations ===============
.
.scr=DWGTrueViewScriptFile
.
=============== Created Last 30 ================
.
2012-08-28 19:28:08 418464 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-24 13:52:58 73728 —-a-w- c:\windows\system32\javacpl.cpl
2012-08-24 13:52:58 477168 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-08-24 13:02:46 ——– d—–w- c:\windows\system32\wbem\repository\FS
2012-08-24 13:02:46 ——– d—–w- c:\windows\system32\wbem\Repository
.
==================== Find3M ====================
.
2012-08-28 19:28:08 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-24 13:52:34 473072 —-a-w- c:\windows\system32\deployJava1.dll
2012-08-24 13:14:41 102400 —-a-w- c:\windows\RegBootClean.exe
2012-06-02 19:19:44 22040 —-a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 19:19:38 219160 —-a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 19:19:38 15384 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 19:19:34 15384 —-a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 19:19:30 17944 —-a-w- c:\windows\system32\wuaueng.dll.mui
2012-05-31 13:22:09 599040 —-a-w- c:\windows\system32\crypt32.dll
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD1600BJKT-75F4T0 rev.11.01A11 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8A1704B1]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8a17793c]; MOV EAX, [0x8a177ab0]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\Harddisk0\DR0[0x8A549AB8]
3 CLASSPNP[0xBA108FD7] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> [0x8A4CA258]
\Driver\atapi[0x8A245030] -> IRP_MJ_CREATE -> 0x8A1704B1
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A1702E2
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 7:24:29.53 ===============

ATTACH.TXT:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 4/28/2010 1:21:00 PM
System Uptime: 8/29/2012 7:16:25 AM (0 hours ago)
.
Motherboard: Dell Inc. | | 0W620R
Processor: Intel Pentium III Xeon processor | Microprocessor | 2526/266mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 149 GiB total, 75.106 GiB free.
D: is CDROM (CDFS)
E: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Cisco Systems VPN Adapter
Device ID: ROOT\NET\0000
Manufacturer: Cisco Systems
Name: Cisco Systems VPN Adapter
PNP Device ID: ROOT\NET\0000
Service: CVirtA
.
==== System Restore Points ===================
.
RP717: 5/30/2012 6:18:33 PM - System Checkpoint
RP718: 5/31/2012 11:05:43 PM - System Checkpoint
RP719: 6/2/2012 1:02:50 PM - System Checkpoint
RP720: 6/3/2012 5:57:23 PM - System Checkpoint
RP721: 6/4/2012 6:46:42 PM - System Checkpoint
RP722: 6/6/2012 7:31:48 PM - System Checkpoint
RP723: 6/8/2012 11:16:34 AM - Software Distribution Service 3.0
RP724: 6/9/2012 12:00:36 PM - System Checkpoint
RP725: 6/10/2012 12:49:20 PM - System Checkpoint
RP726: 6/12/2012 10:00:38 AM - System Checkpoint
RP727: 6/13/2012 11:18:11 AM - System Checkpoint
RP728: 6/14/2012 6:51:40 PM - System Checkpoint
RP729: 6/15/2012 2:57:42 PM - Software Distribution Service 3.0
RP730: 6/15/2012 5:04:11 PM - Software Distribution Service 3.0
RP731: 6/16/2012 2:02:25 AM - Software Distribution Service 3.0
RP732: 6/17/2012 2:29:06 AM - System Checkpoint
RP733: 6/21/2012 12:37:07 PM - System Checkpoint
RP734: 6/22/2012 1:28:48 PM - System Checkpoint
RP735: 6/23/2012 6:06:31 PM - System Checkpoint
RP736: 6/24/2012 6:48:10 PM - System Checkpoint
RP737: 6/25/2012 10:08:11 PM - System Checkpoint
RP738: 6/26/2012 11:19:55 PM - System Checkpoint
RP739: 6/27/2012 11:47:32 PM - System Checkpoint
RP740: 6/30/2012 9:27:24 AM - System Checkpoint
RP741: 7/1/2012 10:40:16 AM - System Checkpoint
RP742: 7/2/2012 12:17:35 PM - System Checkpoint
RP743: 7/3/2012 5:43:17 PM - System Checkpoint
RP744: 7/4/2012 7:25:31 PM - System Checkpoint
RP745: 7/5/2012 8:28:53 PM - System Checkpoint
RP746: 7/7/2012 2:16:58 AM - System Checkpoint
RP747: 7/9/2012 6:33:50 AM - System Checkpoint
RP748: 7/10/2012 6:48:42 AM - System Checkpoint
RP749: 7/11/2012 8:55:13 AM - System Checkpoint
RP750: 7/12/2012 12:17:24 PM - System Checkpoint
RP751: 7/12/2012 3:03:31 PM - Software Distribution Service 3.0
RP752: 7/13/2012 3:46:54 PM - System Checkpoint
RP753: 7/14/2012 4:18:32 PM - System Checkpoint
RP754: 7/15/2012 7:23:07 PM - System Checkpoint
RP755: 7/16/2012 5:26:55 PM - Software Distribution Service 3.0
RP756: 7/19/2012 8:27:34 PM - System Checkpoint
RP757: 7/20/2012 10:36:26 PM - System Checkpoint
RP758: 7/22/2012 8:52:45 AM - System Checkpoint
RP759: 7/23/2012 11:21:11 AM - System Checkpoint
RP760: 7/24/2012 12:34:57 PM - System Checkpoint
RP761: 7/25/2012 4:26:30 PM - System Checkpoint
RP762: 7/26/2012 5:03:41 PM - System Checkpoint
RP763: 7/27/2012 5:14:50 PM - System Checkpoint
RP764: 7/28/2012 5:43:29 PM - System Checkpoint
RP765: 7/29/2012 6:48:56 PM - System Checkpoint
RP766: 7/31/2012 3:12:18 PM - System Checkpoint
RP767: 8/1/2012 11:47:14 PM - System Checkpoint
RP768: 8/3/2012 12:04:59 AM - System Checkpoint
RP769: 8/4/2012 12:47:35 PM - System Checkpoint
RP770: 8/5/2012 4:42:28 PM - System Checkpoint
RP771: 8/6/2012 4:50:32 PM - System Checkpoint
RP772: 8/7/2012 6:42:21 PM - System Checkpoint
RP773: 8/18/2012 6:29:14 PM - System Checkpoint
RP774: 8/21/2012 7:41:34 AM - Software Distribution Service 3.0
RP775: 8/22/2012 9:37:01 AM - System Checkpoint
RP776: 8/23/2012 12:24:49 PM - System Checkpoint
RP777: 8/24/2012 8:45:04 AM - Restore Operation
RP778: 8/24/2012 9:41:57 AM - Removed Dell Resource CD.
RP779: 8/24/2012 9:51:36 AM - Removed Java™ 6 Update 24
RP780: 8/24/2012 5:03:17 PM - Software Distribution Service 3.0
RP781: 8/25/2012 5:19:14 PM - System Checkpoint
RP782: 8/26/2012 10:47:17 PM - System Checkpoint
RP783: 8/27/2012 10:51:52 PM - System Checkpoint
.
==== Installed Programs ======================
.
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 9
Altiris ActiveX Controls
Altiris Application Metering Agent
Altiris Client Task Agent
Altiris Power Management Agent
Altiris Script Task Agent
Altiris Service Control Task Agent
Altiris Software Delivery Agent For Task Server
Altiris Software Delivery Solution Agent
Altiris Task Synchronization Agent
AnswerWorks 5.0 English Runtime
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AutoVue Professional, Desktop Edition
BioAPI Framework
BlackBerry Desktop Software 6.1
Bonjour
Cisco Systems VPN Client 5.0.01.0600
Citrix Presentation Server Client
Compatibility Pack for the 2007 Office system
Conexant HDA D330 MDC V.92 Modem
CrossLoop 2.44
Dell ControlVault Host Components Installer
Dell Security Device Driver Pack
Dell Touchpad
Dell Wireless WLAN Card Utility
DWG TrueView 2012
EasyCleaner
Foseco Degasser R
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB942288-v3)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB967048-v2)
Hotfix for Windows XP (KB976002-v5)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
IDT Audio
Intel® Graphics Media Accelerator Driver
Intel® Network Connections Drivers
IrfanView (remove only)
iTunes
Java Auto Updater
Java™ 6 Update 34
Lotus Notes 8.5.2
Malwarebytes Anti-Malware version 1.61.0.1400
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2656353)
Microsoft .NET Framework 1.1 Security Update (KB2656370)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft ActiveSync
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Money for the Pocket PC
Microsoft Money Plus
Microsoft Money Shared Libraries
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Standard Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MSXML 4.0 SP2 (KB973688)
OpenOffice.org 3.1
PowerDVD
PrimoPDF
PrimoPDF – by Nitro PDF Software
Quicken 2010
QuickTime
Recorders Tools
RICOH R5C83x/84x Media Driver Ver.3.53.02
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE 10.3
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Update Manager
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Skype™ 4.2
TeamViewer 7
Trend Micro OfficeScan Client
Ultr@VNC 1.0.0 RC11d - Win32
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676-v2)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2718704)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB980182)
VZAccess Manager
WebEx
WebFldrs XP
Windows Driver Package - Dell Inc. PBADRV System (01/07/2008 1.0.1.5)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
WModem Driver Installer
Xvid 1.2.2 final uninstall
.
==== Event Viewer Messages From Past Week ========
.
8/28/2012 3:26:11 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the iPod Service service to connect.
8/28/2012 3:26:11 PM, error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
8/28/2012 3:25:55 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
8/28/2012 3:25:04 PM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
8/28/2012 3:24:35 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect.
8/27/2012 4:04:11 PM, error: NETLOGON [5719] - No Domain Controller is available for domain CORP due to the following: There are currently no logon servers available to service the logon request. . Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.
8/26/2012 9:13:41 PM, error: Dhcp [1002] - The IP address lease 192.168.1.135 for the Network Card with network address F07BCB56B27B has been denied by the DHCP server 172.20.1.1 (The DHCP Server sent a DHCPNACK message).
.
==== End Of File ===========================


aswMBR:

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-08-29 07:27:07
—————————–
07:27:07.921 OS Version: Windows 5.1.2600 Service Pack 3
07:27:07.921 Number of processors: 2 586 0x170A
07:27:07.921 ComputerName: CD-BEGANBRI-LP1 UserName: Administrator
07:27:09.437 Initialize success
07:33:45.578 AVAST engine defs: 12082900
07:34:43.125 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
07:34:43.125 Disk 0 Vendor: WDC_WD1600BJKT-75F4T0 11.01A11 Size: 152627MB BusType: 3
07:34:43.125 Device \Driver\atapi -> DriverStartIo 8a1702e2
07:34:43.125 Disk 0 MBR read successfully
07:34:43.125 Disk 0 MBR scan
07:34:43.218 Disk 0 Windows XP default MBR code
07:34:43.218 Disk 0 MBR hidden
07:34:43.218 Disk 0 Partition 1 00 07 HPFS/NTFS NTFS 152617 MB offset 63
07:34:43.218 Disk 0 scanning sectors +312560640
07:34:43.296 Disk 0 scanning C:\WINDOWS\system32\drivers
07:35:35.312 Service scanning
07:35:55.968 Service TmFilter C:\Program Files\Trend Micro\OfficeScan Client\TmXPFlt.sys **LOCKED** 32
07:35:56.187 Service TmPreFilter C:\Program Files\Trend Micro\OfficeScan Client\TmPreFlt.sys **LOCKED** 32
07:35:58.031 Service VSApiNt C:\Program Files\Trend Micro\OfficeScan Client\VSApiNt.sys **LOCKED** 32
07:36:00.546 Modules scanning
07:36:04.515 Disk 0 trace - called modules:
07:36:04.515 ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8a1704b1]<<
07:36:04.515 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a549ab8]
07:36:04.515 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> [0x8a4ca258]
07:36:04.531 \Driver\atapi[0x8a245030] -> IRP_MJ_CREATE -> 0x8a1704b1
07:36:05.093 AVAST engine scan C:\WINDOWS
07:36:15.937 AVAST engine scan C:\WINDOWS\system32
07:40:04.093 AVAST engine scan C:\WINDOWS\system32\drivers
07:42:11.906 AVAST engine scan C:\Documents and Settings\Administrator
07:44:01.531 AVAST engine scan C:\Documents and Settings\All Users
07:44:46.625 Scan finished successfully
07:46:28.625 Disk 0 MBR has been saved successfully to "E:\began\MBR.dat"
07:46:28.656 The log file has been saved successfully to "E:\began\aswMBR.txt"

Hi,

Please do the following:

Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• when the window opens, click on Change Parameters
• under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”
• click OK
• Press Start Scan
  
  • If Malicious objects are found then ensure Cure is selected
  • If TDLFS File System is found then ensure Cure is selected (if Cure is not available, choose Skip)
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

NEXT


Download ComboFix from the following location:

Link 1

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

• Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Thanks for responding!!

