Is there a free anti-virus you would recommend?
I was unable to drag the file into combofix in normal mode as the same dialog pops up "A device attached to this system is not functioning". I needed to do it in safe mode. After it was complete, I restarted and ran TDSSKILLER in normal mode choosing to cure the root kit. For some reason, it produced two logs. One at 8:08pm during the original scan and then at 8:17pm when it rebooted. I will post both just in case.
ComboFix 12-09-10.04 - patricia 09/10/2012 19:45:17.5.2 - x86 NETWORK
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3066.2557 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\patricia\Desktop\CFScript.txt
AV: Norton AntiVirus *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Norton AntiVirus *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\program files\iWonEI\Installr\1.bin\jfEIPlug.dll"
"c:\users\patricia\.frostwire5\updates\frostwire-5.1.4.windows.exe"
"c:\users\patricia\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgailgaldchajpkkmbjdlbimhdnmmgld\arcadewebchrome.dll"
"c:\users\patricia\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\4516a4e2-28f303e8"
"c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8XSTONSD\cat-and-dolphin-playing-together[1].htm"
"c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\98R0W52A\s[1].htm"
"c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUZ01X8F\imp[8].js"
"c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WR65XPID\impCALBMYAY.js"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\iWonEI\Installr\1.bin\jfEIPlug.dll
c:\users\patricia\.frostwire5\updates\frostwire-5.1.4.windows.exe
c:\users\patricia\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgailgaldchajpkkmbjdlbimhdnmmgld\arcadewebchrome.dll
c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8XSTONSD\cat-and-dolphin-playing-together[1].htm
c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\98R0W52A\s[1].htm
c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PUZ01X8F\imp[8].js
c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WR65XPID\impCALBMYAY.js
.
.
((((((((((((((((((((((((( Files Created from 2012-08-10 to 2012-09-10 )))))))))))))))))))))))))))))))
.
.
2012-09-10 23:56 . 2012-09-10 23:57 ——– d—–w- c:\users\patricia\AppData\Local\temp
2012-09-10 23:56 . 2012-09-10 23:56 ——– d—–w- c:\users\Public\AppData\Local\temp
2012-09-10 23:56 . 2012-09-10 23:56 ——– d—–w- c:\users\NeroMediaHomeUser.4\AppData\Local\temp
2012-09-10 23:56 . 2012-09-10 23:56 ——– d—–w- c:\users\NeroMediaHomeUser.4.patricia-PC\AppData\Local\temp
2012-09-10 23:56 . 2012-09-10 23:56 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-09-01 22:53 . 2012-09-01 22:53 ——– d—–w- c:\programdata\Pinnacle Studio
2012-09-01 22:42 . 2012-09-01 22:42 ——– d—–w- c:\program files\Pinnacle
2012-09-01 22:42 . 2012-09-01 22:42 ——– d—–w- c:\programdata\Studio 12
2012-09-01 22:37 . 2012-09-01 22:58 ——– d—–w- c:\programdata\Pinnacle
2012-08-29 23:12 . 2012-09-09 20:04 ——– d—–w- c:\users\patricia\AppData\Local\CrashDumps
2012-08-28 21:42 . 2012-08-29 18:40 ——– d—–w- c:\program files\Common Files\Symantec Shared
2012-08-28 21:42 . 2012-08-28 21:42 ——– d—–w- c:\program files\Symantec
2012-08-28 21:42 . 2012-08-28 21:42 141944 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2012-08-28 21:41 . 2012-08-28 21:41 ——– d—–w- c:\windows\system32\drivers\NAV
2012-08-28 21:41 . 2012-08-28 21:41 ——– d—–w- c:\program files\Norton AntiVirus
2012-08-28 21:41 . 2012-08-28 21:41 ——– d—–w- c:\program files\NortonInstaller
2012-08-27 00:28 . 2012-08-27 00:29 ——– d—–w- c:\users\patricia\AppData\Roaming\ooVoo Details
2012-08-27 00:27 . 2012-08-27 00:27 ——– d—–w- c:\users\patricia\AppData\Local\Deals Plugin
2012-08-27 00:27 . 2012-09-07 21:39 ——– d—–w- c:\program files\Deals Plugin
2012-08-27 00:27 . 2012-08-27 00:27 ——– d—–w- c:\program files\ooVoo
2012-08-25 01:50 . 2012-08-25 01:50 ——– d—–w- c:\program files\Common Files\Java
2012-08-25 01:50 . 2012-08-25 01:49 93672 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-08-25 00:46 . 2012-08-25 00:45 477168 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-08-20 19:51 . 2009-05-18 17:17 26600 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2012-08-20 19:51 . 2008-04-17 16:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2012-08-20 19:49 . 2012-08-20 19:49 ——– d—–w- c:\program files\iPod
2012-08-20 19:49 . 2012-08-20 19:51 ——– d—–w- c:\program files\iTunes
2012-08-20 19:48 . 2012-08-20 19:48 ——– d—–w- c:\program files\Apple Software Update
2012-08-20 19:46 . 2012-08-20 19:46 ——– d—–w- c:\program files\Bonjour
2012-08-20 19:46 . 2012-08-20 19:49 ——– d—–w- c:\program files\Common Files\Apple
2012-08-20 18:37 . 2012-05-11 15:57 623616 —-a-w- c:\windows\system32\localspl.dll
2012-08-20 18:35 . 2012-07-04 14:02 2047488 —-a-w- c:\windows\system32\win32k.sys
2012-08-12 01:19 . 2012-08-12 01:19 ——– d—–w- c:\users\patricia\AppData\Roaming\CANON INC
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-25 01:49 . 2011-05-17 23:09 746984 —-a-w- c:\windows\system32\deployJava1.dll
2012-08-20 19:31 . 2012-05-13 22:10 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-20 19:31 . 2011-07-30 23:06 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-03 17:46 . 2009-09-08 01:59 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-06-25 20:04 . 2012-06-25 20:04 1394248 —-a-w- c:\windows\system32\msxml4.dll
2012-07-19 22:47 . 2011-05-06 18:34 136672 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-04-14 18:01 . 2010-08-01 23:53 24376 —-a-w- c:\program files\mozilla firefox\components\Scriptff.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\patricia\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\patricia\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- c:\users\patricia\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Nero MediaHome 4"="c:\program files\Nero\Nero MediaHome 4\NeroMediaHome.exe" [2009-03-05 4695336]
"BitTorrent"="c:\program files\BitTorrent\BitTorrent.exe" [2012-06-04 6380440]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"AOL Fast Start"="c:\program files\AOL Desktop 9.7\AOL.EXE" [2011-12-14 42320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-04-27 233472]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-12-22 3810304]
"Dell DataSafe Online"="c:\program files\Dell DataSafe Online\DataSafeOnline.exe" [2009-11-13 1807600]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-06-03 206064]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-12-19 76304]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-03-30 483428]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-07-31 38872]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
.
c:\users\patricia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote Table Of Contents.onetoc2 [2009-8-12 3656]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-7-14 809488]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2008-7-31 1616976]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-2-27 1316192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2009-06-30 15:58 10536 —-a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\SPYWAR~1\sp_rsdel.exe \??\c:\progra~2\SPYWAR~1\sp_rsdel.dat
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Users^patricia^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\patricia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-11 19:00 919008 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-07-31 11:20 38872 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
2011-12-14 20:51 42320 —-a-w- c:\program files\AOL Desktop 9.7\aol.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
2012-06-04 00:59 6380440 —-a-w- c:\program files\BitTorrent\BitTorrent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Webcam Central]
2009-01-09 18:49 405639 ——w- c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2010-03-08 07:27 41800 —-a-w- c:\program files\Common Files\aol\1323560415\ee\aolsoftware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2012-06-07 23:33 421776 —-a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2012-03-08 22:50 4280184 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nero MediaHome 4]
2009-03-05 14:12 4695336 —-a-w- c:\program files\Nero\Nero MediaHome 4\NeroMediaHome.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ooVoo.exe]
2012-08-20 20:13 27040888 —-a-w- c:\program files\ooVoo\ooVoo.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
2009-02-05 02:26 128232 ——w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PeerBlock]
2010-11-07 03:24 1866864 —-a-w- c:\program files\PeerBlock\peerblock.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-02-14 02:31 61440 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25 202240 —-a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
2010-11-11 17:55 159472 —-a-w- c:\program files\Zune\ZuneLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=""
"FirewallOverride"=""
.
R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - ECACHE
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-13 19:31]
.
2012-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-25 00:12]
.
2012-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-25 00:12]
.
2011-07-25 c:\windows\Tasks\User_Feed_Synchronization-{3665EB40-7FE9-4CC9-A94B-EAE9FD7003FC}.job
- c:\windows\system32\msfeedssync.exe [2011-07-16 20:16]
.
.
——- Supplementary Scan ——-
.
mStart Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid=NAV&pvid=19.7.1.5
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\patricia\AppData\Roaming\Mozilla\Firefox\Profiles\88udgmg2.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-RunOnce- - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2012-09-10 19:57
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NAV]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\19.8.0.14\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\19.8.0.14\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCD5SRVC{3F6A8B78-EC003E00-05040104}]
"ImagePath"="\??\c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'Explorer.exe'(1472)
c:\users\patricia\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
Completion time: 2012-09-10 20:00:01
ComboFix-quarantined-files.txt 2012-09-10 23:59
ComboFix2.txt 2012-09-09 19:59
ComboFix3.txt 2010-10-24 20:36
.
Pre-Run: 106,382,635,008 bytes free
Post-Run: 106,382,192,640 bytes free
.
