Spyware / Malware / Virus Removal

IE8 Redirects to Adverts and Popup Ads during browsing [Solved]

7 min read

Looking for the outcome? Ask AI

Scotty P

Post #16September 22, 2012, 8:01 AM UTC

Here are the logs:

08:41:48.0234 3480 TDSS rootkit removing tool [removed] Sep 17 2012 19:23:24
08:41:48.0328 3480 ============================================================
08:41:48.0328 3480 Current date / time: 2012/09/22 08:41:48.0328
08:41:48.0328 3480 SystemInfo:
08:41:48.0328 3480
08:41:48.0328 3480 OS Version: 5.1.2600 ServicePack: 3.0
08:41:48.0328 3480 Product type: Workstation
08:41:48.0328 3480 ComputerName: RS-02
08:41:48.0328 3480 UserName: RS Parkin Ltd
08:41:48.0328 3480 Windows directory: C:\WINXP
08:41:48.0328 3480 System windows directory: C:\WINXP
08:41:48.0328 3480 Processor architecture: Intel x86
08:41:48.0328 3480 Number of processors: 2
08:41:48.0328 3480 Page size: 0x1000
08:41:48.0328 3480 Boot type: Normal boot
08:41:48.0328 3480 ============================================================
08:41:49.0468 3480 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000058
08:41:49.0468 3480 ============================================================
08:41:49.0468 3480 \Device\Harddisk0\DR0:
08:41:49.0468 3480 MBR partitions:
08:41:49.0468 3480 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xC7FF53F
08:41:49.0484 3480 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xC7FF5BD, BlocksNum 0x109C1103
08:41:49.0484 3480 ============================================================
08:41:49.0531 3480 C: <-> \Device\Harddisk0\DR0\Partition1
08:41:49.0562 3480 E: <-> \Device\Harddisk0\DR0\Partition2
08:41:49.0562 3480 ============================================================
08:41:49.0562 3480 Initialize success
08:41:49.0562 3480 ============================================================
08:42:10.0125 3284 ============================================================
08:42:10.0125 3284 Scan started
08:42:10.0125 3284 Mode: Manual; TDLFS;
08:42:10.0125 3284 ============================================================
08:42:11.0156 3284 ================ Scan system memory ========================
08:42:11.0156 3284 System memory - ok
08:42:11.0156 3284 ================ Scan services =============================
08:42:11.0281 3284 Abiosdsk - ok
08:42:11.0281 3284 abp480n5 - ok
08:42:11.0328 3284 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINXP\system32\DRIVERS\ACPI.sys
08:42:11.0328 3284 ACPI - ok
08:42:11.0359 3284 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINXP\system32\drivers\ACPIEC.sys
08:42:11.0359 3284 ACPIEC - ok
08:42:11.0437 3284 [ E12CFCF1DDBFC50948A75E6E38793225 ] AdobeFlashPlayerUpdateSvc C:\WINXP\system32\Macromed\Flash\FlashPlayerUpdateService.exe
08:42:11.0437 3284 AdobeFlashPlayerUpdateSvc - ok
08:42:11.0437 3284 adpu160m - ok
08:42:11.0468 3284 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINXP\system32\drivers\aec.sys
08:42:11.0468 3284 aec - ok
08:42:11.0515 3284 [ F6B7B1ECD7B41736BDB6FF4B092BCB79 ] AFD C:\WINXP\System32\drivers\afd.sys
08:42:11.0515 3284 AFD - ok
08:42:11.0515 3284 Aha154x - ok
08:42:11.0515 3284 aic78u2 - ok
08:42:11.0515 3284 aic78xx - ok
08:42:11.0546 3284 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINXP\system32\alrsvc.dll
08:42:11.0546 3284 Alerter - ok
08:42:11.0562 3284 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINXP\System32\alg.exe
08:42:11.0562 3284 ALG - ok
08:42:11.0562 3284 AliIde - ok
08:42:11.0562 3284 amsint - ok
08:42:11.0593 3284 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINXP\System32\appmgmts.dll
08:42:11.0593 3284 AppMgmt - ok
08:42:11.0593 3284 asc - ok
08:42:11.0593 3284 asc3350p - ok
08:42:11.0593 3284 asc3550 - ok
08:42:11.0656 3284 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINXP\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
08:42:11.0703 3284 aspnet_state - ok
08:42:11.0718 3284 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINXP\system32\DRIVERS\asyncmac.sys
08:42:11.0718 3284 AsyncMac - ok
08:42:11.0734 3284 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINXP\system32\DRIVERS\atapi.sys
08:42:11.0734 3284 atapi - ok
08:42:11.0734 3284 Atdisk - ok
08:42:11.0750 3284 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINXP\system32\DRIVERS\atmarpc.sys
08:42:11.0750 3284 Atmarpc - ok
08:42:11.0765 3284 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINXP\System32\audiosrv.dll
08:42:11.0765 3284 AudioSrv - ok
08:42:11.0796 3284 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINXP\system32\DRIVERS\audstub.sys
08:42:11.0796 3284 audstub - ok
08:42:11.0828 3284 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINXP\system32\drivers\Beep.sys
08:42:11.0828 3284 Beep - ok
08:42:11.0875 3284 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINXP\system32\qmgr.dll
08:42:11.0890 3284 BITS - ok
08:42:11.0921 3284 [ FC6D1D80588D371F0321E15A75B2F8F2 ] Browser C:\WINXP\System32\browser.dll
08:42:11.0921 3284 Browser - ok
08:42:11.0953 3284 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINXP\system32\drivers\cbidf2k.sys
08:42:11.0953 3284 cbidf2k - ok
08:42:11.0953 3284 cd20xrnt - ok
08:42:11.0953 3284 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINXP\system32\drivers\Cdaudio.sys
08:42:11.0953 3284 Cdaudio - ok
08:42:12.0000 3284 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINXP\system32\drivers\Cdfs.sys
08:42:12.0000 3284 Cdfs - ok
08:42:12.0015 3284 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINXP\system32\DRIVERS\cdrom.sys
08:42:12.0015 3284 Cdrom - ok
08:42:12.0015 3284 Changer - ok
08:42:12.0031 3284 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINXP\system32\cisvc.exe
08:42:12.0031 3284 CiSvc - ok
08:42:12.0031 3284 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINXP\system32\clipsrv.exe
08:42:12.0031 3284 ClipSrv - ok
08:42:12.0046 3284 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINXP\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
08:42:12.0156 3284 clr_optimization_v2.0.50727_32 - ok
08:42:12.0156 3284 CmdIde - ok
08:42:12.0156 3284 COMSysApp - ok
08:42:12.0171 3284 Cpqarray - ok
08:42:12.0203 3284 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINXP\System32\cryptsvc.dll
08:42:12.0203 3284 CryptSvc - ok
08:42:12.0203 3284 dac2w2k - ok
08:42:12.0203 3284 dac960nt - ok
08:42:12.0250 3284 [ 9222562D44021B988B9F9F62207FB6F2 ] DcomLaunch C:\WINXP\system32\rpcss.dll
08:42:12.0250 3284 DcomLaunch - ok
08:42:12.0265 3284 [ 7F19DBA1A467B838CCB23124A2C55568 ] DgiVecp C:\WINXP\system32\Drivers\DgiVecp.sys
08:42:12.0265 3284 DgiVecp - ok
08:42:12.0265 3284 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINXP\System32\dhcpcsvc.dll
08:42:12.0265 3284 Dhcp - ok
08:42:12.0281 3284 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINXP\system32\DRIVERS\disk.sys
08:42:12.0281 3284 Disk - ok
08:42:12.0281 3284 dmadmin - ok
08:42:12.0296 3284 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINXP\system32\drivers\dmboot.sys
08:42:12.0312 3284 dmboot - ok
08:42:12.0328 3284 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINXP\system32\drivers\dmio.sys
08:42:12.0343 3284 dmio - ok
08:42:12.0343 3284 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINXP\system32\drivers\dmload.sys
08:42:12.0359 3284 dmload - ok
08:42:12.0375 3284 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINXP\System32\dmserver.dll
08:42:12.0375 3284 dmserver - ok
08:42:12.0406 3284 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINXP\system32\drivers\DMusic.sys
08:42:12.0406 3284 DMusic - ok
08:42:12.0406 3284 [ D977659AE4D8ECE5286D99D1ED34614D ] Dnscache C:\WINXP\System32\dnsrslvr.dll
08:42:12.0406 3284 Dnscache - ok
08:42:12.0437 3284 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINXP\System32\dot3svc.dll
08:42:12.0437 3284 Dot3svc - ok
08:42:12.0437 3284 dpti2o - ok
08:42:12.0453 3284 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINXP\system32\drivers\drmkaud.sys
08:42:12.0453 3284 drmkaud - ok
08:42:12.0468 3284 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINXP\System32\eapsvc.dll
08:42:12.0468 3284 EapHost - ok
08:42:12.0500 3284 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINXP\System32\ersvc.dll
08:42:12.0500 3284 ERSvc - ok
08:42:12.0531 3284 [ 020CEAAEDC8EB655B6506B8C70D53BB6 ] Eventlog C:\WINXP\system32\services.exe
08:42:12.0531 3284 Eventlog - ok
08:42:12.0531 3284 [ F17F6226BDC0CD5F0BEF0DAF84D29BEC ] EventSystem C:\WINXP\system32\es.dll
08:42:12.0531 3284 EventSystem - ok
08:42:12.0546 3284 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINXP\system32\drivers\Fastfat.sys
08:42:12.0546 3284 Fastfat - ok
08:42:12.0562 3284 [ 888CD7B39C37E13A2419BECFAAF0A28C ] FastUserSwitchingCompatibility C:\WINXP\System32\shsvcs.dll
08:42:12.0562 3284 FastUserSwitchingCompatibility - ok
08:42:12.0562 3284 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINXP\system32\drivers\Fdc.sys
08:42:12.0562 3284 Fdc - ok
08:42:12.0578 3284 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINXP\system32\drivers\Fips.sys
08:42:12.0578 3284 Fips - ok
08:42:12.0640 3284 [ 1F63900E2EB00101B9ACA2B7A870704E ] FLEXnet Licensing Service C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
08:42:12.0656 3284 FLEXnet Licensing Service - ok
08:42:12.0671 3284 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINXP\system32\drivers\Flpydisk.sys
08:42:12.0671 3284 Flpydisk - ok
08:42:12.0687 3284 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINXP\system32\DRIVERS\fltMgr.sys
08:42:12.0687 3284 FltMgr - ok
08:42:12.0718 3284 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINXP\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
08:42:12.0718 3284 FontCache3.0.0.0 - ok
08:42:12.0796 3284 [ 7DFF82ACDAB23414ABC2A95FEF8982F8 ] ForceWare Intelligent Application Manager (IAM) C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
08:42:12.0796 3284 ForceWare Intelligent Application Manager (IAM) - ok
08:42:12.0828 3284 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINXP\system32\drivers\Fs_Rec.sys