TDSSkiller text:

07:41:50.0984 3560 TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
07:41:51.0281 3560 ============================================================
07:41:51.0281 3560 Current date / time: 2012/09/04 07:41:51.0281
07:41:51.0281 3560 SystemInfo:
07:41:51.0281 3560
07:41:51.0281 3560 OS Version: 5.1.2600 ServicePack: 3.0
07:41:51.0281 3560 Product type: Workstation
07:41:51.0281 3560 ComputerName: CD-BEGANBRI-LP1
07:41:51.0281 3560 UserName: imiolaldm
07:41:51.0281 3560 Windows directory: C:\WINDOWS
07:41:51.0281 3560 System windows directory: C:\WINDOWS
07:41:51.0281 3560 Processor architecture: Intel x86
07:41:51.0281 3560 Number of processors: 2
07:41:51.0281 3560 Page size: 0x1000
07:41:51.0281 3560 Boot type: Normal boot
07:41:51.0281 3560 ============================================================
07:41:52.0421 3560 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
07:41:52.0421 3560 Drive \Device\Harddisk1\DR2 - Size: 0x78000000 (1.88 Gb), SectorSize: 0x200, Cylinders: 0xF4, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
07:41:52.0421 3560 ============================================================
07:41:52.0421 3560 \Device\Harddisk0\DR0:
07:41:52.0421 3560 MBR partitions:
07:41:52.0421 3560 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x12A14BC1
07:41:52.0421 3560 \Device\Harddisk1\DR2:
07:41:52.0421 3560 MBR partitions:
07:41:52.0421 3560 \Device\Harddisk1\DR2\Partition1: MBR, Type 0xC, StartLBA 0x20, BlocksNum 0x3BFFE0
07:41:52.0421 3560 ============================================================
07:41:52.0500 3560 C: <-> \Device\Harddisk0\DR0\Partition1
07:41:52.0500 3560 ============================================================
07:41:52.0500 3560 Initialize success
07:41:52.0500 3560 ============================================================
07:41:58.0703 3752 ============================================================
07:41:58.0703 3752 Scan started
07:41:58.0703 3752 Mode: Manual; TDLFS;
07:41:58.0703 3752 ============================================================
07:41:59.0531 3752 ================ Scan system memory ========================
07:42:01.0265 3752 System memory - ok
07:42:01.0265 3752 ================ Scan services =============================
07:42:01.0328 3752 Abiosdsk - ok
07:42:01.0328 3752 abp480n5 - ok
07:42:01.0343 3752 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
07:42:01.0343 3752 ACPI - ok
07:42:01.0359 3752 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
07:42:01.0375 3752 ACPIEC - ok
07:42:01.0453 3752 [ 0D4C486A24A711A45FD83ACDF4D18506 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
07:42:01.0453 3752 AdobeFlashPlayerUpdateSvc - ok
07:42:01.0453 3752 adpu160m - ok
07:42:01.0500 3752 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
07:42:01.0531 3752 aec - ok
07:42:01.0562 3752 [ F21D5E93A94514BE9F5B6EBF74A696B2 ] AESTAud C:\WINDOWS\system32\drivers\AESTAud.sys
07:42:01.0609 3752 AESTAud - ok
07:42:01.0671 3752 [ 9203AD68320587889DDDDC0DF6648C29 ] AeXNSClient C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
07:42:01.0687 3752 AeXNSClient - ok
07:42:01.0718 3752 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
07:42:01.0734 3752 AFD - ok
07:42:01.0734 3752 Aha154x - ok
07:42:01.0734 3752 aic78u2 - ok
07:42:01.0750 3752 aic78xx - ok
07:42:01.0765 3752 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll
07:42:01.0796 3752 Alerter - ok
07:42:01.0828 3752 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe
07:42:01.0828 3752 ALG - ok
07:42:01.0828 3752 AliIde - ok
07:42:01.0828 3752 amsint - ok
07:42:01.0843 3752 [ 22403504E15810E99A563782E9D45311 ] ApfiltrService C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
07:42:01.0859 3752 ApfiltrService - ok
07:42:01.0890 3752 [ D503DF3ABA595F551B98B9BAE017A271 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
07:42:01.0906 3752 Apple Mobile Device - ok
07:42:01.0937 3752 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll
07:42:01.0953 3752 AppMgmt - ok
07:42:01.0953 3752 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys
07:42:01.0968 3752 Arp1394 - ok
07:42:01.0968 3752 asc - ok
07:42:01.0968 3752 asc3350p - ok
07:42:01.0968 3752 asc3550 - ok
07:42:02.0109 3752 [ 776ACEFA0CA9DF0FAA51A5FB2F435705 ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
07:42:02.0140 3752 aspnet_state - ok
07:42:02.0156 3752 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
07:42:02.0156 3752 AsyncMac - ok
07:42:02.0171 3752 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
07:42:02.0171 3752 atapi - ok
07:42:02.0187 3752 Atdisk - ok
07:42:02.0187 3752 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
07:42:02.0203 3752 Atmarpc - ok
07:42:02.0218 3752 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
07:42:02.0234 3752 AudioSrv - ok
07:42:02.0281 3752 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
07:42:02.0359 3752 audstub - ok
07:42:02.0421 3752 [ FE4ED785396EAA554C561992106A35FA ] BCM43XX C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
07:42:02.0453 3752 BCM43XX - ok
07:42:02.0484 3752 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
07:42:02.0500 3752 Beep - ok
07:42:02.0515 3752 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll
07:42:02.0546 3752 BITS - ok
07:42:02.0578 3752 [ EBAD0F51D8D4DADE7660B1851ADDBD07 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
07:42:02.0609 3752 Bonjour Service - ok
07:42:02.0625 3752 [ A06CE3399D16DB864F55FAEB1F1927A9 ] Browser C:\WINDOWS\System32\browser.dll
07:42:02.0625 3752 Browser - ok
07:42:02.0656 3752 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
07:42:02.0671 3752 cbidf2k - ok
07:42:02.0687 3752 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
07:42:02.0703 3752 CCDECODE - ok
07:42:02.0703 3752 cd20xrnt - ok
07:42:02.0734 3752 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
07:42:02.0734 3752 Cdaudio - ok
07:42:02.0734 3752 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
07:42:02.0750 3752 Cdfs - ok
07:42:02.0765 3752 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
07:42:02.0796 3752 Cdrom - ok
07:42:02.0796 3752 Changer - ok
07:42:02.0812 3752 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe
07:42:02.0812 3752 CiSvc - ok
07:42:02.0828 3752 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
07:42:02.0828 3752 ClipSrv - ok
07:42:02.0875 3752 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
07:42:02.0875 3752 clr_optimization_v2.0.50727_32 - ok
07:42:02.0906 3752 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
07:42:02.0968 3752 clr_optimization_v4.0.30319_32 - ok
07:42:03.0000 3752 [ 0F6C187D38D98F8DF904589A5F94D411 ] CmBatt C:\WINDOWS\system32\DRIVERS\CmBatt.sys
07:42:03.0031 3752 CmBatt - ok
07:42:03.0031 3752 CmdIde - ok
07:42:03.0031 3752 [ 6E4C9F21F0FAE8940661144F41B13203 ] Compbatt C:\WINDOWS\system32\DRIVERS\compbatt.sys
07:42:03.0046 3752 Compbatt - ok
07:42:03.0046 3752 COMSysApp - ok
07:42:03.0046 3752 Cpqarray - ok
07:42:03.0093 3752 [ E5E7A3BEA7033479D205CA5048FE4FE8 ] Credential Vault Host Control Service C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe
07:42:03.0125 3752 Credential Vault Host Control Service - ok
07:42:03.0125 3752 [ 879F8314BBF09738630ED1AF6BB1FC00 ] Credential Vault Host Storage C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe
07:42:03.0140 3752 Credential Vault Host Storage - ok
07:42:03.0171 3752 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
07:42:03.0187 3752 CryptSvc - ok
07:42:03.0218 3752 [ B5ECADF7708960F1818C7FA015F4C239 ] CVirtA C:\WINDOWS\system32\DRIVERS\CVirtA.sys
07:42:03.0265 3752 CVirtA - ok
07:42:03.0328 3752 [ DAD192D12DD0B4C92F6843203852829F ] CVPND C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
07:42:03.0375 3752 CVPND - ok
07:42:03.0390 3752 [ 26DEEF07394624247D1F549BD94F0B15 ] CVPNDRVA C:\WINDOWS\system32\Drivers\CVPNDRVA.sys
07:42:03.0406 3752 CVPNDRVA - ok
07:42:03.0437 3752 [ EE773B1806A93A86283B10FACEBE57DB ] cvusbdrv C:\WINDOWS\system32\Drivers\cvusbdrv.sys
07:42:03.0453 3752 cvusbdrv - ok
07:42:03.0453 3752 dac2w2k - ok
07:42:03.0468 3752 dac960nt - ok
07:42:03.0515 3752 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
07:42:03.0515 3752 DcomLaunch - ok
07:42:03.0531 3752 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
07:42:03.0531 3752 Dhcp - ok
07:42:03.0562 3752 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
07:42:03.0562 3752 Disk - ok
07:42:03.0562 3752 dmadmin - ok
07:42:03.0609 3752 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
07:42:03.0671 3752 dmboot - ok
07:42:03.0718 3752 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys
07:42:03.0734 3752 dmio - ok
07:42:03.0750 3752 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
07:42:03.0765 3752 dmload - ok
07:42:03.0781 3752 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll
07:42:03.0796 3752 dmserver - ok
07:42:03.0828 3752 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
07:42:03.0843 3752 DMusic - ok
07:42:03.0875 3752 [ 7B4FDFBE97C047175E613AA96F3DE987 ] DNE C:\WINDOWS\system32\DRIVERS\dne2000.sys
07:42:03.0875 3752 DNE - ok
07:42:03.0921 3752 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
07:42:03.0937 3752 Dnscache - ok
07:42:03.0953 3752 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
07:42:03.0968 3752 Dot3svc - ok
07:42:03.0968 3752 dpti2o - ok
07:42:03.0984 3752 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
07:42:04.0000 3752 drmkaud - ok
07:42:04.0031 3752 [ 71FF7AD30BD9E3C06DF112383BB60089 ] e1yexpress C:\WINDOWS\system32\DRIVERS\e1y5132.sys
07:42:04.0046 3752 e1yexpress - ok
07:42:04.0062 3752 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll
07:42:04.0078 3752 EapHost - ok
07:42:04.0093 3752 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll
07:42:04.0109 3752 ERSvc - ok
07:42:04.0109 3752 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe
07:42:04.0109 3752 Eventlog - ok
07:42:04.0140 3752 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll
07:42:04.0140 3752 EventSystem - ok
07:42:04.0140 3752 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
07:42:04.0140 3752 Fastfat - ok
07:42:04.0171 3752 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
07:42:04.0187 3752 FastUserSwitchingCompatibility - ok
07:42:04.0218 3752 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys
07:42:04.0250 3752 Fdc - ok
07:42:04.0265 3752 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
07:42:04.0281 3752 Fips - ok
07:42:04.0328 3752 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys
07:42:04.0328 3752 Flpydisk - ok
07:42:04.0375 3752 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\DRIVERS\fltMgr.sys
07:42:04.0421 3752 FltMgr - ok
07:42:04.0515 3752 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
07:42:04.0515 3752 FontCache3.0.0.0 - ok
07:42:04.0531 3752 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
07:42:04.0531 3752 Fs_Rec - ok
07:42:04.0531 3752 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
07:42:04.0562 3752 Ftdisk - ok
07:42:04.0593 3752 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
07:42:04.0593 3752 GEARAspiWDM - ok
07:42:04.0609 3752 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
07:42:04.0625 3752 Gpc - ok
07:42:04.0671 3752 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
07:42:04.0671 3752 HDAudBus - ok
07:42:04.0734 3752 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
07:42:04.0734 3752 helpsvc - ok
07:42:04.0765 3752 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll
07:42:04.0781 3752 HidServ - ok
07:42:04.0812 3752 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
07:42:04.0828 3752 HidUsb - ok
07:42:04.0859 3752 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
07:42:04.0875 3752 hkmsvc - ok
07:42:04.0906 3752 [ E4E0B356A8756066CF89080D9DA69F22 ] HPFXBULK C:\WINDOWS\system32\drivers\hpfxbulk.sys
07:42:04.0906 3752 HPFXBULK - ok
07:42:04.0906 3752 hpn - ok
07:42:04.0968 3752 [ F25BB78B0063A8E8FCEFF33493C305E0 ] HSFHWAZL C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys
07:42:04.0984 3752 HSFHWAZL - ok
07:42:05.0000 3752 [ 04D872629E0AFCB07BA9088EAA308C11 ] HSF_DPV C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys
07:42:05.0093 3752 HSF_DPV - ok
07:42:05.0125 3752 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
07:42:05.0125 3752 HTTP - ok
07:42:05.0156 3752 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
07:42:05.0250 3752 HTTPFilter - ok
07:42:05.0265 3752 i2omgmt - ok
07:42:05.0265 3752 i2omp - ok
07:42:05.0296 3752 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
07:42:05.0312 3752 i8042prt - ok
07:42:05.0468 3752 [ 3B743262B6456167888D15F1121B3BF7 ] ialm C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
07:42:05.0812 3752 ialm - ok
07:42:05.0859 3752 [ DAF66902F08796F9C694901660E5A64A ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
07:42:05.0906 3752 IDriverT - ok
07:42:06.0015 3752 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
07:42:06.0109 3752 idsvc - ok
07:42:06.0140 3752 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
07:42:06.0156 3752 Imapi - ok
07:42:06.0203 3752 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe
07:42:06.0203 3752 ImapiService - ok