- - End Of File - - DE331443BF208DE1C88227AF9ADB874F
20:06:15.0664 4876 TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
20:06:16.0604 4876 ============================================================
20:06:16.0604 4876 Current date / time: 2012/09/10 20:06:16.0604
20:06:16.0604 4876 SystemInfo:
20:06:16.0604 4876
20:06:16.0605 4876 OS Version: 6.0.6002 ServicePack: 2.0
20:06:16.0605 4876 Product type: Workstation
20:06:16.0605 4876 ComputerName: PATRICIA-PC
20:06:16.0605 4876 UserName: patricia
20:06:16.0605 4876 Windows directory: C:\Windows
20:06:16.0605 4876 System windows directory: C:\Windows
20:06:16.0605 4876 Processor architecture: Intel x86
20:06:16.0605 4876 Number of processors: 2
20:06:16.0605 4876 Page size: 0x1000
20:06:16.0605 4876 Boot type: Normal boot
20:06:16.0605 4876 ============================================================
20:06:28.0893 4876 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
20:06:28.0896 4876 ============================================================
20:06:28.0896 4876 \Device\Harddisk0\DR0:
20:06:28.0897 4876 MBR partitions:
20:06:28.0897 4876 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x27800, BlocksNum 0x1E00000
20:06:28.0897 4876 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1E27800, BlocksNum 0x1B39D800
20:06:28.0897 4876 ============================================================
20:06:29.0119 4876 C: <-> \Device\Harddisk0\DR0\Partition2
20:06:29.0228 4876 D: <-> \Device\Harddisk0\DR0\Partition1
20:06:29.0228 4876 ============================================================
20:06:29.0228 4876 Initialize success
20:06:29.0228 4876 ============================================================
20:06:55.0131 5432 ============================================================
20:06:55.0131 5432 Scan started
20:06:55.0131 5432 Mode: Manual;
20:06:55.0131 5432 ============================================================
20:06:59.0902 5432 ================ Scan system memory ========================
20:06:59.0902 5432 System memory - ok
20:06:59.0902 5432 ================ Scan services =============================
20:07:00.0269 5432 [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI C:\Windows\system32\drivers\acpi.sys
20:07:00.0513 5432 ACPI - ok
20:07:00.0841 5432 [ A9D3B95E8466BD58EEB8A1154654E162 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
20:07:00.0868 5432 AdobeFlashPlayerUpdateSvc - ok
20:07:00.0944 5432 [ 04F0FCAC69C7C71A3AC4EB97FAFC8303 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
20:07:00.0954 5432 adp94xx - ok
20:07:00.0975 5432 [ 60505E0041F7751BDBB80F88BF45C2CE ] adpahci C:\Windows\system32\drivers\adpahci.sys
20:07:00.0981 5432 adpahci - ok
20:07:00.0993 5432 [ 8A42779B02AEC986EAB64ECFC98F8BD7 ] adpu160m C:\Windows\system32\drivers\adpu160m.sys
20:07:00.0996 5432 adpu160m - ok
20:07:01.0013 5432 [ 241C9E37F8CE45EF51C3DE27515CA4E5 ] adpu320 C:\Windows\system32\drivers\adpu320.sys
20:07:01.0016 5432 adpu320 - ok
20:07:01.0061 5432 [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
20:07:01.0062 5432 AeLookupSvc - ok
20:07:01.0563 5432 [ 827DBC22C96EECF6D36A13162FABAFD3 ] AESTFilters C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe
20:07:01.0686 5432 AESTFilters - ok
20:07:01.0886 5432 [ 3911B972B55FEA0478476B2E777B29FA ] AFD C:\Windows\system32\drivers\afd.sys
20:07:01.0893 5432 AFD - ok
20:07:01.0954 5432 [ 13F9E33747E6B41A3FF305C37DB0D360 ] agp440 C:\Windows\system32\drivers\agp440.sys
20:07:01.0956 5432 agp440 - ok
20:07:02.0054 5432 [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx C:\Windows\system32\drivers\djsvs.sys
20:07:02.0056 5432 aic78xx - ok
20:07:02.0085 5432 [ A1545B731579895D8CC44FC0481C1192 ] ALG C:\Windows\System32\alg.exe
20:07:02.0087 5432 ALG - ok
20:07:02.0125 5432 [ 9EAEF5FC9B8E351AFA7E78A6FAE91F91 ] aliide C:\Windows\system32\drivers\aliide.sys
20:07:02.0125 5432 aliide - ok
20:07:02.0164 5432 [ C47344BC706E5F0B9DCE369516661578 ] amdagp C:\Windows\system32\drivers\amdagp.sys
20:07:02.0166 5432 amdagp - ok
20:07:02.0173 5432 [ 9B78A39A4C173FDBC1321E0DD659B34C ] amdide C:\Windows\system32\drivers\amdide.sys
20:07:02.0175 5432 amdide - ok
20:07:02.0221 5432 [ 18F29B49AD23ECEE3D2A826C725C8D48 ] AmdK7 C:\Windows\system32\drivers\amdk7.sys
20:07:02.0223 5432 AmdK7 - ok
20:07:02.0253 5432 [ 93AE7F7DD54AB986A6F1A1B37BE7442D ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
20:07:02.0255 5432 AmdK8 - ok
20:07:02.0565 5432 [ 85180CF88C5EBAD73B452A43A004CA51 ] AOL ACS C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
20:07:02.0567 5432 AOL ACS - ok
20:07:02.0607 5432 [ D7723A101C5CB4C0FA979E4DDA732EC0 ] ApfiltrService C:\Windows\system32\DRIVERS\Apfiltr.sys
20:07:02.0609 5432 ApfiltrService - ok
20:07:02.0655 5432 [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo C:\Windows\System32\appinfo.dll
20:07:02.0655 5432 Appinfo - ok
20:07:02.0757 5432 [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
20:07:02.0786 5432 Apple Mobile Device - ok
20:07:02.0873 5432 [ 5D2888182FB46632511ACEE92FDAD522 ] arc C:\Windows\system32\drivers\arc.sys
20:07:02.0876 5432 arc - ok
20:07:02.0907 5432 [ 5E2A321BD7C8B3624E41FDEC3E244945 ] arcsas C:\Windows\system32\drivers\arcsas.sys
20:07:02.0909 5432 arcsas - ok
20:07:02.0924 5432 [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
20:07:02.0925 5432 AsyncMac - ok
20:07:02.0969 5432 [ 1F05B78AB91C9075565A9D8A4B880BC4 ] atapi C:\Windows\system32\drivers\atapi.sys
20:07:02.0969 5432 atapi - ok
20:07:03.0028 5432 [ 02CBD9AF51BE20608C21547582723FC8 ] Ati External Event Utility C:\Windows\system32\Ati2evxx.exe
20:07:03.0052 5432 Ati External Event Utility - ok
20:07:03.0176 5432 [ 7A46CF1F1075EB0340EA40F12D88A862 ] atikmdag C:\Windows\system32\DRIVERS\atikmdag.sys
20:07:03.0274 5432 atikmdag - ok
20:07:03.0384 5432 [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
20:07:03.0389 5432 AudioEndpointBuilder - ok
20:07:03.0429 5432 [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv C:\Windows\System32\Audiosrv.dll
20:07:03.0431 5432 Audiosrv - ok
20:07:03.0470 5432 [ 423C7B87E886AC93D22936EA82665F83 ] BCM42RLY C:\Windows\system32\drivers\BCM42RLY.sys
20:07:03.0471 5432 BCM42RLY - ok
20:07:03.0539 5432 [ 41A70777E892C3DEA606758366566A77 ] BCM43XX C:\Windows\system32\DRIVERS\bcmwl6.sys
20:07:03.0548 5432 BCM43XX - ok
20:07:03.0762 5432 [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep C:\Windows\system32\drivers\Beep.sys
20:07:03.0763 5432 Beep - ok
20:07:03.0817 5432 [ C789AF0F724FDA5852FB9A7D3A432381 ] BFE C:\Windows\System32\bfe.dll
20:07:03.0823 5432 BFE - ok
20:07:05.0237 5432 [ C364F02969E9A842321DD91BCFF749D4 ] BHDrvx86 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.8.0.14\Definitions\BASHDefs\20120905.001\BHDrvx86.sys
20:07:05.0244 5432 BHDrvx86 - ok
20:07:05.0341 5432 [ 93952506C6D67330367F7E7934B6A02F ] BITS C:\Windows\system32\qmgr.dll
20:07:05.0363 5432 BITS - ok
20:07:05.0406 5432 [ D4DF28447741FD3D953526E33A617397 ] blbdrive C:\Windows\system32\drivers\blbdrive.sys
20:07:05.0407 5432 blbdrive - ok
20:07:05.0984 5432 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
20:07:06.0079 5432 Bonjour Service - ok
20:07:06.0274 5432 [ 35F376253F687BDE63976CCB3F2108CA ] bowser C:\Windows\system32\DRIVERS\bowser.sys
20:07:06.0298 5432 bowser - ok
20:07:06.0398 5432 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\drivers\brfiltlo.sys
20:07:06.0400 5432 BrFiltLo - ok
20:07:06.0416 5432 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\drivers\brfiltup.sys
20:07:06.0418 5432 BrFiltUp - ok
20:07:06.0651 5432 [ B1564976D98E91FC764D5DC28A0297DA ] Bridge C:\Windows\system32\DRIVERS\bridge.sys
20:07:06.0712 5432 Bridge - ok
20:07:06.0750 5432 [ B1564976D98E91FC764D5DC28A0297DA ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys
20:07:06.0751 5432 BridgeMP - ok
20:07:06.0814 5432 [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser C:\Windows\System32\browser.dll
20:07:06.0814 5432 Browser - ok
20:07:06.0842 5432 [ B304E75CFF293029EDDF094246747113 ] Brserid C:\Windows\system32\drivers\brserid.sys
20:07:06.0845 5432 Brserid - ok
20:07:06.0860 5432 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\system32\drivers\brserwdm.sys
20:07:06.0862 5432 BrSerWdm - ok
20:07:06.0875 5432 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\system32\drivers\brusbmdm.sys
20:07:06.0876 5432 BrUsbMdm - ok
20:07:06.0895 5432 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\system32\drivers\brusbser.sys
20:07:06.0896 5432 BrUsbSer - ok
20:07:06.0933 5432 [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
20:07:06.0934 5432 BTHMODEM - ok
20:07:07.0109 5432 catchme - ok
20:07:07.0271 5432 [ ACE85AF1C31F68BDFEE9333F6592917E ] ccSet_NAV C:\Windows\system32\drivers\NAV\1308000.00E\ccSetx86.sys
20:07:07.0272 5432 ccSet_NAV - ok
20:07:07.0344 5432 [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