08:42:12.0828 3284 Fs_Rec - ok
08:42:12.0843 3284 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINXP\system32\DRIVERS\ftdisk.sys
08:42:12.0843 3284 Ftdisk - ok
08:42:12.0875 3284 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINXP\system32\DRIVERS\msgpc.sys
08:42:12.0875 3284 Gpc - ok
08:42:12.0921 3284 [ D95554949082FD29A04D351B58396718 ] Hardlock C:\WINXP\system32\drivers\hardlock.sys
08:42:12.0937 3284 Hardlock - ok
08:42:12.0968 3284 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINXP\system32\DRIVERS\HDAudBus.sys
08:42:12.0968 3284 HDAudBus - ok
08:42:13.0015 3284 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINXP\PCHealth\HelpCtr\Binaries\pchsvc.dll
08:42:13.0015 3284 helpsvc - ok
08:42:13.0031 3284 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINXP\System32\hidserv.dll
08:42:13.0031 3284 HidServ - ok
08:42:13.0062 3284 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb C:\WINXP\system32\DRIVERS\hidusb.sys
08:42:13.0078 3284 hidusb - ok
08:42:13.0093 3284 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINXP\System32\kmsvc.dll
08:42:13.0093 3284 hkmsvc - ok
08:42:13.0093 3284 hpn - ok
08:42:13.0125 3284 [ CBD09ED9CF6822177EE85AEA4D8816A2 ] HTCAND32 C:\WINXP\system32\Drivers\ANDROIDUSB.sys
08:42:13.0125 3284 HTCAND32 - ok
08:42:13.0140 3284 [ 04E3B3554076B8192A668EFE88A682A1 ] htcnprot C:\WINXP\system32\DRIVERS\htcnprot.sys
08:42:13.0140 3284 htcnprot - ok
08:42:13.0156 3284 [ 937031C085718C1C04A9C0864625EC6B ] HTTP C:\WINXP\system32\Drivers\HTTP.sys
08:42:13.0171 3284 HTTP - ok
08:42:13.0203 3284 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINXP\System32\w3ssl.dll
08:42:13.0203 3284 HTTPFilter - ok
08:42:13.0203 3284 i2omgmt - ok
08:42:13.0203 3284 i2omp - ok
08:42:13.0218 3284 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINXP\system32\DRIVERS\i8042prt.sys
08:42:13.0218 3284 i8042prt - ok
08:42:13.0265 3284 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINXP\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
08:42:13.0281 3284 idsvc - ok
08:42:13.0312 3284 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINXP\system32\DRIVERS\imapi.sys
08:42:13.0312 3284 Imapi - ok
08:42:13.0328 3284 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINXP\system32\imapi.exe
08:42:13.0328 3284 ImapiService - ok
08:42:13.0328 3284 ini910u - ok
08:42:13.0328 3284 IntelIde - ok
08:42:13.0343 3284 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINXP\system32\DRIVERS\Ip6Fw.sys
08:42:13.0343 3284 Ip6Fw - ok
08:42:13.0375 3284 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINXP\system32\DRIVERS\ipfltdrv.sys
08:42:13.0375 3284 IpFilterDriver - ok
08:42:13.0390 3284 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINXP\system32\DRIVERS\ipinip.sys
08:42:13.0390 3284 IpInIp - ok
08:42:13.0406 3284 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINXP\system32\DRIVERS\ipnat.sys
08:42:13.0406 3284 IpNat - ok
08:42:13.0406 3284 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINXP\system32\DRIVERS\ipsec.sys
08:42:13.0406 3284 IPSec - ok
08:42:13.0453 3284 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINXP\system32\DRIVERS\irenum.sys
08:42:13.0453 3284 IRENUM - ok
08:42:13.0468 3284 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINXP\system32\DRIVERS\isapnp.sys
08:42:13.0468 3284 isapnp - ok
08:42:13.0515 3284 [ 0E410EDC8D0527801B899CF29E60597C ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe
08:42:13.0515 3284 JavaQuickStarterService - ok
08:42:13.0546 3284 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINXP\system32\DRIVERS\kbdclass.sys
08:42:13.0546 3284 Kbdclass - ok
08:42:13.0578 3284 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINXP\system32\DRIVERS\kbdhid.sys
08:42:13.0578 3284 kbdhid - ok
08:42:13.0625 3284 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINXP\system32\drivers\kmixer.sys
08:42:13.0625 3284 kmixer - ok
08:42:13.0656 3284 [ C6EBF1D6AD71DF30DB49B8D3287E1368 ] KSecDD C:\WINXP\system32\drivers\KSecDD.sys
08:42:13.0656 3284 KSecDD - ok
08:42:13.0687 3284 [ 3695B8D03745B2F8022B161238347A9D ] LanmanServer C:\WINXP\System32\srvsvc.dll
08:42:13.0687 3284 LanmanServer - ok
08:42:13.0718 3284 [ 3B9324D60DD321BAB7BF6F77931D3FD1 ] lanmanworkstation C:\WINXP\System32\wkssvc.dll
08:42:13.0718 3284 lanmanworkstation - ok
08:42:13.0718 3284 lbrtfdc - ok
08:42:13.0734 3284 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINXP\System32\lmhsvc.dll
08:42:13.0734 3284 LmHosts - ok
08:42:13.0750 3284 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINXP\System32\msgsvc.dll
08:42:13.0750 3284 Messenger - ok
08:42:13.0781 3284 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINXP\system32\drivers\mnmdd.sys
08:42:13.0781 3284 mnmdd - ok
08:42:13.0812 3284 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINXP\system32\mnmsrvc.exe
08:42:13.0812 3284 mnmsrvc - ok
08:42:13.0843 3284 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINXP\system32\drivers\Modem.sys
08:42:13.0843 3284 Modem - ok
08:42:13.0859 3284 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINXP\system32\DRIVERS\mouclass.sys
08:42:13.0859 3284 Mouclass - ok
08:42:13.0859 3284 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINXP\system32\DRIVERS\mouhid.sys
08:42:13.0859 3284 mouhid - ok
08:42:13.0875 3284 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINXP\system32\drivers\MountMgr.sys
08:42:13.0875 3284 MountMgr - ok
08:42:13.0875 3284 mraid35x - ok
08:42:13.0890 3284 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINXP\system32\DRIVERS\mrxdav.sys
08:42:13.0890 3284 MRxDAV - ok
08:42:13.0937 3284 [ FB2FCCC70F7174C7BF64F48E96D3ADF4 ] MRxSmb C:\WINXP\system32\DRIVERS\mrxsmb.sys
08:42:13.0937 3284 MRxSmb - ok
08:42:13.0968 3284 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINXP\system32\msdtc.exe
08:42:13.0968 3284 MSDTC - ok
08:42:13.0968 3284 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINXP\system32\drivers\Msfs.sys
08:42:13.0968 3284 Msfs - ok
08:42:13.0968 3284 MSIServer - ok
08:42:14.0000 3284 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINXP\system32\drivers\MSKSSRV.sys
08:42:14.0000 3284 MSKSSRV - ok
08:42:14.0000 3284 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINXP\system32\drivers\MSPCLOCK.sys
08:42:14.0015 3284 MSPCLOCK - ok
08:42:14.0015 3284 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINXP\system32\drivers\MSPQM.sys
08:42:14.0015 3284 MSPQM - ok
08:42:14.0031 3284 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINXP\system32\DRIVERS\mssmbios.sys
08:42:14.0031 3284 mssmbios - ok
08:42:14.0093 3284 MSSQL$FINAWARE - ok
08:42:14.0109 3284 [ C06EA83F6FC2959E897C117255B6B1D5 ] MSSQLServerADHelper C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe
08:42:14.0109 3284 MSSQLServerADHelper - ok
08:42:14.0140 3284 [ D48659BB24C48345D926ECB45C1EBDF5 ] MTsensor C:\WINXP\system32\DRIVERS\ASACPI.sys
08:42:14.0140 3284 MTsensor - ok
08:42:14.0171 3284 [ F7B1AD991491F02AF6DA70B00B8BF114 ] Mup C:\WINXP\system32\drivers\Mup.sys
08:42:14.0171 3284 Mup - ok
08:42:14.0203 3284 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINXP\System32\qagentrt.dll
08:42:14.0203 3284 napagent - ok
08:42:14.0218 3284 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINXP\system32\drivers\NDIS.sys
08:42:14.0218 3284 NDIS - ok
08:42:14.0265 3284 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINXP\system32\DRIVERS\ndistapi.sys
08:42:14.0265 3284 NdisTapi - ok
08:42:14.0281 3284 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINXP\system32\DRIVERS\ndisuio.sys
08:42:14.0281 3284 Ndisuio - ok
08:42:14.0281 3284 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINXP\system32\DRIVERS\ndiswan.sys
08:42:14.0296 3284 NdisWan - ok
08:42:14.0296 3284 [ 816460BD4B4ACD27937D1D0813E2E9E9 ] NDProxy C:\WINXP\system32\drivers\NDProxy.sys
08:42:14.0296 3284 NDProxy - ok
08:42:14.0296 3284 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINXP\system32\DRIVERS\netbios.sys
08:42:14.0296 3284 NetBIOS - ok
08:42:14.0312 3284 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINXP\system32\DRIVERS\netbt.sys
08:42:14.0312 3284 NetBT - ok
08:42:14.0328 3284 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINXP\system32\netdde.exe
08:42:14.0328 3284 NetDDE - ok
08:42:14.0328 3284 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINXP\system32\netdde.exe
08:42:14.0328 3284 NetDDEdsdm - ok
08:42:14.0343 3284 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINXP\system32\lsass.exe
08:42:14.0343 3284 Netlogon - ok
08:42:14.0359 3284 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINXP\System32\netman.dll
08:42:14.0359 3284 Netman - ok
08:42:14.0390 3284 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINXP\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
08:42:14.0390 3284 NetTcpPortSharing - ok
08:42:14.0406 3284 [ FCEE5FCB99F7C724593365C706D28388 ] Nla C:\WINXP\System32\mswsock.dll
08:42:14.0406 3284 Nla - ok
08:42:14.0421 3284 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINXP\system32\drivers\Npfs.sys
08:42:14.0421 3284 Npfs - ok
08:42:14.0468 3284 [ F8E396F5E703D7A8F37D90F59C776268 ] NSHE C:\WINXP\system32\Drivers\NSHE.SYS
08:42:14.0468 3284 NSHE - ok
08:42:14.0500 3284 [ 198FF60A42802C319FBA58FDB13EEE49 ] nSvcIp C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
08:42:14.0500 3284 nSvcIp - ok
08:42:14.0531 3284 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINXP\system32\drivers\Ntfs.sys
08:42:14.0562 3284 Ntfs - ok
08:42:14.0562 3284 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINXP\system32\lsass.exe
08:42:14.0562 3284 NtLmSsp - ok
08:42:14.0593 3284 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINXP\system32\ntmssvc.dll
08:42:14.0593 3284 NtmsSvc - ok
08:42:14.0625 3284 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINXP\system32\drivers\Null.sys
08:42:14.0625 3284 Null - ok
08:42:14.0781 3284 [ CD9ED87B4FC6EC41D3B5BE0B923843FC ] nv C:\WINXP\system32\DRIVERS\nv4_mini.sys
08:42:14.0906 3284 nv - ok
08:42:14.0921 3284 [ C61927D27B75ED56723F2508F1A6B1BE ] NVENETFD C:\WINXP\system32\DRIVERS\NVENETFD.sys