07:42:06.0203 3752 ini910u - ok
07:42:06.0234 3752 [ F32A62C765885BD8E4352A1565F702A6 ] IntcHdmiAddService C:\WINDOWS\system32\drivers\IntcHdmi.sys
07:42:06.0250 3752 IntcHdmiAddService - ok
07:42:06.0250 3752 IntelIde - ok
07:42:06.0296 3752 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
07:42:06.0296 3752 intelppm - ok
07:42:06.0312 3752 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
07:42:06.0375 3752 Ip6Fw - ok
07:42:06.0406 3752 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
07:42:06.0421 3752 IpFilterDriver - ok
07:42:06.0421 3752 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
07:42:06.0421 3752 IpInIp - ok
07:42:06.0453 3752 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
07:42:06.0453 3752 IpNat - ok
07:42:06.0500 3752 [ 3C30491045DBBD44A42876B3D6F3917D ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
07:42:06.0515 3752 iPod Service - ok
07:42:06.0546 3752 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
07:42:06.0562 3752 IPSec - ok
07:42:06.0578 3752 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
07:42:06.0593 3752 IRENUM - ok
07:42:06.0625 3752 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
07:42:06.0656 3752 isapnp - ok
07:42:06.0734 3752 [ 0AB63D5785991F9CB362D82DEFF1DBBA ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe
07:42:06.0750 3752 JavaQuickStarterService - ok
07:42:06.0781 3752 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
07:42:06.0781 3752 Kbdclass - ok
07:42:06.0812 3752 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys
07:42:06.0843 3752 kbdhid - ok
07:42:06.0875 3752 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
07:42:06.0875 3752 kmixer - ok
07:42:06.0890 3752 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
07:42:06.0890 3752 KSecDD - ok
07:42:06.0921 3752 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] LanmanServer C:\WINDOWS\System32\srvsvc.dll
07:42:06.0937 3752 LanmanServer - ok
07:42:06.0984 3752 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
07:42:06.0984 3752 lanmanworkstation - ok
07:42:06.0984 3752 lbrtfdc - ok
07:42:07.0000 3752 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
07:42:07.0000 3752 LmHosts - ok
07:42:07.0187 3752 [ 731FD0367064D15989DFF8A6F826E881 ] Lotus Notes Diagnostics C:\Program Files\Lotus\Notes\nsd.exe
07:42:07.0281 3752 Lotus Notes Diagnostics - ok
07:42:07.0312 3752 [ 1A394A0372622B3D5F989AE8329326F2 ] Lotus Notes Single Logon C:\Program Files\Lotus\Notes\nslsvice.exe
07:42:07.0328 3752 Lotus Notes Single Logon - ok
07:42:07.0343 3752 [ 0CEA2D0D3FA284B85ED5B68365114F76 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
07:42:07.0343 3752 mdmxsdk - ok
07:42:07.0375 3752 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll
07:42:07.0375 3752 Messenger - ok
07:42:07.0406 3752 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
07:42:07.0421 3752 mnmdd - ok
07:42:07.0453 3752 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
07:42:07.0453 3752 mnmsrvc - ok
07:42:07.0484 3752 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
07:42:07.0484 3752 Modem - ok
07:42:07.0500 3752 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
07:42:07.0531 3752 Mouclass - ok
07:42:07.0562 3752 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys
07:42:07.0578 3752 mouhid - ok
07:42:07.0593 3752 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
07:42:07.0609 3752 MountMgr - ok
07:42:07.0609 3752 mraid35x - ok
07:42:07.0609 3752 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
07:42:07.0625 3752 MRxDAV - ok
07:42:07.0671 3752 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
07:42:07.0718 3752 MRxSmb - ok
07:42:07.0750 3752 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe
07:42:07.0750 3752 MSDTC - ok
07:42:07.0781 3752 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
07:42:07.0796 3752 Msfs - ok
07:42:07.0796 3752 MSIServer - ok
07:42:07.0812 3752 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
07:42:07.0828 3752 MSKSSRV - ok
07:42:07.0843 3752 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
07:42:07.0843 3752 MSPCLOCK - ok
07:42:07.0859 3752 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
07:42:07.0859 3752 MSPQM - ok
07:42:07.0890 3752 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
07:42:07.0890 3752 mssmbios - ok
07:42:07.0921 3752 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys
07:42:07.0921 3752 MSTEE - ok
07:42:07.0953 3752 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
07:42:07.0953 3752 Mup - ok
07:42:07.0984 3752 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
07:42:08.0031 3752 NABTSFEC - ok
07:42:08.0046 3752 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll
07:42:08.0078 3752 napagent - ok
07:42:08.0093 3752 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
07:42:08.0109 3752 NDIS - ok
07:42:08.0140 3752 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys
07:42:08.0140 3752 NdisIP - ok
07:42:08.0171 3752 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
07:42:08.0171 3752 NdisTapi - ok
07:42:08.0203 3752 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
07:42:08.0328 3752 Ndisuio - ok
07:42:08.0343 3752 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
07:42:08.0359 3752 NdisWan - ok
07:42:08.0406 3752 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
07:42:08.0406 3752 NDProxy - ok
07:42:08.0406 3752 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
07:42:08.0421 3752 NetBIOS - ok
07:42:08.0421 3752 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
07:42:08.0453 3752 NetBT - ok
07:42:08.0453 3752 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe
07:42:08.0453 3752 NetDDE - ok
07:42:08.0453 3752 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
07:42:08.0468 3752 NetDDEdsdm - ok
07:42:08.0500 3752 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe
07:42:08.0500 3752 Netlogon - ok
07:42:08.0531 3752 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll
07:42:08.0531 3752 Netman - ok
07:42:08.0578 3752 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
07:42:08.0593 3752 NetTcpPortSharing - ok
07:42:08.0609 3752 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys
07:42:08.0609 3752 NIC1394 - ok
07:42:08.0656 3752 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll
07:42:08.0656 3752 Nla - ok
07:42:08.0671 3752 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
07:42:08.0671 3752 Npfs - ok
07:42:08.0687 3752 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
07:42:08.0734 3752 Ntfs - ok
07:42:08.0734 3752 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
07:42:08.0734 3752 NtLmSsp - ok
07:42:08.0765 3752 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
07:42:08.0812 3752 NtmsSvc - ok
07:42:08.0890 3752 [ A5FB5070F78E5C26C39B4E7F9163C6DF ] ntrtscan C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
07:42:08.0921 3752 ntrtscan - ok
07:42:08.0921 3752 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
07:42:08.0937 3752 Null - ok
07:42:08.0968 3752 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
07:42:09.0000 3752 NwlnkFlt - ok
07:42:09.0000 3752 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
07:42:09.0015 3752 NwlnkFwd - ok
07:42:09.0031 3752 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys
07:42:09.0031 3752 ohci1394 - ok
07:42:09.0078 3752 [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
07:42:09.0093 3752 ose - ok
07:42:09.0125 3752 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\drivers\Parport.sys
07:42:09.0140 3752 Parport - ok
07:42:09.0140 3752 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
07:42:09.0140 3752 PartMgr - ok
07:42:09.0171 3752 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
07:42:09.0171 3752 ParVdm - ok
07:42:09.0187 3752 [ 4088C1ECD1F54281A92FA663B0FDC36F ] PBADRV C:\WINDOWS\system32\DRIVERS\PBADRV.sys
07:42:09.0250 3752 PBADRV - ok
07:42:09.0265 3752 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
07:42:09.0281 3752 PCI - ok
07:42:09.0281 3752 PCIDump - ok
07:42:09.0296 3752 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
07:42:09.0312 3752 PCIIde - ok
07:42:09.0312 3752 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\DRIVERS\pcmcia.sys
07:42:09.0328 3752 Pcmcia - ok
07:42:09.0328 3752 PDCOMP - ok
07:42:09.0328 3752 PDFRAME - ok
07:42:09.0343 3752 PDRELI - ok
07:42:09.0343 3752 PDRFRAME - ok
07:42:09.0343 3752 perc2 - ok
07:42:09.0343 3752 perc2hib - ok
07:42:09.0359 3752 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe
07:42:09.0359 3752 PlugPlay - ok
07:42:09.0375 3752 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
07:42:09.0375 3752 PolicyAgent - ok
07:42:09.0375 3752 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
07:42:09.0390 3752 PptpMiniport - ok
07:42:09.0390 3752 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
07:42:09.0390 3752 ProtectedStorage - ok
07:42:09.0406 3752 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
07:42:09.0421 3752 PSched - ok
07:42:09.0421 3752 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
07:42:09.0437 3752 Ptilink - ok
07:42:09.0453 3752 [ 03E0FE281823BA64B3782F5B38950E73 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys
07:42:09.0484 3752 PxHelp20 - ok
07:42:09.0484 3752 ql1080 - ok
07:42:09.0484 3752 Ql10wnt - ok
07:42:09.0500 3752 ql12160 - ok
07:42:09.0500 3752 ql1240 - ok
07:42:09.0500 3752 ql1280 - ok
07:42:09.0515 3752 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
07:42:09.0531 3752 RasAcd - ok
07:42:09.0546 3752 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll
07:42:09.0562 3752 RasAuto - ok
07:42:09.0578 3752 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
07:42:09.0593 3752 Rasl2tp - ok
07:42:09.0609 3752 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll
07:42:09.0625 3752 RasMan - ok
07:42:09.0625 3752 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
07:42:09.0640 3752 RasPppoe - ok
07:42:09.0656 3752 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
07:42:09.0656 3752 Raspti - ok
07:42:09.0671 3752 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
07:42:09.0703 3752 Rdbss - ok
07:42:09.0718 3752 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
07:42:09.0734 3752 RDPCDD - ok
07:42:09.0765 3752 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
07:42:09.0781 3752 rdpdr - ok
07:42:09.0843 3752 [ 5B3055DAA788BD688594D2F5981F2A83 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
07:42:09.0843 3752 RDPWD - ok
07:42:09.0890 3752 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
07:42:09.0890 3752 RDSessMgr - ok
07:42:09.0906 3752 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
07:42:09.0921 3752 redbook - ok
07:42:09.0937 3752 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
07:42:09.0953 3752 RemoteAccess - ok
07:42:09.0984 3752 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll
07:42:09.0984 3752 RemoteRegistry - ok
07:42:10.0000 3752 [ 355AAC141B214BEF1DBC1483AFD9BD50 ] rimmptsk C:\WINDOWS\system32\DRIVERS\rimmptsk.sys
07:42:10.0015 3752 rimmptsk - ok
07:42:10.0046 3752 [ 4F4A4C09CC5BE58A76CAC1C337E004E6 ] RimUsb C:\WINDOWS\system32\Drivers\RimUsb.sys
07:42:10.0062 3752 RimUsb - ok
07:42:10.0078 3752 [ 3A5633AD615E2B15291BD0B1B97CCD8A ] RimVSerPort C:\WINDOWS\system32\DRIVERS\RimSerial.sys
07:42:10.0093 3752 RimVSerPort - ok
07:42:10.0093 3752 [ D8B0B4ADE32574B2D9C5CC34DC0DBBE7 ] ROOTMODEM C:\WINDOWS\system32\Drivers\RootMdm.sys
07:42:10.0109 3752 ROOTMODEM - ok
07:42:10.0125 3752 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe
07:42:10.0125 3752 RpcLocator - ok
07:42:10.0203 3752 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\system32\rpcss.dll
07:42:10.0203 3752 RpcSs - ok
07:42:10.0218 3752 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe
07:42:10.0218 3752 RSVP - ok
07:42:10.0218 3752 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe
07:42:10.0218 3752 SamSs - ok
07:42:10.0234 3752 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
07:42:10.0234 3752 SCardSvr - ok
07:42:10.0281 3752 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll
07:42:10.0296 3752 Schedule - ok
07:42:10.0312 3752 [ 8D04819A3CE51B9EB47E5689B44D43C4 ] sdbus C:\WINDOWS\system32\DRIVERS\sdbus.sys
07:42:10.0328 3752 sdbus - ok
07:42:10.0359 3752 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
07:42:10.0359 3752 Secdrv - ok
07:42:10.0390 3752 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll
07:42:10.0421 3752 seclogon - ok
07:42:10.0453 3752 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll
07:42:10.0453 3752 SENS - ok
07:42:10.0453 3752 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] Serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
07:42:10.0468 3752 Serenum - ok
07:42:10.0484 3752 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
07:42:10.0500 3752 Serial - ok
07:42:10.0515 3752 [ 0FA803C64DF0914B41F807EA276BF2A6 ] sffdisk C:\WINDOWS\system32\DRIVERS\sffdisk.sys
07:42:10.0515 3752 sffdisk - ok
07:42:10.0531 3752 [ C17C331E435ED8737525C86A7557B3AC ] sffp_sd C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
07:42:10.0531 3752 sffp_sd - ok
07:42:10.0546 3752 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
07:42:10.0546 3752 Sfloppy - ok