20:07:07.0346 5432 cdfs - ok
20:07:07.0462 5432 [ 6B4BFFB9BECD728097024276430DB314 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
20:07:07.0464 5432 cdrom - ok
20:07:07.0638 5432 [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc C:\Windows\System32\certprop.dll
20:07:07.0639 5432 CertPropSvc - ok
20:07:07.0687 5432 [ E5D4133F37219DBCFE102BC61072589D ] circlass C:\Windows\system32\DRIVERS\circlass.sys
20:07:07.0689 5432 circlass - ok
20:07:08.0185 5432 [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS C:\Windows\system32\CLFS.sys
20:07:08.0190 5432 CLFS - ok
20:07:08.0287 5432 [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:07:08.0290 5432 clr_optimization_v2.0.50727_32 - ok
20:07:08.0592 5432 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:07:08.0704 5432 clr_optimization_v4.0.30319_32 - ok
20:07:08.0742 5432 [ 99AFC3795B58CC478FBBBCDC658FCB56 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
20:07:08.0744 5432 CmBatt - ok
20:07:08.0816 5432 [ 0CA25E686A4928484E9FDABD168AB629 ] cmdide C:\Windows\system32\drivers\cmdide.sys
20:07:08.0818 5432 cmdide - ok
20:07:08.0884 5432 [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
20:07:08.0885 5432 Compbatt - ok
20:07:08.0891 5432 COMSysApp - ok
20:07:09.0113 5432 [ 741E9DFF4F42D2D8477D0FC1DC0DF871 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
20:07:09.0114 5432 crcdisk - ok
20:07:09.0252 5432 [ 1F07BECDCA750766A96CDA811BA86410 ] Crusoe C:\Windows\system32\drivers\crusoe.sys
20:07:09.0268 5432 Crusoe - ok
20:07:09.0360 5432 [ 75C6A297E364014840B48ECCD7525E30 ] CryptSvc C:\Windows\system32\cryptsvc.dll
20:07:09.0362 5432 CryptSvc - ok
20:07:09.0493 5432 [ 281B2B60B5CB449BCF0474EECF73EBEC ] CtClsFlt C:\Windows\system32\DRIVERS\CtClsFlt.sys
20:07:09.0497 5432 CtClsFlt - ok
20:07:09.0642 5432 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch C:\Windows\system32\rpcss.dll
20:07:09.0653 5432 DcomLaunch - ok
20:07:09.0676 5432 [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC C:\Windows\system32\Drivers\dfsc.sys
20:07:09.0678 5432 DfsC - ok
20:07:09.0963 5432 [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR C:\Windows\system32\DFSR.exe
20:07:10.0065 5432 DFSR - ok
20:07:10.0126 5432 [ 9028559C132146FB75EB7ACF384B086A ] Dhcp C:\Windows\System32\dhcpcsvc.dll
20:07:10.0130 5432 Dhcp - ok
20:07:10.0191 5432 [ 5D4AEFC3386920236A548271F8F1AF6A ] disk C:\Windows\system32\drivers\disk.sys
20:07:10.0192 5432 disk - ok
20:07:10.0804 5432 [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache C:\Windows\System32\dnsrslvr.dll
20:07:10.0806 5432 Dnscache - ok
20:07:11.0348 5432 [ 0840ABBBDF438691EE65A20040635CBE ] DockLoginService C:\Program Files\Dell\DellDock\DockLogin.exe
20:07:11.0352 5432 DockLoginService - ok
20:07:11.0436 5432 [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc C:\Windows\System32\dot3svc.dll
20:07:11.0440 5432 dot3svc - ok
20:07:11.0477 5432 [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS C:\Windows\system32\dps.dll
20:07:11.0479 5432 DPS - ok
20:07:11.0528 5432 [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
20:07:11.0529 5432 drmkaud - ok
20:07:11.0575 5432 [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
20:07:11.0581 5432 DXGKrnl - ok
20:07:11.0624 5432 [ 908ED85B7806E8AF3AF5E9B74F7809D4 ] e1express C:\Windows\system32\DRIVERS\e1e6032.sys
20:07:11.0630 5432 e1express - ok
20:07:11.0645 5432 [ 5425F74AC0C1DBD96A1E04F17D63F94C ] E1G60 C:\Windows\system32\DRIVERS\E1G60I32.sys
20:07:11.0648 5432 E1G60 - ok
20:07:11.0675 5432 [ C0B95E40D85CD807D614E264248A45B9 ] EapHost C:\Windows\System32\eapsvc.dll
20:07:11.0676 5432 EapHost - ok
20:07:11.0718 5432 [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache C:\Windows\system32\drivers\ecache.sys
20:07:11.0721 5432 Ecache - ok
20:07:11.0858 5432 [ 85B8B4032A895A746D46A288A9B30DED ] eeCtrl C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
20:07:11.0860 5432 eeCtrl - ok
20:07:12.0014 5432 [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
20:07:12.0020 5432 ehRecvr - ok
20:07:12.0059 5432 [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched C:\Windows\ehome\ehsched.exe
20:07:12.0062 5432 ehSched - ok
20:07:12.0090 5432 [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart C:\Windows\ehome\ehstart.dll
20:07:12.0091 5432 ehstart - ok
20:07:12.0146 5432 [ 23B62471681A124889978F6295B3F4C6 ] elxstor C:\Windows\system32\drivers\elxstor.sys
20:07:12.0154 5432 elxstor - ok
20:07:12.0281 5432 [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt C:\Windows\system32\emdmgmt.dll
20:07:12.0316 5432 EMDMgmt - ok
20:07:12.0547 5432 [ B5A8A04A6E5B4E86B95B1553AA918F5F ] EraserUtilRebootDrv C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
20:07:12.0548 5432 EraserUtilRebootDrv - ok
20:07:12.0707 5432 [ F2A80DE2D1B7116052C09CB4D4CA1416 ] ErrDev C:\Windows\system32\drivers\errdev.sys
20:07:12.0709 5432 ErrDev - ok
20:07:12.0931 5432 [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem C:\Windows\system32\es.dll
20:07:12.0936 5432 EventSystem - ok
20:07:13.0019 5432 [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat C:\Windows\system32\drivers\exfat.sys
20:07:13.0022 5432 exfat - ok
20:07:13.0055 5432 [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat C:\Windows\system32\drivers\fastfat.sys
20:07:13.0059 5432 fastfat - ok
20:07:13.0107 5432 [ AFE1E8B9782A0DD7FB46BBD88E43F89A ] fdc C:\Windows\system32\DRIVERS\fdc.sys
20:07:13.0109 5432 fdc - ok
20:07:13.0128 5432 [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost C:\Windows\system32\fdPHost.dll
20:07:13.0129 5432 fdPHost - ok
20:07:13.0134 5432 [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub C:\Windows\system32\fdrespub.dll
20:07:13.0135 5432 FDResPub - ok
20:07:13.0211 5432 [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
20:07:13.0213 5432 FileInfo - ok
20:07:13.0337 5432 [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace C:\Windows\system32\drivers\filetrace.sys
20:07:13.0339 5432 Filetrace - ok
20:07:13.0358 5432 [ 85B7CF99D532820495D68D747FDA9EBD ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
20:07:13.0359 5432 flpydisk - ok
20:07:13.0407 5432 [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
20:07:13.0411 5432 FltMgr - ok
20:07:13.0548 5432 [ 8CE364388C8ECA59B14B539179276D44 ] FontCache C:\Windows\system32\FntCache.dll
20:07:13.0571 5432 FontCache - ok
20:07:13.0736 5432 [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
20:07:13.0739 5432 FontCache3.0.0.0 - ok
20:07:14.0018 5432 [ B0082808A6856A252F7CDD939892CE50 ] fssfltr C:\Windows\system32\DRIVERS\fssfltr.sys
20:07:14.0020 5432 fssfltr - ok
20:07:14.0361 5432 [ 28DDEEEC44E988657B732CF404D504CB ] fsssvc C:\Program Files\Windows Live\Family Safety\fsssvc.exe
20:07:14.0404 5432 fsssvc - ok
20:07:14.0497 5432 [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
20:07:14.0498 5432 Fs_Rec - ok
20:07:14.0587 5432 [ 34582A6E6573D54A07ECE5FE24A126B5 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
20:07:14.0589 5432 gagp30kx - ok
20:07:14.0763 5432 [ C403C5DB49A0F9AAF4F2128EDC0106D8 ] GamesAppService C:\Program Files\WildTangent Games\App\GamesAppService.exe
20:07:14.0794 5432 GamesAppService - ok
20:07:14.0915 5432 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
20:07:14.0916 5432 GEARAspiWDM - ok
20:07:14.0974 5432 [ D3316F6E3C011435F36E3D6E49B3196C ] GoToAssist C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
20:07:14.0977 5432 GoToAssist - ok
20:07:15.0061 5432 [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc C:\Windows\System32\gpsvc.dll
20:07:15.0083 5432 gpsvc - ok
20:07:16.0384 5432 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe
20:07:16.0391 5432 gupdate - ok
20:07:16.0735 5432 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe
20:07:16.0738 5432 gupdatem - ok
20:07:17.0193 5432 [ 3F90E001369A07243763BD5A523D8722 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
20:07:17.0198 5432 HdAudAddService - ok
20:07:17.0395 5432 [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
20:07:17.0428 5432 HDAudBus - ok
20:07:17.0482 5432 [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth C:\Windows\system32\drivers\hidbth.sys
20:07:17.0484 5432 HidBth - ok
20:07:17.0551 5432 [ D8DF3722D5E961BAA1292AA2F12827E2 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
20:07:17.0791 5432 HidIr - ok
20:07:17.0989 5432 [ 84067081F3318162797385E11A8F0582 ] hidserv C:\Windows\System32\hidserv.dll
20:07:17.0991 5432 hidserv - ok
20:07:18.0109 5432 [ CCA4B519B17E23A00B826C55716809CC ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
20:07:18.0160 5432 HidUsb - ok
20:07:18.0226 5432 [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc C:\Windows\system32\kmsvc.dll
20:07:18.0272 5432 hkmsvc - ok
20:07:18.0346 5432 [ 16EE7B23A009E00D835CDB79574A91A6 ] HpCISSs C:\Windows\system32\drivers\hpcisss.sys
20:07:18.0348 5432 HpCISSs - ok