08:42:14.0921 3284 NVENETFD - ok
08:42:14.0968 3284 [ 52DCE3B30C9D61C8E20FE3C6DA4BDFB7 ] nvgts C:\WINXP\system32\DRIVERS\nvgts.sys
08:42:14.0968 3284 nvgts - ok
08:42:14.0968 3284 [ C529B614EF88BE0F62B886C67B516550 ] nvnetbus C:\WINXP\system32\DRIVERS\nvnetbus.sys
08:42:14.0968 3284 nvnetbus - ok
08:42:14.0984 3284 [ E48C1AA03B6519B51756E3232C093300 ] nvsvc C:\WINXP\system32\nvsvc32.exe
08:42:14.0984 3284 nvsvc - ok
08:42:15.0000 3284 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINXP\system32\DRIVERS\nwlnkflt.sys
08:42:15.0000 3284 NwlnkFlt - ok
08:42:15.0000 3284 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINXP\system32\DRIVERS\nwlnkfwd.sys
08:42:15.0000 3284 NwlnkFwd - ok
08:42:15.0062 3284 [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
08:42:15.0062 3284 ose - ok
08:42:15.0093 3284 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINXP\system32\DRIVERS\parport.sys
08:42:15.0109 3284 Parport - ok
08:42:15.0171 3284 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINXP\system32\drivers\PartMgr.sys
08:42:15.0171 3284 PartMgr - ok
08:42:15.0218 3284 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINXP\system32\drivers\ParVdm.sys
08:42:15.0218 3284 ParVdm - ok
08:42:15.0265 3284 [ A1E779A0CF7A21B42E8FD3E8856D8481 ] PassThru Service C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
08:42:15.0265 3284 PassThru Service - ok
08:42:15.0390 3284 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINXP\system32\DRIVERS\pci.sys
08:42:15.0421 3284 PCI - ok
08:42:15.0421 3284 PCIDump - ok
08:42:15.0453 3284 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINXP\system32\DRIVERS\pciide.sys
08:42:15.0468 3284 PCIIde - ok
08:42:15.0500 3284 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINXP\system32\drivers\Pcmcia.sys
08:42:15.0500 3284 Pcmcia - ok
08:42:15.0500 3284 PDCOMP - ok
08:42:15.0500 3284 PDFRAME - ok
08:42:15.0515 3284 PDRELI - ok
08:42:15.0515 3284 PDRFRAME - ok
08:42:15.0515 3284 perc2 - ok
08:42:15.0515 3284 perc2hib - ok
08:42:15.0562 3284 [ 020CEAAEDC8EB655B6506B8C70D53BB6 ] PlugPlay C:\WINXP\system32\services.exe
08:42:15.0562 3284 PlugPlay - ok
08:42:15.0593 3284 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINXP\system32\lsass.exe
08:42:15.0593 3284 PolicyAgent - ok
08:42:15.0609 3284 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINXP\system32\DRIVERS\raspptp.sys
08:42:15.0609 3284 PptpMiniport - ok
08:42:15.0625 3284 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor C:\WINXP\system32\DRIVERS\processr.sys
08:42:15.0625 3284 Processor - ok
08:42:15.0625 3284 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINXP\system32\lsass.exe
08:42:15.0625 3284 ProtectedStorage - ok
08:42:15.0671 3284 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINXP\system32\DRIVERS\psched.sys
08:42:15.0671 3284 PSched - ok
08:42:15.0718 3284 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINXP\system32\DRIVERS\ptilink.sys
08:42:15.0718 3284 Ptilink - ok
08:42:15.0718 3284 ql1080 - ok
08:42:15.0718 3284 Ql10wnt - ok
08:42:15.0718 3284 ql12160 - ok
08:42:15.0718 3284 ql1240 - ok
08:42:15.0734 3284 ql1280 - ok
08:42:15.0765 3284 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINXP\system32\DRIVERS\rasacd.sys
08:42:15.0765 3284 RasAcd - ok
08:42:15.0796 3284 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINXP\System32\rasauto.dll
08:42:15.0796 3284 RasAuto - ok
08:42:15.0812 3284 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINXP\system32\DRIVERS\rasl2tp.sys
08:42:15.0828 3284 Rasl2tp - ok
08:42:15.0828 3284 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINXP\System32\rasmans.dll
08:42:15.0828 3284 RasMan - ok
08:42:15.0843 3284 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINXP\system32\DRIVERS\raspppoe.sys
08:42:15.0843 3284 RasPppoe - ok
08:42:15.0859 3284 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINXP\system32\DRIVERS\raspti.sys
08:42:15.0859 3284 Raspti - ok
08:42:15.0875 3284 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINXP\system32\DRIVERS\rdbss.sys
08:42:15.0875 3284 Rdbss - ok
08:42:15.0875 3284 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINXP\system32\DRIVERS\RDPCDD.sys
08:42:15.0875 3284 RDPCDD - ok
08:42:15.0906 3284 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINXP\system32\DRIVERS\rdpdr.sys
08:42:15.0906 3284 rdpdr - ok
08:42:15.0953 3284 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINXP\system32\drivers\RDPWD.sys
08:42:15.0953 3284 RDPWD - ok
08:42:15.0984 3284 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINXP\system32\sessmgr.exe
08:42:15.0984 3284 RDSessMgr - ok
08:42:16.0000 3284 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINXP\system32\DRIVERS\redbook.sys
08:42:16.0015 3284 redbook - ok
08:42:16.0031 3284 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINXP\System32\mprdim.dll
08:42:16.0031 3284 RemoteAccess - ok
08:42:16.0062 3284 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINXP\system32\regsvc.dll
08:42:16.0062 3284 RemoteRegistry - ok
08:42:16.0093 3284 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINXP\system32\locator.exe
08:42:16.0093 3284 RpcLocator - ok
08:42:16.0109 3284 [ 9222562D44021B988B9F9F62207FB6F2 ] RpcSs C:\WINXP\system32\rpcss.dll
08:42:16.0125 3284 RpcSs - ok
08:42:16.0140 3284 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINXP\system32\rsvp.exe
08:42:16.0156 3284 RSVP - ok
08:42:16.0171 3284 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINXP\system32\lsass.exe
08:42:16.0171 3284 SamSs - ok
08:42:16.0203 3284 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINXP\System32\SCardSvr.exe
08:42:16.0203 3284 SCardSvr - ok
08:42:16.0234 3284 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINXP\system32\schedsvc.dll
08:42:16.0234 3284 Schedule - ok
08:42:16.0250 3284 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINXP\system32\DRIVERS\secdrv.sys
08:42:16.0250 3284 Secdrv - ok
08:42:16.0265 3284 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINXP\System32\seclogon.dll
08:42:16.0265 3284 seclogon - ok
08:42:16.0281 3284 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINXP\system32\sens.dll
08:42:16.0281 3284 SENS - ok
08:42:16.0281 3284 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINXP\system32\DRIVERS\serenum.sys
08:42:16.0281 3284 serenum - ok
08:42:16.0296 3284 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINXP\system32\DRIVERS\serial.sys
08:42:16.0296 3284 Serial - ok
08:42:16.0312 3284 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINXP\system32\drivers\Sfloppy.sys
08:42:16.0312 3284 Sfloppy - ok
08:42:16.0328 3284 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINXP\System32\ipnathlp.dll
08:42:16.0328 3284 SharedAccess - ok
08:42:16.0343 3284 [ 888CD7B39C37E13A2419BECFAAF0A28C ] ShellHWDetection C:\WINXP\System32\shsvcs.dll
08:42:16.0343 3284 ShellHWDetection - ok
08:42:16.0343 3284 Simbad - ok
08:42:16.0359 3284 Sparrow - ok
08:42:16.0390 3284 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINXP\system32\drivers\splitter.sys
08:42:16.0390 3284 splitter - ok
08:42:16.0390 3284 [ 258DD5D4283FD9F9A7166BE9AE45CE73 ] Spooler C:\WINXP\system32\spoolsv.exe
08:42:16.0406 3284 Spooler - ok
08:42:16.0437 3284 [ B2EC3E1DEAC5F0A764BD3486D213A0AF ] SQLBrowser C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
08:42:16.0437 3284 SQLBrowser - ok
08:42:16.0437 3284 [ D2F4F32B59440011174B4F8137AF4E0C ] SQLWriter C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
08:42:16.0453 3284 SQLWriter - ok
08:42:16.0484 3284 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINXP\system32\DRIVERS\sr.sys
08:42:16.0484 3284 sr - ok
08:42:16.0500 3284 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINXP\system32\srsvc.dll
08:42:16.0500 3284 srservice - ok
08:42:16.0531 3284 [ 9B390283569EA58D43D2586032B892F5 ] Srv C:\WINXP\system32\DRIVERS\srv.sys
08:42:16.0531 3284 Srv - ok
08:42:16.0562 3284 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINXP\System32\ssdpsrv.dll
08:42:16.0578 3284 SSDPSRV - ok
08:42:16.0578 3284 SSPORT - ok
08:42:16.0609 3284 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINXP\system32\wiaservc.dll
08:42:16.0609 3284 stisvc - ok
08:42:16.0656 3284 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINXP\system32\DRIVERS\swenum.sys
08:42:16.0656 3284 swenum - ok
08:42:16.0687 3284 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINXP\system32\drivers\swmidi.sys
08:42:16.0687 3284 swmidi - ok
08:42:16.0687 3284 SwPrv - ok
08:42:16.0687 3284 symc810 - ok
08:42:16.0687 3284 symc8xx - ok
08:42:16.0687 3284 sym_hi - ok
08:42:16.0687 3284 sym_u3 - ok
08:42:16.0734 3284 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINXP\system32\drivers\sysaudio.sys
08:42:16.0734 3284 sysaudio - ok
08:42:16.0750 3284 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINXP\system32\smlogsvc.exe
08:42:16.0765 3284 SysmonLog - ok
08:42:16.0781 3284 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINXP\System32\tapisrv.dll
08:42:16.0781 3284 TapiSrv - ok
08:42:16.0796 3284 [ AD978A1B783B5719720CFF204B666C8E ] Tcpip C:\WINXP\system32\DRIVERS\tcpip.sys
08:42:16.0796 3284 Tcpip - ok
08:42:16.0828 3284 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINXP\system32\drivers\TDPIPE.sys
08:42:16.0828 3284 TDPIPE - ok
08:42:16.0859 3284 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINXP\system32\drivers\TDTCP.sys
08:42:16.0859 3284 TDTCP - ok
08:42:16.0875 3284 [ 88155247177638048422893737429D9E ] TermDD C:\WINXP\system32\DRIVERS\termdd.sys
08:42:16.0875 3284 TermDD - ok
08:42:16.0921 3284 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINXP\System32\termsrv.dll
08:42:16.0921 3284 TermService - ok
08:42:16.0921 3284 [ 888CD7B39C37E13A2419BECFAAF0A28C ] Themes C:\WINXP\System32\shsvcs.dll
08:42:16.0921 3284 Themes - ok
08:42:16.0953 3284 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINXP\system32\tlntsvr.exe
08:42:16.0953 3284 TlntSvr - ok
08:42:16.0968 3284 TosIde - ok
08:42:16.0984 3284 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINXP\system32\trkwks.dll