07:42:10.0562 3752 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
07:42:10.0593 3752 SharedAccess - ok
07:42:10.0593 3752 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
07:42:10.0593 3752 ShellHWDetection - ok
07:42:10.0609 3752 Simbad - ok
07:42:10.0625 3752 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys
07:42:10.0656 3752 SLIP - ok
07:42:10.0671 3752 [ 1E715247EFFFDDA938C085913045D599 ] SMSIVZAM5 C:\PROGRA~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS
07:42:10.0687 3752 SMSIVZAM5 - ok
07:42:10.0687 3752 Sparrow - ok
07:42:10.0718 3752 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
07:42:10.0734 3752 splitter - ok
07:42:10.0765 3752 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
07:42:10.0765 3752 Spooler - ok
07:42:10.0796 3752 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
07:42:10.0812 3752 sr - ok
07:42:10.0843 3752 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll
07:42:10.0859 3752 srservice - ok
07:42:10.0875 3752 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
07:42:10.0921 3752 Srv - ok
07:42:10.0937 3752 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
07:42:10.0953 3752 SSDPSRV - ok
07:42:11.0000 3752 [ 3603F3DB9FBA2A8FA91829681BA25AFA ] STacSV c:\program files\idt\dellxpm09b_6159v043\wdm\stacsv.exe
07:42:11.0015 3752 STacSV - ok
07:42:11.0062 3752 [ 1B76479B80FF0F6E245BA590A64102BE ] STHDA C:\WINDOWS\system32\drivers\sthda.sys
07:42:11.0125 3752 STHDA - ok
07:42:11.0140 3752 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll
07:42:11.0171 3752 stisvc - ok
07:42:11.0203 3752 [ E476C66713C842F58E61A95826ED1D57 ] stllssvr C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
07:42:11.0234 3752 stllssvr - ok
07:42:11.0250 3752 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys
07:42:11.0265 3752 streamip - ok
07:42:11.0265 3752 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
07:42:11.0281 3752 swenum - ok
07:42:11.0296 3752 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
07:42:11.0359 3752 swmidi - ok
07:42:11.0359 3752 SwPrv - ok
07:42:11.0359 3752 symc810 - ok
07:42:11.0359 3752 symc8xx - ok
07:42:11.0375 3752 sym_hi - ok
07:42:11.0375 3752 sym_u3 - ok
07:42:11.0390 3752 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
07:42:11.0406 3752 sysaudio - ok
07:42:11.0421 3752 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
07:42:11.0421 3752 SysmonLog - ok
07:42:11.0437 3752 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
07:42:11.0453 3752 TapiSrv - ok
07:42:11.0484 3752 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
07:42:11.0515 3752 Tcpip - ok
07:42:11.0531 3752 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
07:42:11.0546 3752 TDPIPE - ok
07:42:11.0562 3752 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
07:42:11.0578 3752 TDTCP - ok
07:42:11.0593 3752 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
07:42:11.0609 3752 TermDD - ok
07:42:11.0640 3752 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll
07:42:11.0656 3752 TermService - ok
07:42:11.0671 3752 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll
07:42:11.0671 3752 Themes - ok
07:42:11.0687 3752 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe
07:42:11.0687 3752 TlntSvr - ok
07:42:11.0718 3752 [ FBB4A664450EB3905527C01B7F91D5C9 ] tmactmon C:\WINDOWS\system32\drivers\tmactmon.sys
07:42:11.0734 3752 tmactmon - ok
07:42:11.0796 3752 [ F9964675C072664ADA62126492DB5AC8 ] TMBMServer C:\Program Files\Trend Micro\BM\TMBMSRV.exe
07:42:11.0812 3752 TMBMServer - ok
07:42:11.0875 3752 [ 2FD877742C7F750A8E4B0053AD62CAFE ] tmcomm C:\WINDOWS\system32\drivers\tmcomm.sys
07:42:11.0890 3752 tmcomm - ok
07:42:11.0906 3752 [ B0F6745DA670754E64146A6E64B96B30 ] tmevtmgr C:\WINDOWS\system32\drivers\tmevtmgr.sys
07:42:11.0921 3752 tmevtmgr - ok
07:42:11.0953 3752 [ 717E406972BBC07F8FB2A989416CAB73 ] TmFilter C:\Program Files\Trend Micro\OfficeScan Client\TmXPFlt.sys
07:42:11.0984 3752 TmFilter - ok
07:42:12.0046 3752 [ 0A10C6741C45B3AD40FC603A58461B94 ] tmlisten C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
07:42:12.0078 3752 tmlisten - ok
07:42:12.0078 3752 [ 379C4F99994A56B66E11D1E32BB22A1C ] TmPreFilter C:\Program Files\Trend Micro\OfficeScan Client\TmPreFlt.sys
07:42:12.0093 3752 TmPreFilter - ok
07:42:12.0156 3752 [ 12FE3DB7B9822BFEE3AF1016A535F2D8 ] TmProxy C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe
07:42:12.0171 3752 TmProxy - ok
07:42:12.0218 3752 [ 5F7F63884A8547981EE379B8C0FB3312 ] tmtdi C:\WINDOWS\system32\DRIVERS\tmtdi.sys
07:42:12.0234 3752 tmtdi - ok
07:42:12.0234 3752 TosIde - ok
07:42:12.0312 3752 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll
07:42:12.0312 3752 TrkWks - ok
07:42:12.0343 3752 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
07:42:12.0343 3752 Udfs - ok
07:42:12.0359 3752 ultra - ok
07:42:12.0375 3752 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
07:42:12.0406 3752 Update - ok
07:42:12.0421 3752 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll
07:42:12.0437 3752 upnphost - ok
07:42:12.0453 3752 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe
07:42:12.0453 3752 UPS - ok
07:42:12.0468 3752 [ E8C1B9EBAC65288E1B51E8A987D98AF6 ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys
07:42:12.0484 3752 USBAAPL - ok
07:42:12.0515 3752 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys
07:42:12.0515 3752 usbaudio - ok
07:42:12.0562 3752 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
07:42:12.0562 3752 usbccgp - ok
07:42:12.0593 3752 [ 2825E0E294686A26506690059E1F437A ] USBCCID C:\WINDOWS\system32\DRIVERS\usbccid.sys
07:42:12.0609 3752 USBCCID - ok
07:42:12.0640 3752 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
07:42:12.0656 3752 usbehci - ok
07:42:12.0671 3752 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
07:42:12.0671 3752 usbhub - ok
07:42:12.0718 3752 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys
07:42:12.0750 3752 usbprint - ok
07:42:12.0781 3752 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
07:42:12.0781 3752 usbscan - ok
07:42:12.0812 3752 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
07:42:12.0812 3752 USBSTOR - ok
07:42:12.0843 3752 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
07:42:12.0890 3752 usbuhci - ok
07:42:12.0906 3752 [ 63BBFCA7F390F4C49ED4B96BFB1633E0 ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys
07:42:12.0921 3752 usbvideo - ok
07:42:12.0953 3752 [ B6CC50279D6CD28E090A5D33244ADC9A ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys
07:42:12.0984 3752 usb_rndisx - ok
07:42:13.0000 3752 [ 94D73B62E458FB56C9CE60AA96D914F9 ] VClone C:\WINDOWS\system32\DRIVERS\VClone.sys
07:42:13.0015 3752 VClone - ok
07:42:13.0031 3752 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
07:42:13.0046 3752 VgaSave - ok
07:42:13.0046 3752 ViaIde - ok
07:42:13.0046 3752 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
07:42:13.0062 3752 VolSnap - ok
07:42:13.0171 3752 [ 642EB152CB980AD9181B2161066BE629 ] VSApiNt C:\Program Files\Trend Micro\OfficeScan Client\VSApiNt.sys
07:42:13.0187 3752 VSApiNt - ok
07:42:13.0265 3752 [ 27B3DD12A19EEC50220DF15B64913DDA ] vsdatant C:\WINDOWS\system32\vsdatant.sys
07:42:13.0296 3752 vsdatant - ok
07:42:13.0312 3752 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe
07:42:13.0312 3752 VSS - ok
07:42:13.0343 3752 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll
07:42:13.0359 3752 W32Time - ok
07:42:13.0375 3752 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
07:42:13.0390 3752 Wanarp - ok
07:42:13.0437 3752 [ D918617B46457B9AC28027722E30F647 ] Wdf01000 C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
07:42:13.0484 3752 Wdf01000 - ok
07:42:13.0484 3752 WDICA - ok
07:42:13.0515 3752 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
07:42:13.0531 3752 wdmaud - ok
07:42:13.0531 3752 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll
07:42:13.0546 3752 WebClient - ok
07:42:13.0593 3752 [ 2760C329AC300ED64C3DBA8CDA599CDA ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
07:42:13.0656 3752 winachsf - ok
07:42:13.0734 3752 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
07:42:13.0750 3752 winmgmt - ok
07:42:13.0750 3752 wltrysvc - ok
07:42:13.0781 3752 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
07:42:13.0781 3752 WmdmPmSN - ok
07:42:13.0828 3752 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll
07:42:13.0828 3752 Wmi - ok
07:42:13.0828 3752 [ C42584FD66CE9E17403AEBCA199F7BDB ] WmiAcpi C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
07:42:13.0828 3752 WmiAcpi - ok
07:42:13.0843 3752 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
07:42:13.0843 3752 WmiApSrv - ok
07:42:13.0968 3752 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
07:42:14.0046 3752 WMPNetworkSvc - ok
07:42:14.0062 3752 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys
07:42:14.0078 3752 WpdUsb - ok
07:42:14.0312 3752 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
07:42:14.0328 3752 WPFFontCache_v0400 - ok
07:42:14.0359 3752 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
07:42:14.0359 3752 wscsvc - ok
07:42:14.0390 3752 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
07:42:14.0406 3752 WSTCODEC - ok
07:42:14.0421 3752 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll
07:42:14.0437 3752 wuauserv - ok
07:42:14.0468 3752 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
07:42:14.0484 3752 WudfPf - ok
07:42:14.0500 3752 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
07:42:14.0515 3752 WudfRd - ok
07:42:14.0546 3752 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
07:42:14.0562 3752 WudfSvc - ok
07:42:14.0593 3752 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
07:42:14.0609 3752 WZCSVC - ok
07:42:14.0625 3752 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
07:42:14.0640 3752 xmlprov - ok
07:42:14.0656 3752 ================ Scan global ===============================
07:42:14.0671 3752 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll
07:42:14.0718 3752 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
07:42:14.0750 3752 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
07:42:14.0750 3752 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe
07:42:14.0750 3752 [Global] - ok
07:42:14.0765 3752 ================ Scan MBR ==================================
07:42:14.0765 3752 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
07:42:14.0765 3752 Suspicious mbr (Forged): \Device\Harddisk0\DR0
07:42:14.0812 3752 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected
07:42:14.0812 3752 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0)
07:42:14.0859 3752 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
07:42:14.0859 3752 \Device\Harddisk0\DR0 - detected TDSS File System (1)
07:42:14.0875 3752 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR2
07:42:17.0250 3752 \Device\Harddisk1\DR2 - ok
07:42:17.0250 3752 ================ Scan VBR ==================================
07:42:17.0250 3752 [ 23083F7D26015A01C4C144AC7F34A728 ] \Device\Harddisk0\DR0\Partition1
07:42:17.0250 3752 \Device\Harddisk0\DR0\Partition1 - ok
07:42:17.0265 3752 [ 462BF56AEB38A97067B76B75CE2FD2B1 ] \Device\Harddisk1\DR2\Partition1
07:42:17.0265 3752 \Device\Harddisk1\DR2\Partition1 - ok
07:42:17.0265 3752 ============================================================
07:42:17.0265 3752 Scan finished
07:42:17.0265 3752 ============================================================
07:42:17.0265 3032 Detected object count: 2
07:42:17.0265 3032 Actual detected object count: 2
07:42:32.0390 3032 \Device\Harddisk0\DR0\# - copied to quarantine
07:42:32.0390 3032 \Device\Harddisk0\DR0 - copied to quarantine
07:42:32.0437 3032 \Device\Harddisk0\DR0\TDLFS\ldrm - copied to quarantine
07:42:32.0500 3032 \Device\Harddisk0\DR0\TDLFS\cmd.dll - copied to quarantine
07:42:32.0515 3032 \Device\Harddisk0\DR0\TDLFS\cmd64.dll - copied to quarantine
07:42:32.0562 3032 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine
07:42:32.0625 3032 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine
07:42:32.0640 3032 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine
07:42:32.0656 3032 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine
07:42:32.0671 3032 \Device\Harddisk0\DR0\TDLFS\servers.dat - copied to quarantine
07:42:32.0687 3032 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine
07:42:32.0687 3032 \Device\Harddisk0\DR0\TDLFS\ldr16 - copied to quarantine
07:42:32.0687 3032 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine
07:42:32.0703 3032 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine
07:42:32.0703 3032 \Device\Harddisk0\DR0\TDLFS\s - copied to quarantine
07:42:32.0718 3032 \Device\Harddisk0\DR0\TDLFS\u - copied to quarantine
07:42:32.0734 3032 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine
07:42:32.0750 3032 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - will be cured on reboot
07:42:32.0750 3032 \Device\Harddisk0\DR0 - ok
07:42:32.0750 3032 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Cure
07:42:32.0750 3032 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
07:42:32.0750 3032 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip
07:42:37.0890 0736 Deinitialize success