20:07:18.0476 5432 [ CBD09ED9CF6822177EE85AEA4D8816A2 ] HTCAND32 C:\Windows\system32\Drivers\ANDROIDUSB.sys
20:07:18.0477 5432 HTCAND32 - ok
20:07:18.0576 5432 [ 52395A94C127C0266D1C0F3CCE8A4345 ] htcnprot C:\Windows\system32\DRIVERS\htcnprot.sys
20:07:18.0578 5432 htcnprot - ok
20:07:18.0622 5432 [ F870AA3E254628EBEAFE754108D664DE ] HTTP C:\Windows\system32\drivers\HTTP.sys
20:07:18.0630 5432 HTTP - ok
20:07:18.0657 5432 [ C6B032D69650985468160FC9937CF5B4 ] i2omp C:\Windows\system32\drivers\i2omp.sys
20:07:18.0658 5432 i2omp - ok
20:07:18.0706 5432 [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
20:07:18.0708 5432 i8042prt - ok
20:07:18.0951 5432 [ 54155EA1B0DF185878E0FC9EC3AC3A14 ] iaStorV C:\Windows\system32\drivers\iastorv.sys
20:07:18.0956 5432 iaStorV - ok
20:07:19.0066 5432 [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:07:19.0248 5432 idsvc - ok
20:07:19.0784 5432 [ 404FB2AAF532BC7BBACC8880BE401C74 ] IDSVix86 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.8.0.14\Definitions\IPSDefs\20120907.001\IDSvix86.sys
20:07:19.0787 5432 IDSVix86 - ok
20:07:19.0873 5432 [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp C:\Windows\system32\drivers\iirsp.sys
20:07:19.0911 5432 iirsp - ok
20:07:19.0970 5432 [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT C:\Windows\System32\ikeext.dll
20:07:19.0979 5432 IKEEXT - ok
20:07:20.0133 5432 [ 83AA759F3189E6370C30DE5DC5590718 ] intelide C:\Windows\system32\drivers\intelide.sys
20:07:20.0134 5432 intelide - ok
20:07:20.0156 5432 [ 224191001E78C89DFA78924C3EA595FF ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
20:07:20.0157 5432 intelppm - ok
20:07:20.0188 5432 [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum C:\Windows\system32\ipbusenum.dll
20:07:20.0190 5432 IPBusEnum - ok
20:07:20.0235 5432 [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:07:20.0238 5432 IpFilterDriver - ok
20:07:20.0501 5432 [ 1998BD97F950680BB55F55A7244679C2 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
20:07:20.0505 5432 iphlpsvc - ok
20:07:20.0511 5432 IpInIp - ok
20:07:20.0546 5432 [ B25AAF203552B7B3491139D582B39AD1 ] IPMIDRV C:\Windows\system32\drivers\ipmidrv.sys
20:07:20.0562 5432 IPMIDRV - ok
20:07:20.0587 5432 [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT C:\Windows\system32\DRIVERS\ipnat.sys
20:07:20.0590 5432 IPNAT - ok
20:07:20.0651 5432 [ E6BE7A41A28D8F2DB174957454D32448 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
20:07:20.0684 5432 iPod Service - ok
20:07:20.0710 5432 [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
20:07:20.0711 5432 IRENUM - ok
20:07:20.0738 5432 [ 6C70698A3E5C4376C6AB5C7C17FB0614 ] isapnp C:\Windows\system32\drivers\isapnp.sys
20:07:20.0740 5432 isapnp - ok
20:07:20.0867 5432 [ 232FA340531D940AAC623B121A595034 ] iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys
20:07:20.0869 5432 iScsiPrt - ok
20:07:20.0895 5432 [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi C:\Windows\system32\drivers\iteatapi.sys
20:07:20.0896 5432 iteatapi - ok
20:07:20.0978 5432 [ 20425664E2E196D339CA877E0387C023 ] itecir C:\Windows\system32\DRIVERS\itecir.sys
20:07:20.0979 5432 itecir - ok
20:07:21.0031 5432 [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid C:\Windows\system32\drivers\iteraid.sys
20:07:21.0033 5432 iteraid - ok
20:07:21.0089 5432 [ EE894427AC0B2B2C2C8B32CB78357DAE ] jumi C:\Windows\system32\DRIVERS\jumi.sys
20:07:21.0090 5432 jumi - ok
20:07:21.0130 5432 [ 2FBF424E4E8D5F320D2F69D9A726DE30 ] k57nd60x C:\Windows\system32\DRIVERS\k57nd60x.sys
20:07:21.0136 5432 k57nd60x - ok
20:07:21.0149 5432 [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
20:07:21.0150 5432 kbdclass - ok
20:07:21.0197 5432 [ EDE59EC70E25C24581ADD1FBEC7325F7 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
20:07:21.0198 5432 kbdhid - ok
20:07:21.0232 5432 [ A3E186B4B935905B829219502557314E ] KeyIso C:\Windows\system32\lsass.exe
20:07:21.0234 5432 KeyIso - ok
20:07:21.0348 5432 [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
20:07:21.0357 5432 KSecDD - ok
20:07:21.0392 5432 [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm C:\Windows\system32\msdtckrm.dll
20:07:21.0400 5432 KtmRm - ok
20:07:21.0469 5432 [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer C:\Windows\System32\srvsvc.dll
20:07:21.0471 5432 LanmanServer - ok
20:07:21.0507 5432 [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
20:07:21.0511 5432 LanmanWorkstation - ok
20:07:21.0612 5432 [ 47C12F1A54B5C1B51008D7629C1D4F7B ] LBTServ C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
20:07:21.0615 5432 LBTServ - ok
20:07:21.0664 5432 [ 8B30311241F97B35167AFE68D79E8530 ] LHidFilt C:\Windows\system32\DRIVERS\LHidFilt.Sys
20:07:21.0664 5432 LHidFilt - ok
20:07:21.0757 5432 [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
20:07:21.0781 5432 lltdio - ok
20:07:21.0841 5432 [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc C:\Windows\System32\lltdsvc.dll
20:07:21.0846 5432 lltdsvc - ok
20:07:21.0868 5432 [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts C:\Windows\System32\lmhsvc.dll
20:07:21.0870 5432 lmhosts - ok
20:07:21.0921 5432 [ 48D7422A6C4EEC886B56AC534CFA3ACF ] LMouFilt C:\Windows\system32\DRIVERS\LMouFilt.Sys
20:07:21.0921 5432 LMouFilt - ok
20:07:21.0949 5432 [ C7E15E82879BF3235B559563D4185365 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
20:07:21.0952 5432 LSI_FC - ok
20:07:21.0996 5432 [ EE01EBAE8C9BF0FA072E0FF68718920A ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
20:07:21.0998 5432 LSI_SAS - ok
20:07:22.0018 5432 [ 912A04696E9CA30146A62AFA1463DD5C ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
20:07:22.0021 5432 LSI_SCSI - ok
20:07:22.0040 5432 [ 8F5C7426567798E62A3B3614965D62CC ] luafv C:\Windows\system32\drivers\luafv.sys
20:07:22.0042 5432 luafv - ok
20:07:22.0120 5432 [ 6DFE7F2E8E8A337263AA5C92A215F161 ] MBAMProtector C:\Windows\system32\drivers\mbam.sys
20:07:22.0121 5432 MBAMProtector - ok
20:07:23.0401 5432 [ 43683E970F008C93C9429EF428147A54 ] MBAMService C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
20:07:23.0412 5432 MBAMService - ok
20:07:23.0629 5432 [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
20:07:23.0631 5432 Mcx2Svc - ok
20:07:23.0765 5432 [ 0001CE609D66632FA17B84705F658879 ] megasas C:\Windows\system32\drivers\megasas.sys
20:07:24.0027 5432 megasas - ok
20:07:24.0230 5432 [ C252F32CD9A49DBFC25ECF26EBD51A99 ] MegaSR C:\Windows\system32\drivers\megasr.sys
20:07:24.0319 5432 MegaSR - ok
20:07:24.0467 5432 [ 41FE2F288E05A6C8AB85DD56770FFBAD ] mferkdk C:\Windows\system32\drivers\mferkdk.sys
20:07:24.0469 5432 mferkdk - ok
20:07:24.0528 5432 [ 096B52EA918AA909BA5903D79E129005 ] mfesmfk C:\Windows\system32\drivers\mfesmfk.sys
20:07:24.0529 5432 mfesmfk - ok
20:07:24.0578 5432 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS C:\Windows\system32\mmcss.dll
20:07:24.0580 5432 MMCSS - ok
20:07:24.0593 5432 [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem C:\Windows\system32\drivers\modem.sys
20:07:24.0595 5432 Modem - ok
20:07:24.0648 5432 [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
20:07:24.0649 5432 monitor - ok
20:07:24.0672 5432 [ 5BF6A1326A335C5298477754A506D263 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
20:07:24.0673 5432 mouclass - ok
20:07:24.0684 5432 [ 93B8D4869E12CFBE663915502900876F ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
20:07:24.0685 5432 mouhid - ok
20:07:24.0724 5432 [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr C:\Windows\system32\drivers\mountmgr.sys
20:07:24.0725 5432 MountMgr - ok
20:07:24.0842 5432 [ 46297FA8E30A6007F14118FC2B942FBC ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
20:07:24.0845 5432 MozillaMaintenance - ok
20:07:24.0902 5432 [ 511D011289755DD9F9A7579FB0B064E6 ] mpio C:\Windows\system32\drivers\mpio.sys
20:07:24.0905 5432 mpio - ok
20:07:24.0950 5432 [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
20:07:24.0951 5432 mpsdrv - ok
20:07:25.0003 5432 [ 5DE62C6E9108F14F6794060A9BDECAEC ] MpsSvc C:\Windows\system32\mpssvc.dll
20:07:25.0011 5432 MpsSvc - ok
20:07:25.0027 5432 [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x C:\Windows\system32\drivers\mraid35x.sys
20:07:25.0035 5432 Mraid35x - ok
20:07:25.0082 5432 [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
20:07:25.0084 5432 MRxDAV - ok
20:07:25.0165 5432 [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
20:07:25.0168 5432 mrxsmb - ok
20:07:25.0307 5432 [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:07:25.0586 5432 mrxsmb10 - ok
20:07:25.0606 5432 [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:07:25.0609 5432 mrxsmb20 - ok
20:07:25.0859 5432 [ 5457DCFA7C0DA43522F4D9D4049C1472 ] msahci C:\Windows\system32\drivers\msahci.sys
20:07:25.0860 5432 msahci - ok
20:07:25.0951 5432 [ 4468B0F385A86ECDDAF8D3CA662EC0E7 ] msdsm C:\Windows\system32\drivers\msdsm.sys