08:42:16.0984 3284 TrkWks - ok
08:42:17.0046 3284 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINXP\system32\drivers\Udfs.sys
08:42:17.0046 3284 Udfs - ok
08:42:17.0046 3284 ultra - ok
08:42:17.0093 3284 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINXP\system32\DRIVERS\update.sys
08:42:17.0109 3284 Update - ok
08:42:17.0125 3284 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINXP\System32\upnphost.dll
08:42:17.0125 3284 upnphost - ok
08:42:17.0140 3284 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINXP\System32\ups.exe
08:42:17.0140 3284 UPS - ok
08:42:17.0156 3284 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINXP\system32\DRIVERS\usbccgp.sys
08:42:17.0156 3284 usbccgp - ok
08:42:17.0171 3284 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINXP\system32\DRIVERS\usbehci.sys
08:42:17.0171 3284 usbehci - ok
08:42:17.0187 3284 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINXP\system32\DRIVERS\usbhub.sys
08:42:17.0187 3284 usbhub - ok
08:42:17.0203 3284 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINXP\system32\DRIVERS\usbohci.sys
08:42:17.0203 3284 usbohci - ok
08:42:17.0234 3284 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINXP\system32\DRIVERS\usbprint.sys
08:42:17.0234 3284 usbprint - ok
08:42:17.0265 3284 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINXP\system32\DRIVERS\usbscan.sys
08:42:17.0265 3284 usbscan - ok
08:42:17.0281 3284 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINXP\system32\DRIVERS\USBSTOR.SYS
08:42:17.0281 3284 USBSTOR - ok
08:42:17.0312 3284 [ B6CC50279D6CD28E090A5D33244ADC9A ] usb_rndisx C:\WINXP\system32\DRIVERS\usb8023x.sys
08:42:17.0312 3284 usb_rndisx - ok
08:42:17.0328 3284 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINXP\System32\drivers\vga.sys
08:42:17.0343 3284 VgaSave - ok
08:42:17.0390 3284 [ CBC1CE0A1FCE0DEED4F6F093BE91D132 ] VIAHdAudAddService C:\WINXP\system32\drivers\viahduaa.sys
08:42:17.0390 3284 VIAHdAudAddService - ok
08:42:17.0390 3284 ViaIde - ok
08:42:17.0406 3284 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINXP\system32\drivers\VolSnap.sys
08:42:17.0406 3284 VolSnap - ok
08:42:17.0437 3284 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINXP\System32\vssvc.exe
08:42:17.0437 3284 VSS - ok
08:42:17.0453 3284 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINXP\system32\w32time.dll
08:42:17.0468 3284 W32Time - ok
08:42:17.0484 3284 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINXP\system32\DRIVERS\wanarp.sys
08:42:17.0484 3284 Wanarp - ok
08:42:17.0515 3284 [ 4769596D7CC0F5FA447D2BABC239672A ] Wdf01000 C:\WINXP\system32\Drivers\wdf01000.sys
08:42:17.0515 3284 Wdf01000 - ok
08:42:17.0515 3284 WDICA - ok
08:42:17.0531 3284 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINXP\system32\drivers\wdmaud.sys
08:42:17.0531 3284 wdmaud - ok
08:42:17.0562 3284 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINXP\System32\webclnt.dll
08:42:17.0578 3284 WebClient - ok
08:42:17.0640 3284 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINXP\system32\wbem\WMIsvc.dll
08:42:17.0640 3284 winmgmt - ok
08:42:17.0671 3284 [ 051B1BDECD6DEE18C771B5D5EC7F044D ] WmdmPmSN C:\WINXP\system32\MsPMSNSv.dll
08:42:17.0671 3284 WmdmPmSN - ok
08:42:17.0718 3284 [ C8A6C82F90B055149925DC7526B2D78C ] Wmi C:\WINXP\System32\advapi32.dll
08:42:17.0718 3284 Wmi - ok
08:42:17.0750 3284 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINXP\system32\wbem\wmiapsrv.exe
08:42:17.0750 3284 WmiApSrv - ok
08:42:17.0828 3284 [ 6BAB4DC65515A098505F8B3D01FB6FE5 ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
08:42:17.0843 3284 WMPNetworkSvc - ok
08:42:17.0875 3284 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINXP\system32\wscsvc.dll
08:42:17.0875 3284 wscsvc - ok
08:42:17.0906 3284 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINXP\system32\wuauserv.dll
08:42:17.0921 3284 wuauserv - ok
08:42:17.0953 3284 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINXP\system32\DRIVERS\WudfPf.sys
08:42:17.0953 3284 WudfPf - ok
08:42:17.0984 3284 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINXP\system32\DRIVERS\wudfrd.sys
08:42:17.0984 3284 WudfRd - ok
08:42:18.0015 3284 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINXP\System32\WUDFSvc.dll
08:42:18.0015 3284 WudfSvc - ok
08:42:18.0046 3284 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINXP\System32\wzcsvc.dll
08:42:18.0046 3284 WZCSVC - ok
08:42:18.0078 3284 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINXP\System32\xmlprov.dll
08:42:18.0078 3284 xmlprov - ok
08:42:18.0093 3284 ================ Scan global ===============================
08:42:18.0109 3284 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINXP\system32\basesrv.dll
08:42:18.0125 3284 [ B23423313519C522E0E73BA170D3CE71 ] C:\WINXP\system32\winsrv.dll
08:42:18.0140 3284 [ B23423313519C522E0E73BA170D3CE71 ] C:\WINXP\system32\winsrv.dll
08:42:18.0156 3284 [ 020CEAAEDC8EB655B6506B8C70D53BB6 ] C:\WINXP\system32\services.exe
08:42:18.0156 3284 [Global] - ok
08:42:18.0156 3284 ================ Scan MBR ==================================
08:42:18.0171 3284 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
08:42:18.0593 3284 \Device\Harddisk0\DR0 - ok
08:42:18.0593 3284 ================ Scan VBR ==================================
08:42:18.0593 3284 [ E9B8BC9720F096BCE259BAC29FC7E0EA ] \Device\Harddisk0\DR0\Partition1
08:42:18.0593 3284 \Device\Harddisk0\DR0\Partition1 - ok
08:42:18.0609 3284 [ 515CD635F91D50908C2E879F51C549F8 ] \Device\Harddisk0\DR0\Partition2
08:42:18.0609 3284 \Device\Harddisk0\DR0\Partition2 - ok
08:42:18.0609 3284 ============================================================
08:42:18.0609 3284 Scan finished
08:42:18.0609 3284 ============================================================
08:42:18.0609 3276 Detected object count: 0
08:42:18.0609 3276 Actual detected object count: 0
08:42:26.0328 3268 ============================================================
08:42:26.0328 3268 Scan started
08:42:26.0328 3268 Mode: Manual; TDLFS;
08:42:26.0328 3268 ============================================================
08:42:26.0656 3268 ================ Scan system memory ========================
08:42:26.0656 3268 System memory - ok
08:42:26.0656 3268 ================ Scan services =============================
08:42:26.0718 3268 Abiosdsk - ok
08:42:26.0718 3268 abp480n5 - ok
08:42:26.0734 3268 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINXP\system32\DRIVERS\ACPI.sys
08:42:26.0734 3268 ACPI - ok
08:42:26.0781 3268 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINXP\system32\drivers\ACPIEC.sys
08:42:26.0781 3268 ACPIEC - ok
08:42:26.0843 3268 [ E12CFCF1DDBFC50948A75E6E38793225 ] AdobeFlashPlayerUpdateSvc C:\WINXP\system32\Macromed\Flash\FlashPlayerUpdateService.exe
08:42:26.0843 3268 AdobeFlashPlayerUpdateSvc - ok
08:42:26.0843 3268 adpu160m - ok
08:42:26.0875 3268 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINXP\system32\drivers\aec.sys
08:42:26.0875 3268 aec - ok
08:42:26.0921 3268 [ F6B7B1ECD7B41736BDB6FF4B092BCB79 ] AFD C:\WINXP\System32\drivers\afd.sys
08:42:26.0921 3268 AFD - ok
08:42:26.0921 3268 Aha154x - ok
08:42:26.0921 3268 aic78u2 - ok
08:42:26.0921 3268 aic78xx - ok
08:42:26.0953 3268 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINXP\system32\alrsvc.dll
08:42:26.0953 3268 Alerter - ok
08:42:26.0968 3268 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINXP\System32\alg.exe
08:42:26.0968 3268 ALG - ok
08:42:26.0968 3268 AliIde - ok
08:42:26.0984 3268 amsint - ok
08:42:27.0000 3268 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINXP\System32\appmgmts.dll
08:42:27.0000 3268 AppMgmt - ok
08:42:27.0000 3268 asc - ok
08:42:27.0000 3268 asc3350p - ok
08:42:27.0000 3268 asc3550 - ok
08:42:27.0062 3268 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINXP\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
08:42:27.0062 3268 aspnet_state - ok
08:42:27.0093 3268 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINXP\system32\DRIVERS\asyncmac.sys
08:42:27.0093 3268 AsyncMac - ok
08:42:27.0093 3268 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINXP\system32\DRIVERS\atapi.sys
08:42:27.0093 3268 atapi - ok
08:42:27.0109 3268 Atdisk - ok
08:42:27.0109 3268 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINXP\system32\DRIVERS\atmarpc.sys
08:42:27.0109 3268 Atmarpc - ok
08:42:27.0125 3268 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINXP\System32\audiosrv.dll
08:42:27.0125 3268 AudioSrv - ok
08:42:27.0156 3268 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINXP\system32\DRIVERS\audstub.sys
08:42:27.0156 3268 audstub - ok
08:42:27.0203 3268 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINXP\system32\drivers\Beep.sys
08:42:27.0203 3268 Beep - ok
08:42:27.0234 3268 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINXP\system32\qmgr.dll
08:42:27.0250 3268 BITS - ok
08:42:27.0281 3268 [ FC6D1D80588D371F0321E15A75B2F8F2 ] Browser C:\WINXP\System32\browser.dll
08:42:27.0281 3268 Browser - ok
08:42:27.0296 3268 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINXP\system32\drivers\cbidf2k.sys
08:42:27.0296 3268 cbidf2k - ok
08:42:27.0296 3268 cd20xrnt - ok
08:42:27.0296 3268 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINXP\system32\drivers\Cdaudio.sys
08:42:27.0296 3268 Cdaudio - ok
08:42:27.0343 3268 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINXP\system32\drivers\Cdfs.sys
08:42:27.0343 3268 Cdfs - ok
08:42:27.0343 3268 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINXP\system32\DRIVERS\cdrom.sys
08:42:27.0343 3268 Cdrom - ok
08:42:27.0359 3268 Changer - ok
08:42:27.0375 3268 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINXP\system32\cisvc.exe
08:42:27.0375 3268 CiSvc - ok
08:42:27.0375 3268 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINXP\system32\clipsrv.exe
08:42:27.0375 3268 ClipSrv - ok
08:42:27.0390 3268 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINXP\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
