Virus: Win32/Small.ca [Closed]

Hello icyjin,

My name is OCD. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice, this will be a team effort. This may cause a delay, but I will do my best to keep it as short as possible. Please bear with me, I will post back to you as soon as I can.

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  
• The fixes are specific to your problem and should only be used for the issues on this machine.
  
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  
• It's often worth reading through these instructions and printing them for ease of reference.
  
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  
• Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Important Note for Vista and Windows 7 users:

These tools MUST be run from the executable.(.exe) every time you run them with Admin Rights (Right click, choose "Run as Administrator")

Please stay with this topic until I let you know that your system appears to be "All Clear"

Hey OCD, Thanks a lot for helping my case, do I have to upload anymore logs for you to examine my problem? Once again, thanks a lot Icy

Hey OCD Thank you very much for looking into my case again. Actually, i did format my pc once as i mentioned earlier from windows xp to windows 7 around one month ago, but then after formatting, two days after it start sudden shut down with that blue screen i provided in 1st post, do i have the format all of my drives? or just the c drive is good enough? because as i asked i am not sure if the virus is hidden in my other hard drives also, i have total of 3 hard drives and an external one, i back up my files to the external hard drive before i format to windows 7, i am afraid the virus will be there. These few days, my explorer is pretty weird, it just show me there is error, after i click ok the menu at the bottom vanish, so as all the icons on desktop need to restart in order to get it normally function again. Anyway, tdkiller found no threat on my pc, here it is. 21:05:00.0918 5488 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42 21:05:01.0936 5488 ============================================================ 21:05:01.0936 5488 Current date / time: 2013/03/20 21:05:01.0936 21:05:01.0936 5488 SystemInfo: 21:05:01.0936 5488 21:05:01.0936 5488 OS Version: 6.1.7601 ServicePack: 1.0 21:05:01.0936 5488 Product type: Workstation 21:05:01.0936 5488 ComputerName: 21:05:01.0936 5488 UserName: 21:05:01.0936 5488 Windows directory: C:\Windows 21:05:01.0936 5488 System windows directory: C:\Windows 21:05:01.0936 5488 Processor architecture: Intel x86 21:05:01.0936 5488 Number of processors: 2 21:05:01.0936 5488 Page size: 0x1000 21:05:01.0936 5488 Boot type: Normal boot 21:05:01.0936 5488 ============================================================ 21:05:03.0362 5488 Drive \Device\Harddisk1\DR1 - Size: 0x3A38A25E00 (232.88 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050 21:05:03.0378 5488 Drive \Device\Harddisk2\DR2 - Size: 0x4A85C4DE00 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050 21:05:03.0382 5488 Drive \Device\Harddisk3\DR3 - Size: 0xE8E0B00000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB00, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W' 21:05:03.0695 5488 ============================================================ 21:05:03.0695 5488 \Device\Harddisk1\DR1: 21:05:03.0715 5488 MBR partitions: 21:05:03.0715 5488 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xF003E73 21:05:03.0715 5488 \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0xF004000, BlocksNum 0xE1C0000 21:05:03.0715 5488 \Device\Harddisk2\DR2: 21:05:03.0717 5488 MBR partitions: 21:05:03.0717 5488 \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x12A14BC1 21:05:03.0734 5488 \Device\Harddisk2\DR2\Partition2: MBR, Type 0x7, StartLBA 0x12A14C3F, BlocksNum 0x12A18A82 21:05:03.0734 5488 \Device\Harddisk3\DR3: 21:05:03.0736 5488 MBR partitions: 21:05:03.0736 5488 \Device\Harddisk3\DR3\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x74705000 21:05:03.0736 5488 ============================================================ 21:05:03.0785 5488 C: <-> \Device\Harddisk1\DR1\Partition1 21:05:03.0822 5488 E: <-> \Device\Harddisk2\DR2\Partition1 21:05:03.0857 5488 F: <-> \Device\Harddisk2\DR2\Partition2 21:05:03.0916 5488 L: <-> \Device\Harddisk1\DR1\Partition2 21:05:03.0946 5488 O: <-> \Device\Harddisk3\DR3\Partition1 21:05:03.0946 5488 ============================================================ 21:05:03.0946 5488 Initialize success 21:05:03.0946 5488 ============================================================ 21:05:09.0584 5480 Deinitialize success 21:05:21.0001 5736 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42 21:05:21.0765 5736 ============================================================ 21:05:21.0765 5736 Current date / time: 2013/03/20 21:05:21.0765 21:05:21.0765 5736 SystemInfo: 21:05:21.0765 5736 21:05:21.0765 5736 OS Version: 6.1.7601 ServicePack: 1.0 21:05:21.0765 5736 Product type: Workstation 21:05:21.0765 5736 ComputerName: 21:05:21.0765 5736 UserName: 21:05:21.0765 5736 Windows directory: C:\Windows 21:05:21.0765 5736 System windows directory: C:\Windows 21:05:21.0765 5736 Processor architecture: Intel x86 21:05:21.0765 5736 Number of processors: 2 21:05:21.0765 5736 Page size: 0x1000 21:05:21.0765 5736 Boot type: Normal boot 21:05:21.0765 5736 ============================================================ 21:05:22.0713 5736 Drive \Device\Harddisk1\DR1 - Size: 0x3A38A25E00 (232.88 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050 21:05:22.0729 5736 Drive \Device\Harddisk2\DR2 - Size: 0x4A85C4DE00 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050 21:05:22.0732 5736 Drive \Device\Harddisk3\DR3 - Size: 0xE8E0B00000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB00, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W' 21:05:22.0739 5736 ============================================================ 21:05:22.0740 5736 \Device\Harddisk1\DR1: 21:05:22.0746 5736 MBR partitions: 21:05:22.0746 5736 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xF003E73 21:05:22.0746 5736 \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0xF004000, BlocksNum 0xE1C0000 21:05:22.0746 5736 \Device\Harddisk2\DR2: 21:05:22.0746 5736 MBR partitions: 21:05:22.0746 5736 \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x12A14BC1 21:05:22.0768 5736 \Device\Harddisk2\DR2\Partition2: MBR, Type 0x7, StartLBA 0x12A14C3F, BlocksNum 0x12A18A82 21:05:22.0768 5736 \Device\Harddisk3\DR3: 21:05:22.0769 5736 MBR partitions: 21:05:22.0769 5736 \Device\Harddisk3\DR3\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x74705000 21:05:22.0769 5736 ============================================================ 21:05:22.0790 5736 C: <-> \Device\Harddisk1\DR1\Partition1 21:05:22.0816 5736 E: <-> \Device\Harddisk2\DR2\Partition1 21:05:22.0840 5736 F: <-> \Device\Harddisk2\DR2\Partition2 21:05:22.0873 5736 L: <-> \Device\Harddisk1\DR1\Partition2 21:05:22.0878 5736 O: <-> \Device\Harddisk3\DR3\Partition1 21:05:22.0878 5736 ============================================================ 21:05:22.0878 5736 Initialize success 21:05:22.0878 5736 ============================================================ 21:05:49.0567 5816 ============================================================ 21:05:49.0567 5816 Scan started 21:05:49.0567 5816 Mode: Manual; 21:05:49.0567 5816 ============================================================ 21:05:50.0393 5816 ================ Scan system memory ======================== 21:05:50.0393 5816 System memory - ok 21:05:50.0393 5816 ================ Scan services ============================= 21:05:50.0528 5816 [ 1B133875B8AA8AC48969BD3458AFE9F5 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys 21:05:50.0531 5816 1394ohci - ok 21:05:50.0556 5816 [ CEA80C80BED809AA0DA6FEBC04733349 ] ACPI C:\Windows\system32\drivers\ACPI.sys 21:05:50.0559 5816 ACPI - ok 21:05:50.0590 5816 [ 1EFBC664ABFF416D1D07DB115DCB264F ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys 21:05:50.0592 5816 AcpiPmi - ok 21:05:50.0627 5816 [ 21E785EBD7DC90A06391141AAC7892FB ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys 21:05:50.0644 5816 adp94xx - ok 21:05:50.0654 5816 [ 0C676BC278D5B59FF5ABD57BBE9123F2 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys 21:05:50.0660 5816 adpahci - ok 21:05:50.0668 5816 [ 7C7B5EE4B7B822EC85321FE23A27DB33 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys 21:05:50.0672 5816 adpu320 - ok 21:05:50.0698 5816 [ 8B5EEFEEC1E6D1A72A06C526628AD161 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll 21:05:50.0699 5816 AeLookupSvc - ok 21:05:50.0744 5816 [ 9EBBBA55060F786F0FCAA3893BFA2806 ] AFD C:\Windows\system32\drivers\afd.sys 21:05:50.0749 5816 AFD - ok 21:05:50.0771 5816 [ 507812C3054C21CEF746B6EE3D04DD6E ] agp440 C:\Windows\system32\drivers\agp440.sys 21:05:50.0774 5816 agp440 - ok 21:05:50.0804 5816 [ 8B30250D573A8F6B4BD23195160D8707 ] aic78xx C:\Windows\system32\DRIVERS\djsvs.sys 21:05:50.0807 5816 aic78xx - ok 21:05:50.0836 5816 [ 18A54E132947CD98FEA9ACCC57F98F13 ] ALG C:\Windows\System32\alg.exe 21:05:50.0839 5816 ALG - ok 21:05:50.0860 5816 [ 0D40BCF52EA90FC7DF2AEAB6503DEA44 ] aliide C:\Windows\system32\drivers\aliide.sys 21:05:50.0861 5816 aliide - ok 21:05:50.0892 5816 [ 72B4122645F1C7166265560B67EA98F9 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe 21:05:50.0894 5816 AMD External Events Utility - ok 21:05:50.0912 5816 [ 3C6600A0696E90A463771C7422E23AB5 ] amdagp C:\Windows\system32\drivers\amdagp.sys 21:05:50.0914 5816 amdagp - ok 21:05:50.0926 5816 [ CD5914170297126B6266860198D1D4F0 ] amdide C:\Windows\system32\drivers\amdide.sys 21:05:50.0928 5816 amdide - ok 21:05:50.0972 5816 [ 00DDA200D71BAC534BF56A9DB5DFD666 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys 21:05:50.0973 5816 AmdK8 - ok 21:05:50.0986 5816 [ 3CBF30F5370FDA40DD3E87DF38EA53B6 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys 21:05:50.0988 5816 AmdPPM - ok 21:05:51.0009 5816 [ 6F64C768A9A48FAB7C6D6CEE1B30F97F ] amdsata C:\Windows\system32\DRIVERS\amdsata.sys 21:05:51.0010 5816 amdsata - ok 21:05:51.0023 5816 [ EA43AF0C423FF267355F74E7A53BDABA ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys 21:05:51.0027 5816 amdsbs - ok 21:05:51.0036 5816 [ E27866684780606BCCE640A57937D88A ] amdxata C:\Windows\system32\DRIVERS\amdxata.sys 21:05:51.0038 5816 amdxata - ok 21:05:51.0069 5816 [ AEA177F783E20150ACE5383EE368DA19 ] AppID C:\Windows\system32\drivers\appid.sys 21:05:51.0072 5816 AppID - ok 21:05:51.0097 5816 [ 62A9C86CB6085E20DB4823E4E97826F5 ] AppIDSvc C:\Windows\System32\appidsvc.dll 21:05:51.0099 5816 AppIDSvc - ok 21:05:51.0126 5816 [ FB1959012294D6AD43E5304DF65E3C26 ] Appinfo C:\Windows\System32\appinfo.dll 21:05:51.0128 5816 Appinfo - ok 21:05:51.0155 5816 [ 2932004F49677BD84DBC72EDB754FFB3 ] arc C:\Windows\system32\DRIVERS\arc.sys 21:05:51.0158 5816 arc - ok 21:05:51.0171 5816 [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7 ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys 21:05:51.0174 5816 arcsas - ok 21:05:51.0185 5816 [ ADD2ADE1C2B285AB8378D2DAAF991481 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys 21:05:51.0189 5816 AsyncMac - ok 21:05:51.0211 5816 [ 338C86357871C167A96AB976519BF59E ] atapi C:\Windows\system32\drivers\atapi.sys 21:05:51.0212 5816 atapi - ok 21:05:51.0349 5816 [ 13C1C7EA14691EE53D8A27AACC028E54 ] atikmdag C:\Windows\system32\DRIVERS\atikmdag.sys 21:05:51.0467 5816 atikmdag - ok 21:05:51.0491 5816 [ B73C832088DD54B55E04FF6F9646AD8C ] AtiPcie C:\Windows\system32\DRIVERS\AtiPcie.sys 21:05:51.0492 5816 AtiPcie - ok 21:05:51.0530 5816 [ CE3B4E731638D2EF62FCB419BE0D39F0 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll 21:05:51.0538 5816 AudioEndpointBuilder - ok 21:05:51.0555 5816 [ CE3B4E731638D2EF62FCB419BE0D39F0 ] Audiosrv C:\Windows\System32\Audiosrv.dll 21:05:51.0559 5816 Audiosrv - ok 21:05:51.0596 5816 [ 6E30D02AAC9CAC84F421622E3A2F6178 ] AxInstSV C:\Windows\System32\AxInstSV.dll 21:05:51.0600 5816 AxInstSV - ok 21:05:51.0626 5816 [ 1A231ABEC60FD316EC54C66715543CEC ] b06bdrv C:\Windows\system32\DRIVERS\bxvbdx.sys 21:05:51.0633 5816 b06bdrv - ok 21:05:51.0656 5816 [ BD8869EB9CDE6BBE4508D869929869EE ] b57nd60x C:\Windows\system32\DRIVERS\b57nd60x.sys 21:05:51.0662 5816 b57nd60x - ok 21:05:51.0732 5816 [ 23E723B149FECF53006FE89C29C67535 ] BaiduUpdater C:\Program Files\Baidu\BaiduUpdate\bdupdate.exe 21:05:51.0741 5816 BaiduUpdater - ok 21:05:51.0782 5816 [ EE1E9C3BB8228AE423DD38DB69128E71 ] BDESVC C:\Windows\System32\bdesvc.dll 21:05:51.0785 5816 BDESVC - ok 21:05:51.0801 5816 [ 505506526A9D467307B3C393DEDAF858 ] Beep C:\Windows\system32\drivers\Beep.sys 21:05:51.0803 5816 Beep - ok 21:05:51.0846 5816 [ 1E2BAC209D184BB851E1A187D8A29136 ] BFE C:\Windows\System32\bfe.dll 21:05:51.0854 5816 BFE - ok 21:05:51.0898 5816 [ E585445D5021971FAE10393F0F1C3961 ] BITS C:\Windows\System32\qmgr.dll 21:05:51.0909 5816 BITS - ok 21:05:51.0928 5816 [ 2287078ED48FCFC477B05B20CF38F36F ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys 21:05:51.0930 5816 blbdrive - ok 21:05:51.0955 5816 [ 8F2DA3028D5FCBD1A060A3DE64CD6506 ] bowser C:\Windows\system32\DRIVERS\bowser.sys 21:05:51.0957 5816 bowser - ok 21:05:51.0973 5816 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys 21:05:51.0975 5816 BrFiltLo - ok 21:05:51.0989 5816 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys 21:05:51.0991 5816 BrFiltUp - ok 21:05:52.0015 5816 [ 3DAA727B5B0A45039B0E1C9A211B8400 ] Browser C:\Windows\System32\browser.dll 21:05:52.0017 5816 Browser - ok 21:05:52.0037 5816 [ 845B8CE732E67F3B4133164868C666EA ] Brserid C:\Windows\System32\Drivers\Brserid.sys 21:05:52.0043 5816 Brserid - ok 21:05:52.0055 5816 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys 21:05:52.0058 5816 BrSerWdm - ok 21:05:52.0070 5816 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys 21:05:52.0072 5816 BrUsbMdm - ok 21:05:52.0079 5816 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys 21:05:52.0080 5816 BrUsbSer - ok 21:05:52.0091 5816 [ ED3DF7C56CE0084EB2034432FC56565A ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys 21:05:52.0093 5816 BTHMODEM - ok 21:05:52.0117 5816 [ 1DF19C96EEF6C29D1C3E1A8678E07190 ] bthserv C:\Windows\system32\bthserv.dll 21:05:52.0120 5816 bthserv - ok 21:05:52.0139 5816 [ 77EA11B065E0A8AB902D78145CA51E10 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys 21:05:52.0141 5816 cdfs - ok 21:05:52.0171 5816 [ BE167ED0FDB9C1FA1133953C18D5A6C9 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys 21:05:52.0174 5816 cdrom - ok 21:05:52.0215 5816 [ 319C6B309773D063541D01DF8AC6F55F ] CertPropSvc C:\Windows\System32\certprop.dll 21:05:52.0217 5816 CertPropSvc - ok 21:05:52.0249 5816 [ 3FE3FE94A34DF6FB06E6418D0F6A0060 ] circlass C:\Windows\system32\DRIVERS\circlass.sys 21:05:52.0251 5816 circlass - ok 21:05:52.0285 5816 [ 635181E0E9BBF16871BF5380D71DB02D ] CLFS C:\Windows\system32\CLFS.sys 21:05:52.0290 5816 CLFS - ok 21:05:52.0340 5816 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 21:05:52.0343 5816 clr_optimization_v2.0.50727_32 - ok 21:05:52.0390 5816 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 21:05:52.0393 5816 clr_optimization_v4.0.30319_32 - ok 21:05:52.0426 5816 [ DEA805815E587DAD1DD2C502220B5616 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys 21:05:52.0427 5816 CmBatt - ok 21:05:52.0462 5816 [ C537B1DB64D495B9B4717B4D6D9EDBF2 ] cmdide C:\Windows\system32\drivers\cmdide.sys 21:05:52.0463 5816 cmdide - ok 21:05:52.0511 5816 [ 247B4CE2DAB1160CD422D532D5241E1F ] CNG C:\Windows\system32\Drivers\cng.sys 21:05:52.0517 5816 CNG - ok 21:05:52.0531 5816 [ A6023D3823C37043986713F118A89BEE ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys 21:05:52.0533 5816 Compbatt - ok 21:05:52.0569 5816 [ CBE8C58A8579CFE5FCCF809E6F114E89 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys 21:05:52.0572 5816 CompositeBus - ok 21:05:52.0581 5816 COMSysApp - ok 21:05:52.0597 5816 [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys 21:05:52.0598 5816 crcdisk - ok 21:05:52.0635 5816 [ 96C0E38905CFD788313BE8E11DAE3F2F ] CryptSvc C:\Windows\system32\cryptsvc.dll 21:05:52.0638 5816 CryptSvc - ok 21:05:52.0668 5816 [ 7660F01D3B38ACA1747E397D21D790AF ] DcomLaunch C:\Windows\system32\rpcss.dll 21:05:52.0686 5816 DcomLaunch - ok 21:05:52.0717 5816 [ 8D6E10A2D9A5EED59562D9B82CF804E1 ] defragsvc C:\Windows\System32\defragsvc.dll 21:05:52.0722 5816 defragsvc - ok 21:05:52.0752 5816 [ F024449C97EC1E464AAFFDA18593DB88 ] DfsC C:\Windows\system32\Drivers\dfsc.sys 21:05:52.0755 5816 DfsC - ok 21:05:52.0785 5816 [ 649705E3DAE598BC0F957BACBF9A2BD5 ] dg_ssudbus C:\Windows\system32\DRIVERS\ssudbus.sys 21:05:52.0787 5816 dg_ssudbus - ok 21:05:52.0823 5816 [ E9E01EB683C132F7FA27CD607B8A2B63 ] Dhcp C:\Windows\system32\dhcpcore.dll 21:05:52.0826 5816 Dhcp - ok 21:05:52.0835 5816 [ 1A050B0274BFB3890703D490F330C0DA ] discache C:\Windows\system32\drivers\discache.sys 21:05:52.0837 5816 discache - ok 21:05:52.0875 5816 [ 565003F326F99802E68CA78F2A68E9FF ] Disk C:\Windows\system32\DRIVERS\disk.sys 21:05:52.0877 5816 Disk - ok 21:05:52.0906 5816 [ 33EF4861F19A0736B11314AAD9AE28D0 ] Dnscache C:\Windows\System32\dnsrslvr.dll 21:05:52.0908 5816 Dnscache - ok 21:05:52.0938 5816 [ 366BA8FB4B7BB7435E3B9EACB3843F67 ] dot3svc C:\Windows\System32\dot3svc.dll 21:05:52.0943 5816 dot3svc - ok 21:05:52.0973 5816 [ 8EC04CA86F1D68DA9E11952EB85973D6 ] DPS C:\Windows\system32\dps.dll 21:05:52.0975 5816 DPS - ok 21:05:53.0001 5816 [ B918E7C5F9BF77202F89E1A9539F2EB4 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys 21:05:53.0003 5816 drmkaud - ok 21:05:53.0041 5816 [ 23F5D28378A160352BA8F817BD8C71CB ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys 21:05:53.0057 5816 DXGKrnl - ok 21:05:53.0108 5816 [ 04238864710460C5682E260207D06192 ] eamonm C:\Windows\system32\DRIVERS\eamonm.sys 21:05:53.0110 5816 eamonm - ok 21:05:53.0141 5816 [ 8600142FA91C1B96367D3300AD0F3F3A ] EapHost C:\Windows\System32\eapsvc.dll 21:05:53.0143 5816 EapHost - ok 21:05:53.0245 5816 [ 024E1B5CAC09731E4D868E64DBFB4AB0 ] ebdrv C:\Windows\system32\DRIVERS\evbdx.sys 21:05:53.0339 