20:07:25.0953 5432 msdsm - ok
20:07:26.0054 5432 [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC C:\Windows\System32\msdtc.exe
20:07:26.0082 5432 MSDTC - ok
20:07:26.0124 5432 [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs C:\Windows\system32\drivers\Msfs.sys
20:07:26.0126 5432 Msfs - ok
20:07:26.0196 5432 [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
20:07:26.0196 5432 msisadrv - ok
20:07:26.0401 5432 [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
20:07:26.0406 5432 MSiSCSI - ok
20:07:26.0415 5432 msiserver - ok
20:07:26.0495 5432 [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
20:07:26.0496 5432 MSKSSRV - ok
20:07:26.0524 5432 [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
20:07:26.0525 5432 MSPCLOCK - ok
20:07:26.0581 5432 [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
20:07:26.0582 5432 MSPQM - ok
20:07:26.0607 5432 [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
20:07:26.0610 5432 MsRPC - ok
20:07:26.0644 5432 [ E384487CB84BE41D09711C30CA79646C ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
20:07:26.0645 5432 mssmbios - ok
20:07:26.0663 5432 [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
20:07:26.0664 5432 MSTEE - ok
20:07:26.0701 5432 [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup C:\Windows\system32\Drivers\mup.sys
20:07:26.0703 5432 Mup - ok
20:07:26.0736 5432 [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent C:\Windows\system32\qagentRT.dll
20:07:26.0744 5432 napagent - ok
20:07:26.0839 5432 [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
20:07:26.0843 5432 NativeWifiP - ok
20:07:27.0127 5432 [ F2840DBFE9322F35557219AE82CC4597 ] NAV C:\Program Files\Norton AntiVirus\Engine\19.8.0.14\ccSvcHst.exe
20:07:27.0130 5432 NAV - ok
20:07:27.0551 5432 [ FA0B7D801E71CE79B915BAE5A90DE224 ] NAVENG C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.8.0.14\Definitions\VirusDefs\20120910.002\NAVENG.SYS
20:07:27.0554 5432 NAVENG - ok
20:07:27.0626 5432 [ 80BB71A7D14CF14B54514A201BF5B985 ] NAVEX15 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.8.0.14\Definitions\VirusDefs\20120910.002\NAVEX15.SYS
20:07:27.0670 5432 NAVEX15 - ok
20:07:27.0890 5432 [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS C:\Windows\system32\drivers\ndis.sys
20:07:27.0911 5432 NDIS - ok
20:07:28.0016 5432 [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
20:07:28.0018 5432 NdisTapi - ok
20:07:28.0031 5432 [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
20:07:28.0033 5432 Ndisuio - ok
20:07:28.0055 5432 [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
20:07:28.0058 5432 NdisWan - ok
20:07:28.0108 5432 [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
20:07:28.0110 5432 NDProxy - ok
20:07:28.0213 5432 [ 581EC763915B13B921D9A57E6A9ED941 ] NeroMediaHomeService.4 C:\Program Files\Nero\Nero MediaHome 4\NMMediaServerService.exe
20:07:28.0217 5432 NeroMediaHomeService.4 - ok
20:07:28.0423 5432 [ 29C45722E20572B6440B57E3359E73EE ] Netaapl C:\Windows\system32\DRIVERS\netaapl.sys
20:07:28.0707 5432 Netaapl - ok
20:07:28.0987 5432 [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
20:07:29.0007 5432 NetBIOS - ok
20:07:29.0101 5432 [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt C:\Windows\system32\DRIVERS\netbt.sys
20:07:29.0105 5432 netbt - ok
20:07:29.0122 5432 [ A3E186B4B935905B829219502557314E ] Netlogon C:\Windows\system32\lsass.exe
20:07:29.0123 5432 Netlogon - ok
20:07:29.0149 5432 [ C8052711DAECC48B982434C5116CA401 ] Netman C:\Windows\System32\netman.dll
20:07:29.0153 5432 Netman - ok
20:07:29.0206 5432 [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm C:\Windows\System32\netprofm.dll
20:07:29.0211 5432 netprofm - ok
20:07:29.0269 5432 [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:07:29.0360 5432 NetTcpPortSharing - ok
20:07:29.0524 5432 [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
20:07:29.0668 5432 nfrd960 - ok
20:07:29.0742 5432 [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc C:\Windows\System32\nlasvc.dll
20:07:29.0745 5432 NlaSvc - ok
20:07:29.0836 5432 [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs C:\Windows\system32\drivers\Npfs.sys
20:07:29.0837 5432 Npfs - ok
20:07:29.0895 5432 [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi C:\Windows\system32\nsisvc.dll
20:07:29.0896 5432 nsi - ok
20:07:29.0956 5432 [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
20:07:29.0958 5432 nsiproxy - ok
20:07:30.0028 5432 [ 6A4A98CEE84CF9E99564510DDA4BAA47 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
20:07:30.0063 5432 Ntfs - ok
20:07:30.0096 5432 [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi C:\Windows\system32\drivers\ntrigdigi.sys
20:07:30.0098 5432 ntrigdigi - ok
20:07:30.0147 5432 [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null C:\Windows\system32\drivers\Null.sys
20:07:30.0148 5432 Null - ok
20:07:30.0193 5432 [ 2EDF9E7751554B42CBB60116DE727101 ] nvraid C:\Windows\system32\drivers\nvraid.sys
20:07:30.0198 5432 nvraid - ok
20:07:30.0218 5432 [ ABED0C09758D1D97DB0042DBB2688177 ] nvstor C:\Windows\system32\drivers\nvstor.sys
20:07:30.0220 5432 nvstor - ok
20:07:30.0246 5432 [ 18BBDF913916B71BD54575BDB6EEAC0B ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
20:07:30.0249 5432 nv_agp - ok
20:07:30.0278 5432 NwlnkFlt - ok
20:07:30.0285 5432 NwlnkFwd - ok
20:07:30.0368 5432 [ 2CF21D5F8F1B74BB1922135AC2B12DDB ] OA001Ufd C:\Windows\system32\DRIVERS\OA001Ufd.sys
20:07:30.0371 5432 OA001Ufd - ok
20:07:30.0468 5432 [ 4075063D25AF9DA64101769854B83787 ] OA001Vid C:\Windows\system32\DRIVERS\OA001Vid.sys
20:07:30.0474 5432 OA001Vid - ok
20:07:30.0611 5432 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
20:07:30.0620 5432 odserv - ok
20:07:30.0813 5432 [ 6F310E890D46E246E0E261A63D9B36B4 ] ohci1394 C:\Windows\system32\DRIVERS\ohci1394.sys
20:07:30.0814 5432 ohci1394 - ok
20:07:30.0879 5432 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:07:30.0883 5432 ose - ok
20:07:30.0958 5432 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc C:\Windows\system32\p2psvc.dll
20:07:30.0981 5432 p2pimsvc - ok
20:07:30.0995 5432 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc C:\Windows\system32\p2psvc.dll
20:07:31.0000 5432 p2psvc - ok
20:07:31.0055 5432 [ 0FA9B5055484649D63C303FE404E5F4D ] Parport C:\Windows\system32\drivers\parport.sys
20:07:31.0057 5432 Parport - ok
20:07:31.0110 5432 [ B9C2B89F08670E159F7181891E449CD9 ] partmgr C:\Windows\system32\drivers\partmgr.sys
20:07:31.0111 5432 partmgr - ok
20:07:31.0130 5432 [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm C:\Windows\system32\drivers\parvdm.sys
20:07:31.0131 5432 Parvdm - ok
20:07:31.0206 5432 [ A1E779A0CF7A21B42E8FD3E8856D8481 ] PassThru Service C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
20:07:31.0208 5432 PassThru Service - ok
20:07:31.0241 5432 [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc C:\Windows\System32\pcasvc.dll
20:07:31.0243 5432 PcaSvc - ok
20:07:32.0156 5432 [ 42EDE7D217325FF56CB8A9983CD7F73B ] PCD5SRVC{3F6A8B78-EC003E00-05040104} C:\PROGRA~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms
20:07:32.0308 5432 PCD5SRVC{3F6A8B78-EC003E00-05040104} - ok
20:07:32.0456 5432 [ 941DC1D19E7E8620F40BBC206981EFDB ] pci C:\Windows\system32\drivers\pci.sys
20:07:32.0459 5432 pci - ok
20:07:32.0488 5432 [ FC175F5DDAB666D7F4D17449A547626F ] pciide C:\Windows\system32\drivers\pciide.sys
20:07:32.0489 5432 pciide - ok
20:07:32.0663 5432 [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
20:07:32.0667 5432 pcmcia - ok
20:07:32.0731 5432 [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH C:\Windows\system32\drivers\peauth.sys
20:07:32.0753 5432 PEAUTH - ok
20:07:32.0873 5432 [ B1689DF169143F57053F795390C99DB3 ] pla C:\Windows\system32\pla.dll
20:07:33.0474 5432 pla - ok
20:07:33.0507 5432 [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay C:\Windows\system32\umpnpmgr.dll
20:07:33.0511 5432 PlugPlay - ok
20:07:33.0691 5432 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg C:\Windows\system32\p2psvc.dll
20:07:33.0696 5432 PNRPAutoReg - ok
20:07:33.0724 5432 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc C:\Windows\system32\p2psvc.dll
20:07:33.0730 5432 PNRPsvc - ok
20:07:33.0823 5432 [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
20:07:33.0829 5432 PolicyAgent - ok
20:07:33.0903 5432 [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
20:07:33.0905 5432 PptpMiniport - ok
20:07:33.0986 5432 [ 2027293619DD0F047C584CF2E7DF4FFD ] Processor C:\Windows\system32\drivers\processr.sys
20:07:33.0988 5432 Processor - ok
20:07:34.0069 5432 [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc C:\Windows\system32\profsvc.dll
20:07:34.0072 5432 ProfSvc - ok
20:07:34.0090 5432 [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe
20:07:34.0091 5432 ProtectedStorage - ok