08:42:27.0390 3268 clr_optimization_v2.0.50727_32 - ok
08:42:27.0406 3268 CmdIde - ok
08:42:27.0406 3268 COMSysApp - ok
08:42:27.0406 3268 Cpqarray - ok
08:42:27.0437 3268 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINXP\System32\cryptsvc.dll
08:42:27.0437 3268 CryptSvc - ok
08:42:27.0437 3268 dac2w2k - ok
08:42:27.0453 3268 dac960nt - ok
08:42:27.0484 3268 [ 9222562D44021B988B9F9F62207FB6F2 ] DcomLaunch C:\WINXP\system32\rpcss.dll
08:42:27.0484 3268 DcomLaunch - ok
08:42:27.0500 3268 [ 7F19DBA1A467B838CCB23124A2C55568 ] DgiVecp C:\WINXP\system32\Drivers\DgiVecp.sys
08:42:27.0500 3268 DgiVecp - ok
08:42:27.0531 3268 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINXP\System32\dhcpcsvc.dll
08:42:27.0531 3268 Dhcp - ok
08:42:27.0531 3268 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINXP\system32\DRIVERS\disk.sys
08:42:27.0531 3268 Disk - ok
08:42:27.0531 3268 dmadmin - ok
08:42:27.0562 3268 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINXP\system32\drivers\dmboot.sys
08:42:27.0562 3268 dmboot - ok
08:42:27.0562 3268 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINXP\system32\drivers\dmio.sys
08:42:27.0562 3268 dmio - ok
08:42:27.0578 3268 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINXP\system32\drivers\dmload.sys
08:42:27.0578 3268 dmload - ok
08:42:27.0609 3268 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINXP\System32\dmserver.dll
08:42:27.0609 3268 dmserver - ok
08:42:27.0656 3268 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINXP\system32\drivers\DMusic.sys
08:42:27.0656 3268 DMusic - ok
08:42:27.0671 3268 [ D977659AE4D8ECE5286D99D1ED34614D ] Dnscache C:\WINXP\System32\dnsrslvr.dll
08:42:27.0671 3268 Dnscache - ok
08:42:27.0687 3268 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINXP\System32\dot3svc.dll
08:42:27.0687 3268 Dot3svc - ok
08:42:27.0687 3268 dpti2o - ok
08:42:27.0703 3268 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINXP\system32\drivers\drmkaud.sys
08:42:27.0718 3268 drmkaud - ok
08:42:27.0734 3268 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINXP\System32\eapsvc.dll
08:42:27.0734 3268 EapHost - ok
08:42:27.0750 3268 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINXP\System32\ersvc.dll
08:42:27.0750 3268 ERSvc - ok
08:42:27.0781 3268 [ 020CEAAEDC8EB655B6506B8C70D53BB6 ] Eventlog C:\WINXP\system32\services.exe
08:42:27.0781 3268 Eventlog - ok
08:42:27.0796 3268 [ F17F6226BDC0CD5F0BEF0DAF84D29BEC ] EventSystem C:\WINXP\system32\es.dll
08:42:27.0796 3268 EventSystem - ok
08:42:27.0796 3268 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINXP\system32\drivers\Fastfat.sys
08:42:27.0796 3268 Fastfat - ok
08:42:27.0812 3268 [ 888CD7B39C37E13A2419BECFAAF0A28C ] FastUserSwitchingCompatibility C:\WINXP\System32\shsvcs.dll
08:42:27.0812 3268 FastUserSwitchingCompatibility - ok
08:42:27.0828 3268 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINXP\system32\drivers\Fdc.sys
08:42:27.0828 3268 Fdc - ok
08:42:27.0828 3268 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINXP\system32\drivers\Fips.sys
08:42:27.0828 3268 Fips - ok
08:42:27.0890 3268 [ 1F63900E2EB00101B9ACA2B7A870704E ] FLEXnet Licensing Service C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
08:42:27.0890 3268 FLEXnet Licensing Service - ok
08:42:27.0921 3268 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINXP\system32\drivers\Flpydisk.sys
08:42:27.0921 3268 Flpydisk - ok
08:42:27.0953 3268 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINXP\system32\DRIVERS\fltMgr.sys
08:42:27.0953 3268 FltMgr - ok
08:42:27.0984 3268 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINXP\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
08:42:27.0984 3268 FontCache3.0.0.0 - ok
08:42:28.0078 3268 [ 7DFF82ACDAB23414ABC2A95FEF8982F8 ] ForceWare Intelligent Application Manager (IAM) C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
08:42:28.0078 3268 ForceWare Intelligent Application Manager (IAM) - ok
08:42:28.0109 3268 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINXP\system32\drivers\Fs_Rec.sys
08:42:28.0109 3268 Fs_Rec - ok
08:42:28.0125 3268 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINXP\system32\DRIVERS\ftdisk.sys
08:42:28.0125 3268 Ftdisk - ok
08:42:28.0140 3268 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINXP\system32\DRIVERS\msgpc.sys
08:42:28.0140 3268 Gpc - ok
08:42:28.0171 3268 [ D95554949082FD29A04D351B58396718 ] Hardlock C:\WINXP\system32\drivers\hardlock.sys
08:42:28.0171 3268 Hardlock - ok
08:42:28.0218 3268 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINXP\system32\DRIVERS\HDAudBus.sys
08:42:28.0218 3268 HDAudBus - ok
08:42:28.0265 3268 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINXP\PCHealth\HelpCtr\Binaries\pchsvc.dll
08:42:28.0265 3268 helpsvc - ok
08:42:28.0281 3268 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINXP\System32\hidserv.dll
08:42:28.0281 3268 HidServ - ok
08:42:28.0328 3268 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb C:\WINXP\system32\DRIVERS\hidusb.sys
08:42:28.0328 3268 hidusb - ok
08:42:28.0343 3268 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINXP\System32\kmsvc.dll
08:42:28.0343 3268 hkmsvc - ok
08:42:28.0343 3268 hpn - ok
08:42:28.0375 3268 [ CBD09ED9CF6822177EE85AEA4D8816A2 ] HTCAND32 C:\WINXP\system32\Drivers\ANDROIDUSB.sys
08:42:28.0375 3268 HTCAND32 - ok
08:42:28.0390 3268 [ 04E3B3554076B8192A668EFE88A682A1 ] htcnprot C:\WINXP\system32\DRIVERS\htcnprot.sys
08:42:28.0390 3268 htcnprot - ok
08:42:28.0421 3268 [ 937031C085718C1C04A9C0864625EC6B ] HTTP C:\WINXP\system32\Drivers\HTTP.sys
08:42:28.0421 3268 HTTP - ok
08:42:28.0453 3268 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINXP\System32\w3ssl.dll
08:42:28.0453 3268 HTTPFilter - ok
08:42:28.0453 3268 i2omgmt - ok
08:42:28.0468 3268 i2omp - ok
08:42:28.0468 3268 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINXP\system32\DRIVERS\i8042prt.sys
08:42:28.0468 3268 i8042prt - ok
08:42:28.0531 3268 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINXP\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
08:42:28.0531 3268 idsvc - ok
08:42:28.0546 3268 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINXP\system32\DRIVERS\imapi.sys
08:42:28.0546 3268 Imapi - ok
08:42:28.0578 3268 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINXP\system32\imapi.exe
08:42:28.0578 3268 ImapiService - ok
08:42:28.0578 3268 ini910u - ok
08:42:28.0578 3268 IntelIde - ok
08:42:28.0593 3268 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINXP\system32\DRIVERS\Ip6Fw.sys
08:42:28.0593 3268 Ip6Fw - ok
08:42:28.0625 3268 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINXP\system32\DRIVERS\ipfltdrv.sys
08:42:28.0625 3268 IpFilterDriver - ok
08:42:28.0640 3268 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINXP\system32\DRIVERS\ipinip.sys
08:42:28.0640 3268 IpInIp - ok
08:42:28.0656 3268 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINXP\system32\DRIVERS\ipnat.sys
08:42:28.0656 3268 IpNat - ok
08:42:28.0656 3268 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINXP\system32\DRIVERS\ipsec.sys
08:42:28.0656 3268 IPSec - ok
08:42:28.0687 3268 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINXP\system32\DRIVERS\irenum.sys
08:42:28.0687 3268 IRENUM - ok
08:42:28.0703 3268 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINXP\system32\DRIVERS\isapnp.sys
08:42:28.0703 3268 isapnp - ok
08:42:28.0765 3268 [ 0E410EDC8D0527801B899CF29E60597C ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe
08:42:28.0765 3268 JavaQuickStarterService - ok
08:42:28.0796 3268 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINXP\system32\DRIVERS\kbdclass.sys
08:42:28.0796 3268 Kbdclass - ok
08:42:28.0828 3268 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINXP\system32\DRIVERS\kbdhid.sys
08:42:28.0828 3268 kbdhid - ok
08:42:28.0859 3268 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINXP\system32\drivers\kmixer.sys
08:42:28.0859 3268 kmixer - ok
08:42:28.0890 3268 [ C6EBF1D6AD71DF30DB49B8D3287E1368 ] KSecDD C:\WINXP\system32\drivers\KSecDD.sys
08:42:28.0890 3268 KSecDD - ok
08:42:28.0921 3268 [ 3695B8D03745B2F8022B161238347A9D ] LanmanServer C:\WINXP\System32\srvsvc.dll
08:42:28.0921 3268 LanmanServer - ok
08:42:28.0953 3268 [ 3B9324D60DD321BAB7BF6F77931D3FD1 ] lanmanworkstation C:\WINXP\System32\wkssvc.dll
08:42:28.0953 3268 lanmanworkstation - ok
08:42:28.0953 3268 lbrtfdc - ok
08:42:28.0968 3268 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINXP\System32\lmhsvc.dll
08:42:28.0968 3268 LmHosts - ok
08:42:28.0984 3268 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINXP\System32\msgsvc.dll
08:42:28.0984 3268 Messenger - ok
08:42:29.0015 3268 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINXP\system32\drivers\mnmdd.sys
08:42:29.0015 3268 mnmdd - ok
08:42:29.0046 3268 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINXP\system32\mnmsrvc.exe
08:42:29.0046 3268 mnmsrvc - ok
08:42:29.0062 3268 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINXP\system32\drivers\Modem.sys
08:42:29.0062 3268 Modem - ok
08:42:29.0078 3268 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINXP\system32\DRIVERS\mouclass.sys
08:42:29.0078 3268 Mouclass - ok
08:42:29.0093 3268 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINXP\system32\DRIVERS\mouhid.sys
08:42:29.0093 3268 mouhid - ok
08:42:29.0093 3268 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINXP\system32\drivers\MountMgr.sys
08:42:29.0093 3268 MountMgr - ok
08:42:29.0093 3268 mraid35x - ok
08:42:29.0109 3268 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINXP\system32\DRIVERS\mrxdav.sys
08:42:29.0109 3268 MRxDAV - ok
08:42:29.0140 3268 [ FB2FCCC70F7174C7BF64F48E96D3ADF4 ] MRxSmb C:\WINXP\system32\DRIVERS\mrxsmb.sys
08:42:29.0140 3268 MRxSmb - ok
08:42:29.0171 3268 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINXP\system32\msdtc.exe
08:42:29.0171 3268 MSDTC - ok
08:42:29.0171 3268 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINXP\system32\drivers\Msfs.sys
08:42:29.0171 3268 Msfs - ok