5816 ebdrv - ok 21:05:53.0365 5816 [ 81951F51E318AECC2D68559E47485CC4 ] EFS C:\Windows\System32\lsass.exe 21:05:53.0367 5816 EFS - ok 21:05:53.0410 5816 [ DEFF87F04AB5F6DD5EDF2B80853BBE10 ] ehdrv C:\Windows\system32\DRIVERS\ehdrv.sys 21:05:53.0414 5816 ehdrv - ok 21:05:53.0476 5816 [ A8C362018EFC87BEB013EE28F29C0863 ] ehRecvr C:\Windows\ehome\ehRecvr.exe 21:05:53.0495 5816 ehRecvr - ok 21:05:53.0514 5816 [ D389BFF34F80CAEDE417BF9D1507996A ] ehSched C:\Windows\ehome\ehsched.exe 21:05:53.0517 5816 ehSched - ok 21:05:53.0628 5816 [ FB5453892EC5CF4626D2077832F0081C ] ekrn C:\Program Files\ESET\ESET Smart Security\ekrn.exe 21:05:53.0634 5816 ekrn - ok 21:05:53.0668 5816 [ 0ED67910C8C326796FAA00B2BF6D9D3C ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys 21:05:53.0685 5816 elxstor - ok 21:05:53.0727 5816 [ 5BA193CA0AE31209AAA39939CE6736B2 ] epfw C:\Windows\system32\DRIVERS\epfw.sys 21:05:53.0729 5816 epfw - ok 21:05:53.0778 5816 [ 9CEFD59C8E5EBFB48165AEF54617F539 ] EpfwLWF C:\Windows\system32\DRIVERS\EpfwLWF.sys 21:05:53.0780 5816 EpfwLWF - ok 21:05:53.0813 5816 [ 7144A06AC105A2A7302944602E415EC1 ] epfwwfp C:\Windows\system32\DRIVERS\epfwwfp.sys 21:05:53.0814 5816 epfwwfp - ok 21:05:53.0843 5816 [ 8FC3208352DD3912C94367A206AB3F11 ] ErrDev C:\Windows\system32\drivers\errdev.sys 21:05:53.0845 5816 ErrDev - ok 21:05:53.0882 5816 [ F6916EFC29D9953D5D0DF06882AE8E16 ] EventSystem C:\Windows\system32\es.dll 21:05:53.0888 5816 EventSystem - ok 21:05:53.0927 5816 [ A3B790C7BA67CCC0876FB3D7555E1816 ] ewusbmbb C:\Windows\system32\DRIVERS\ewusbwwan.sys 21:05:53.0934 5816 ewusbmbb - ok 21:05:53.0961 5816 [ 57C171EA22F0A7F068FCB0CAEDD1E8E7 ] ew_hwusbdev C:\Windows\system32\DRIVERS\ew_hwusbdev.sys 21:05:53.0965 5816 ew_hwusbdev - ok 21:05:53.0976 5816 [ 61A973F60E94A551BA7B15F3460444FB ] ew_usbenumfilter C:\Windows\system32\DRIVERS\ew_usbenumfilter.sys 21:05:53.0977 5816 ew_usbenumfilter - ok 21:05:53.0989 5816 [ 2DC9108D74081149CC8B651D3A26207F ] exfat C:\Windows\system32\drivers\exfat.sys 21:05:53.0994 5816 exfat - ok 21:05:54.0016 5816 [ EA5F680375E064722CD4D6C968DF272A ] FancyRd C:\Windows\system32\DRIVERS\fancyrd.sys 21:05:54.0019 5816 FancyRd - ok 21:05:54.0040 5816 [ 7E0AB74553476622FB6AE36F73D97D35 ] fastfat C:\Windows\system32\drivers\fastfat.sys 21:05:54.0044 5816 fastfat - ok 21:05:54.0078 5816 [ 967EA5B213E9984CBE270205DF37755B ] Fax C:\Windows\system32\fxssvc.exe 21:05:54.0088 5816 Fax - ok 21:05:54.0111 5816 [ E817A017F82DF2A1F8CFDBDA29388B29 ] fdc C:\Windows\system32\DRIVERS\fdc.sys 21:05:54.0113 5816 fdc - ok 21:05:54.0142 5816 [ F3222C893BD2F5821A0179E5C71E88FB ] fdPHost C:\Windows\system32\fdPHost.dll 21:05:54.0144 5816 fdPHost - ok 21:05:54.0156 5816 [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B ] FDResPub C:\Windows\system32\fdrespub.dll 21:05:54.0159 5816 FDResPub - ok 21:05:54.0174 5816 [ 6CF00369C97F3CF563BE99BE983D13D8 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys 21:05:54.0176 5816 FileInfo - ok 21:05:54.0192 5816 [ 42C51DC94C91DA21CB9196EB64C45DB9 ] Filetrace C:\Windows\system32\drivers\filetrace.sys 21:05:54.0311 5816 Filetrace - ok 21:05:54.0322 5816 [ 87907AA70CB3C56600F1C2FB8841579B ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys 21:05:54.0324 5816 flpydisk - ok 21:05:54.0339 5816 [ 7520EC808E0C35E0EE6F841294316653 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys 21:05:54.0343 5816 FltMgr - ok 21:05:54.0402 5816 [ E12C4928B32ACE04610259647F072635 ] FontCache C:\Windows\system32\FntCache.dll 21:05:54.0426 5816 FontCache - ok 21:05:54.0471 5816 [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe 21:05:54.0473 5816 FontCache3.0.0.0 - ok 21:05:54.0496 5816 [ 1A16B57943853E598CFF37FE2B8CBF1D ] FsDepends C:\Windows\system32\drivers\FsDepends.sys 21:05:54.0498 5816 FsDepends - ok 21:05:54.0521 5816 [ 7DAE5EBCC80E45D3253F4923DC424D05 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys 21:05:54.0523 5816 Fs_Rec - ok 21:05:54.0567 5816 [ 8A73E79089B282100B9393B644CB853B ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys 21:05:54.0571 5816 fvevol - ok 21:05:54.0591 5816 [ 65EE0C7A58B65E74AE05637418153938 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys 21:05:54.0593 5816 gagp30kx - ok 21:05:54.0642 5816 [ E897EAF5ED6BA41E081060C9B447A673 ] gpsvc C:\Windows\System32\gpsvc.dll 21:05:54.0653 5816 gpsvc - ok 21:05:54.0665 5816 [ C44E3C2BAB6837DB337DDEE7544736DB ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys 21:05:54.0667 5816 hcw85cir - ok 21:05:54.0703 5816 [ A5EF29D5315111C80A5C1ABAD14C8972 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys 21:05:54.0720 5816 HdAudAddService - ok 21:05:54.0745 5816 [ 9036377B8A6C15DC2EEC53E489D159B5 ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys 21:05:54.0747 5816 HDAudBus - ok 21:05:54.0770 5816 [ 1D58A7F3E11A9731D0EAAAA8405ACC36 ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys 21:05:54.0772 5816 HidBatt - ok 21:05:54.0783 5816 [ 89448F40E6DF260C206A193A4683BA78 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys 21:05:54.0786 5816 HidBth - ok 21:05:54.0817 5816 [ CF50B4CF4A4F229B9F3C08351F99CA5E ] HidIr C:\Windows\system32\DRIVERS\hidir.sys 21:05:54.0820 5816 HidIr - ok 21:05:54.0838 5816 [ 2BC6F6A1992B3A77F5F41432CA6B3B6B ] hidserv C:\Windows\system32\hidserv.dll 21:05:54.0839 5816 hidserv - ok 21:05:54.0886 5816 [ 10C19F8290891AF023EAEC0832E1EB4D ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys 21:05:54.0888 5816 HidUsb - ok 21:05:54.0910 5816 [ 196B4E3F4CCCC24AF836CE58FACBB699 ] hkmsvc C:\Windows\system32\kmsvc.dll 21:05:54.0913 5816 hkmsvc - ok 21:05:54.0942 5816 [ 6658F4404DE03D75FE3BA09F7ABA6A30 ] HomeGroupListener C:\Windows\system32\ListSvc.dll 21:05:54.0947 5816 HomeGroupListener - ok 21:05:54.0960 5816 [ DBC02D918FFF1CAD628ACBE0C0EAA8E8 ] HomeGroupProvider C:\Windows\system32\provsvc.dll 21:05:54.0964 5816 HomeGroupProvider - ok 21:05:54.0995 5816 [ 295FDC419039090EB8B49FFDBB374549 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys 21:05:54.0998 5816 HpSAMD - ok 21:05:55.0041 5816 [ 871917B07A141BFF43D76D8844D48106 ] HTTP C:\Windows\system32\drivers\HTTP.sys 21:05:55.0048 5816 HTTP - ok 21:05:55.0077 5816 [ 2AEB89AEAC08ECD23FC0DA3EB4330A29 ] huawei_enumerator C:\Windows\system32\DRIVERS\ew_jubusenum.sys 21:05:55.0080 5816 huawei_enumerator - ok 21:05:55.0110 5816 [ D276036EBE90A3A2E94AA59C73967F79 ] hwdatacard C:\Windows\system32\DRIVERS\ewusbmdm.sys 21:05:55.0115 5816 hwdatacard - ok 21:05:55.0177 5816 [ 5EF3427AE503B5C03A48F7C9FF458B69 ] HWDeviceService.exe C:\ProgramData\DatacardService\HWDeviceService.exe 21:05:55.0179 5816 HWDeviceService.exe - ok 21:05:55.0210 5816 [ 0C4E035C7F105F1299258C90886C64C5 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys 21:05:55.0212 5816 hwpolicy - ok 21:05:55.0243 5816 [ F151F0BDC47F4A28B1B20A0818EA36D6 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys 21:05:55.0246 5816 i8042prt - ok 21:05:55.0280 5816 [ 5CD5F9A5444E6CDCB0AC89BD62D8B76E ] iaStorV C:\Windows\system32\drivers\iaStorV.sys 21:05:55.0287 5816 iaStorV - ok 21:05:55.0338 5816 [ C521D7EB6497BB1AF6AFA89E322FB43C ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 21:05:55.0357 5816 idsvc - ok 21:05:55.0379 5816 [ 4173FF5708F3236CF25195FECD742915 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys 21:05:55.0382 5816 iirsp - ok 21:05:55.0429 5816 [ F95622F161474511B8D80D6B093AA610 ] IKEEXT C:\Windows\System32\ikeext.dll 21:05:55.0439 5816 IKEEXT - ok 21:05:55.0458 5816 [ A0F12F2C9BA6C72F3987CE780E77C130 ] intelide C:\Windows\system32\drivers\intelide.sys 21:05:55.0459 5816 intelide - ok 21:05:55.0484 5816 [ 3B514D27BFC4ACCB4037BC6685F766E0 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys 21:05:55.0487 5816 intelppm - ok 21:05:55.0506 5816 [ ACB364B9075A45C0736E5C47BE5CAE19 ] IPBusEnum C:\Windows\system32\ipbusenum.dll 21:05:55.0509 5816 IPBusEnum - ok 21:05:55.0520 5816 [ 709D1761D3B19A932FF0238EA6D50200 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys 21:05:55.0523 5816 IpFilterDriver - ok 21:05:55.0562 5816 [ 58F67245D041FBE7AF88F4EAF79DF0FA ] iphlpsvc C:\Windows\System32\iphlpsvc.dll 21:05:55.0579 5816 iphlpsvc - ok 21:05:55.0604 5816 [ 4BD7134618C1D2A27466A099062547BF ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys 21:05:55.0607 5816 IPMIDRV - ok 21:05:55.0633 5816 [ A5FA468D67ABCDAA36264E463A7BB0CD ] IPNAT C:\Windows\system32\drivers\ipnat.sys 21:05:55.0637 5816 IPNAT - ok 21:05:55.0662 5816 [ 42996CFF20A3084A56017B7902307E9F ] IRENUM C:\Windows\system32\drivers\irenum.sys 21:05:55.0664 5816 IRENUM - ok 21:05:55.0694 5816 [ 1F32BB6B38F62F7DF1A7AB7292638A35 ] isapnp C:\Windows\system32\drivers\isapnp.sys 21:05:55.0697 5816 isapnp - ok 21:05:55.0714 5816 [ CB7A9ABB12B8415BCE5D74994C7BA3AE ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys 21:05:55.0720 5816 iScsiPrt - ok 21:05:55.0739 5816 [ 994EBB45C4B438E1F6EA0B958AE9B9A3 ] ivusb C:\Windows\system32\DRIVERS\ivusb.sys 21:05:55.0741 5816 ivusb - ok 21:05:55.0764 5816 [ ADEF52CA1AEAE82B50DF86B56413107E ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys 21:05:55.0766 