20:07:34.0373 5432 [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched C:\Windows\system32\DRIVERS\pacer.sys
20:07:34.0375 5432 PSched - ok
20:07:34.0486 5432 [ E42E3433DBB4CFFE8FDD91EAB29AEA8E ] PxHelp20 C:\Windows\system32\Drivers\PxHelp20.sys
20:07:34.0487 5432 PxHelp20 - ok
20:07:35.0110 5432 [ 0A6DB55AFB7820C99AA1F3A1D270F4F6 ] ql2300 C:\Windows\system32\drivers\ql2300.sys
20:07:35.0292 5432 ql2300 - ok
20:07:35.0376 5432 [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
20:07:35.0426 5432 ql40xx - ok
20:07:35.0456 5432 [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE C:\Windows\system32\qwave.dll
20:07:35.0463 5432 QWAVE - ok
20:07:35.0481 5432 [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
20:07:35.0482 5432 QWAVEdrv - ok
20:07:35.0604 5432 [ 7A46CF1F1075EB0340EA40F12D88A862 ] R300 C:\Windows\system32\DRIVERS\atikmdag.sys
20:07:35.0632 5432 R300 - ok
20:07:35.0679 5432 [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
20:07:35.0680 5432 RasAcd - ok
20:07:35.0746 5432 [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto C:\Windows\System32\rasauto.dll
20:07:35.0750 5432 RasAuto - ok
20:07:35.0880 5432 [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
20:07:35.0882 5432 Rasl2tp - ok
20:07:35.0913 5432 [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan C:\Windows\System32\rasmans.dll
20:07:35.0919 5432 RasMan - ok
20:07:36.0176 5432 [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
20:07:36.0203 5432 RasPppoe - ok
20:07:36.0274 5432 [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
20:07:36.0293 5432 RasSstp - ok
20:07:36.0333 5432 [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
20:07:36.0338 5432 rdbss - ok
20:07:36.0361 5432 [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
20:07:36.0362 5432 RDPCDD - ok
20:07:36.0387 5432 [ FBC0BACD9C3D7F6956853F64A66E252D ] rdpdr C:\Windows\system32\drivers\rdpdr.sys
20:07:36.0636 5432 rdpdr - ok
20:07:36.0709 5432 [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
20:07:36.0711 5432 RDPENCDD - ok
20:07:36.0803 5432 [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
20:07:36.0808 5432 RDPWD - ok
20:07:36.0837 5432 [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess C:\Windows\System32\mprdim.dll
20:07:36.0840 5432 RemoteAccess - ok
20:07:36.0877 5432 [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry C:\Windows\system32\regsvc.dll
20:07:36.0881 5432 RemoteRegistry - ok
20:07:36.0904 5432 [ C2EF513BBE069F0D4EE0938A76F975D3 ] rimmptsk C:\Windows\system32\DRIVERS\rimmptsk.sys
20:07:36.0906 5432 rimmptsk - ok
20:07:36.0974 5432 [ C398BCA91216755B098679A8DA8A2300 ] rimsptsk C:\Windows\system32\DRIVERS\rimsptsk.sys
20:07:36.0975 5432 rimsptsk - ok
20:07:36.0990 5432 [ 2A2554CB24506E0A0508FC395C4A1B42 ] rismxdp C:\Windows\system32\DRIVERS\rixdptsk.sys
20:07:36.0991 5432 rismxdp - ok
20:07:37.0026 5432 [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator C:\Windows\system32\locator.exe
20:07:37.0029 5432 RpcLocator - ok
20:07:37.0067 5432 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs C:\Windows\System32\rpcss.dll
20:07:37.0072 5432 RpcSs - ok
20:07:37.0148 5432 [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
20:07:37.0150 5432 rspndr - ok
20:07:37.0156 5432 [ A3E186B4B935905B829219502557314E ] SamSs C:\Windows\system32\lsass.exe
20:07:37.0157 5432 SamSs - ok
20:07:37.0199 5432 [ 3CE8F073A557E172B330109436984E30 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
20:07:37.0202 5432 sbp2port - ok
20:07:37.0297 5432 [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr C:\Windows\System32\SCardSvr.dll
20:07:37.0300 5432 SCardSvr - ok
20:07:37.0360 5432 [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule C:\Windows\system32\schedsvc.dll
20:07:37.0384 5432 Schedule - ok
20:07:37.0439 5432 [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc C:\Windows\System32\certprop.dll
20:07:37.0440 5432 SCPolicySvc - ok
20:07:37.0481 5432 [ 8F36B54688C31EED4580129040C6A3D3 ] sdbus C:\Windows\system32\DRIVERS\sdbus.sys
20:07:37.0484 5432 sdbus - ok
20:07:37.0510 5432 [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC C:\Windows\System32\SDRSVC.dll
20:07:37.0515 5432 SDRSVC - ok
20:07:37.0628 5432 [ 16A252022535B680046F6E34E136D378 ] SeaPort C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
20:07:37.0633 5432 SeaPort - ok
20:07:37.0666 5432 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys
20:07:37.0667 5432 secdrv - ok
20:07:37.0679 5432 [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon C:\Windows\system32\seclogon.dll
20:07:37.0681 5432 seclogon - ok
20:07:37.0703 5432 [ A9BBAB5759771E523F55563D6CBE140F ] SENS C:\Windows\system32\sens.dll
20:07:37.0706 5432 SENS - ok
20:07:37.0818 5432 [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum C:\Windows\system32\drivers\serenum.sys
20:07:37.0820 5432 Serenum - ok
20:07:37.0880 5432 [ C70D69A918B178D3C3B06339B40C2E1B ] Serial C:\Windows\system32\drivers\serial.sys
20:07:38.0225 5432 Serial - ok
20:07:38.0261 5432 [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse C:\Windows\system32\drivers\sermouse.sys
20:07:38.0262 5432 sermouse - ok
20:07:38.0357 5432 [ D2193326F729B163125610DBF3E17D57 ] SessionEnv C:\Windows\system32\sessenv.dll
20:07:38.0398 5432 SessionEnv - ok
20:07:38.0458 5432 [ 3EFA810BDCA87F6ECC24F9832243FE86 ] sffdisk C:\Windows\system32\DRIVERS\sffdisk.sys
20:07:38.0459 5432 sffdisk - ok
20:07:38.0519 5432 [ E95D451F7EA3E583AEC75F3B3EE42DC5 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
20:07:38.0521 5432 sffp_mmc - ok
20:07:39.0094 5432 [ 9F66A46C55D6F1CCABC79BB7AFCCC545 ] sffp_sd C:\Windows\system32\DRIVERS\sffp_sd.sys
20:07:39.0123 5432 sffp_sd - ok
20:07:39.0258 5432 [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
20:07:39.0259 5432 sfloppy - ok
20:07:39.0792 5432 [ 4EF8FC5158AA1A01DF37FDB3FADDA077 ] SftService C:\Program Files\Dell DataSafe Local Backup\sftservice.EXE
20:07:39.0887 5432 SftService - ok
20:07:39.0926 5432 [ E1499BD0FF76B1B2FBBF1AF339D91165 ] SharedAccess C:\Windows\System32\ipnathlp.dll
20:07:39.0931 5432 SharedAccess - ok
20:07:39.0966 5432 [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
20:07:39.0971 5432 ShellHWDetection - ok
20:07:39.0997 5432 [ 1D76624A09A054F682D746B924E2DBC3 ] sisagp C:\Windows\system32\drivers\sisagp.sys
20:07:39.0999 5432 sisagp - ok
20:07:40.0038 5432 [ 43CB7AA756C7DB280D01DA9B676CFDE2 ] SiSRaid2 C:\Windows\system32\drivers\sisraid2.sys
20:07:40.0039 5432 SiSRaid2 - ok
20:07:40.0060 5432 [ A99C6C8B0BAA970D8AA59DDC50B57F94 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
20:07:40.0063 5432 SiSRaid4 - ok
20:07:40.0224 5432 [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc C:\Windows\system32\SLsvc.exe
20:07:40.0348 5432 slsvc - ok
20:07:40.0422 5432 [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify C:\Windows\system32\SLUINotify.dll
20:07:40.0425 5432 SLUINotify - ok
20:07:40.0454 5432 [ 7B75299A4D201D6A6533603D6914AB04 ] Smb C:\Windows\system32\DRIVERS\smb.sys
20:07:40.0456 5432 Smb - ok
20:07:40.0499 5432 [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
20:07:40.0501 5432 SNMPTRAP - ok
20:07:40.0528 5432 [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr C:\Windows\system32\drivers\spldr.sys
20:07:40.0528 5432 spldr - ok
20:07:40.0711 5432 [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler C:\Windows\System32\spoolsv.exe
20:07:40.0715 5432 Spooler - ok
20:07:40.0858 5432 [ 777115C9CC675BD98127660712D2F784 ] sprtsvc_DellSupportCenter C:\Program Files\Dell Support Center\bin\sprtsvc.exe
20:07:40.0863 5432 sprtsvc_DellSupportCenter - ok
20:07:41.0026 5432 [ 7BB297CADA42903328E92425D9761DA6 ] SRTSP C:\Windows\system32\drivers\NAV\1308000.00E\SRTSP.SYS
20:07:41.0037 5432 SRTSP - ok
20:07:41.0066 5432 [ 475FCF0F28D845BF1C8ABAC27F19003E ] SRTSPX C:\Windows\system32\drivers\NAV\1308000.00E\SRTSPX.SYS
20:07:41.0066 5432 SRTSPX - ok
20:07:41.0141 5432 [ 41987F9FC0E61ADF54F581E15029AD91 ] srv C:\Windows\system32\DRIVERS\srv.sys
20:07:41.0148 5432 srv - ok
20:07:41.0207 5432 [ FF33AFF99564B1AA534F58868CBE41EF ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
20:07:41.0210 5432 srv2 - ok
20:07:41.0243 5432 [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
20:07:41.0246 5432 srvnet - ok
20:07:41.0276 5432 [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
20:07:41.0280 5432 SSDPSRV - ok
20:07:41.0300 5432 [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc C:\Windows\system32\sstpsvc.dll
20:07:41.0302 5432 SstpSvc - ok
20:07:41.0495 5432 [ DDEB942850278D67EDC108D57F774BF8 ] STacSV C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\STacSV.exe
20:07:41.0500 5432 STacSV - ok
20:07:41.0538 5432 [ C4BE9C3AF8AF6F2E4CDD22FCABF77A1B ] STHDA C:\Windows\system32\DRIVERS\stwrt.sys
20:07:41.0547 5432 STHDA - ok
20:07:41.0599 5432 [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc C:\Windows\System32\wiaservc.dll