08:42:29.0171 3268 MSIServer - ok
08:42:29.0203 3268 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINXP\system32\drivers\MSKSSRV.sys
08:42:29.0203 3268 MSKSSRV - ok
08:42:29.0203 3268 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINXP\system32\drivers\MSPCLOCK.sys
08:42:29.0203 3268 MSPCLOCK - ok
08:42:29.0218 3268 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINXP\system32\drivers\MSPQM.sys
08:42:29.0218 3268 MSPQM - ok
08:42:29.0234 3268 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINXP\system32\DRIVERS\mssmbios.sys
08:42:29.0234 3268 mssmbios - ok
08:42:29.0281 3268 MSSQL$FINAWARE - ok
08:42:29.0312 3268 [ C06EA83F6FC2959E897C117255B6B1D5 ] MSSQLServerADHelper C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe
08:42:29.0312 3268 MSSQLServerADHelper - ok
08:42:29.0328 3268 [ D48659BB24C48345D926ECB45C1EBDF5 ] MTsensor C:\WINXP\system32\DRIVERS\ASACPI.sys
08:42:29.0328 3268 MTsensor - ok
08:42:29.0359 3268 [ F7B1AD991491F02AF6DA70B00B8BF114 ] Mup C:\WINXP\system32\drivers\Mup.sys
08:42:29.0359 3268 Mup - ok
08:42:29.0406 3268 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINXP\System32\qagentrt.dll
08:42:29.0406 3268 napagent - ok
08:42:29.0421 3268 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINXP\system32\drivers\NDIS.sys
08:42:29.0421 3268 NDIS - ok
08:42:29.0468 3268 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINXP\system32\DRIVERS\ndistapi.sys
08:42:29.0468 3268 NdisTapi - ok
08:42:29.0468 3268 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINXP\system32\DRIVERS\ndisuio.sys
08:42:29.0468 3268 Ndisuio - ok
08:42:29.0484 3268 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINXP\system32\DRIVERS\ndiswan.sys
08:42:29.0484 3268 NdisWan - ok
08:42:29.0500 3268 [ 816460BD4B4ACD27937D1D0813E2E9E9 ] NDProxy C:\WINXP\system32\drivers\NDProxy.sys
08:42:29.0500 3268 NDProxy - ok
08:42:29.0500 3268 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINXP\system32\DRIVERS\netbios.sys
08:42:29.0500 3268 NetBIOS - ok
08:42:29.0500 3268 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINXP\system32\DRIVERS\netbt.sys
08:42:29.0500 3268 NetBT - ok
08:42:29.0531 3268 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINXP\system32\netdde.exe
08:42:29.0531 3268 NetDDE - ok
08:42:29.0531 3268 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINXP\system32\netdde.exe
08:42:29.0531 3268 NetDDEdsdm - ok
08:42:29.0562 3268 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINXP\system32\lsass.exe
08:42:29.0562 3268 Netlogon - ok
08:42:29.0578 3268 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINXP\System32\netman.dll
08:42:29.0578 3268 Netman - ok
08:42:29.0609 3268 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINXP\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
08:42:29.0609 3268 NetTcpPortSharing - ok
08:42:29.0640 3268 [ FCEE5FCB99F7C724593365C706D28388 ] Nla C:\WINXP\System32\mswsock.dll
08:42:29.0640 3268 Nla - ok
08:42:29.0640 3268 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINXP\system32\drivers\Npfs.sys
08:42:29.0656 3268 Npfs - ok
08:42:29.0687 3268 [ F8E396F5E703D7A8F37D90F59C776268 ] NSHE C:\WINXP\system32\Drivers\NSHE.SYS
08:42:29.0687 3268 NSHE - ok
08:42:29.0718 3268 [ 198FF60A42802C319FBA58FDB13EEE49 ] nSvcIp C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
08:42:29.0718 3268 nSvcIp - ok
08:42:29.0734 3268 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINXP\system32\drivers\Ntfs.sys
08:42:29.0734 3268 Ntfs - ok
08:42:29.0750 3268 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINXP\system32\lsass.exe
08:42:29.0750 3268 NtLmSsp - ok
08:42:29.0765 3268 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINXP\system32\ntmssvc.dll
08:42:29.0781 3268 NtmsSvc - ok
08:42:29.0796 3268 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINXP\system32\drivers\Null.sys
08:42:29.0796 3268 Null - ok
08:42:29.0968 3268 [ CD9ED87B4FC6EC41D3B5BE0B923843FC ] nv C:\WINXP\system32\DRIVERS\nv4_mini.sys
08:42:30.0000 3268 nv - ok
08:42:30.0015 3268 [ C61927D27B75ED56723F2508F1A6B1BE ] NVENETFD C:\WINXP\system32\DRIVERS\NVENETFD.sys
08:42:30.0015 3268 NVENETFD - ok
08:42:30.0031 3268 [ 52DCE3B30C9D61C8E20FE3C6DA4BDFB7 ] nvgts C:\WINXP\system32\DRIVERS\nvgts.sys
08:42:30.0031 3268 nvgts - ok
08:42:30.0031 3268 [ C529B614EF88BE0F62B886C67B516550 ] nvnetbus C:\WINXP\system32\DRIVERS\nvnetbus.sys
08:42:30.0031 3268 nvnetbus - ok
08:42:30.0046 3268 [ E48C1AA03B6519B51756E3232C093300 ] nvsvc C:\WINXP\system32\nvsvc32.exe
08:42:30.0046 3268 nvsvc - ok
08:42:30.0093 3268 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINXP\system32\DRIVERS\nwlnkflt.sys
08:42:30.0093 3268 NwlnkFlt - ok
08:42:30.0093 3268 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINXP\system32\DRIVERS\nwlnkfwd.sys
08:42:30.0093 3268 NwlnkFwd - ok
08:42:30.0156 3268 [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
08:42:30.0156 3268 ose - ok
08:42:30.0187 3268 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINXP\system32\DRIVERS\parport.sys
08:42:30.0187 3268 Parport - ok
08:42:30.0203 3268 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINXP\system32\drivers\PartMgr.sys
08:42:30.0203 3268 PartMgr - ok
08:42:30.0234 3268 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINXP\system32\drivers\ParVdm.sys
08:42:30.0234 3268 ParVdm - ok
08:42:30.0312 3268 [ A1E779A0CF7A21B42E8FD3E8856D8481 ] PassThru Service C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
08:42:30.0312 3268 PassThru Service - ok
08:42:30.0312 3268 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINXP\system32\DRIVERS\pci.sys
08:42:30.0312 3268 PCI - ok
08:42:30.0312 3268 PCIDump - ok
08:42:30.0312 3268 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINXP\system32\DRIVERS\pciide.sys
08:42:30.0312 3268 PCIIde - ok
08:42:30.0343 3268 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINXP\system32\drivers\Pcmcia.sys
08:42:30.0343 3268 Pcmcia - ok
08:42:30.0359 3268 PDCOMP - ok
08:42:30.0359 3268 PDFRAME - ok
08:42:30.0359 3268 PDRELI - ok
08:42:30.0359 3268 PDRFRAME - ok
08:42:30.0359 3268 perc2 - ok
08:42:30.0359 3268 perc2hib - ok
08:42:30.0375 3268 [ 020CEAAEDC8EB655B6506B8C70D53BB6 ] PlugPlay C:\WINXP\system32\services.exe
08:42:30.0390 3268 PlugPlay - ok
08:42:30.0390 3268 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINXP\system32\lsass.exe
08:42:30.0390 3268 PolicyAgent - ok
08:42:30.0406 3268 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINXP\system32\DRIVERS\raspptp.sys
08:42:30.0406 3268 PptpMiniport - ok
08:42:30.0406 3268 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor C:\WINXP\system32\DRIVERS\processr.sys
08:42:30.0406 3268 Processor - ok
08:42:30.0406 3268 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINXP\system32\lsass.exe
08:42:30.0406 3268 ProtectedStorage - ok
08:42:30.0421 3268 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINXP\system32\DRIVERS\psched.sys
08:42:30.0421 3268 PSched - ok
08:42:30.0437 3268 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINXP\system32\DRIVERS\ptilink.sys
08:42:30.0437 3268 Ptilink - ok
08:42:30.0437 3268 ql1080 - ok
08:42:30.0437 3268 Ql10wnt - ok
08:42:30.0437 3268 ql12160 - ok
08:42:30.0437 3268 ql1240 - ok
08:42:30.0437 3268 ql1280 - ok
08:42:30.0468 3268 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINXP\system32\DRIVERS\rasacd.sys
08:42:30.0468 3268 RasAcd - ok
08:42:30.0484 3268 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINXP\System32\rasauto.dll
08:42:30.0484 3268 RasAuto - ok
08:42:30.0500 3268 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINXP\system32\DRIVERS\rasl2tp.sys
08:42:30.0500 3268 Rasl2tp - ok
08:42:30.0515 3268 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINXP\System32\rasmans.dll
08:42:30.0515 3268 RasMan - ok
08:42:30.0531 3268 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINXP\system32\DRIVERS\raspppoe.sys
08:42:30.0531 3268 RasPppoe - ok
08:42:30.0562 3268 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINXP\system32\DRIVERS\raspti.sys
08:42:30.0562 3268 Raspti - ok
08:42:30.0578 3268 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINXP\system32\DRIVERS\rdbss.sys
08:42:30.0578 3268 Rdbss - ok
08:42:30.0578 3268 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINXP\system32\DRIVERS\RDPCDD.sys
08:42:30.0578 3268 RDPCDD - ok
08:42:30.0609 3268 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINXP\system32\DRIVERS\rdpdr.sys
08:42:30.0609 3268 rdpdr - ok
08:42:30.0640 3268 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINXP\system32\drivers\RDPWD.sys
08:42:30.0640 3268 RDPWD - ok
08:42:30.0671 3268 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINXP\system32\sessmgr.exe
08:42:30.0671 3268 RDSessMgr - ok
08:42:30.0687 3268 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINXP\system32\DRIVERS\redbook.sys
08:42:30.0687 3268 redbook - ok
08:42:30.0718 3268 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINXP\System32\mprdim.dll
08:42:30.0718 3268 RemoteAccess - ok
08:42:30.0750 3268 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINXP\system32\regsvc.dll
08:42:30.0750 3268 RemoteRegistry - ok
08:42:30.0765 3268 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINXP\system32\locator.exe
08:42:30.0765 3268 RpcLocator - ok
08:42:30.0781 3268 [ 9222562D44021B988B9F9F62207FB6F2 ] RpcSs C:\WINXP\system32\rpcss.dll
08:42:30.0781 3268 RpcSs - ok
08:42:30.0812 3268 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINXP\system32\rsvp.exe
08:42:30.0812 3268 RSVP - ok
08:42:30.0828 3268 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINXP\system32\lsass.exe
08:42:30.0828 3268 SamSs - ok
08:42:30.0859 3268 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINXP\System32\SCardSvr.exe
08:42:30.0859 3268 SCardSvr - ok
08:42:30.0890 3268 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINXP\system32\schedsvc.dll
08:42:30.0890 3268 Schedule - ok
08:42:30.0906 3268 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINXP\system32\DRIVERS\secdrv.sys
08:42:30.0906 3268 Secdrv - ok
