Police e-crime virus [Solved]

Please do another scan with RogueKiller.

When it shows the results, check all the boxes next to the ZeroAccess detections then click on Delete. Post the log it produces.

======================================================

Please run these in the order requested.

Run TDSSKiller

Please download TDSSKiller.zip

• extract it to your desktop
• double click TDSSKiller.exe
• press Start Scan

  only if Malicious objects are found then ensure Cure is selected. Do not change it to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly.

• click Continue > Reboot now

• copy and paste the log in your next reply
• a copy of the log will be saved automatically to the root of the drive (typically C:\) called TDSSKiller_*** (*** denotes version & date)

======================================================

Download and run ComboFix

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It MUST be saved directly to your desktop. Choose save as and then make sure you choose Desktop

——————————————————————–

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

——————————————————————–

Double click on ComboFix.exe & follow the prompts.

• when finished, it will produce a report for you.
• please post the C:\ComboFix.txt for further review.

Logs to include with next post:

RogueKiller log
TDSSKiller log
ComboFix.txt

Thanks

Satchfan

I ran TDSSKiller. It detected no threats (so I didn't have the option to 'continue and reboot'). Here is the report: 07:53:29.0583 1964 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42 07:53:29.0926 1964 ============================================================ 07:53:29.0926 1964 Current date / time: 2013/05/06 07:53:29.0926 07:53:29.0926 1964 SystemInfo: 07:53:29.0926 1964 07:53:29.0926 1964 OS Version: 6.0.6002 ServicePack: 2.0 07:53:29.0926 1964 Product type: Workstation 07:53:29.0926 1964 ComputerName: STONE-PC 07:53:29.0926 1964 UserName: Peter 07:53:29.0926 1964 Windows directory: C:\Windows 07:53:29.0926 1964 System windows directory: C:\Windows 07:53:29.0926 1964 Processor architecture: Intel x86 07:53:29.0926 1964 Number of processors: 2 07:53:29.0926 1964 Page size: 0x1000 07:53:29.0926 1964 Boot type: Safe boot with network 07:53:29.0926 1964 ============================================================ 07:53:30.0894 1964 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050 07:53:30.0909 1964 ============================================================ 07:53:30.0909 1964 \Device\Harddisk0\DR0: 07:53:30.0909 1964 MBR partitions: 07:53:30.0909 1964 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x132F800, BlocksNum 0x1BE95970 07:53:30.0909 1964 ============================================================ 07:53:30.0940 1964 C: <-> \Device\Harddisk0\DR0\Partition1 07:53:30.0940 1964 ============================================================ 07:53:30.0940 1964 Initialize success 07:53:30.0940 1964 ============================================================ 07:53:34.0216 1896 ============================================================ 07:53:34.0216 1896 Scan started 07:53:34.0216 1896 Mode: Manual; 07:53:34.0216 1896 ============================================================ 07:53:34.0840 1896 ================ Scan system memory ======================== 07:53:34.0840 1896 System memory - ok 07:53:34.0840 1896 ================ Scan services ============================= 07:53:34.0996 1896 [ ADC420616C501B45D26C0FD3EF1E54E4 ] ACDaemon C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe 07:53:34.0996 1896 ACDaemon - ok 07:53:35.0152 1896 [ 82B296AE1892FE3DBEE00C9CF92F8AC7 ] ACPI C:\Windows\system32\drivers\acpi.sys 07:53:35.0152 1896 ACPI - ok 07:53:35.0262 1896 [ 9942DC4CC265CDA00486504444EF521D ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe 07:53:35.0262 1896 AdobeFlashPlayerUpdateSvc - ok 07:53:35.0340 1896 [ 04F0FCAC69C7C71A3AC4EB97FAFC8303 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys 07:53:35.0340 1896 adp94xx - ok 07:53:35.0402 1896 [ 60505E0041F7751BDBB80F88BF45C2CE ] adpahci C:\Windows\system32\drivers\adpahci.sys 07:53:35.0402 1896 adpahci - ok 07:53:35.0449 1896 [ 8A42779B02AEC986EAB64ECFC98F8BD7 ] adpu160m C:\Windows\system32\drivers\adpu160m.sys 07:53:35.0449 1896 adpu160m - ok 07:53:35.0480 1896 [ 241C9E37F8CE45EF51C3DE27515CA4E5 ] adpu320 C:\Windows\system32\drivers\adpu320.sys 07:53:35.0480 1896 adpu320 - ok 07:53:35.0558 1896 [ 9D1FDA9E086BA64E3C93C9DE32461BCF ] AeLookupSvc C:\Windows\System32\aelupsvc.dll 07:53:35.0558 1896 AeLookupSvc - ok 07:53:35.0636 1896 [ 3911B972B55FEA0478476B2E777B29FA ] AFD C:\Windows\system32\drivers\afd.sys 07:53:35.0636 1896 AFD - ok 07:53:35.0683 1896 [ 13F9E33747E6B41A3FF305C37DB0D360 ] agp440 C:\Windows\system32\drivers\agp440.sys 07:53:35.0683 1896 agp440 - ok 07:53:35.0730 1896 [ AE1FDF7BF7BB6C6A70F67699D880592A ] aic78xx C:\Windows\system32\drivers\djsvs.sys 07:53:35.0730 1896 aic78xx - ok 07:53:35.0792 1896 [ A1545B731579895D8CC44FC0481C1192 ] ALG C:\Windows\System32\alg.exe 07:53:35.0792 1896 ALG - ok 07:53:35.0823 1896 [ 9EAEF5FC9B8E351AFA7E78A6FAE91F91 ] aliide C:\Windows\system32\drivers\aliide.sys 07:53:35.0823 1896 aliide - ok 07:53:35.0854 1896 [ C47344BC706E5F0B9DCE369516661578 ] amdagp C:\Windows\system32\drivers\amdagp.sys 07:53:35.0854 1896 amdagp - ok 07:53:35.0886 1896 [ 9B78A39A4C173FDBC1321E0DD659B34C ] amdide C:\Windows\system32\drivers\amdide.sys 07:53:35.0886 1896 amdide - ok 07:53:35.0917 1896 [ 18F29B49AD23ECEE3D2A826C725C8D48 ] AmdK7 C:\Windows\system32\drivers\amdk7.sys 07:53:35.0917 1896 AmdK7 - ok 07:53:35.0948 1896 [ 93AE7F7DD54AB986A6F1A1B37BE7442D ] AmdK8 C:\Windows\system32\drivers\amdk8.sys 07:53:35.0948 1896 AmdK8 - ok 07:53:35.0995 1896 [ C6D704C7F0434DC791AAC37CAC4B6E14 ] Appinfo C:\Windows\System32\appinfo.dll 07:53:35.0995 1896 Appinfo - ok 07:53:36.0073 1896 [ 4FE5C6D40664AE07BE5105874357D2ED ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 07:53:36.0073 1896 Apple Mobile Device - ok 07:53:36.0166 1896 [ 5D2888182FB46632511ACEE92FDAD522 ] arc C:\Windows\system32\drivers\arc.sys 07:53:36.0166 1896 arc - ok 07:53:36.0229 1896 [ 5E2A321BD7C8B3624E41FDEC3E244945 ] arcsas C:\Windows\system32\drivers\arcsas.sys 07:53:36.0229 1896 arcsas - ok 07:53:36.0276 1896 [ 857B48965A0503B7AB795D4BFE7CBD8B ] ArcSoftKsUFilter C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys 07:53:36.0291 1896 ArcSoftKsUFilter - ok 07:53:36.0322 1896 [ 53B202ABEE6455406254444303E87BE1 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys 07:53:36.0322 1896 AsyncMac - ok 07:53:36.0354 1896 [ 2D9C903DC76A66813D350A562DE40ED9 ] atapi C:\Windows\system32\drivers\atapi.sys 07:53:36.0354 1896 atapi - ok 07:53:36.0447 1896 [ 600EFE56F37ADBD65A0FB076B50D1B8D ] athr C:\Windows\system32\DRIVERS\athr.sys 07:53:36.0447 1896 athr - ok 07:53:36.0666 1896 [ 9F66D1BA97911731133E46212539A08D ] atikmdag C:\Windows\system32\DRIVERS\atikmdag.sys 07:53:36.0712 1896 atikmdag - ok 07:53:36.0837 1896 [ 68E2A1A0407A66CF50DA0300852424AB ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll 07:53:36.0837 1896 AudioEndpointBuilder - ok 07:53:36.0853 1896 [ 68E2A1A0407A66CF50DA0300852424AB ] Audiosrv C:\Windows\System32\Audiosrv.dll 07:53:36.0853 1896 Audiosrv - ok 07:53:36.0978 1896 [ 6163664C7E9CD110AF70180C126C3FDC ] BcmSqlStartupSvc C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe 07:53:36.0978 1896 BcmSqlStartupSvc - ok 07:53:37.0040 1896 [ 67E506B75BD5326A3EC7B70BD014DFB6 ] Beep C:\Windows\system32\drivers\Beep.sys 07:53:37.0040 1896 Beep - ok 07:53:37.0321 1896 [ 89BF5550E4FC31E3FE728E68C558BF10 ] BHDrvx86 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\BASHDefs\20130412.001\BHDrvx86.sys 07:53:37.0321 1896 BHDrvx86 - ok 07:53:37.0446 1896 [ 93952506C6D67330367F7E7934B6A02F ] BITS C:\Windows\System32\qmgr.dll 07:53:37.0524 1896 BITS - ok 07:53:37.0570 1896 [ D4DF28447741FD3D953526E33A617397 ] blbdrive C:\Windows\system32\drivers\blbdrive.sys 07:53:37.0570 1896 blbdrive - ok 07:53:37.0648 1896 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe 07:53:37.0664 1896 Bonjour Service - ok 07:53:37.0742 1896 [ 35F376253F687BDE63976CCB3F2108CA ] bowser C:\Windows\system32\DRIVERS\bowser.sys 07:53:37.0742 1896 bowser - ok 07:53:37.0836 1896 [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo C:\Windows\system32\drivers\brfiltlo.sys 07:53:37.0836 1896 BrFiltLo - ok 07:53:37.0851 1896 [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp C:\Windows\system32\drivers\brfiltup.sys 07:53:37.0851 1896 BrFiltUp - ok 07:53:37.0898 1896 [ A3629A0C4226F9E9C72FAAEEBC3AD33C ] Browser C:\Windows\System32\browser.dll 07:53:37.0898 1896 Browser - ok 07:53:37.0945 1896 [ B304E75CFF293029EDDF094246747113 ] Brserid C:\Windows\system32\drivers\brserid.sys 07:53:37.0945 1896 Brserid - ok 07:53:37.0960 1896 [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm C:\Windows\system32\drivers\brserwdm.sys 07:53:37.0960 1896 BrSerWdm - ok 07:53:37.0992 1896 [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm C:\Windows\system32\drivers\brusbmdm.sys 07:53:37.0992 1896 BrUsbMdm - ok 07:53:38.0023 1896 [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer C:\Windows\system32\drivers\brusbser.sys 07:53:38.0023 1896 BrUsbSer - ok 07:53:38.0054 1896 [ AD07C1EC6665B8B35741AB91200C6B68 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys 07:53:38.0054 1896 BTHMODEM - ok 07:53:38.0148 1896 [ ACE85AF1C31F68BDFEE9333F6592917E ] ccSet_NIS C:\Windows\system32\drivers\NIS\1309010.00E\ccSetx86.sys 07:53:38.0148 1896 ccSet_NIS - ok 07:53:38.0210 