5816 kbdclass - ok 21:05:55.0790 5816 [ 9E3CED91863E6EE98C24794D05E27A71 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys 21:05:55.0791 5816 kbdhid - ok 21:05:55.0797 5816 [ 81951F51E318AECC2D68559E47485CC4 ] KeyIso C:\Windows\system32\lsass.exe 21:05:55.0799 5816 KeyIso - ok 21:05:55.0820 5816 [ B7895B4182C0D16F6EFADEB8081E8D36 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys 21:05:55.0822 5816 KSecDD - ok 21:05:55.0837 5816 [ D30159AC9237519FBC62C6EC247D2D46 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys 21:05:55.0840 5816 KSecPkg - ok 21:05:55.0870 5816 [ 89A7B9CC98D0D80C6F31B91C0A310FCD ] KtmRm C:\Windows\system32\msdtckrm.dll 21:05:55.0877 5816 KtmRm - ok 21:05:55.0900 5816 [ D64AF876D53ECA3668BB97B51B4E70AB ] LanmanServer C:\Windows\system32\srvsvc.dll 21:05:55.0904 5816 LanmanServer - ok 21:05:55.0928 5816 [ 58405E4F68BA8E4057C6E914F326ABA2 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll 21:05:55.0932 5816 LanmanWorkstation - ok 21:05:55.0961 5816 [ F7611EC07349979DA9B0AE1F18CCC7A6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys 21:05:55.0963 5816 lltdio - ok 21:05:55.0995 5816 [ 5700673E13A2117FA3B9020C852C01E2 ] lltdsvc C:\Windows\System32\lltdsvc.dll 21:05:56.0001 5816 lltdsvc - ok 21:05:56.0021 5816 [ 55CA01BA19D0006C8F2639B6C045E08B ] lmhosts C:\Windows\System32\lmhsvc.dll 21:05:56.0023 5816 lmhosts - ok 21:05:56.0043 5816 [ EB119A53CCF2ACC000AC71B065B78FEF ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys 21:05:56.0046 5816 LSI_FC - ok 21:05:56.0061 5816 [ 8ADE1C877256A22E49B75D1CC9161F9C ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys 21:05:56.0064 5816 LSI_SAS - ok 21:05:56.0083 5816 [ DC9DC3D3DAA0E276FD2EC262E38B11E9 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys 21:05:56.0086 5816 LSI_SAS2 - ok 21:05:56.0101 5816 [ 0A036C7D7CAB643A7F07135AC47E0524 ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys 21:05:56.0105 5816 LSI_SCSI - ok 21:05:56.0122 5816 [ 6703E366CC18D3B6E534F5CF7DF39CEE ] luafv C:\Windows\system32\drivers\luafv.sys 21:05:56.0125 5816 luafv - ok 21:05:56.0153 5816 [ BFB9EE8EE977EFE85D1A3105ABEF6DD1 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll 21:05:56.0156 5816 Mcx2Svc - ok 21:05:56.0176 5816 [ 0FFF5B045293002AB38EB1FD1FC2FB74 ] megasas C:\Windows\system32\DRIVERS\megasas.sys 21:05:56.0178 5816 megasas - ok 21:05:56.0232 5816 [ DCBAB2920C75F390CAF1D29F675D03D6 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys 21:05:56.0237 5816 MegaSR - ok 21:05:56.0295 5816 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe 21:05:56.0297 5816 Microsoft Office Groove Audit Service - ok 21:05:56.0338 5816 [ 146B6F43A673379A3C670E86D89BE5EA ] MMCSS C:\Windows\system32\mmcss.dll 21:05:56.0340 5816 MMCSS - ok 21:05:56.0369 5816 [ F001861E5700EE84E2D4E52C712F4964 ] Modem C:\Windows\system32\drivers\modem.sys 21:05:56.0371 5816 Modem - ok 21:05:56.0400 5816 [ 79D10964DE86B292320E9DFE02282A23 ] monitor C:\Windows\system32\DRIVERS\monitor.sys 21:05:56.0400 5816 monitor - ok 21:05:56.0443 5816 [ FB18CC1D4C2E716B6B903B0AC0CC0609 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys 21:05:56.0446 5816 mouclass - ok 21:05:56.0465 5816 [ 2C388D2CD01C9042596CF3C8F3C7B24D ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys 21:05:56.0467 5816 mouhid - ok 21:05:56.0496 5816 [ FC8771F45ECCCFD89684E38842539B9B ] mountmgr C:\Windows\system32\drivers\mountmgr.sys 21:05:56.0498 5816 mountmgr - ok 21:05:56.0519 5816 [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0 ] mpio C:\Windows\system32\drivers\mpio.sys 21:05:56.0523 5816 mpio - ok 21:05:56.0540 5816 [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys 21:05:56.0543 5816 mpsdrv - ok 21:05:56.0584 5816 [ 9835584E999D25004E1EE8E5F3E3B881 ] MpsSvc C:\Windows\system32\mpssvc.dll 21:05:56.0601 5816 MpsSvc - ok 21:05:56.0614 5816 [ CEB46AB7C01C9F825F8CC6BABC18166A ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys 21:05:56.0617 5816 MRxDAV - ok 21:05:56.0654 5816 [ 5D16C921E3671636C0EBA3BBAAC5FD25 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys 21:05:56.0657 5816 mrxsmb - ok 21:05:56.0670 5816 [ 6D17A4791ACA19328C685D256349FEFC ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys 21:05:56.0674 5816 mrxsmb10 - ok 21:05:56.0687 5816 [ B81F204D146000BE76651A50670A5E9E ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys 21:05:56.0690 5816 mrxsmb20 - ok 21:05:56.0705 5816 [ 012C5F4E9349E711E11E0F19A8589F0A ] msahci C:\Windows\system32\drivers\msahci.sys 21:05:56.0706 5816 msahci - ok 21:05:56.0726 5816 [ 55055F8AD8BE27A64C831322A780A228 ] msdsm C:\Windows\system32\drivers\msdsm.sys 21:05:56.0730 5816 msdsm - ok 21:05:56.0749 5816 [ E1BCE74A3BD9902B72599C0192A07E27 ] MSDTC C:\Windows\System32\msdtc.exe 21:05:56.0754 5816 MSDTC - ok 21:05:56.0787 5816 [ DAEFB28E3AF5A76ABCC2C3078C07327F ] Msfs C:\Windows\system32\drivers\Msfs.sys 21:05:56.0789 5816 Msfs - ok 21:05:56.0799 5816 [ 3E1E5767043C5AF9367F0056295E9F84 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys 21:05:56.0801 5816 mshidkmdf - ok 21:05:56.0823 5816 [ 0A4E5757AE09FA9622E3158CC1AEF114 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys 21:05:56.0824 5816 msisadrv - ok 21:05:56.0859 5816 [ 90F7D9E6B6F27E1A707D4A297F077828 ] MSiSCSI C:\Windows\system32\iscsiexe.dll 21:05:56.0863 5816 MSiSCSI - ok 21:05:56.0869 5816 msiserver - ok 21:05:56.0902 5816 [ 8C0860D6366AAFFB6C5BB9DF9448E631 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys 21:05:56.0904 5816 MSKSSRV - ok 21:05:56.0921 5816 [ 3EA8B949F963562CEDBB549EAC0C11CE ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys 21:05:56.0923 5816 MSPCLOCK - ok 21:05:56.0929 5816 [ F456E973590D663B1073E9C463B40932 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys 21:05:56.0931 5816 MSPQM - ok 21:05:56.0946 5816 [ 0E008FC4819D238C51D7C93E7B41E560 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys 21:05:56.0949 5816 MsRPC - ok 21:05:56.0971 5816 [ FC6B9FF600CC585EA38B12589BD4E246 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys 21:05:56.0972 5816 mssmbios - ok 21:05:56.0978 5816 [ B42C6B921F61A6E55159B8BE6CD54A36 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys 21:05:56.0980 5816 MSTEE - ok 21:05:56.0995 5816 [ 33599130F44E1F34631CEA241DE8AC84 ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys 21:05:56.0997 5816 MTConfig - ok 21:05:57.0007 5816 [ 159FAD02F64E6381758C990F753BCC80 ] Mup C:\Windows\system32\Drivers\mup.sys 21:05:57.0009 5816 Mup - ok 21:05:57.0038 5816 [ 61D57A5D7C6D9AFE10E77DAE6E1B445E ] napagent C:\Windows\system32\qagentRT.dll 21:05:57.0046 5816 napagent - ok 21:05:57.0089 5816 [ 26384429FCD85D83746F63E798AB1480 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys 21:05:57.0094 5816 NativeWifiP - ok 21:05:57.0132 5816 [ 8C9C922D71F1CD4DEF73F186416B7896 ] NDIS C:\Windows\system32\drivers\ndis.sys 21:05:57.0155 5816 NDIS - ok 21:05:57.0170 5816 [ 0E1787AA6C9191D3D319E8BAFE86F80C ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys 21:05:57.0172 5816 NdisCap - ok 21:05:57.0188 5816 [ E4A8AEC125A2E43A9E32AFEEA7C9C888 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys 21:05:57.0190 5816 NdisTapi - ok 21:05:57.0219 5816 [ D8A65DAFB3EB41CBB622745676FCD072 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys 21:05:57.0221 5816 Ndisuio - ok 21:05:57.0254 5816 [ 38FBE267E7E6983311179230FACB1017 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys 21:05:57.0257 5816 NdisWan - ok 21:05:57.0271 5816 [ A4BDC541E69674FBFF1A8FF00BE913F2 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys 21:05:57.0273 5816 NDProxy - ok 21:05:57.0296 5816 [ 80B275B1CE3B0E79909DB7B39AF74D51 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys 21:05:57.0298 5816 NetBIOS - ok 21:05:57.0326 5816 [ 280122DDCF04B378EDD1AD54D71C1E54 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys 21:05:57.0331 5816 NetBT - ok 21:05:57.0346 5816 [ 81951F51E318AECC2D68559E47485CC4 ] Netlogon C:\Windows\system32\lsass.exe 21:05:57.0348 5816 Netlogon - ok 21:05:57.0388 5816 [ 7CCCFCA7510684768DA22092D1FA4DB2 ] Netman C:\Windows\System32\netman.dll 21:05:57.0395 5816 Netman - ok 21:05:57.0406 5816 [ 8C338238C16777A802D6A9211EB2BA50 ] netprofm C:\Windows\System32\netprofm.dll 21:05:57.0412 5816 netprofm - ok 21:05:57.0434 5816 [ F476EC40033CDB91EFBE73EB99B8362D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 21:05:57.0438 5816 NetTcpPortSharing - ok 21:05:57.0470 5816 [ 1D85C4B390B0EE09C7A46B91EFB2C097 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys 21:05:57.0472 5816 nfrd960 - ok 21:05:57.0505 5816 [ 374071043F9E4231EE43BE2BB48DD36D ] NlaSvc C:\Windows\System32\nlasvc.dll 21:05:57.0509 5816 NlaSvc - ok 21:05:57.0519 5816 [ 1DB262A9F8C087E8153D89BEF3D2235F ] Npfs C:\Windows\system32\drivers\Npfs.sys 21:05:57.0521 5816 Npfs - ok 21:05:57.0549 5816 [ BA387E955E890C8A88306D9B8D06BF17 ] nsi C:\Windows\system32\nsisvc.dll 21:05:57.0552 5816 nsi - ok 21:05:57.0565 5816 [ E9A0A4D07E53D8FEA2BB8387A3293C58 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys 21:05:57.0567 5816 nsiproxy - ok 21:05:57.0621 5816 [ 