08:42:30.0906 3268 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINXP\System32\seclogon.dll
08:42:30.0906 3268 seclogon - ok
08:42:30.0921 3268 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINXP\system32\sens.dll
08:42:30.0921 3268 SENS - ok
08:42:30.0921 3268 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINXP\system32\DRIVERS\serenum.sys
08:42:30.0921 3268 serenum - ok
08:42:30.0968 3268 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINXP\system32\DRIVERS\serial.sys
08:42:30.0968 3268 Serial - ok
08:42:30.0984 3268 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINXP\system32\drivers\Sfloppy.sys
08:42:30.0984 3268 Sfloppy - ok
08:42:30.0984 3268 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINXP\System32\ipnathlp.dll
08:42:31.0000 3268 SharedAccess - ok
08:42:31.0000 3268 [ 888CD7B39C37E13A2419BECFAAF0A28C ] ShellHWDetection C:\WINXP\System32\shsvcs.dll
08:42:31.0000 3268 ShellHWDetection - ok
08:42:31.0000 3268 Simbad - ok
08:42:31.0015 3268 Sparrow - ok
08:42:31.0046 3268 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINXP\system32\drivers\splitter.sys
08:42:31.0046 3268 splitter - ok
08:42:31.0062 3268 [ 258DD5D4283FD9F9A7166BE9AE45CE73 ] Spooler C:\WINXP\system32\spoolsv.exe
08:42:31.0062 3268 Spooler - ok
08:42:31.0093 3268 [ B2EC3E1DEAC5F0A764BD3486D213A0AF ] SQLBrowser C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
08:42:31.0093 3268 SQLBrowser - ok
08:42:31.0093 3268 [ D2F4F32B59440011174B4F8137AF4E0C ] SQLWriter C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
08:42:31.0093 3268 SQLWriter - ok
08:42:31.0125 3268 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINXP\system32\DRIVERS\sr.sys
08:42:31.0125 3268 sr - ok
08:42:31.0140 3268 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINXP\system32\srsvc.dll
08:42:31.0140 3268 srservice - ok
08:42:31.0140 3268 [ 9B390283569EA58D43D2586032B892F5 ] Srv C:\WINXP\system32\DRIVERS\srv.sys
08:42:31.0140 3268 Srv - ok
08:42:31.0156 3268 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINXP\System32\ssdpsrv.dll
08:42:31.0156 3268 SSDPSRV - ok
08:42:31.0156 3268 SSPORT - ok
08:42:31.0187 3268 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINXP\system32\wiaservc.dll
08:42:31.0203 3268 stisvc - ok
08:42:31.0203 3268 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINXP\system32\DRIVERS\swenum.sys
08:42:31.0203 3268 swenum - ok
08:42:31.0234 3268 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINXP\system32\drivers\swmidi.sys
08:42:31.0234 3268 swmidi - ok
08:42:31.0234 3268 SwPrv - ok
08:42:31.0250 3268 symc810 - ok
08:42:31.0250 3268 symc8xx - ok
08:42:31.0250 3268 sym_hi - ok
08:42:31.0250 3268 sym_u3 - ok
08:42:31.0281 3268 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINXP\system32\drivers\sysaudio.sys
08:42:31.0281 3268 sysaudio - ok
08:42:31.0296 3268 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINXP\system32\smlogsvc.exe
08:42:31.0296 3268 SysmonLog - ok
08:42:31.0328 3268 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINXP\System32\tapisrv.dll
08:42:31.0328 3268 TapiSrv - ok
08:42:31.0343 3268 [ AD978A1B783B5719720CFF204B666C8E ] Tcpip C:\WINXP\system32\DRIVERS\tcpip.sys
08:42:31.0343 3268 Tcpip - ok
08:42:31.0359 3268 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINXP\system32\drivers\TDPIPE.sys
08:42:31.0359 3268 TDPIPE - ok
08:42:31.0375 3268 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINXP\system32\drivers\TDTCP.sys
08:42:31.0375 3268 TDTCP - ok
08:42:31.0390 3268 [ 88155247177638048422893737429D9E ] TermDD C:\WINXP\system32\DRIVERS\termdd.sys
08:42:31.0390 3268 TermDD - ok
08:42:31.0406 3268 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINXP\System32\termsrv.dll
08:42:31.0406 3268 TermService - ok
08:42:31.0406 3268 [ 888CD7B39C37E13A2419BECFAAF0A28C ] Themes C:\WINXP\System32\shsvcs.dll
08:42:31.0406 3268 Themes - ok
08:42:31.0437 3268 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINXP\system32\tlntsvr.exe
08:42:31.0437 3268 TlntSvr - ok
08:42:31.0437 3268 TosIde - ok
08:42:31.0453 3268 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINXP\system32\trkwks.dll
08:42:31.0453 3268 TrkWks - ok
08:42:31.0468 3268 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINXP\system32\drivers\Udfs.sys
08:42:31.0468 3268 Udfs - ok
08:42:31.0468 3268 ultra - ok
08:42:31.0515 3268 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINXP\system32\DRIVERS\update.sys
08:42:31.0515 3268 Update - ok
08:42:31.0531 3268 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINXP\System32\upnphost.dll
08:42:31.0531 3268 upnphost - ok
08:42:31.0546 3268 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINXP\System32\ups.exe
08:42:31.0546 3268 UPS - ok
08:42:31.0562 3268 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINXP\system32\DRIVERS\usbccgp.sys
08:42:31.0562 3268 usbccgp - ok
08:42:31.0562 3268 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINXP\system32\DRIVERS\usbehci.sys
08:42:31.0562 3268 usbehci - ok
08:42:31.0578 3268 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINXP\system32\DRIVERS\usbhub.sys
08:42:31.0578 3268 usbhub - ok
08:42:31.0593 3268 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINXP\system32\DRIVERS\usbohci.sys
08:42:31.0593 3268 usbohci - ok
08:42:31.0625 3268 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINXP\system32\DRIVERS\usbprint.sys
08:42:31.0625 3268 usbprint - ok
08:42:31.0656 3268 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINXP\system32\DRIVERS\usbscan.sys
08:42:31.0656 3268 usbscan - ok
08:42:31.0656 3268 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINXP\system32\DRIVERS\USBSTOR.SYS
08:42:31.0656 3268 USBSTOR - ok
08:42:31.0703 3268 [ B6CC50279D6CD28E090A5D33244ADC9A ] usb_rndisx C:\WINXP\system32\DRIVERS\usb8023x.sys
08:42:31.0703 3268 usb_rndisx - ok
08:42:31.0734 3268 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINXP\System32\drivers\vga.sys
08:42:31.0734 3268 VgaSave - ok
08:42:31.0796 3268 [ CBC1CE0A1FCE0DEED4F6F093BE91D132 ] VIAHdAudAddService C:\WINXP\system32\drivers\viahduaa.sys
08:42:31.0796 3268 VIAHdAudAddService - ok
08:42:31.0812 3268 ViaIde - ok
08:42:31.0812 3268 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINXP\system32\drivers\VolSnap.sys
08:42:31.0812 3268 VolSnap - ok
08:42:31.0828 3268 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINXP\System32\vssvc.exe
08:42:31.0843 3268 VSS - ok
08:42:31.0859 3268 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINXP\system32\w32time.dll
08:42:31.0859 3268 W32Time - ok
08:42:31.0890 3268 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINXP\system32\DRIVERS\wanarp.sys
08:42:31.0890 3268 Wanarp - ok
08:42:31.0906 3268 [ 4769596D7CC0F5FA447D2BABC239672A ] Wdf01000 C:\WINXP\system32\Drivers\wdf01000.sys
08:42:31.0921 3268 Wdf01000 - ok
08:42:31.0921 3268 WDICA - ok
08:42:31.0937 3268 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINXP\system32\drivers\wdmaud.sys
08:42:31.0937 3268 wdmaud - ok
08:42:31.0937 3268 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINXP\System32\webclnt.dll
08:42:31.0937 3268 WebClient - ok
08:42:32.0000 3268 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINXP\system32\wbem\WMIsvc.dll
08:42:32.0000 3268 winmgmt - ok
08:42:32.0031 3268 [ 051B1BDECD6DEE18C771B5D5EC7F044D ] WmdmPmSN C:\WINXP\system32\MsPMSNSv.dll
08:42:32.0031 3268 WmdmPmSN - ok
08:42:32.0078 3268 [ C8A6C82F90B055149925DC7526B2D78C ] Wmi C:\WINXP\System32\advapi32.dll
08:42:32.0078 3268 Wmi - ok
08:42:32.0109 3268 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINXP\system32\wbem\wmiapsrv.exe
08:42:32.0109 3268 WmiApSrv - ok
08:42:32.0156 3268 [ 6BAB4DC65515A098505F8B3D01FB6FE5 ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
08:42:32.0156 3268 WMPNetworkSvc - ok
08:42:32.0187 3268 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINXP\system32\wscsvc.dll
08:42:32.0203 3268 wscsvc - ok
08:42:32.0234 3268 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINXP\system32\wuauserv.dll
08:42:32.0234 3268 wuauserv - ok
08:42:32.0250 3268 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINXP\system32\DRIVERS\WudfPf.sys
08:42:32.0250 3268 WudfPf - ok
08:42:32.0250 3268 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINXP\system32\DRIVERS\wudfrd.sys
08:42:32.0250 3268 WudfRd - ok
08:42:32.0265 3268 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINXP\System32\WUDFSvc.dll
08:42:32.0265 3268 WudfSvc - ok
08:42:32.0296 3268 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINXP\System32\wzcsvc.dll
08:42:32.0296 3268 WZCSVC - ok
08:42:32.0312 3268 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINXP\System32\xmlprov.dll
08:42:32.0312 3268 xmlprov - ok
08:42:32.0312 3268 ================ Scan global ===============================
08:42:32.0343 3268 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINXP\system32\basesrv.dll
08:42:32.0375 3268 [ B23423313519C522E0E73BA170D3CE71 ] C:\WINXP\system32\winsrv.dll
08:42:32.0375 3268 [ B23423313519C522E0E73BA170D3CE71 ] C:\WINXP\system32\winsrv.dll
08:42:32.0390 3268 [ 020CEAAEDC8EB655B6506B8C70D53BB6 ] C:\WINXP\system32\services.exe
08:42:32.0390 3268 [Global] - ok
08:42:32.0390 3268 ================ Scan MBR ==================================
08:42:32.0406 3268 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0
08:42:32.0687 3268 \Device\Harddisk0\DR0 - ok
08:42:32.0687 3268 ================ Scan VBR ==================================
08:42:32.0687 3268 [ E9B8BC9720F096BCE259BAC29FC7E0EA ] \Device\Harddisk0\DR0\Partition1
08:42:32.0687 3268 \Device\Harddisk0\DR0\Partition1 - ok
08:42:32.0687 3268 [ 515CD635F91D50908C2E879F51C549F8 ] \Device\Harddisk0\DR0\Partition2
08:42:32.0687 3268 \Device\Harddisk0\DR0\Partition2 - ok
08:42:32.0687 3268 ============================================================
08:42:32.0687 3268 Scan finished
08:42:32.0687 3268 ============================================================
08:42:32.0687 3216 Detected object count: 0
08:42:32.0687 3216 Actual detected object count: 0
08:44:45.0937 3476 Deinitialize success