ComboFix text:

ComboFix 12-09-04.01 - ImiolalDM 09/04/2012 8:54.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2000.1566 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Trend Micro OfficeScan Antivirus *Disabled/Outdated* {4CA5B9AB-4295-4D4C-9664-0EBE85AE0525}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\program files\Common Files\Altiris_Icon.ico
c:\windows\psapi.dll
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\regtlib.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-08-04 to 2012-09-04 )))))))))))))))))))))))))))))))
.
.
2012-09-04 11:42 . 2012-09-04 11:42 ——– d—–w- C:\TDSSKiller_Quarantine
2012-08-28 19:28 . 2012-08-28 19:28 418464 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-24 13:54 . 2012-08-24 13:54 ——– d—–w- c:\program files\Common Files\Java
2012-08-24 13:52 . 2012-08-24 13:52 73728 —-a-w- c:\windows\system32\javacpl.cpl
2012-08-24 13:52 . 2012-08-24 13:52 477168 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-08-24 13:02 . 2012-08-24 13:02 ——– d—–w- c:\windows\system32\wbem\Repository
2012-08-24 12:36 . 2012-08-24 12:36 ——– d—–w- c:\documents and settings\imiolaldm\Local Settings\Application Data\Google
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-04 11:43 . 2012-05-04 16:09 102400 —-a-w- c:\windows\RegBootClean.exe
2012-08-28 19:28 . 2011-08-02 00:38 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-24 13:52 . 2010-04-26 16:14 473072 —-a-w- c:\windows\system32\deployJava1.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-21 134656]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-21 166912]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-21 134656]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2010-04-15 2396160]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-02-23 483420]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2008-12-16 729088]
"OfficeScanNT Monitor"="c:\program files\Trend Micro\OfficeScan Client\pccntmon.exe" [2012-05-14 1113984]
"AeXAgentLogon"="c:\program files\Altiris\Altiris Agent\AeXAgentActivate.exe" [2010-02-26 152872]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 118784]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-02-17 278528]
"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-09-01 90448]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
VPN Client.lnk - c:\windows\Installer\{14FCFE7C-AB86-428A-9D2E-BFB6F5A7AA6E}\Icon3E5562ED7.ico [2010-6-10 6144]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"consentpromptbehavioradmin"= 0 (0x0)
"consentpromptbehavioruser"= 3 (0x3)
"promptonsecuredesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\AMInit32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-821405301-94645080-3068728547-16088\Scripts\Logon\0\0]
"Script"=cdlogon2012062501.vbs
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-821405301-94645080-3068728547-16089\Scripts\Logon\0\0]
"Script"=cdlogon2009112004.vbs
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-821405301-94645080-3068728547-1722\Scripts\Logon\0\0]
"Script"=cdlogon2012062501.vbs
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-821405301-94645080-3068728547-5685\Scripts\Logon\0\0]
"Script"=cdlogon2009112004.vbs
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntivirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8081:TCP"= 8081:TCP:Trend Micro OfficeScan Listener
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"29532:TCP"= 29532:TCP:Trend Micro OfficeScan Listener
.
R2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [6/26/2009 9:26 AM 812392]
R2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [6/26/2009 9:26 AM 26984]
R2 Lotus Notes Diagnostics;Lotus Notes Diagnostics;c:\program files\lotus\Notes\nsd.exe [8/11/2010 11:26 AM 3417480]
R2 TmPreFilter;Trend Micro PreFilter;c:\program files\Trend Micro\OfficeScan Client\tmpreflt.sys [9/30/2009 3:37 PM 36624]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [4/15/2010 10:58 AM 112512]
R3 cvusbdrv;Dell ControlVault;c:\windows\system32\drivers\cvusbdrv.sys [4/15/2010 12:46 PM 33832]
R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y5132.sys [4/15/2010 10:46 AM 240344]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [4/15/2010 10:50 AM 109568]
S2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [4/22/2010 2:56 PM 60648]
S2 TmFilter;Trend Micro Filter;c:\program files\Trend Micro\OfficeScan Client\TmXPFlt.sys [9/30/2009 3:38 PM 262416]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [8/28/2012 3:28 PM 253600]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [10/29/2009 7:23 PM 32408]
S3 TmProxy;OfficeScan NT Proxy Service;c:\program files\Trend Micro\OfficeScan Client\TmProxy.exe [8/24/2012 10:28 AM 689680]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - 46754680
*NewlyCreated* - 58101123
*Deregistered* - 46754680
*Deregistered* - 58101123
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-28 19:28]
.
2012-08-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
mStart Page = about:blank
TCP: DhcpNameServer = 10.208.1.9 10.208.1.29 10.200.4.130 10.142.4.130
DPF: {FDF527BA-DDDA-11D3-AA82-006094EB09CB} - hxxp://dc-altiris01:8085/aspnet_client/Altiris_AppWeaver/6_0_sp3/lib/AeXClipboard.CAB
.
- - - - ORPHANS REMOVED - - - -
.
SafeBoot-46754680.sys
AddRemove-FosecoDegasser98 - c:\documents and settings\BeganBri\Desktop\Uninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-04 08:59
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1296)
c:\windows\system32\AMINIT32.dll
.
- - - - - - - > 'lsass.exe'(1352)
c:\windows\system32\AMINIT32.dll
.
Completion time: 2012-09-04 09:01:14
ComboFix-quarantined-files.txt 2012-09-04 13:01
.
Pre-Run: 80,370,671,616 bytes free
Post-Run: 81,764,802,560 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 629414992683FF98913B577D46D5F7BB

Now that the Pihar rootkit has been cured, you can re-run TDSSKiller and choose to delete the TDSS file system it found.

NEXT

• Please open your MalwareBytes AntiMalware Program
• Click the Update Tab and search for updates
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <– very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Go here to run an online scanner from ESET.

• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activeX control to install
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
• Wait for the scan to finish
• When the scan completes, press the LIST OF THREATS FOUND button
• Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
• Include the contents of this report in your next reply.
• Press the BACK button.
• Press Finish