0D87503986BB3DFED58E343FE39DDE13 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys 21:05:57.0656 5816 Ntfs - ok 21:05:57.0687 5816 [ F9756A98D69098DCA8945D62858A812C ] Null C:\Windows\system32\drivers\Null.sys 21:05:57.0689 5816 Null - ok 21:05:57.0702 5816 [ B3E25EE28883877076E0E1FF877D02E0 ] nvraid C:\Windows\system32\drivers\nvraid.sys 21:05:57.0706 5816 nvraid - ok 21:05:57.0728 5816 [ 4380E59A170D88C4F1022EFF6719A8A4 ] nvstor C:\Windows\system32\drivers\nvstor.sys 21:05:57.0732 5816 nvstor - ok 21:05:57.0759 5816 [ 5A0983915F02BAE73267CC2A041F717D ] nv_agp C:\Windows\system32\drivers\nv_agp.sys 21:05:57.0762 5816 nv_agp - ok 21:05:57.0820 5816 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 21:05:57.0828 5816 odserv - ok 21:05:57.0852 5816 [ 08A70A1F2CDDE9BB49B885CB817A66EB ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys 21:05:57.0855 5816 ohci1394 - ok 21:05:57.0879 5816 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 21:05:57.0883 5816 ose - ok 21:05:57.0919 5816 [ 82A8521DDC60710C3D3D3E7325209BEC ] p2pimsvc C:\Windows\system32\pnrpsvc.dll 21:05:57.0926 5816 p2pimsvc - ok 21:05:57.0950 5816 [ 59C3DDD501E39E006DAC31BF55150D91 ] p2psvc C:\Windows\system32\p2psvc.dll 21:05:57.0967 5816 p2psvc - ok 21:05:58.0002 5816 [ 2EA877ED5DD9713C5AC74E8EA7348D14 ] Parport C:\Windows\system32\DRIVERS\parport.sys 21:05:58.0005 5816 Parport - ok 21:05:58.0030 5816 [ 3F34A1B4C5F6475F320C275E63AFCE9B ] partmgr C:\Windows\system32\drivers\partmgr.sys 21:05:58.0032 5816 partmgr - ok 21:05:58.0041 5816 [ EB0A59F29C19B86479D36B35983DAADC ] Parvdm C:\Windows\system32\DRIVERS\parvdm.sys 21:05:58.0043 5816 Parvdm - ok 21:05:58.0069 5816 [ 358AB7956D3160000726574083DFC8A6 ] PcaSvc C:\Windows\System32\pcasvc.dll 21:05:58.0072 5816 PcaSvc - ok 21:05:58.0099 5816 [ 673E55C3498EB970088E812EA820AA8F ] pci C:\Windows\system32\drivers\pci.sys 21:05:58.0103 5816 pci - ok 21:05:58.0112 5816 [ AFE86F419014DB4E5593F69FFE26CE0A ] pciide C:\Windows\system32\drivers\pciide.sys 21:05:58.0114 5816 pciide - ok 21:05:58.0127 5816 [ F396431B31693E71E8A80687EF523506 ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys 21:05:58.0132 5816 pcmcia - ok 21:05:58.0181 5816 [ 5B6C11DE7E839C05248CED8825470FEF ] pcouffin C:\Windows\system32\Drivers\pcouffin.sys 21:05:58.0183 5816 pcouffin - ok 21:05:58.0203 5816 [ 250F6B43D2B613172035C6747AEEB19F ] pcw C:\Windows\system32\drivers\pcw.sys 21:05:58.0204 5816 pcw - ok 21:05:58.0232 5816 [ 9E0104BA49F4E6973749A02BF41344ED ] PEAUTH C:\Windows\system32\drivers\peauth.sys 21:05:58.0249 5816 PEAUTH - ok 21:05:58.0346 5816 [ 414BBA67A3DED1D28437EB66AEB8A720 ] pla C:\Windows\system32\pla.dll 21:05:58.0415 5816 pla - ok 21:05:58.0443 5816 [ EC7BC28D207DA09E79B3E9FAF8B232CA ] PlugPlay C:\Windows\system32\umpnpmgr.dll 21:05:58.0449 5816 PlugPlay - ok 21:05:58.0466 5816 [ 63FF8572611249931EB16BB8EED6AFC8 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll 21:05:58.0470 5816 PNRPAutoReg - ok 21:05:58.0486 5816 [ 82A8521DDC60710C3D3D3E7325209BEC ] PNRPsvc C:\Windows\system32\pnrpsvc.dll 21:05:58.0490 5816 PNRPsvc - ok 21:05:58.0521 5816 [ 53946B69BA0836BD95B03759530C81EC ] PolicyAgent C:\Windows\System32\ipsecsvc.dll 21:05:58.0526 5816 PolicyAgent - ok 21:05:58.0545 5816 [ F87D30E72E03D579A5199CCB3831D6EA ] Power C:\Windows\system32\umpo.dll 21:05:58.0549 5816 Power - ok 21:05:58.0574 5816 [ 631E3E205AD6D86F2AED6A4A8E69F2DB ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys 21:05:58.0577 5816 PptpMiniport - ok 21:05:58.0590 5816 [ 85B1E3A0C7585BC4AAE6899EC6FCF011 ] Processor C:\Windows\system32\DRIVERS\processr.sys 21:05:58.0592 5816 Processor - ok 21:05:58.0624 5816 [ CADEFAC453040E370A1BDFF3973BE00D ] ProfSvc C:\Windows\system32\profsvc.dll 21:05:58.0628 5816 ProfSvc - ok 21:05:58.0637 5816 [ 81951F51E318AECC2D68559E47485CC4 ] ProtectedStorage C:\Windows\system32\lsass.exe 21:05:58.0639 5816 ProtectedStorage - ok 21:05:58.0667 5816 [ 6270CCAE2A86DE6D146529FE55B3246A ] Psched C:\Windows\system32\DRIVERS\pacer.sys 21:05:58.0671 5816 Psched - ok 21:05:58.0713 5816 [ AB95ECF1F6659A60DDC166D8315B0751 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys 21:05:58.0748 5816 ql2300 - ok 21:05:58.0771 5816 [ B4DD51DD25182244B86737DC51AF2270 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys 21:05:58.0774 5816 ql40xx - ok 21:05:58.0799 5816 [ 31AC809E7707EB580B2BDB760390765A ] QWAVE C:\Windows\system32\qwave.dll 21:05:58.0806 5816 QWAVE - ok 21:05:58.0817 5816 [ 584078CA1B95CA72DF2A27C336F9719D ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys 21:05:58.0820 5816 QWAVEdrv - ok 21:05:58.0830 5816 [ 30A81B53C766D0133BB86D234E5556AB ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys 21:05:58.0832 5816 RasAcd - ok 21:05:58.0860 5816 [ 57EC4AEF73660166074D8F7F31C0D4FD ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys 21:05:58.0862 5816 RasAgileVpn - ok 21:05:58.0879 5816 [ A60F1839849C0C00739787FD5EC03F13 ] RasAuto C:\Windows\System32\rasauto.dll 21:05:58.0884 5816 RasAuto - ok 21:05:58.0905 5816 [ D9F91EAFEC2815365CBE6D167E4E332A ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys 21:05:58.0908 5816 Rasl2tp - ok 21:05:58.0947 5816 [ CB9E04DC05EACF5B9A36CA276D475006 ] RasMan C:\Windows\System32\rasmans.dll 21:05:58.0964 5816 RasMan - ok 21:05:58.0978 5816 [ 0FE8B15916307A6AC12BFB6A63E45507 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys 21:05:58.0989 5816 RasPppoe - ok 21:05:59.0040 5816 [ 44101F495A83EA6401D886E7FD70096B ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys 21:05:59.0059 5816 RasSstp - ok 21:05:59.0091 5816 [ D528BC58A489409BA40334EBF96A311B ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys 21:05:59.0110 5816 rdbss - ok 21:05:59.0133 5816 [ 0D8F05481CB76E70E1DA06EE9F0DA9DF ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys 21:05:59.0158 5816 rdpbus - ok 21:05:59.0201 5816 [ 23DAE03F29D253AE74C44F99E515F9A1 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys 21:05:59.0202 5816 RDPCDD - ok 21:05:59.0269 5816 [ 5A53CA1598DD4156D44196D200C94B8A ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys 21:05:59.0271 5816 RDPENCDD - ok 21:05:59.0310 5816 [ 44B0A53CD4F27D50ED461DAE0C0B4E1F ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys 21:05:59.0311 5816 RDPREFMP - ok 21:05:59.0355 5816 [ F031683E6D1FEA157ABB2FF260B51E61 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys 21:05:59.0377 5816 RDPWD - ok 21:05:59.0415 5816 [ 518395321DC96FE2C9F0E96AC743B656 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys 21:05:59.0435 5816 rdyboost - ok 21:05:59.0522 5816 [ 7B5E1419717FAC363A31CC302895217A ] RemoteAccess C:\Windows\System32\mprdim.dll 21:05:59.0543 5816 RemoteAccess - ok 21:05:59.0573 5816 [ CB9A8683F4EF2BF99E123D79950D7935 ] RemoteRegistry C:\Windows\system32\regsvc.dll 21:05:59.0577 5816 RemoteRegistry - ok 21:05:59.0603 5816 [ 78D072F35BC45D9E4E1B61895C152234 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll 21:05:59.0606 5816 RpcEptMapper - ok 21:05:59.0622 5816 [ 94D36C0E44677DD26981D2BFEEF2A29D ] RpcLocator C:\Windows\system32\locator.exe 21:05:59.0625 5816 RpcLocator - ok 21:05:59.0641 5816 [ 7660F01D3B38ACA1747E397D21D790AF ] RpcSs C:\Windows\system32\rpcss.dll 21:05:59.0646 5816 RpcSs - ok 21:05:59.0677 5816 [ 032B0D36AD92B582D869879F5AF5B928 ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys 21:05:59.0679 5816 rspndr - ok 21:05:59.0710 5816 [ 7DFD48E24479B68B258D8770121155A0 ] RTL8167 C:\Windows\system32\DRIVERS\Rt86win7.sys 21:05:59.0713 5816 RTL8167 - ok 21:05:59.0721 5816 [ 81951F51E318AECC2D68559E47485CC4 ] SamSs C:\Windows\system32\lsass.exe 21:05:59.0723 5816 SamSs - ok 21:05:59.0752 5816 [ 05D860DA1040F111503AC416CCEF2BCA ] sbp2port C:\Windows\system32\drivers\sbp2port.sys 21:05:59.0755 5816 sbp2port - ok 21:05:59.0774 5816 [ 8FC518FFE9519C2631D37515A68009C4 ] SCardSvr C:\Windows\System32\SCardSvr.dll 21:05:59.0780 5816 SCardSvr - ok 21:05:59.0790 5816 [ 0693B5EC673E34DC147E195779A4DCF6 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys 21:05:59.0793 5816 scfilter - ok 21:05:59.0844 5816 [ A04BB13F8A72F8B6E8B4071723E4E336 ] Schedule C:\Windows\system32\schedsvc.dll 21:05:59.0861 5816 Schedule - ok 21:05:59.0879 5816 [ 319C6B309773D063541D01DF8AC6F55F ] SCPolicySvc C:\Windows\System32\certprop.dll 21:05:59.0880 5816 SCPolicySvc - ok 21:05:59.0909 5816 [ 08236C4BCE5EDD0A0318A438AF28E0F7 ] SDRSVC C:\Windows\System32\SDRSVC.dll 21:05:59.0914 5816 SDRSVC - ok 21:05:59.0945 5816 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys 21:05:59.0947 5816 secdrv - ok 21:05:59.0977 5816 [ A59B3A4442C52060CC7A85293AA3546F ] seclogon C:\Windows\system32\seclogon.dll 21:05:59.0980 5816 seclogon - ok 21:05:59.0999 5816 [ DCB7FCDCC97F87360F75D77425B81737 ] SENS C:\Windows\System32\sens.dll 21:06:00.0003 5816 SENS - ok 21:06:00.0020 5816 [ 50087FE1EE447009C9CC2997B90DE53F ] SensrSvc C:\Windows\system32\sensrsvc.dll 21:06:00.0024 5816 SensrSvc - ok 21:06:00.0042 5816 [ 9AD8B8B515E3DF6ACD4212EF465DE2D1 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys 21:06:00.0044 5816 Serenum - ok 21:06:00.0069 5816 [ 5FB7FCEA0490D821F26F39CC5EA3D1E2 ] Serial C:\Windows\system32\DRIVERS\serial.sys 21:06:00.0073 5816 Serial - ok 21:06:00.0082 5816 [ 79BFFB520327FF916A582DFEA17AA813 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys 21:06:00.0084 5816 sermouse - ok 21:06:00.0119 5816 [ 4AE380F39A0032EAB7DD953030B26D28 ] SessionEnv C:\Windows\system32\sessenv.dll 21:06:00.0124 5816 SessionEnv - ok 21:06:00.0147 5816 [ 9F976E1EB233DF46FCE808D9DEA3EB9C ] sffdisk C:\Windows\system32\drivers\sffdisk.sys 21:06:00.0148 5816 sffdisk - ok 21:06:00.0172 5816 [ 932A68EE27833CFD57C1639D375F2731 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys 21:06:00.0174 5816 sffp_mmc - ok 21:06:00.0182 5816 [ 6D4CCAEDC018F1CF52866BBBAA235982 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys 21:06:00.0184 5816 sffp_sd - ok 21:06:00.0216 5816 [ DB96666CC8312EBC45032F30B007A547 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys 21:06:00.0218 5816 sfloppy - ok 21:06:00.0263 5816 [ D1A079A0DE2EA524513B6930C24527A2 ] SharedAccess C:\Windows\System32\ipnathlp.dll 21:06:00.0272 5816 SharedAccess - ok 21:06:00.0303 5816 [ 414DA952A35BF5D50192E28263B40577 ] ShellHWDetection C:\Windows\System32\shsvcs.dll 21:06:00.0311 5816 ShellHWDetection - ok 21:06:00.0327 5816 [ 2565CAC0DC9FE0371BDCE60832582B2E ] sisagp C:\Windows\system32\drivers\sisagp.sys 21:06:00.0329 5816 sisagp - ok 21:06:00.0353 5816 [ A9F0486851BECB6DDA1D89D381E71055 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys 21:06:00.0356 5816 SiSRaid2 - ok 21:06:00.0371 5816 [ 3727097B55738E2F554972C3BE5BC1AA ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys 21:06:00.0374 5816 SiSRaid4 - ok 21:06:00.0402 5816 [ E7BD0B6F5E781560B4A24E957F9F0A74 ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe 21:06:00.0406 5816 SkypeUpdate - ok 21:06:00.0478 5816 [ 625C98D60AD5AB1FCCBD0E2C0AC0D905 ] SmarTone Mobile Broadband. RunOuc C:\Program Files\SmarTone Mobile Broadband\UpdateDog\ouc.exe 21:06:00.0482 5816 SmarTone Mobile Broadband. RunOuc - ok 21:06:00.0502 5816 [ 3E21C083B8A01CB70BA1F09303010FCE ] Smb C:\Windows\system32\DRIVERS\smb.sys 21:06:00.0505 5816 Smb - ok 21:06:00.0541 5816 [ 6A984831644ECA1A33FFEAE4126F4F37 ] SNMPTRAP C:\Windows\System32\snmptrap.exe 21:06:00.0544 5816 SNMPTRAP - ok 21:06:00.0565 5816 [ 95CF1AE7527FB70F7816563CBC09D942 ] spldr C:\Windows\system32\drivers\spldr.sys 21:06:00.0567 5816 spldr - ok 21:06:00.0593 5816 [ 9AEA093B8F9C37CF45538382CABA2475 ] Spooler C:\Windows\System32\spoolsv.exe 21:06:00.0598 5816 Spooler - ok 21:06:00.0710 5816 [ CF87A1DE791347E75B98885214CED2B8 ] sppsvc C:\Windows\system32\sppsvc.exe 21:06:00.0804 5816 sppsvc - ok 21:06:00.0829 5816 [ B0180B20B065D89232A78A40FE56EAA6 ] sppuinotify C:\Windows\system32\sppuinotify.dll 21:06:00.0833 5816 sppuinotify - ok 21:06:00.0882 5816 [ CDDDEC541BC3C96F91ECB48759673505 ] sptd C:\Windows\System32\Drivers\sptd.sys 21:06:00.0900 5816 sptd - ok 21:06:00.0934 5816 [ E4C2764065D66EA1D2D3EBC28FE99C46 ] srv C:\Windows\system32\DRIVERS\srv.sys 21:06:00.0939 5816 srv - ok 21:06:00.0955 5816 [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB ] srv2 C:\Windows\system32\DRIVERS\srv2.sys 21:06:00.0961 5816 srv2 - ok 21:06:00.0973 5816 [ BE6BD660CAA6F291AE06A718A4FA8ABC ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys 21:06:00.0976 5816 srvnet - ok 21:06:01.0001 5816 [ D887C9FD02AC9FA880F6E5027A43E118 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll 21:06:01.0006 5816 SSDPSRV - ok 21:06:01.0018 5816 [ D318F23BE45D5E3A107469EB64815B50 ] SstpSvc C:\Windows\system32\sstpsvc.dll 21:06:01.0023 5816 SstpSvc - ok 21:06:01.0061 5816 [ 6D82CB78DE57A073E95431F3486B1B27 ] ssudmdm C:\Windows\system32\DRIVERS\ssudmdm.sys 21:06:01.0063 5816 ssudmdm - ok 21:06:01.0086 5816 [ DB32D325C192B801DF274BFD12A7E72B ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys 21:06:01.0088 5816 stexstor - ok 21:06:01.0133 5816 [ E1FB3706030FB4578A0D72C2FC3689E4 ] StiSvc C:\Windows\System32\wiaservc.dll 21:06:01.0150 5816 StiSvc - ok 21:06:01.0172 5816 [ E58C78A848ADD9610A4DB6D214AF5224 ] swenum C:\Windows\system32\drivers\swenum.sys 21:06:01.0174 5816 swenum - ok 21:06:01.0209 5816 [ A28BD92DF340E57B024BA433165D34D7 ] swprv C:\Windows\System32\swprv.dll 21:06:01.0226 5816 swprv - ok 21:06:01.0281 5816 [ 36650D618CA34C9D357DFD3D89B2C56F ] SysMain C:\Windows\system32\sysmain.dll 21:06:01.0297 5816 SysMain - ok 21:06:01.0324 5816 [ 763FECDC3D30C815FE72DD57936C6CD1 ] TabletInputService C:\Windows\System32\TabSvc.dll 21:06:01.0328 5816 TabletInputService - ok 21:06:01.0360 5816 [ 613BF4820361543956909043A265C6AC ] TapiSrv C:\Windows\System32\tapisrv.dll 21:06:01.0367 5816 TapiSrv - ok 21:06:01.0397 5816 [ B799D9FDB26111737F58288D8DC172D9 ] TBS C:\Windows\System32\tbssvc.dll 21:06:01.0401 5816 TBS - ok 21:06:01.0467 5816 [ 7C0507D2391AF5933600CBCED799F277 ] Tcpip C:\Windows\system32\drivers\tcpip.sys 21:06:01.0501 5816 Tcpip - ok 21:06:01.0550 5816 [ 7C0507D2391AF5933600CBCED799F277 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys 21:06:01.0558 5816 TCPIP6 - ok 21:06:01.0593 5816 [ 3EEBD3BD93DA46A26E89893C7AB2FF3B ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys 21:06:01.0595 5816 tcpipreg - ok 21:06:01.0623 5816 [ 1CB91B2BD8F6DD367DFC2EF26FD751B2 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys 21:06:01.0625 5816 TDPIPE - ok 21:06:01.0631 5816 [ 2C2C5AFE7EE4F620D69C23C0617651A8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys 21:06:01.0634 5816 TDTCP - ok 21:06:01.0659 5816 [ B459575348C20E8121D6039DA063C704 ] tdx C:\Windows\system32\DRIVERS\tdx.sys 21:06:01.0662 5816 tdx - ok 21:06:01.0671 5816 [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20 ] TermDD C:\Windows\system32\drivers\termdd.sys 21:06:01.0674 5816 TermDD - ok 21:06:01.0710 5816 [ 382C804C92811BE57829D8E550A900E2 ] TermService C:\Windows\System32\termsrv.dll 21:06:01.0727 5816 TermService - ok 21:06:01.0754 5816 [ 42FB6AFD6B79D9FE07381609172E7CA4 ] Themes C:\Windows\system32\themeservice.dll 21:06:01.0757 5816 Themes - ok 21:06:01.0770 5816 [ 146B6F43A673379A3C670E86D89BE5EA ] THREADORDER C:\Windows\system32\mmcss.dll 21:06:01.0772 5816 THREADORDER - ok 21:06:01.0787 5816 [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A ] TrkWks C:\Windows\System32\trkwks.dll 21:06:01.0791 5816 TrkWks - ok 21:06:01.0836 5816 [ 2C49B175AEE1D4364B91B531417FE583 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe 21:06:01.0840 5816 TrustedInstaller - ok 21:06:01.0870 5816 [ 254BB140EEE3C59D6114C1A86B636877 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys 21:06:01.0872 5816 tssecsrv - ok 21:06:01.0902 5816 [ FD1D6C73E6333BE727CBCC6054247654 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys 21:06:01.0905 5816 TsUsbFlt - ok 21:06:01.0934 5816 [ B2FA25D9B17A68BB93D58B0556E8C90D ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys 21:06:01.0937 5816 tunnel - ok 21:06:01.0960 5816 [ 750FBCB269F4D7DD2E420C56B795DB6D ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys 21:06:01.0962 5816 uagp35 - ok 21:06:01.0980 5816 [ EE43346C7E4B5E63E54F927BABBB32FF ] udfs C:\Windows\system32\DRIVERS\udfs.sys 21:06:01.0987 5816 udfs - ok 21:06:02.0016 5816 [ 8344FD4FCE927880AA1AA7681D4927E5 ] UI0Detect C:\Windows\system32\UI0Detect.exe 21:06:02.0020 5816 UI0Detect - ok 21:06:02.0039 5816 [ 44E8048ACE47BEFBFDC2E9BE4CBC8880 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys 21:06:02.0042 5816 uliagpkx - ok 21:06:02.0074 5816 [ D295BED4B898F0FD999FCFA9B32B071B ] umbus C:\Windows\system32\drivers\umbus.sys 21:06:02.0076 5816 umbus - ok 21:06:02.0103 5816 [ 7550AD0C6998BA1CB4843E920EE0FEAC ] UmPass C:\Windows\system32\DRIVERS\umpass.sys 21:06:02.0105 5816 UmPass - ok 21:06:02.0129 5816 [ 833FBB672460EFCE8011D262175FAD33 ] upnphost C:\Windows\System32\upnphost.dll 21:06:02.0138 5816 upnphost - ok 21:06:02.0165 5816 [ BD9C55D7023C5DE374507ACC7A14E2AC ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys 21:06:02.0168 5816 usbccgp - ok 21:06:02.0199 5816 [ 04EC7CEC62EC3B6D9354EEE93327FC82 ] usbcir C:\Windows\system32\drivers\usbcir.sys 21:06:02.0202 5816 usbcir - ok 21:06:02.0231 5816 [ F92DE757E4B7CE9C07C5E65423F3AE3B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys 21:06:02.0234 5816 usbehci - ok 21:06:02.0272 5816 [ 0150B06D3E73F6C27AFCB963FD931820 ] usbfilter C:\Windows\system32\DRIVERS\usbfilter.sys 21:06:02.0274 5816 usbfilter - ok 21:06:02.0300 5816 [ 8DC94AEC6A7E644A06135AE7506DC2E9 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys 21:06:02.0305 5816 usbhub - ok 21:06:02.0321 5816 [ E185D44FAC515A18D9DEDDC23C2CDF44 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys 21:06:02.0323 5816 usbohci - ok 21:06:02.0343 5816 [ 797D862FE0875E75C7CC4C1AD7B30252 ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys 21:06:02.0345 5816 usbprint - ok 21:06:02.0363 5816 [ F991AB9CC6B908DB552166768176896A ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS 21:06:02.0365 5816 USBSTOR - ok 21:06:02.0375 5816 [ 68DF884CF41CDADA664BEB01DAF67E3D ] usbuhci C:\Windows\system32\drivers\usbuhci.sys 21:06:02.0377 5816 usbuhci - ok 