_________

ComboFix 12-09-21.01 - RS Parkin Ltd 22/09/2012 8:47.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2815.2255 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\RS Parkin Ltd\Application Data\Otobri
c:\documents and settings\RS Parkin Ltd\Application Data\Otobri\ymelr.gus
c:\documents and settings\RS Parkin Ltd\Application Data\vcape.dll
c:\documents and settings\RS Parkin Ltd\Local Settings\Application Data\{0f181d9d-f14f-950d-5715-e95a70b79248}
c:\documents and settings\RS Parkin Ltd\Local Settings\Application Data\{0f181d9d-f14f-950d-5715-e95a70b79248}\@
c:\documents and settings\RS Parkin Ltd\Local Settings\Application Data\{0f181d9d-f14f-950d-5715-e95a70b79248}\n
c:\winxp\Installer\{0f181d9d-f14f-950d-5715-e95a70b79248}
c:\winxp\Installer\{0f181d9d-f14f-950d-5715-e95a70b79248}\@
c:\winxp\Installer\{0f181d9d-f14f-950d-5715-e95a70b79248}\U\00000001.@
c:\winxp\system32\FlashPlayerInstaller.exe
c:\winxp\system32\NEWA5.tmp
c:\winxp\system32\NEWAB.tmp
c:\winxp\system32\UNWISE.EXE
.
.
((((((((((((((((((((((((( Files Created from 2012-08-22 to 2012-09-22 )))))))))))))))))))))))))))))))
.
.
2012-09-21 15:53 . 2012-09-21 15:53 ——– d—–w- c:\program files\Common Files\Java
2012-09-21 15:52 . 2012-09-21 15:52 73728 —-a-w- c:\winxp\system32\javacpl.cpl
2012-09-21 15:52 . 2012-09-21 15:52 477168 —-a-w- c:\winxp\system32\npdeployJava1.dll
2012-09-21 15:52 . 2012-09-21 15:52 ——– d—–w- c:\program files\Java
2012-09-21 15:52 . 2012-09-21 15:52 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2012-09-21 15:14 . 2012-09-21 15:14 ——– d—–w- c:\program files\ESET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-21 15:52 . 2011-07-06 17:21 473072 —-a-w- c:\winxp\system32\deployJava1.dll
2012-09-21 10:15 . 2012-03-30 07:10 696240 —-a-w- c:\winxp\system32\FlashPlayerApp.exe
2012-09-21 10:15 . 2011-07-21 08:34 73136 —-a-w- c:\winxp\system32\FlashPlayerCPLApp.cpl
2012-09-07 16:04 . 2012-08-03 12:45 22856 —-a-w- c:\winxp\system32\drivers\mbam.sys
2012-08-03 12:37 . 2012-08-03 12:37 35144 —-a-w- c:\winxp\system32\drivers\mbamchameleon.sys
2012-07-06 13:58 . 2008-04-14 09:00 78336 —-a-w- c:\winxp\system32\browser.dll
2012-07-04 14:05 . 2011-07-06 16:09 139784 —-a-w- c:\winxp\system32\drivers\rdpwd.sys
2012-07-03 13:40 . 2011-04-12 18:46 1875072 —-a-w- c:\winxp\system32\win32k.sys
2012-07-02 17:48 . 2011-06-14 18:15 920064 —-a-w- c:\winxp\system32\wininet.dll
2012-07-02 17:48 . 2011-06-14 18:15 43520 —-a-w- c:\winxp\system32\licmgr10.dll
2012-07-02 17:48 . 2011-06-14 18:15 1469440 —-a-w- c:\winxp\system32\inetcpl.cpl
2012-07-02 11:57 . 2011-06-14 18:15 385024 —-a-w- c:\winxp\system32\html.iec
2012-06-25 15:04 . 2012-06-25 15:04 1394248 —-a-w- c:\winxp\system32\msxml4.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seagull Drivers"="ssdal_nc.exe startup" [X]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2010-05-24 33747360]
"NvMediaCenter"="c:\winxp\system32\NvMcTray.dll" [2010-03-16 110696]
"NvCplDaemon"="c:\winxp\system32\NvCpl.dll" [2010-03-16 13670504]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"HTC Sync Loader"="c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2011-04-26 593920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\winxp\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"6160:TCP"= 6160:TCP:Seagull Driver Networking
.
R2 MSSQL$FINAWARE;SQL Server (FINAWARE);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [24/11/2008 23:31 29263712]
R2 NSHE;Guardant Emulator Driver;c:\winxp\system32\drivers\NSHE.SYS [20/07/2011 09:11 97792]
R2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [31/03/2011 16:08 80896]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\winxp\system32\drivers\viahduaa.sys [06/07/2011 17:18 2136224]
S2 SSPORT;SSPORT;\??\c:\winxp\system32\Drivers\SSPORT.sys –> c:\winxp\system32\Drivers\SSPORT.sys [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\winxp\system32\Macromed\Flash\FlashPlayerUpdateService.exe [30/03/2012 08:10 250288]
S3 HTCAND32;HTC Device Driver;c:\winxp\system32\drivers\ANDROIDUSB.sys [07/08/2012 11:09 24576]
S3 htcnprot;HTC NDIS Protocol Driver;c:\winxp\system32\drivers\htcnprot.sys [22/06/2010 18:01 21248]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - 67161061
*NewlyCreated* - MBAMSWISSARMY
*Deregistered* - 67161061
*Deregistered* - MBAMSwissArmy
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-21 c:\winxp\Tasks\Adobe Flash Player Updater.job
- c:\winxp\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 10:15]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://mail.google.com/mail/?hl=en&shva=1#inbox
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: parcelforce.net\www
Trusted Zone: rmdmo.co.uk\www
TCP: Interfaces\{7DF36725-0848-4B01-A80C-D5A30E228A18}: NameServer = 192.168.1.1
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-ISUSPM - c:\documents and settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe
HKLM-Run-nwiz - nwiz.exe
AddRemove-Hardlock Device Drivers - c:\winxp\system32\UNWISE.EXE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-22 08:50
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ISUSPM = "c:\documents and settings\All Users\Application Data\FLEXnet\Connect\11\ISUSPM.exe" -scheduler????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????}?????C??????x?+}???????????}?????????????](}0???????????(??????? ??|???????|????????j??|????0???????[??????????????
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINXP\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINXP\\system32\\Macromed\\Flash\\FlashUtil32_11_4_402_278_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2012-09-22 08:51:07
ComboFix-quarantined-files.txt 2012-09-22 07:51
.
Pre-Run: 87,659,790,336 bytes free
Post-Run: 88,056,700,928 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINXP
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINXP="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - AC2AE080CE91B82C2820672B855575BB

THANKS

CatByte

Post #17September 22, 2012, 11:50 AM UTC

good,

ComboFix did a great job

let's sweep for leftovers

please do the following:

Download AdwCleaner from here and save it to your desktop.

Run AdwCleaner and select Delete
Once done it will ask to reboot, allow the reboot
On reboot a log will be produced, please attach the content of the log to your next reply

NEXT

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Go here to run an online scanner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activeX control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
When the scan completes, press the LIST OF THREATS FOUND button
Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
Include the contents of this report in your next reply.
Press the BACK button.
Press Finish

Scotty P

Post #18September 22, 2012, 1:12 PM UTC

# AdwCleaner v2.002 - Logfile created 09/22/2012 at 12:59:37 # Updated 16/09/2012 by Xplode # Operating system : Microsoft Windows XP Service Pack 3 (32 bits) # User : RS Parkin Ltd - RS-02 # Boot Mode : Normal # Running from : C:\Documents and Settings\RS Parkin Ltd\Desktop\Scanners\adwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** ***** [Registry] ***** Key Deleted : HKLM\Software\Freeze.com ***** [Internet Browsers] ***** -\\ Internet Explorer v8.0.6001.18702 Restored : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope] Restored : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope] Restored : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope] Restored : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope] Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxps://mail.google.com/mail/?hl=en&shva=1#inbox –> hxxp://www.google.com ************************* AdwCleaner[S1].txt - [1078 octets] - [22/09/2012 12:59:37] ########## EOF - C:\AdwCleaner[S1].txt - [1138 octets] ########## Malwarebytes Anti-Malware 1.65.0.1400 www.malwarebytes.org Database version: v2012.09.22.04 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 RS Parkin Ltd :: RS-02 [administrator] 22/09/2012 13:03:40 mbam-log-2012-09-22 (13-03-40).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 202373 Time elapsed: 2 minute(s), 13 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) ESETSCAN C:\Documents and Settings\RS Parkin Ltd\Application Data\Sun\Java\Deployment\cache\6.0\39\4f581d67-38f5fb3e a variant of Win32/Injector.USA trojan C:\Qoobox\Quarantine\C\Documents and Settings\RS Parkin Ltd\Application Data\vcape.dll.vir a variant of Win32/Medfos.BR trojan C:\Qoobox\Quarantine\C\Documents and Settings\RS Parkin Ltd\Local Settings\Application Data\{0f181d9d-f14f-950d-5715-e95a70b79248}\n.vir a variant of Win32/Kryptik.AKUA trojan C:\Qoobox\Quarantine\C\WINXP\Installer\{0f181d9d-f14f-950d-5715-e95a70b79248}\U\00000001.@.vir Win32/Conedex.I trojan Looks like some slipped through the net Thanks

CatByte

Post #19September 22, 2012, 2:31 PM UTC

those detections are in combofix quarantine, the other is in Java cache, we just need to empty the cache and update java

go to Start > Control Panel > Programs and Features > scroll down to the Java installation and Remove it, now download the latest Java version 7 update 7 and install it: http://java.com/en/download/index.jsp

Clear Java cache

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup) If you do not see the icon, look to your left and click 'Switch to Classic View'.

On the General tab, under Temporary Internet Files, click the Settings button.
Next, click on the Delete Files button
There are two options in the window to clear the cache - Leave BOTH Checked
- Applications and Applets
  Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

you should be good to go on this computer, advise if there are any outstanding issues, if not, then post for the next computer (DDS and aswMBR)

I'll give you the usual clean up routine that I normally give when there is no further signs of malware, then you can perform this clean up routine on all the machines once they are done:

(we won't be using all the tools on every machine, this is the generic cleanup)

Follow these steps to uninstall Combofix

Make sure your security programs are totally disabled.
Press the WinKey +R to open a run box
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

NEXT

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

NEXT

If there are any logs/tools remaining on your desktop > right click and delete them. (eg: TDSSKiller, aswMBR, Farbar tools and logs etc.)

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
Download TFC to your desktop
- Close any open windows.
- Double click the TFC icon to run the program
- TFC will close all open programs itself in order to run,
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish it's job
- Once its finished it should automatically reboot your machine,
- if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox and IE
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
PC Safety and Security–What Do I Need?.
Simple and easy ways to keep your computer safe and secure on the Internet

CatByte

Post #20October 5, 2012, 11:46 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

IE8 Redirects to Adverts and Popup Ads during browsing [Solved]

✨ Ask AI

Ask AI