TDSSKiller text: 07:41:50.0984 3560 TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48 07:41:51.0281 3560 ============================================================ 07:41:51.0281 3560 Current date / time: 2012/09/04 07:41:51.0281 07:41:51.0281 3560 SystemInfo: 07:41:51.0281 3560 07:41:51.0281 3560 OS Version: 5.1.2600 ServicePack: 3.0 07:41:51.0281 3560 Product type: Workstation 07:41:51.0281 3560 ComputerName: CD-BEGANBRI-LP1 07:41:51.0281 3560 UserName: imiolaldm 07:41:51.0281 3560 Windows directory: C:\WINDOWS 07:41:51.0281 3560 System windows directory: C:\WINDOWS 07:41:51.0281 3560 Processor architecture: Intel x86 07:41:51.0281 3560 Number of processors: 2 07:41:51.0281 3560 Page size: 0x1000 07:41:51.0281 3560 Boot type: Normal boot 07:41:51.0281 3560 ============================================================ 07:41:52.0421 3560 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 07:41:52.0421 3560 Drive \Device\Harddisk1\DR2 - Size: 0x78000000 (1.88 Gb), SectorSize: 0x200, Cylinders: 0xF4, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W' 07:41:52.0421 3560 ============================================================ 07:41:52.0421 3560 \Device\Harddisk0\DR0: 07:41:52.0421 3560 MBR partitions: 07:41:52.0421 3560 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x12A14BC1 07:41:52.0421 3560 \Device\Harddisk1\DR2: 07:41:52.0421 3560 MBR partitions: 07:41:52.0421 3560 \Device\Harddisk1\DR2\Partition1: MBR, Type 0xC, StartLBA 0x20, BlocksNum 0x3BFFE0 07:41:52.0421 3560 ============================================================ 07:41:52.0500 3560 C: <-> \Device\Harddisk0\DR0\Partition1 07:41:52.0500 3560 ============================================================ 07:41:52.0500 3560 Initialize success 07:41:52.0500 3560 ============================================================ 07:41:58.0703 3752 ============================================================ 07:41:58.0703 3752 Scan started 07:41:58.0703 3752 Mode: Manual; TDLFS; 07:41:58.0703 3752 ============================================================ 07:41:59.0531 3752 ================ Scan system memory ======================== 07:42:01.0265 3752 System memory - ok 07:42:01.0265 3752 ================ Scan services ============================= 07:42:01.0328 3752 Abiosdsk - ok 07:42:01.0328 3752 abp480n5 - ok 07:42:01.0343 3752 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys 07:42:01.0343 3752 ACPI - ok 07:42:01.0359 3752 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\DRIVERS\ACPIEC.sys 07:42:01.0375 3752 ACPIEC - ok 07:42:01.0453 3752 [ 0D4C486A24A711A45FD83ACDF4D18506 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 07:42:01.0453 3752 AdobeFlashPlayerUpdateSvc - ok 07:42:01.0453 3752 adpu160m - ok 07:42:01.0500 3752 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys 07:42:01.0531 3752 aec - ok 07:42:01.0562 3752 [ F21D5E93A94514BE9F5B6EBF74A696B2 ] AESTAud C:\WINDOWS\system32\drivers\AESTAud.sys 07:42:01.0609 3752 AESTAud - ok 07:42:01.0671 3752 [ 9203AD68320587889DDDDC0DF6648C29 ] AeXNSClient C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe 07:42:01.0687 3752 AeXNSClient - ok 07:42:01.0718 3752 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys 07:42:01.0734 3752 AFD - ok 07:42:01.0734 3752 Aha154x - ok 07:42:01.0734 3752 aic78u2 - ok 07:42:01.0750 3752 aic78xx - ok 07:42:01.0765 3752 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll 07:42:01.0796 3752 Alerter - ok 07:42:01.0828 3752 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe 07:42:01.0828 3752 ALG - ok 07:42:01.0828 3752 AliIde - ok 07:42:01.0828 3752 amsint - ok 07:42:01.0843 3752 [ 22403504E15810E99A563782E9D45311 ] ApfiltrService C:\WINDOWS\system32\DRIVERS\Apfiltr.sys 07:42:01.0859 3752 ApfiltrService - ok 07:42:01.0890 3752 [ D503DF3ABA595F551B98B9BAE017A271 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 07:42:01.0906 3752 Apple Mobile Device - ok 07:42:01.0937 3752 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll 07:42:01.0953 3752 AppMgmt - ok 07:42:01.0953 3752 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys 07:42:01.0968 3752 Arp1394 - ok 07:42:01.0968 3752 asc - ok 07:42:01.0968 3752 asc3350p - ok 07:42:01.0968 3752 asc3550 - ok 07:42:02.0109 3752 [ 776ACEFA0CA9DF0FAA51A5FB2F435705 ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 07:42:02.0140 3752 aspnet_state - ok 07:42:02.0156 3752 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys 07:42:02.0156 3752 AsyncMac - ok 07:42:02.0171 3752 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys 07:42:02.0171 3752 atapi - ok 07:42:02.0187 3752 Atdisk - ok 07:42:02.0187 3752 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys 07:42:02.0203 3752 Atmarpc - ok 07:42:02.0218 3752 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll 07:42:02.0234 3752 AudioSrv - ok 07:42:02.0281 3752 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys 07:42:02.0359 3752 audstub - ok 07:42:02.0421 3752 [ FE4ED785396EAA554C561992106A35FA ] BCM43XX C:\WINDOWS\system32\DRIVERS\bcmwl5.sys 07:42:02.0453 3752 BCM43XX - ok 07:42:02.0484 3752 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys 07:42:02.0500 3752 Beep - ok 07:42:02.0515 3752 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll 07:42:02.0546 3752 BITS - ok 07:42:02.0578 3752 [ EBAD0F51D8D4DADE7660B1851ADDBD07 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe 07:42:02.0609 3752 Bonjour Service - ok 07:42:02.0625 3752 [ A06CE3399D16DB864F55FAEB1F1927A9 ] Browser C:\WINDOWS\System32\browser.dll 07:42:02.0625 3752 Browser - ok 07:42:02.0656 3752 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys 07:42:02.0671 3752 cbidf2k - ok 07:42:02.0687 3752 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 07:42:02.0703 3752 CCDECODE - ok 07:42:02.0703 3752 cd20xrnt - ok 07:42:02.0734 3752 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys 07:42:02.0734 3752 Cdaudio - ok 07:42:02.0734 3752 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys 07:42:02.0750 3752 Cdfs - ok 07:42:02.0765 3752 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys 07:42:02.0796 3752 Cdrom - ok 07:42:02.0796 3752 Changer - ok 07:42:02.0812 3752 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe 07:42:02.0812 3752 CiSvc - ok 07:42:02.0828 3752 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe 07:42:02.0828 3752 ClipSrv - ok 07:42:02.0875 3752 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 07:42:02.0875 3752 clr_optimization_v2.0.50727_32 - ok 07:42:02.0906 3752 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 07:42:02.0968 3752 clr_optimization_v4.0.30319_32 - ok 07:42:03.0000 3752 [ 0F6C187D38D98F8DF904589A5F94D411 ] CmBatt C:\WINDOWS\system32\DRIVERS\CmBatt.sys 07:42:03.0031 3752 CmBatt - ok 07:42:03.0031 3752 CmdIde - ok 07:42:03.0031 3752 [ 6E4C9F21F0FAE8940661144F41B13203 ] Compbatt C:\WINDOWS\system32\DRIVERS\compbatt.sys 07:42:03.0046 3752 Compbatt - ok 07:42:03.0046 3752 COMSysApp - ok 07:42:03.0046 3752 Cpqarray - ok 07:42:03.0093 3752 [ E5E7A3BEA7033479D205CA5048FE4FE8 ] Credential Vault Host Control Service C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe 07:42:03.0125 3752 Credential Vault Host Control Service - ok 07:42:03.0125 3752 [ 879F8314BBF09738630ED1AF6BB1FC00 ] Credential Vault Host Storage C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe 07:42:03.0140 3752 Credential Vault Host Storage - ok 07:42:03.0171 3752 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll 07:42:03.0187 3752 CryptSvc - ok 07:42:03.0218 3752 [ B5ECADF7708960F1818C7FA015F4C239 ] CVirtA C:\WINDOWS\system32\DRIVERS\CVirtA.sys 07:42:03.0265 3752 CVirtA - ok 07:42:03.0328 3752 [ DAD192D12DD0B4C92F6843203852829F ] CVPND C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe 07:42:03.0375 3752 CVPND - ok 07:42:03.0390 3752 [ 26DEEF07394624247D1F549BD94F0B15 ] CVPNDRVA C:\WINDOWS\system32\Drivers\CVPNDRVA.sys 07:42:03.0406 3752 CVPNDRVA - ok 07:42:03.0437 3752 [ EE773B1806A93A86283B10FACEBE57DB ] cvusbdrv C:\WINDOWS\system32\Drivers\cvusbdrv.sys 07:42:03.0453 3752 cvusbdrv - ok 07:42:03.0453 3752 dac2w2k - ok 07:42:03.0468 3752 dac960nt - ok 07:42:03.0515 3752 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll 07:42:03.0515 3752 DcomLaunch - ok 07:42:03.0531 3752 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll 07:42:03.0531 3752 Dhcp - ok 07:42:03.0562 3752 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys 07:42:03.0562 3752 Disk - ok 07:42:03.0562 3752 dmadmin - ok 07:42:03.0609 3752 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys 07:42:03.0671 3752 dmboot - ok 07:42:03.0718 3752 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys 07:42:03.0734 3752 dmio - ok 07:42:03.0750 3752 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys 07:42:03.0765 3752 dmload - ok 07:42:03.0781 3752 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll 07:42:03.0796 3752 dmserver - ok 07:42:03.0828 3752 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys 07:42:03.0843 3752 DMusic - ok 07:42:03.0875 3752 [ 7B4FDFBE97C047175E613AA96F3DE987 ] DNE C:\WINDOWS\system32\DRIVERS\dne2000.sys 07:42:03.0875 3752 DNE - ok 07:42:03.0921 3752 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll 07:42:03.0937 3752 Dnscache - ok 07:42:03.0953 3752 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll 07:42:03.0968 3752 Dot3svc - ok 07:42:03.0968 3752 dpti2o - ok 07:42:03.0984 3752 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys 07:42:04.0000 3752 drmkaud - ok 07:42:04.0031 3752 [ 71FF7AD30BD9E3C06DF112383BB60089 ] e1yexpress C:\WINDOWS\system32\DRIVERS\e1y5132.sys 07:42:04.0046 3752 e1yexpress - ok 07:42:04.0062 3752 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll 07:42:04.0078 3752 EapHost - ok 07:42:04.0093 3752 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll 07:42:04.0109 3752 ERSvc - ok 07:42:04.0109 3752 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe 07:42:04.0109 3752 Eventlog - ok 07:42:04.0140 3752 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll 07:42:04.0140 3752 EventSystem - ok 07:42:04.0140 3752 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys 07:42:04.0140 3752 Fastfat - ok 07:42:04.0171 3752 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll 07:42:04.0187 3752 FastUserSwitchingCompatibility - ok 07:42:04.0218 3752 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys 07:42:04.0250 3752 Fdc - ok 07:42:04.0265 3752 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys 07:42:04.0281 3752 Fips - ok 07:42:04.0328 3752 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys 07:42:04.0328 3752 Flpydisk - ok 07:42:04.0375 3752 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\DRIVERS\fltMgr.sys 07:42:04.0421 3752 FltMgr - ok 07:42:04.0515 3752 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 07:42:04.0515 3752 FontCache3.0.0.0 - ok 07:42:04.0531 3752 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys 07:42:04.0531 3752 Fs_Rec - ok 07:42:04.0531 3752 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys 07:42:04.0562 3752 Ftdisk - ok 07:42:04.0593 3752 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 07:42:04.0593 3752 GEARAspiWDM - ok 07:42:04.0609 3752 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys 07:42:04.0625 3752 Gpc - ok 07:42:04.0671 3752 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 07:42:04.0671 3752 HDAudBus - ok 07:42:04.0734 3752 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 07:42:04.0734 3752 helpsvc - ok 07:42:04.0765 3752 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll 07:42:04.0781 3752 HidServ - ok 07:42:04.0812 3752 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys 07:42:04.0828 3752 HidUsb - ok 07:42:04.0859 3752 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll 07:42:04.0875 3752 hkmsvc - ok 07:42:04.0906 3752 [ E4E0B356A8756066CF89080D9DA69F22 ] HPFXBULK C:\WINDOWS\system32\drivers\hpfxbulk.sys 07:42:04.0906 3752 HPFXBULK - ok 07:42:04.0906 3752 hpn - ok 07:42:04.0968 3752 [ F25BB78B0063A8E8FCEFF33493C305E0 ] HSFHWAZL C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys 07:42:04.0984 3752 HSFHWAZL - ok 07:42:05.0000 3752 [ 04D872629E0AFCB07BA9088EAA308C11 ] HSF_DPV C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys 07:42:05.0093 3752 HSF_DPV - ok 07:42:05.0125 3752 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys 07:42:05.0125 3752 HTTP - ok 07:42:05.0156 3752 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll 07:42:05.0250 3752 HTTPFilter - ok 07:42:05.0265 3752 i2omgmt - ok 07:42:05.0265 3752 i2omp - ok 07:42:05.0296 3752 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys 07:42:05.0312 3752 i8042prt - ok 07:42:05.0468 3752 [ 3B743262B6456167888D15F1121B3BF7 ] ialm C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 07:42:05.0812 3752 ialm - ok 07:42:05.0859 3752 [ DAF66902F08796F9C694901660E5A64A ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe 07:42:05.0906 3752 IDriverT - ok 07:42:06.0015 3752 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 07:42:06.0109 3752 idsvc - ok 07:42:06.0140 3752 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys 07:42:06.0156 3752 Imapi - ok 07:42:06.0203 3752 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe 07:42:06.0203 3752 ImapiService - ok 07:42:06.0203 3752 ini910u - ok 07:42:06.0234 3752 [ F32A62C765885BD8E4352A1565F702A6 ] IntcHdmiAddService C:\WINDOWS\system32\drivers\IntcHdmi.sys 07:42:06.0250 3752 IntcHdmiAddService - ok 07:42:06.0250 3752 IntelIde - ok 07:42:06.0296 3752 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys 07:42:06.0296 3752 intelppm - ok 07:42:06.0312 3752 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 07:42:06.0375 3752 Ip6Fw - ok 07:42:06.0406 3752 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 07:42:06.0421 3752 IpFilterDriver - ok 07:42:06.0421 3752 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys 07:42:06.0421 3752 IpInIp - ok 07:42:06.0453 3752 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys 07:42:06.0453 3752 IpNat - ok 07:42:06.0500 3752 [ 3C30491045DBBD44A42876B3D6F3917D ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 07:42:06.0515 3752 iPod Service - ok 07:42:06.0546 3752 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys 07:42:06.0562 3752 IPSec - ok 07:42:06.0578 3752 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys 07:42:06.0593 3752 IRENUM - ok 07:42:06.0625 3752 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys 07:42:06.0656 3752 isapnp - ok 07:42:06.0734 3752 [ 0AB63D5785991F9CB362D82DEFF1DBBA ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe 07:42:06.0750 3752 JavaQuickStarterService - ok 07:42:06.0781 3752 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys 07:42:06.0781 3752 Kbdclass - ok 07:42:06.0812 3752 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys 07:42:06.0843 3752 kbdhid - ok 07:42:06.0875 3752 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys 07:42:06.0875 3752 kmixer - ok 07:42:06.0890 3752 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys 07:42:06.0890 3752 KSecDD - ok 07:42:06.0921 3752 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] LanmanServer C:\WINDOWS\System32\srvsvc.dll 07:42:06.0937 3752 LanmanServer - ok 07:42:06.0984 3752 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll 07:42:06.0984 3752 lanmanworkstation - ok 07:42:06.0984 3752 lbrtfdc - ok 07:42:07.0000 3752 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll 07:42:07.0000 3752 LmHosts - ok 07:42:07.0187 3752 [ 731FD0367064D15989DFF8A6F826E881 ] Lotus Notes Diagnostics C:\Program Files\Lotus\Notes\nsd.exe 07:42:07.0281 3752 Lotus Notes Diagnostics - ok 07:42:07.0312 3752 [ 1A394A0372622B3D5F989AE8329326F2 ] Lotus Notes Single Logon C:\Program Files\Lotus\Notes\nslsvice.exe 07:42:07.0328 3752 Lotus Notes Single Logon - ok 07:42:07.0343 3752 [ 0CEA2D0D3FA284B85ED5B68365114F76 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 07:42:07.0343 3752 mdmxsdk - ok 07:42:07.0375 3752 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll 07:42:07.0375 3752 Messenger - ok 07:42:07.0406 3752 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys 07:42:07.0421 3752 mnmdd - ok 07:42:07.0453 3752 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe 07:42:07.0453 3752 mnmsrvc - ok 07:42:07.0484 3752 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys 07:42:07.0484 3752 Modem - ok 07:42:07.0500 3752 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys 07:42:07.0531 3752 Mouclass - ok 07:42:07.0562 3752 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys 07:42:07.0578 3752 mouhid - ok 07:42:07.0593 3752 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys 07:42:07.0609 3752 MountMgr - ok 07:42:07.0609 3752 mraid35x - ok 07:42:07.0609 3752 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys 07:42:07.0625 3752 MRxDAV - ok 07:42:07.0671 3752 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 07:42:07.0718 3752 MRxSmb - ok 07:42:07.0750 3752 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe 07:42:07.0750 3752 MSDTC - ok 07:42:07.0781 3752 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys 07:42:07.0796 3752 Msfs - ok 07:42:07.0796 3752 MSIServer - ok 07:42:07.0812 3752 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys 07:42:07.0828 3752 MSKSSRV - ok 07:42:07.0843 3752 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys 07:42:07.0843 3752 MSPCLOCK - ok 07:42:07.0859 3752 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys 07:42:07.0859 3752 MSPQM - ok 07:42:07.0890 3752 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys 07:42:07.0890 3752 mssmbios - ok 07:42:07.0921 3752 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys 07:42:07.0921 3752 MSTEE - ok 07:42:07.0953 3752 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys 07:42:07.0953 3752 Mup - ok 07:42:07.0984 3752 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 07:42:08.0031 3752 NABTSFEC - ok 07:42:08.0046 3752 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll 07:42:08.0078 3752 napagent - ok 07:42:08.0093 3752 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys 07:42:08.0109 3752 NDIS - ok 07:42:08.0140 3752 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys 07:42:08.0140 3752 NdisIP - ok 07:42:08.0171 3752 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys 07:42:08.0171 3752 NdisTapi - ok 07:42:08.0203 3752 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys 07:42:08.0328 3752 Ndisuio - ok 07:42:08.0343 3752 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys 07:42:08.0359 3752 NdisWan - ok 07:42:08.0406 3752 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys 07:42:08.0406 3752 NDProxy - ok 07:42:08.0406 3752 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys 07:42:08.0421 3752 NetBIOS - ok 07:42:08.0421 3752 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys 07:42:08.0453 3752 NetBT - ok 07:42:08.0453 3752 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe 07:42:08.0453 3752 NetDDE - ok 07:42:08.0453 3752 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe 07:42:08.0468 3752 NetDDEdsdm - ok 07:42:08.0500 3752 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe 07:42:08.0500 3752 Netlogon - ok 07:42:08.0531 3752 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll 07:42:08.0531 3752 Netman - ok 07:42:08.0578 3752 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 07:42:08.0593 3752 NetTcpPortSharing - ok 07:42:08.0609 3752 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys 07:42:08.0609 3752 NIC1394 - ok 07:42:08.0656 3752 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll 07:42:08.0656 3752 Nla - ok 07:42:08.0671 3752 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys 07:42:08.0671 3752 Npfs - ok 07:42:08.0687 3752 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys 07:42:08.0734 3752 Ntfs - ok 07:42:08.0734 3752 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe 07:42:08.0734 3752 NtLmSsp - ok 07:42:08.0765 3752 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll 07:42:08.0812 3752 NtmsSvc - ok 07:42:08.0890 3752 [ A5FB5070F78E5C26C39B4E7F9163C6DF ] ntrtscan C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe 07:42:08.0921 3752 ntrtscan - ok 07:42:08.0921 3752 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys 07:42:08.0937 3752 Null - ok 07:42:08.0968 3752 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 07:42:09.0000 3752 NwlnkFlt - ok 07:42:09.0000 3752 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 07:42:09.0015 3752 NwlnkFwd - ok 07:42:09.0031 3752 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys 07:42:09.0031 3752 ohci1394 - ok 07:42:09.0078 3752 [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 07:42:09.0093 3752 ose - ok 07:42:09.0125 3752 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\drivers\Parport.sys 07:42:09.0140 3752 Parport - ok 07:42:09.0140 3752 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys 07:42:09.0140 3752 PartMgr - ok 07:42:09.0171 3752 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys 07:42:09.0171 3752 ParVdm - ok 07:42:09.0187 3752 [ 4088C1ECD1F54281A92FA663B0FDC36F ] PBADRV C:\WINDOWS\system32\DRIVERS\PBADRV.sys 07:42:09.0250 3752 PBADRV - ok 07:42:09.0265 3752 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys 07:42:09.0281 3752 PCI - ok 07:42:09.0281 3752 PCIDump - ok 07:42:09.0296 3752 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys 07:42:09.0312 3752 PCIIde - ok 07:42:09.0312 3752 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\DRIVERS\pcmcia.sys 07:42:09.0328 3752 Pcmcia - ok 07:42:09.0328 3752 PDCOMP - ok 07:42:09.0328 3752 PDFRAME - ok 07:42:09.0343 3752 PDRELI - ok 07:42:09.0343 3752 PDRFRAME - ok 07:42:09.0343 3752 perc2 - ok 07:42:09.0343 3752 perc2hib - ok 07:42:09.0359 3752 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe 07:42:09.0359 3752 PlugPlay - ok 07:42:09.0375 3752 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe 07:42:09.0375 3752 PolicyAgent - ok 07:42:09.0375 3752 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys 07:42:09.0390 3752 PptpMiniport - ok 07:42:09.0390 3752 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe 07:42:09.0390 3752 ProtectedStorage - ok 07:42:09.0406 3752 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys 07:42:09.0421 3752 PSched - ok 07:42:09.0421 3752 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys 07:42:09.0437 3752 Ptilink - ok 07:42:09.0453 3752 [ 03E0FE281823BA64B3782F5B38950E73 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys 07:42:09.0484 3752 PxHelp20 - ok 07:42:09.0484 3752 ql1080 - ok 07:42:09.0484 3752 Ql10wnt - ok 07:42:09.0500 3752 ql12160 - ok 07:42:09.0500 3752 ql1240 - ok 07:42:09.0500 3752 ql1280 - ok 07:42:09.0515 3752 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys 07:42:09.0531 3752 RasAcd - ok 07:42:09.0546 3752 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll 07:42:09.0562 3752 RasAuto - ok 07:42:09.0578 3752 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 07:42:09.0593 3752 Rasl2tp - ok 07:42:09.0609 3752 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll 07:42:09.0625 3752 RasMan - ok 07:42:09.0625 3752 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys 07:42:09.0640 3752 RasPppoe - ok 07:42:09.0656 3752 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys 07:42:09.0656 3752 Raspti - ok 07:42:09.0671 3752 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys 07:42:09.0703 3752 Rdbss - ok 07:42:09.0718 3752 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 07:42:09.0734 3752 RDPCDD - ok 07:42:09.0765 3752 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys 07:42:09.0781 3752 rdpdr - ok 07:42:09.0843 3752 [ 5B3055DAA788BD688594D2F5981F2A83 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys 07:42:09.0843 3752 RDPWD - ok 07:42:09.0890 3752 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe 07:42:09.0890 3752 RDSessMgr - ok 07:42:09.0906 3752 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys 07:42:09.0921 3752 redbook - ok 07:42:09.0937 3752 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll 07:42:09.0953 3752 RemoteAccess - ok 07:42:09.0984 3752 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll 07:42:09.0984 3752 RemoteRegistry - ok 07:42:10.0000 3752 [ 355AAC141B214BEF1DBC1483AFD9BD50 ] rimmptsk C:\WINDOWS\system32\DRIVERS\rimmptsk.sys 07:42:10.0015 3752 rimmptsk - ok 07:42:10.0046 3752 [ 4F4A4C09CC5BE58A76CAC1C337E004E6 ] RimUsb C:\WINDOWS\system32\Drivers\RimUsb.sys 07:42:10.0062 3752 RimUsb - ok 07:42:10.0078 3752 [ 3A5633AD615E2B15291BD0B1B97CCD8A ] RimVSerPort C:\WINDOWS\system32\DRIVERS\RimSerial.sys 07:42:10.0093 3752 RimVSerPort - ok 07:42:10.0093 3752 [ D8B0B4ADE32574B2D9C5CC34DC0DBBE7 ] ROOTMODEM C:\WINDOWS\system32\Drivers\RootMdm.sys 07:42:10.0109 3752 ROOTMODEM - ok 07:42:10.0125 3752 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe 07:42:10.0125 3752 RpcLocator - ok 07:42:10.0203 3752 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\system32\rpcss.dll 07:42:10.0203 3752 RpcSs - ok 07:42:10.0218 3752 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe 07:42:10.0218 3752 RSVP - ok 07:42:10.0218 3752 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe 07:42:10.0218 3752 SamSs - ok 07:42:10.0234 3752 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe 07:42:10.0234 3752 SCardSvr - ok 07:42:10.0281 3752 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll 07:42:10.0296 3752 Schedule - ok 07:42:10.0312 3752 [ 8D04819A3CE51B9EB47E5689B44D43C4 ] sdbus C:\WINDOWS\system32\DRIVERS\sdbus.sys 07:42:10.0328 3752 sdbus - ok 07:42:10.0359 3752 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys 07:42:10.0359 3752 Secdrv - ok 07:42:10.0390 3752 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll 07:42:10.0421 3752 seclogon - ok 07:42:10.0453 3752 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll 07:42:10.0453 3752 SENS - ok 07:42:10.0453 3752 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] Serenum C:\WINDOWS\system32\DRIVERS\serenum.sys 07:42:10.0468 3752 Serenum - ok 07:42:10.0484 3752 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys 07:42:10.0500 3752 Serial - ok 07:42:10.0515 3752 [ 0FA803C64DF0914B41F807EA276BF2A6 ] sffdisk C:\WINDOWS\system32\DRIVERS\sffdisk.sys 07:42:10.0515 3752 sffdisk - ok 07:42:10.0531 3752 [ C17C331E435ED8737525C86A7557B3AC ] sffp_sd C:\WINDOWS\system32\DRIVERS\sffp_sd.sys 07:42:10.0531 3752 sffp_sd - ok 07:42:10.0546 3752 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys 07:42:10.0546 3752 Sfloppy - ok 07:42:10.0562 3752 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll 07:42:10.0593 3752 SharedAccess - ok 07:42:10.0593 3752 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll 07:42:10.0593 3752 ShellHWDetection - ok 07:42:10.0609 3752 Simbad - ok 07:42:10.0625 3752 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys 07:42:10.0656 3752 SLIP - ok 07:42:10.0671 3752 [ 1E715247EFFFDDA938C085913045D599 ] SMSIVZAM5 C:\PROGRA~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS 07:42:10.0687 3752 SMSIVZAM5 - ok 07:42:10.0687 3752 Sparrow - ok 07:42:10.0718 3752 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys 07:42:10.0734 3752 splitter - ok 07:42:10.0765 3752 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe 07:42:10.0765 3752 Spooler - ok 07:42:10.0796 3752 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys 07:42:10.0812 3752 sr - ok 07:42:10.0843 3752 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll 07:42:10.0859 3752 srservice - ok 07:42:10.0875 3752 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys 07:42:10.0921 3752 Srv - ok 07:42:10.0937 3752 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll 07:42:10.0953 3752 SSDPSRV - ok 07:42:11.0000 3752 [ 3603F3DB9FBA2A8FA91829681BA25AFA ] STacSV c:\program files\idt\dellxpm09b_6159v043\wdm\stacsv.exe 07:42:11.0015 3752 STacSV - ok 07:42:11.0062 3752 [ 1B76479B80FF0F6E245BA590A64102BE ] STHDA C:\WINDOWS\system32\drivers\sthda.sys 07:42:11.0125 3752 STHDA - ok 07:42:11.0140 3752 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll 07:42:11.0171 3752 stisvc - ok 07:42:11.0203 3752 [ E476C66713C842F58E61A95826ED1D57 ] stllssvr C:\Program Files\Common Files\SureThing Shared\stllssvr.exe 07:42:11.0234 3752 stllssvr - ok 07:42:11.0250 3752 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys 07:42:11.0265 3752 streamip - ok 07:42:11.0265 3752 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys 07:42:11.0281 3752 swenum - ok 07:42:11.0296 3752 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys 07:42:11.0359 3752 swmidi - ok 07:42:11.0359 3752 SwPrv - ok 07:42:11.0359 3752 symc810 - ok 07:42:11.0359 3752 symc8xx - ok 07:42:11.0375 3752 sym_hi - ok 07:42:11.0375 3752 sym_u3 - ok 07:42:11.0390 3752 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys 07:42:11.0406 3752 sysaudio - ok 07:42:11.0421 3752 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe 07:42:11.0421 3752 SysmonLog - ok 07:42:11.0437 3752 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll 07:42:11.0453 3752 TapiSrv - ok 07:42:11.0484 3752 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys 07:42:11.0515 3752 Tcpip - ok 07:42:11.0531 3752 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys 07:42:11.0546 3752 TDPIPE - ok 07:42:11.0562 3752 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys 07:42:11.0578 3752 TDTCP - ok 07:42:11.0593 3752 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys 07:42:11.0609 3752 TermDD - ok 07:42:11.0640 3752 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll 07:42:11.0656 3752 TermService - ok 07:42:11.0671 3752 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll 07:42:11.0671 3752 Themes - ok 07:42:11.0687 3752 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe 07:42:11.0687 3752 TlntSvr - ok 07:42:11.0718 3752 [ FBB4A664450EB3905527C01B7F91D5C9 ] tmactmon C:\WINDOWS\system32\drivers\tmactmon.sys 07:42:11.0734 3752 tmactmon - ok 07:42:11.0796 3752 [ F9964675C072664ADA62126492DB5AC8 ] TMBMServer C:\Program Files\Trend Micro\BM\TMBMSRV.exe 07:42:11.0812 3752 TMBMServer - ok 07:42:11.0875 3752 [ 2FD877742C7F750A8E4B0053AD62CAFE ] tmcomm C:\WINDOWS\system32\drivers\tmcomm.sys 07:42:11.0890 3752 tmcomm - ok 07:42:11.0906 3752 [ B0F6745DA670754E64146A6E64B96B30 ] tmevtmgr C:\WINDOWS\system32\drivers\tmevtmgr.sys 07:42:11.0921 3752 tmevtmgr - ok 07:42:11.0953 3752 [ 717E406972BBC07F8FB2A989416CAB73 ] TmFilter C:\Program Files\Trend Micro\OfficeScan Client\TmXPFlt.sys 07:42:11.0984 3752 TmFilter - ok 07:42:12.0046 3752 [ 0A10C6741C45B3AD40FC603A58461B94 ] tmlisten C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe 07:42:12.0078 3752 tmlisten - ok 07:42:12.0078 3752 [ 379C4F99994A56B66E11D1E32BB22A1C ] TmPreFilter C:\Program Files\Trend Micro\OfficeScan Client\TmPreFlt.sys 07:42:12.0093 3752 TmPreFilter - ok 07:42:12.0156 3752 [ 12FE3DB7B9822BFEE3AF1016A535F2D8 ] TmProxy C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe 07:42:12.0171 3752 TmProxy - ok 07:42:12.0218 3752 [ 5F7F63884A8547981EE379B8C0FB3312 ] tmtdi C:\WINDOWS\system32\DRIVERS\tmtdi.sys 07:42:12.0234 3752 tmtdi - ok 07:42:12.0234 3752 TosIde - ok 07:42:12.0312 3752 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll 07:42:12.0312 3752 TrkWks - ok 07:42:12.0343 3752 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys 07:42:12.0343 3752 Udfs - ok 07:42:12.0359 3752 ultra - ok 07:42:12.0375 3752 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys 07:42:12.0406 3752 Update - ok 07:42:12.0421 3752 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll 07:42:12.0437 3752 upnphost - ok 07:42:12.0453 3752 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe 07:42:12.0453 3752 UPS - ok 07:42:12.0468 3752 [ E8C1B9EBAC65288E1B51E8A987D98AF6 ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys 07:42:12.0484 3752 USBAAPL - ok 07:42:12.0515 3752 [ E919708DB44ED8543A7C017953148330 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys 07:42:12.0515 3752 usbaudio - ok 07:42:12.0562 3752 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys 07:42:12.0562 3752 usbccgp - ok 07:42:12.0593 3752 [ 2825E0E294686A26506690059E1F437A ] USBCCID C:\WINDOWS\system32\DRIVERS\usbccid.sys 07:42:12.0609 3752 USBCCID - ok 07:42:12.0640 3752 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys 07:42:12.0656 3752 usbehci - ok 07:42:12.0671 3752 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys 07:42:12.0671 3752 usbhub - ok 07:42:12.0718 3752 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys 07:42:12.0750 3752 usbprint - ok 07:42:12.0781 3752 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 07:42:12.0781 3752 usbscan - ok 07:42:12.0812 3752 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 07:42:12.0812 3752 USBSTOR - ok 07:42:12.0843 3752 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys 07:42:12.0890 3752 usbuhci - ok 07:42:12.0906 3752 [ 63BBFCA7F390F4C49ED4B96BFB1633E0 ] usbvideo C:\WINDOWS\system32\Drivers\usbvideo.sys 07:42:12.0921 3752 usbvideo - ok 07:42:12.0953 3752 [ B6CC50279D6CD28E090A5D33244ADC9A ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys 07:42:12.0984 3752 usb_rndisx - ok 07:42:13.0000 3752 [ 94D73B62E458FB56C9CE60AA96D914F9 ] VClone C:\WINDOWS\system32\DRIVERS\VClone.sys 07:42:13.0015 3752 VClone - ok 07:42:13.0031 3752 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys 07:42:13.0046 3752 VgaSave - ok 07:42:13.0046 3752 ViaIde - ok 07:42:13.0046 3752 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys 07:42:13.0062 3752 VolSnap - ok 07:42:13.0171 3752 [ 642EB152CB980AD9181B2161066BE629 ] VSApiNt C:\Program Files\Trend Micro\OfficeScan Client\VSApiNt.sys 07:42:13.0187 3752 VSApiNt - ok 07:42:13.0265 3752 [ 27B3DD12A19EEC50220DF15B64913DDA ] vsdatant C:\WINDOWS\system32\vsdatant.sys 07:42:13.0296 3752 vsdatant - ok 07:42:13.0312 3752 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe 07:42:13.0312 3752 VSS - ok 07:42:13.0343 3752 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll 07:42:13.0359 3752 W32Time - ok 07:42:13.0375 3752 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys 07:42:13.0390 3752 Wanarp - ok 07:42:13.0437 3752 [ D918617B46457B9AC28027722E30F647 ] Wdf01000 C:\WINDOWS\system32\DRIVERS\Wdf01000.sys 07:42:13.0484 3752 Wdf01000 - ok 07:42:13.0484 3752 WDICA - ok 07:42:13.0515 3752 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys 07:42:13.0531 3752 wdmaud - ok 07:42:13.0531 3752 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll 07:42:13.0546 3752 WebClient - ok 07:42:13.0593 3752 [ 2760C329AC300ED64C3DBA8CDA599CDA ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 07:42:13.0656 3752 winachsf - ok 07:42:13.0734 3752 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll 07:42:13.0750 3752 winmgmt - ok 07:42:13.0750 3752 wltrysvc - ok 07:42:13.0781 3752 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll 07:42:13.0781 3752 WmdmPmSN - ok 07:42:13.0828 3752 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll 07:42:13.0828 3752 Wmi - ok 07:42:13.0828 3752 [ C42584FD66CE9E17403AEBCA199F7BDB ] WmiAcpi C:\WINDOWS\system32\DRIVERS\wmiacpi.sys 07:42:13.0828 3752 WmiAcpi - ok 07:42:13.0843 3752 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe 07:42:13.0843 3752 WmiApSrv - ok 07:42:13.0968 3752 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe 07:42:14.0046 3752 WMPNetworkSvc - ok 07:42:14.0062 3752 [ CF4DEF1BF66F06964DC0D91844239104 ] WpdUsb C:\WINDOWS\system32\DRIVERS\wpdusb.sys 07:42:14.0078 3752 WpdUsb - ok 07:42:14.0312 3752 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe 07:42:14.0328 3752 WPFFontCache_v0400 - ok 07:42:14.0359 3752 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll 07:42:14.0359 3752 wscsvc - ok 07:42:14.0390 3752 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 07:42:14.0406 3752 WSTCODEC - ok 07:42:14.0421 3752 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll 07:42:14.0437 3752 wuauserv - ok 07:42:14.0468 3752 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys 07:42:14.0484 3752 WudfPf - ok 07:42:14.0500 3752 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys 07:42:14.0515 3752 WudfRd - ok 07:42:14.0546 3752 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll 07:42:14.0562 3752 WudfSvc - ok 07:42:14.0593 3752 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll 07:42:14.0609 3752 WZCSVC - ok 07:42:14.0625 3752 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll 07:42:14.0640 3752 xmlprov - ok 07:42:14.0656 3752 ================ Scan global =============================== 07:42:14.0671 3752 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll 07:42:14.0718 3752 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll 07:42:14.0750 3752 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll 07:42:14.0750 3752 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe 07:42:14.0750 3752 [Global] - ok 07:42:14.0765 3752 ================ Scan MBR ================================== 07:42:14.0765 3752 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0 07:42:14.0765 3752 Suspicious mbr (Forged): \Device\Harddisk0\DR0 07:42:14.0812 3752 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected 07:42:14.0812 3752 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0) 07:42:14.0859 3752 \Device\Harddisk0\DR0 ( TDSS File System ) - warning 07:42:14.0859 3752 \Device\Harddisk0\DR0 - detected TDSS File System (1) 07:42:14.0875 3752 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk1\DR2 07:42:17.0250 3752 \Device\Harddisk1\DR2 - ok 07:42:17.0250 3752 ================ Scan VBR ================================== 07:42:17.0250 3752 [ 23083F7D26015A01C4C144AC7F34A728 ] \Device\Harddisk0\DR0\Partition1 07:42:17.0250 3752 \Device\Harddisk0\DR0\Partition1 - ok 07:42:17.0265 3752 [ 462BF56AEB38A97067B76B75CE2FD2B1 ] \Device\Harddisk1\DR2\Partition1 07:42:17.0265 3752 \Device\Harddisk1\DR2\Partition1 - ok 07:42:17.0265 3752 ============================================================ 07:42:17.0265 3752 Scan finished 07:42:17.0265 3752 ============================================================ 07:42:17.0265 3032 Detected object count: 2 07:42:17.0265 3032 Actual detected object count: 2 07:42:32.0390 3032 \Device\Harddisk0\DR0\# - copied to quarantine 07:42:32.0390 3032 \Device\Harddisk0\DR0 - copied to quarantine 07:42:32.0437 3032 \Device\Harddisk0\DR0\TDLFS\ldrm - copied to quarantine 07:42:32.0500 3032 \Device\Harddisk0\DR0\TDLFS\cmd.dll - copied to quarantine 07:42:32.0515 3032 \Device\Harddisk0\DR0\TDLFS\cmd64.dll - copied to quarantine 07:42:32.0562 3032 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine 07:42:32.0625 3032 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine 07:42:32.0640 3032 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine 07:42:32.0656 3032 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine 07:42:32.0671 3032 \Device\Harddisk0\DR0\TDLFS\servers.dat - copied to quarantine 07:42:32.0687 3032 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine 07:42:32.0687 3032 \Device\Harddisk0\DR0\TDLFS\ldr16 - copied to quarantine 07:42:32.0687 3032 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine 07:42:32.0703 3032 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine 07:42:32.0703 3032 \Device\Harddisk0\DR0\TDLFS\s - copied to quarantine 07:42:32.0718 3032 \Device\Harddisk0\DR0\TDLFS\u - copied to quarantine 07:42:32.0734 3032 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine 07:42:32.0750 3032 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - will be cured on reboot 07:42:32.0750 3032 \Device\Harddisk0\DR0 - ok 07:42:32.0750 3032 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Cure 07:42:32.0750 3032 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user 07:42:32.0750 3032 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip 07:42:37.0890 0736 Deinitialize success ESET Scan text: C:\Documents and Settings\BeganBri\Application Data\Sun\Java\Deployment\cache\6.0\12\25cd6b8c-6d03a375 Java/TrojanDownloader.Agent.NAP trojan C:\Documents and Settings\BeganBri\Local Settings\Temp\585.tmp a variant of Win32/Kryptik.AJFE trojan C:\TDSSKiller_Quarantine\04.09.2012_07.41.51\mbr0000\tdlfs0000\tsk0001.dta a variant of Win32/Olmarik.AYI trojan C:\TDSSKiller_Quarantine\04.09.2012_07.41.51\mbr0000\tdlfs0000\tsk0002.dta Win64/Olmarik.AK trojan C:\TDSSKiller_Quarantine\04.09.2012_07.41.51\mbr0000\tdlfs0000\tsk0009.dta a variant of Win32/Olmarik.AYI trojan C:\TDSSKiller_Quarantine\05.09.2012_07.21.01\tdlfs0000\tsk0001.dta a variant of Win32/Olmarik.AYI trojan C:\TDSSKiller_Quarantine\05.09.2012_07.21.01\tdlfs0000\tsk0002.dta Win64/Olmarik.AK trojan C:\TDSSKiller_Quarantine\05.09.2012_07.21.01\tdlfs0000\tsk0009.dta a variant of Win32/Olmarik.AYI trojan