21:06:02.0402 5816 [ 081E6E1C91AEC36758902A9F727CD23C ] UxSms C:\Windows\System32\uxsms.dll 21:06:02.0406 5816 UxSms - ok 21:06:02.0420 5816 [ 81951F51E318AECC2D68559E47485CC4 ] VaultSvc C:\Windows\system32\lsass.exe 21:06:02.0422 5816 VaultSvc - ok 21:06:02.0433 5816 [ A059C4C3EDB09E07D21A8E5C0AABD3CB ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys 21:06:02.0436 5816 vdrvroot - ok 21:06:02.0472 5816 [ C3CD30495687C2A2F66A65CA6FD89BE9 ] vds C:\Windows\System32\vds.exe 21:06:02.0487 5816 vds - ok 21:06:02.0510 5816 [ 17C408214EA61696CEC9C66E388B14F3 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys 21:06:02.0512 5816 vga - ok 21:06:02.0522 5816 [ 8E38096AD5C8570A6F1570A61E251561 ] VgaSave C:\Windows\System32\drivers\vga.sys 21:06:02.0524 5816 VgaSave - ok 21:06:02.0546 5816 [ 5461686CCA2FDA57B024547733AB42E3 ] vhdmp C:\Windows\system32\drivers\vhdmp.sys 21:06:02.0550 5816 vhdmp - ok 21:06:02.0573 5816 [ C829317A37B4BEA8F39735D4B076E923 ] viaagp C:\Windows\system32\drivers\viaagp.sys 21:06:02.0576 5816 viaagp - ok 21:06:02.0594 5816 [ E02F079A6AA107F06B16549C6E5C7B74 ] ViaC7 C:\Windows\system32\DRIVERS\viac7.sys 21:06:02.0596 5816 ViaC7 - ok 21:06:02.0620 5816 [ E43574F6A56A0EE11809B48C09E4FD3C ] viaide C:\Windows\system32\drivers\viaide.sys 21:06:02.0621 5816 viaide - ok 21:06:02.0636 5816 [ 4C63E00F2F4B5F86AB48A58CD990F212 ] volmgr C:\Windows\system32\drivers\volmgr.sys 21:06:02.0638 5816 volmgr - ok 21:06:02.0657 5816 [ B5BB72067DDDDBBFB04B2F89FF8C3C87 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys 21:06:02.0664 5816 volmgrx - ok 21:06:02.0681 5816 [ F497F67932C6FA693D7DE2780631CFE7 ] volsnap C:\Windows\system32\drivers\volsnap.sys 21:06:02.0686 5816 volsnap - ok 21:06:02.0701 5816 [ 9DFA0CC2F8855A04816729651175B631 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys 21:06:02.0705 5816 vsmraid - ok 21:06:02.0762 5816 [ 209A3B1901B83AEB8527ED211CCE9E4C ] VSS C:\Windows\system32\vssvc.exe 21:06:02.0791 5816 VSS - ok 21:06:02.0806 5816 [ 90567B1E658001E79D7C8BBD3DDE5AA6 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys 21:06:02.0808 5816 vwifibus - ok 21:06:02.0831 5816 [ 55187FD710E27D5095D10A472C8BAF1C ] W32Time C:\Windows\system32\w32time.dll 21:06:02.0839 5816 W32Time - ok 21:06:02.0854 5816 [ DE3721E89C653AA281428C8A69745D90 ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys 21:06:02.0857 5816 WacomPen - ok 21:06:02.0882 5816 [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys 21:06:02.0885 5816 WANARP - ok 21:06:02.0899 5816 [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys 21:06:02.0900 5816 Wanarpv6 - ok 21:06:02.0994 5816 [ 353A04C273EC58475D8633E75CCD5604 ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe 21:06:03.0038 5816 WatAdminSvc - ok 21:06:03.0091 5816 [ 691E3285E53DCA558E1A84667F13E15A ] wbengine C:\Windows\system32\wbengine.exe 21:06:03.0125 5816 wbengine - ok 21:06:03.0145 5816 [ 9614B5D29DC76AC3C29F6D2D3AA70E67 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll 21:06:03.0154 5816 WbioSrvc - ok 21:06:03.0184 5816 [ 34EEE0DFAADB4F691D6D5308A51315DC ] wcncsvc C:\Windows\System32\wcncsvc.dll 21:06:03.0201 5816 wcncsvc - ok 21:06:03.0218 5816 [ 5D930B6357A6D2AF4D7653BDABBF352F ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll 21:06:03.0222 5816 WcsPlugInService - ok 21:06:03.0243 5816 [ 1112A9BADACB47B7C0BB0392E3158DFF ] Wd C:\Windows\system32\DRIVERS\wd.sys 21:06:03.0245 5816 Wd - ok 21:06:03.0278 5816 [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys 21:06:03.0293 5816 Wdf01000 - ok 21:06:03.0304 5816 [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiServiceHost C:\Windows\system32\wdi.dll 21:06:03.0307 5816 WdiServiceHost - ok 21:06:03.0313 5816 [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiSystemHost C:\Windows\system32\wdi.dll 21:06:03.0316 5816 WdiSystemHost - ok 21:06:03.0344 5816 [ A9D880F97530D5B8FEE278923349929D ] WebClient C:\Windows\System32\webclnt.dll 21:06:03.0353 5816 WebClient - ok 21:06:03.0383 5816 [ 760F0AFE937A77CFF27153206534F275 ] Wecsvc C:\Windows\system32\wecsvc.dll 21:06:03.0392 5816 Wecsvc - ok 21:06:03.0407 5816 [ AC804569BB2364FB6017370258A4091B ] wercplsupport C:\Windows\System32\wercplsupport.dll 21:06:03.0410 5816 wercplsupport - ok 21:06:03.0430 5816 [ 08E420D873E4FD85241EE2421B02C4A4 ] WerSvc C:\Windows\System32\WerSvc.dll 21:06:03.0434 5816 WerSvc - ok 21:06:03.0463 5816 [ 8B9A943F3B53861F2BFAF6C186168F79 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys 21:06:03.0465 5816 WfpLwf - ok 21:06:03.0481 5816 [ 5CF95B35E59E2A38023836FFF31BE64C ] WIMMount C:\Windows\system32\drivers\wimmount.sys 21:06:03.0483 5816 WIMMount - ok 21:06:03.0536 5816 [ 3FAE8F94296001C32EAB62CD7D82E0FD ] WinDefend C:\Program Files\Windows Defender\mpsvc.dll 21:06:03.0553 5816 WinDefend - ok 21:06:03.0560 5816 WinHttpAutoProxySvc - ok 21:06:03.0611 5816 [ F62E510B6AD4C21EB9FE8668ED251826 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll 21:06:03.0613 5816 Winmgmt - ok 21:06:03.0670 5816 [ 1B91CD34EA3A90AB6A4EF0550174F4CC ] WinRM C:\Windows\system32\WsmSvc.dll 21:06:03.0704 5816 WinRM - ok 21:06:03.0740 5816 [ A67E5F9A400F3BD1BE3D80613B45F708 ] WinUSB C:\Windows\system32\DRIVERS\WinUSB.sys 21:06:03.0741 5816 WinUSB - ok 21:06:03.0785 5816 [ 16935C98FF639D185086A3529B1F2067 ] Wlansvc C:\Windows\System32\wlansvc.dll 21:06:03.0798 5816 Wlansvc - ok 21:06:03.0821 5816 [ 0217679B8FCA58714C3BF2726D2CA84E ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys 21:06:03.0822 5816 WmiAcpi - ok 21:06:03.0852 5816 [ 6EB6B66517B048D87DC1856DDF1F4C3F ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe 21:06:03.0856 5816 wmiApSrv - ok 21:06:03.0920 5816 [ 3B40D3A61AA8C21B88AE57C58AB3122E ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe 21:06:03.0954 5816 WMPNetworkSvc - ok 21:06:03.0979 5816 [ A2F0EC770A92F2B3F9DE6D518E11409C ] WPCSvc C:\Windows\System32\wpcsvc.dll 21:06:03.0983 5816 WPCSvc - ok 21:06:04.0014 5816 [ AA53356D60AF47EACC85BC617A4F3F66 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll 21:06:04.0017 5816 WPDBusEnum - ok 21:06:04.0035 5816 [ 6DB3276587B853BF886B69528FDB048C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys 21:06:04.0037 5816 ws2ifsl - ok 21:06:04.0049 5816 [ 6F5D49EFE0E7164E03AE773A3FE25340 ] wscsvc C:\Windows\System32\wscsvc.dll 21:06:04.0053 5816 wscsvc - ok 21:06:04.0059 5816 WSearch - ok 21:06:04.0144 5816 [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv C:\Windows\system32\wuaueng.dll 21:06:04.0209 5816 wuauserv - ok 21:06:04.0240 5816 [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys 21:06:04.0249 5816 WudfPf - ok 21:06:04.0285 5816 [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys 21:06:04.0287 5816 WUDFRd - ok 21:06:04.0310 5816 [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc C:\Windows\System32\WUDFSvc.dll 21:06:04.0314 5816 wudfsvc - ok 21:06:04.0339 5816 [ FF2D745B560F7C71B31F30F4D49F73D2 ] WwanSvc C:\Windows\System32\wwansvc.dll 21:06:04.0343 5816 WwanSvc - ok 21:06:04.0364 5816 ================ Scan global =============================== 21:06:04.0387 5816 [ DAB748AE0439955ED2FA22357533DDDB ] C:\Windows\system32\basesrv.dll 21:06:04.0420 5816 [ 1F5F07091D50244F17DD8D5147A628CC ] C:\Windows\system32\winsrv.dll 21:06:04.0437 5816 [ 1F5F07091D50244F17DD8D5147A628CC ] C:\Windows\system32\winsrv.dll 21:06:04.0456 5816 [ 364455805E64882844EE9ACB72522830 ] C:\Windows\system32\sxssrv.dll 21:06:04.0487 5816 [ 5F1B6A9C35D3D5CA72D6D6FDEF9747D6 ] C:\Windows\system32\services.exe 21:06:04.0504 5816 [Global] - ok 21:06:04.0505 5816 ================ Scan MBR ================================== 21:06:04.0522 5816 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1 21:06:04.0953 5816 \Device\Harddisk1\DR1 - ok 21:06:04.0972 5816 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk2\DR2 21:06:05.0122 5816 \Device\Harddisk2\DR2 - ok 21:06:05.0128 5816 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk3\DR3 21:06:05.0137 5816 \Device\Harddisk3\DR3 - ok 21:06:05.0137 5816 ================ Scan VBR ================================== 21:06:05.0141 5816 [ D6357B702153E4891611E1218AE19353 ] \Device\Harddisk1\DR1\Partition1 21:06:05.0143 5816 \Device\Harddisk1\DR1\Partition1 - ok 21:06:05.0172 5816 [ 0F5F3C2C9DB583E1B93CD96531D0D03E ] \Device\Harddisk1\DR1\Partition2 21:06:05.0173 5816 \Device\Harddisk1\DR1\Partition2 - ok 21:06:05.0177 5816 [ 3D7C6FCF5E0DD7F93DE8190F33E9BC53 ] \Device\Harddisk2\DR2\Partition1 21:06:05.0178 5816 \Device\Harddisk2\DR2\Partition1 - ok 21:06:05.0203 5816 [ ABBA2DF56C998E3AA6A25FA7EECA840F ] \Device\Harddisk2\DR2\Partition2 21:06:05.0204 5816 \Device\Harddisk2\DR2\Partition2 - ok 21:06:05.0210 5816 [ EE04ABFA7200323E001C23C9775BBF83 ] \Device\Harddisk3\DR3\Partition1 21:06:05.0213 5816 \Device\Harddisk3\DR3\Partition1 - ok 21:06:05.0213 5816 ============================================================ 21:06:05.0213 5816 Scan finished 21:06:05.0213 5816 ============================================================ 21:06:05.0231 5808 Detected object count: 0 21:06:05.0231 5808 Actual detected object count: 0