20:07:41.0608 5432 stisvc - ok
20:07:41.0648 5432 [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
20:07:41.0649 5432 swenum - ok
20:07:41.0719 5432 [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv C:\Windows\System32\swprv.dll
20:07:41.0728 5432 swprv - ok
20:07:41.0811 5432 [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx C:\Windows\system32\drivers\symc8xx.sys
20:07:41.0813 5432 Symc8xx - ok
20:07:41.0919 5432 [ 690FA0E61B90084C4D9A721BD4F3D779 ] SymDS C:\Windows\system32\drivers\NAV\1308000.00E\SYMDS.SYS
20:07:41.0926 5432 SymDS - ok
20:07:41.0992 5432 [ 8F88EDB211B12537D2DC2A6D73D6067C ] SymEFA C:\Windows\system32\drivers\NAV\1308000.00E\SYMEFA.SYS
20:07:42.0015 5432 SymEFA - ok
20:07:42.0068 5432 [ 74E2521E96176A4449570E50BE91954D ] SymEvent C:\Windows\system32\Drivers\SYMEVENT.SYS
20:07:42.0070 5432 SymEvent - ok
20:07:42.0121 5432 [ 2C356CCA706505CF63CBE39D532B9236 ] SymIRON C:\Windows\system32\drivers\NAV\1308000.00E\Ironx86.SYS
20:07:42.0122 5432 SymIRON - ok
20:07:42.0158 5432 [ 40C6E6417C8B7D7FCF82CFBE71525795 ] SYMTDIv C:\Windows\system32\drivers\NAV\1308000.00E\SYMTDIV.SYS
20:07:42.0161 5432 SYMTDIv - ok
20:07:42.0246 5432 [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi C:\Windows\system32\drivers\sym_hi.sys
20:07:42.0248 5432 Sym_hi - ok
20:07:42.0261 5432 [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3 C:\Windows\system32\drivers\sym_u3.sys
20:07:42.0262 5432 Sym_u3 - ok
20:07:42.0300 5432 [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain C:\Windows\system32\sysmain.dll
20:07:42.0311 5432 SysMain - ok
20:07:42.0350 5432 [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll
20:07:42.0352 5432 TabletInputService - ok
20:07:42.0381 5432 [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv C:\Windows\System32\tapisrv.dll
20:07:42.0386 5432 TapiSrv - ok
20:07:42.0405 5432 [ CB05822CD9CC6C688168E113C603DBE7 ] TBS C:\Windows\System32\tbssvc.dll
20:07:42.0409 5432 TBS - ok
20:07:42.0613 5432 [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
20:07:42.0619 5432 Tcpip - ok
20:07:42.0757 5432 [ 27D470DABC77BC60D0A3B0E4DEB6CB91 ] Tcpip6 C:\Windows\system32\DRIVERS\tcpip.sys
20:07:42.0763 5432 Tcpip6 - ok
20:07:42.0822 5432 [ 608C345A255D82A6289C2D468EB41FD7 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
20:07:42.0824 5432 tcpipreg - ok
20:07:42.0864 5432 [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
20:07:42.0866 5432 TDPIPE - ok
20:07:42.0879 5432 [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
20:07:42.0881 5432 TDTCP - ok
20:07:42.0915 5432 [ 76B06EB8A01FC8624D699E7045303E54 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
20:07:42.0918 5432 tdx - ok
20:07:43.0004 5432 [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
20:07:43.0005 5432 TermDD - ok
20:07:43.0027 5432 [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService C:\Windows\System32\termsrv.dll
20:07:43.0037 5432 TermService - ok
20:07:43.0055 5432 [ C7230FBEE14437716701C15BE02C27B8 ] Themes C:\Windows\system32\shsvcs.dll
20:07:43.0058 5432 Themes - ok
20:07:43.0092 5432 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER C:\Windows\system32\mmcss.dll
20:07:43.0094 5432 THREADORDER - ok
20:07:43.0173 5432 [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks C:\Windows\System32\trkwks.dll
20:07:43.0175 5432 TrkWks - ok
20:07:43.0231 5432 [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
20:07:43.0232 5432 TrustedInstaller - ok
20:07:43.0263 5432 [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
20:07:43.0265 5432 tssecsrv - ok
20:07:43.0276 5432 [ CAECC0120AC49E3D2F758B9169872D38 ] tunmp C:\Windows\system32\DRIVERS\tunmp.sys
20:07:43.0277 5432 tunmp - ok
20:07:43.0328 5432 [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
20:07:43.0330 5432 tunnel - ok
20:07:43.0349 5432 [ 7D33C4DB2CE363C8518D2DFCF533941F ] uagp35 C:\Windows\system32\drivers\uagp35.sys
20:07:43.0351 5432 uagp35 - ok
20:07:43.0388 5432 [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
20:07:43.0393 5432 udfs - ok
20:07:43.0453 5432 [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect C:\Windows\system32\UI0Detect.exe
20:07:43.0456 5432 UI0Detect - ok
20:07:43.0489 5432 [ B0ACFDC9E4AF279E9116C03E014B2B27 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
20:07:43.0491 5432 uliagpkx - ok
20:07:43.0519 5432 [ 9224BB254F591DE4CA8D572A5F0D635C ] uliahci C:\Windows\system32\drivers\uliahci.sys
20:07:43.0525 5432 uliahci - ok
20:07:43.0549 5432 [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata C:\Windows\system32\drivers\ulsata.sys
20:07:43.0551 5432 UlSata - ok
20:07:43.0597 5432 [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2 C:\Windows\system32\drivers\ulsata2.sys
20:07:43.0600 5432 ulsata2 - ok
20:07:43.0621 5432 [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
20:07:43.0622 5432 umbus - ok
20:07:43.0659 5432 [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost C:\Windows\System32\upnphost.dll
20:07:43.0665 5432 upnphost - ok
20:07:43.0719 5432 [ EAFE1E00739AFE6C51487A050E772E17 ] USBAAPL C:\Windows\system32\Drivers\usbaapl.sys
20:07:43.0721 5432 USBAAPL - ok
20:07:43.0745 5432 [ 32DB9517628FF0D070682AAB61E688F0 ] usbaudio C:\Windows\system32\drivers\usbaudio.sys
20:07:43.0748 5432 usbaudio - ok
20:07:43.0850 5432 [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
20:07:43.0852 5432 usbccgp - ok
20:07:43.0902 5432 [ E9476E6C486E76BC4898074768FB7131 ] usbcir C:\Windows\system32\drivers\usbcir.sys
20:07:43.0904 5432 usbcir - ok
20:07:43.0940 5432 [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
20:07:43.0941 5432 usbehci - ok
20:07:44.0044 5432 [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
20:07:44.0048 5432 usbhub - ok
20:07:44.0078 5432 [ 38DBC7DD6CC5A72011F187425384388B ] usbohci C:\Windows\system32\drivers\usbohci.sys
20:07:44.0080 5432 usbohci - ok
20:07:44.0144 5432 [ B51E52ACF758BE00EF3A58EA452FE360 ] usbprint C:\Windows\system32\drivers\usbprint.sys
20:07:44.0145 5432 usbprint - ok
20:07:44.0166 5432 [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:07:44.0168 5432 USBSTOR - ok
20:07:44.0229 5432 [ 814D653EFC4D48BE3B04A307ECEFF56F ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
20:07:44.0230 5432 usbuhci - ok
20:07:44.0349 5432 [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms C:\Windows\System32\uxsms.dll
20:07:44.0351 5432 UxSms - ok
20:07:44.0421 5432 [ CD88D1B7776DC17A119049742EC07EB4 ] vds C:\Windows\System32\vds.exe
20:07:44.0434 5432 vds - ok
20:07:44.0607 5432 [ 87B06E1F30B749A114F74622D013F8D4 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
20:07:44.0609 5432 vga - ok
20:07:44.0672 5432 [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave C:\Windows\System32\drivers\vga.sys
20:07:44.0673 5432 VgaSave - ok
20:07:44.0696 5432 [ 5D7159DEF58A800D5781BA3A879627BC ] viaagp C:\Windows\system32\drivers\viaagp.sys
20:07:44.0699 5432 viaagp - ok
20:07:44.0856 5432 [ C4F3A691B5BAD343E6249BD8C2D45DEE ] ViaC7 C:\Windows\system32\drivers\viac7.sys
20:07:44.0857 5432 ViaC7 - ok
20:07:44.0881 5432 [ AADF5587A4063F52C2C3FED7887426FC ] viaide C:\Windows\system32\drivers\viaide.sys
20:07:45.0597 5432 viaide - ok
20:07:45.0799 5432 [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr C:\Windows\system32\drivers\volmgr.sys
20:07:45.0825 5432 volmgr - ok
20:07:46.0143 5432 [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
20:07:46.0229 5432 volmgrx - ok
20:07:46.0285 5432 [ 147281C01FCB1DF9252DE2A10D5E7093 ] volsnap C:\Windows\system32\drivers\volsnap.sys
20:07:46.0289 5432 volsnap - ok
20:07:46.0355 5432 [ 587253E09325E6BF226B299774B728A9 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
20:07:46.0398 5432 vsmraid - ok
20:07:46.0474 5432 [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS C:\Windows\system32\vssvc.exe
20:07:46.0507 5432 VSS - ok
20:07:46.0563 5432 [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time C:\Windows\system32\w32time.dll
20:07:46.0570 5432 W32Time - ok
20:07:46.0614 5432 [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
20:07:46.0616 5432 WacomPen - ok
20:07:46.0636 5432 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp C:\Windows\system32\DRIVERS\wanarp.sys
20:07:46.0638 5432 Wanarp - ok
20:07:46.0646 5432 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
20:07:46.0647 5432 Wanarpv6 - ok
20:07:46.0720 5432 [ 0A716C08CB13C3A8F4F51E882DBF7416 ] wanatw C:\Windows\system32\DRIVERS\wanatw4.sys
20:07:46.0721 5432 wanatw - ok
20:07:47.0006 5432 [ A3CD60FD826381B49F03832590E069AF ] wcncsvc C:\Windows\System32\wcncsvc.dll
20:07:47.0050 5432 wcncsvc - ok
20:07:47.0112 5432 [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
20:07:47.0114 5432 WcsPlugInService - ok
20:07:47.0193 5432 [ 78FE9542363F297B18C027B2D7E7C07F ] Wd C:\Windows\system32\drivers\wd.sys
20:07:47.0195 5432 Wd - ok
20:07:47.0252 5432 [ D6EFAF429FD30C5DF613D220E344CCE7 ] WDC_SAM C:\Windows\system32\DRIVERS\wdcsam.sys