Hi icyjin,

We will make sure all drives are clean during the process.

= = = = = = = = = = = = = = = = = = = =

Is the external hard drive (X:\) still connected to the computer?

= = = = = = = = = = = = = = = = = = = =

Download ListParts to your Desktop.

• Right click ListParts.exe select "Run as Administrator" to launch the program.
• Press the Scan button.
• When finished scanning it will make a log Result.txt on your Desktop.
• Please post me the contents of the log.

- - - - - Next - - - - -

Refer to the ComboFix User's Guide

• Download ComboFix from the following location:
  
  Link
  
  * IMPORTANT !!! Place ComboFix.exe on your Desktop
  
• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
  You can get help on disabling your protection programs here
• Double click on ComboFix.exe & follow the prompts.
• Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
• When finished, it shall produce a log for you. Post that log in your next reply
  
  Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  
  ———————————————————————————————
  
• Ensure your AntiVirus and AntiSpyware applications are re-enabled.
  
  ———————————————————————————————

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

In your next post please provide the following:

• Answer about external drive
• Result.txt
• ComboFix.txt

Hi icyjin,

P2SP - I see you have/had/use P2SP ("peer to server to peer") Thunder Network on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections and possibly Identity Theft. It likely contributed to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2SP program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P/P2SP filesharing as a major conduit to spread their wares.

I would strongly recommend that you refrain from using it until we have finished cleaning your computer.

= = = = = = = = = = = = = = = = = = = =

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the codebox below into it:

Folder::
c:\users\Victor Lo\AppData\Roaming\Baidu
c:\programdata\Baidu
c:\program files\Baidu

Driver::
BaiduUpdater

Save this as CFScript.txt, in the same location as ComboFix.exe


[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe

When finished, please post the C:\ComboFix.txt for further review.

In your next post please provide the following:

• ComboFix.txt
• How is the computer running?

Hi icyjin,

but I only to use it to download video file, will that minimize my chance of getting infected since i do not download .exe file?

Unfortunatley no. Any type of file you might download from an unknown source can be infected with malware. That's why we strongly recommend not to use file sharing services, because although the service may be a trustworthty site, you/they cannot gaurantee that the files available for download are malware free.

After using combofix my RAMDISK is gone

Are you using a Paid or Freeware version?

= = = = = = = = = = = = = = = = = = = =

Download to your desktop RogueKiller (by tigzy)

Right click and select "Run as Administrator"

• Quit all programs
• Wait until Prescan has finished …
• Click on Scan, Do Not Fix Anything at this point.
• Click the Report button, save the report to your desktop

- - - - - Next - - - - -

Please download Malwarebytes' Anti-Malware to your desktop.

• Right click and select "Run as Administrator" mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan as shown below.
  
  [external image: Posted Image]
  
  
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure nothing is checked, and click Save Log.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

In your next post please provide the following:

• RogueKiller log
• MBAM log

Hi icyjin,

Can you please be more specific about the issues you are encountering other than "acting weird"?

= = = = = = = = = = = = = = = = = = = =

Re-run RogueKiller

Right click and select "Run as Administrator"

• Quit all programs
• Wait until Prescan has finished …
• Click on Scan.
• After the scan has completed click on the Registry tab
• Place a check mark next to each of the following entries:
  
  • RUN][HJNAME] [ON_E:Administrator]HKCU[…]\Run : ctfmon.exe (C:\WINDOWS\system32\ctfmon.exe) [7] -> FOUND
  • [RUN][SUSP PATH] [ON_E:Administrator]HKCU[…]\Run : XMP ("C:\DOCUME~1\ALLUSE~1\APPLIC~1\THUNDE~1\XMP4\Core\Program\XMP.exe" /embedding /sstartfrom Startup101) [x] -> FOUND
  • [RUN][HJNAME] [ON_E:Default User]HKCU[…]\Run : ctfmon.exe (C:\WINDOWS\system32\CTFMON.EXE) [7] -> FOUND
  • [RUN][HJNAME] [ON_E:LocalService]HKCU[…]\Run : ctfmon.exe (C:\WINDOWS\system32\CTFMON.EXE) [7] -> FOUND
  • [RUN][HJNAME] [ON_E:NetworkService]HKCU[…]\Run : ctfmon.exe (C:\WINDOWS\system32\CTFMON.EXE) [7] -> FOUND
    
• Remove the check mark from all other entries listed
• Click the Delete button
• Click the Report button, save the report to your desktop

- - - - - Next - - - - -

Locate Malwarebytes' Anti-Malware (it should be on your desktop).

• Double - click the MBAM icon to launch the program.
• Once the program has loaded, select the Update tab to get the latest updates before performing the scan.
• Select Perform quick scan, then click Scan.
  
  [external image: Posted Image]
  
  
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected .
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

In your next post please provide the following:

• RogueKiller log
• MBAM log
• How is the computer running at the moment?

Hi icyjin, Just checking in to see if you still need help?