20:07:47.0253 5432 WDC_SAM - ok
20:07:47.0349 5432 [ 9950E3D0F08141C7E89E64456AE7DC73 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
20:07:47.0359 5432 Wdf01000 - ok
20:07:47.0426 5432 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost C:\Windows\system32\wdi.dll
20:07:47.0429 5432 WdiServiceHost - ok
20:07:47.0436 5432 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost C:\Windows\system32\wdi.dll
20:07:47.0439 5432 WdiSystemHost - ok
20:07:47.0484 5432 [ 04C37D8107320312FBAE09926103D5E2 ] WebClient C:\Windows\System32\webclnt.dll
20:07:47.0489 5432 WebClient - ok
20:07:47.0556 5432 [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc C:\Windows\system32\wecsvc.dll
20:07:47.0561 5432 Wecsvc - ok
20:07:47.0588 5432 [ 670FF720071ED741206D69BD995EA453 ] wercplsupport C:\Windows\System32\wercplsupport.dll
20:07:47.0592 5432 wercplsupport - ok
20:07:47.0638 5432 [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc C:\Windows\System32\WerSvc.dll
20:07:47.0641 5432 WerSvc - ok
20:07:48.0051 5432 [ 4575AA12561C5648483403541D0D7F2B ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll
20:07:48.0056 5432 WinDefend - ok
20:07:48.0065 5432 WinHttpAutoProxySvc - ok
20:07:48.0200 5432 [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
20:07:48.0202 5432 Winmgmt - ok
20:07:48.0363 5432 [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM C:\Windows\system32\WsmSvc.dll
20:07:48.0441 5432 WinRM - ok
20:07:48.0508 5432 [ 676F4B665BDD8053EAA53AC1695B8074 ] WinUSB C:\Windows\system32\DRIVERS\WinUSB.sys
20:07:48.0510 5432 WinUSB - ok
20:07:48.0568 5432 [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc C:\Windows\System32\wlansvc.dll
20:07:48.0579 5432 Wlansvc - ok
20:07:48.0726 5432 [ 6067ACEF367E79914AF628FA1E9B5330 ] wlcrasvc C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
20:07:48.0728 5432 wlcrasvc - ok
20:07:48.0952 5432 [ FB01D4AE207B9EFDBABFC55DC95C7E31 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
20:07:49.0008 5432 wlidsvc - ok
20:07:49.0016 5432 wltrysvc - ok
20:07:49.0105 5432 [ 2E7255D172DF0B8283CDFB7B433B864E ] WmiAcpi C:\Windows\system32\DRIVERS\wmiacpi.sys
20:07:49.0106 5432 WmiAcpi - ok
20:07:49.0166 5432 [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
20:07:49.0169 5432 wmiApSrv - ok
20:07:49.0250 5432 [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe
20:07:49.0269 5432 WMPNetworkSvc - ok
20:07:49.0457 5432 [ A3BA4712EBF768EDFBCCEC09FA120B6F ] WMZuneComm C:\Program Files\Zune\WMZuneComm.exe
20:07:49.0464 5432 WMZuneComm - ok
20:07:49.0505 5432 [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc C:\Windows\System32\wpcsvc.dll
20:07:49.0510 5432 WPCSvc - ok
20:07:49.0542 5432 [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
20:07:49.0545 5432 WPDBusEnum - ok
20:07:49.0694 5432 [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb C:\Windows\system32\DRIVERS\wpdusb.sys
20:07:49.0695 5432 WpdUsb - ok
20:07:49.0879 5432 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
20:07:49.0902 5432 WPFFontCache_v0400 - ok
20:07:49.0933 5432 [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
20:07:49.0934 5432 ws2ifsl - ok
20:07:49.0956 5432 [ 1CA6C40261DDC0425987980D0CD2AAAB ] wscsvc C:\Windows\system32\wscsvc.dll
20:07:49.0960 5432 wscsvc - ok
20:07:49.0966 5432 WSearch - ok
20:07:50.0072 5432 [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv C:\Windows\system32\wuaueng.dll
20:07:50.0628 5432 wuauserv - ok
20:07:50.0664 5432 [ 6F9B6C0C93232CFF47D0F72D6DB1D21E ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
20:07:50.0667 5432 WudfPf - ok
20:07:50.0734 5432 [ F91FF1E51FCA30B3C3981DB7D5924252 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
20:07:50.0737 5432 WUDFRd - ok
20:07:50.0827 5432 [ 2C0206FF8D2C75AC027D1096FA2FAFDA ] wudfsvc C:\Windows\System32\WUDFSvc.dll
20:07:50.0829 5432 wudfsvc - ok
20:07:51.0104 5432 [ 5BDCACD5B2B0FB972BC570E70F616ACF ] ZuneNetworkSvc C:\Program Files\Zune\ZuneNss.exe
20:07:52.0335 5432 ZuneNetworkSvc - ok
20:07:52.0418 5432 [ E22E48654A66AA3E24F4646C6BC1756C ] ZuneWlanCfgSvc C:\Program Files\Zune\ZuneWlanCfgSvc.exe
20:07:52.0452 5432 ZuneWlanCfgSvc - ok
20:07:52.0482 5432 ================ Scan global ===============================
20:07:52.0530 5432 [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll
20:07:52.0614 5432 [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
20:07:52.0714 5432 [ D2293B069E4B63DC17B2F08D45E71124 ] C:\Windows\system32\winsrv.dll
20:07:52.0901 5432 [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe
20:07:52.0909 5432 [Global] - ok
20:07:52.0910 5432 ================ Scan MBR ==================================
20:07:52.0952 5432 [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
20:07:52.0953 5432 Suspicious mbr (Forged): \Device\Harddisk0\DR0
20:07:53.0054 5432 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected
20:07:53.0054 5432 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0)
20:07:53.0055 5432 ================ Scan VBR ==================================
20:07:53.0111 5432 [ 1154F12C993D61F95828C235FCF731C1 ] \Device\Harddisk0\DR0\Partition1
20:07:53.0113 5432 \Device\Harddisk0\DR0\Partition1 - ok
20:07:53.0121 5432 [ EEBD3C9D4C98534CA23209E484F444D2 ] \Device\Harddisk0\DR0\Partition2
20:07:53.0123 5432 \Device\Harddisk0\DR0\Partition2 - ok
20:07:53.0124 5432 ============================================================
20:07:53.0124 5432 Scan finished
20:07:53.0124 5432 ============================================================
20:07:53.0144 6020 Detected object count: 1
20:07:53.0144 6020 Actual detected object count: 1
20:08:06.0717 6020 \Device\Harddisk0\DR0\# - copied to quarantine
20:08:06.0720 6020 \Device\Harddisk0\DR0 - copied to quarantine
20:08:06.0830 6020 \Device\Harddisk0\DR0\TDLFS\ldrm - copied to quarantine
20:08:06.0861 6020 \Device\Harddisk0\DR0\TDLFS\cmd.dll - copied to quarantine
20:08:07.0043 6020 \Device\Harddisk0\DR0\TDLFS\cmd64.dll - copied to quarantine
20:08:07.0233 6020 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine
20:08:07.0472 6020 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine
20:08:07.0898 6020 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine
20:08:08.0117 6020 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine
20:08:08.0186 6020 \Device\Harddisk0\DR0\TDLFS\servers.dat - copied to quarantine
20:08:08.0189 6020 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine
20:08:08.0439 6020 \Device\Harddisk0\DR0\TDLFS\ldr16 - copied to quarantine
20:08:08.0488 6020 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine
20:08:08.0716 6020 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine
20:08:08.0805 6020 \Device\Harddisk0\DR0\TDLFS\s - copied to quarantine
20:08:08.0851 6020 \Device\Harddisk0\DR0\TDLFS\u - copied to quarantine
20:08:09.0000 6020 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine
20:08:09.0341 6020 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - will be cured on reboot
20:08:09.0403 6020 \Device\Harddisk0\DR0 - ok
20:08:09.0633 6020 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Cure
20:08:21.0952 3912 Deinitialize success
20:11:23.0659 3896 TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
20:11:23.0987 3896 ============================================================
20:11:23.0987 3896 Current date / time: 2012/09/10 20:11:23.0987
20:11:23.0987 3896 SystemInfo:
20:11:23.0987 3896
20:11:23.0987 3896 OS Version: 6.0.6002 ServicePack: 2.0
20:11:23.0987 3896 Product type: Workstation
20:11:23.0987 3896 ComputerName: PATRICIA-PC
20:11:23.0987 3896 UserName: patricia
20:11:23.0987 3896 Windows directory: C:\Windows
20:11:23.0987 3896 System windows directory: C:\Windows
20:11:23.0987 3896 Processor architecture: Intel x86
20:11:23.0987 3896 Number of processors: 2
20:11:23.0987 3896 Page size: 0x1000
20:11:23.0987 3896 Boot type: Normal boot
20:11:23.0987 3896 ============================================================
20:11:27.0653 3896 BG loaded
20:11:28.0698 3896 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
20:11:28.0760 3896 ============================================================
20:11:28.0760 3896 \Device\Harddisk0\DR0:
20:11:28.0760 3896 MBR partitions:
20:11:28.0760 3896 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x27800, BlocksNum 0x1E00000
20:11:28.0760 3896 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1E27800, BlocksNum 0x1B39D800
20:11:28.0760 3896 ============================================================
20:11:29.0057 3896 C: <-> \Device\Harddisk0\DR0\Partition2
20:11:29.0400 3896 D: <-> \Device\Harddisk0\DR0\Partition1
20:11:29.0400 3896 ============================================================
20:11:29.0400 3896 Initialize success
20:11:29.0400 3896 ============================================================
20:17:25.0592 3864 Deinitialize success