1896 [ 2B2F9B4A08190334A9C36446B208BAE9 ] ccSet_NST C:\Windows\system32\drivers\NST\0200000.010\ccSetx86.sys 07:53:38.0210 1896 ccSet_NST - ok 07:53:38.0257 1896 [ 7ADD03E75BEB9E6DD102C3081D29840A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys 07:53:38.0257 1896 cdfs - ok 07:53:38.0304 1896 [ 6B4BFFB9BECD728097024276430DB314 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys 07:53:38.0304 1896 cdrom - ok 07:53:38.0366 1896 [ 312EC3E37A0A1F2006534913E37B4423 ] CertPropSvc C:\Windows\System32\certprop.dll 07:53:38.0366 1896 CertPropSvc - ok 07:53:38.0397 1896 [ E5D4133F37219DBCFE102BC61072589D ] circlass C:\Windows\system32\drivers\circlass.sys 07:53:38.0413 1896 circlass - ok 07:53:38.0460 1896 [ D7659D3B5B92C31E84E53C1431F35132 ] CLFS C:\Windows\system32\CLFS.sys 07:53:38.0460 1896 CLFS - ok 07:53:38.0569 1896 [ 8EE772032E2FE80A924F3B8DD5082194 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 07:53:38.0569 1896 clr_optimization_v2.0.50727_32 - ok 07:53:38.0694 1896 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 07:53:38.0740 1896 clr_optimization_v4.0.30319_32 - ok 07:53:38.0787 1896 [ 99AFC3795B58CC478FBBBCDC658FCB56 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys 07:53:38.0787 1896 CmBatt - ok 07:53:38.0818 1896 [ 0CA25E686A4928484E9FDABD168AB629 ] cmdide C:\Windows\system32\drivers\cmdide.sys 07:53:38.0818 1896 cmdide - ok 07:53:38.0834 1896 [ 6AFEF0B60FA25DE07C0968983EE4F60A ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys 07:53:38.0850 1896 Compbatt - ok 07:53:38.0850 1896 COMSysApp - ok 07:53:38.0881 1896 [ 741E9DFF4F42D2D8477D0FC1DC0DF871 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys 07:53:38.0881 1896 crcdisk - ok 07:53:38.0912 1896 [ 1F07BECDCA750766A96CDA811BA86410 ] Crusoe C:\Windows\system32\drivers\crusoe.sys 07:53:38.0912 1896 Crusoe - ok 07:53:39.0006 1896 [ F1E8C34892336D33EDDCDFE44E474F64 ] CryptSvc C:\Windows\system32\cryptsvc.dll 07:53:39.0006 1896 CryptSvc - ok 07:53:39.0084 1896 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] DcomLaunch C:\Windows\system32\rpcss.dll 07:53:39.0115 1896 DcomLaunch - ok 07:53:39.0162 1896 [ 622C41A07CA7E6DD91770F50D532CB6C ] DfsC C:\Windows\system32\Drivers\dfsc.sys 07:53:39.0162 1896 DfsC - ok 07:53:39.0255 1896 [ 2CC3DCFB533A1035B13DCAB6160AB38B ] DFSR C:\Windows\system32\DFSR.exe 07:53:39.0286 1896 DFSR - ok 07:53:39.0349 1896 [ 9028559C132146FB75EB7ACF384B086A ] Dhcp C:\Windows\System32\dhcpcsvc.dll 07:53:39.0364 1896 Dhcp - ok 07:53:39.0427 1896 [ 5D4AEFC3386920236A548271F8F1AF6A ] disk C:\Windows\system32\drivers\disk.sys 07:53:39.0427 1896 disk - ok 07:53:39.0474 1896 [ F206E28ED74C491FD5D7C0A1119CE37F ] DMICall C:\Windows\system32\DRIVERS\DMICall.sys 07:53:39.0474 1896 DMICall - ok 07:53:39.0536 1896 [ 57D762F6F5974AF0DA2BE88A3349BAAA ] Dnscache C:\Windows\System32\dnsrslvr.dll 07:53:39.0536 1896 Dnscache - ok 07:53:39.0598 1896 [ 324FD74686B1EF5E7C19A8AF49E748F6 ] dot3svc C:\Windows\System32\dot3svc.dll 07:53:39.0614 1896 dot3svc - ok 07:53:39.0661 1896 [ 4F59C172C094E1A1D46463A8DC061CBD ] Dot4 C:\Windows\system32\DRIVERS\Dot4.sys 07:53:39.0676 1896 Dot4 - ok 07:53:39.0708 1896 [ 80BF3BA09F6F2523C8F6B7CC6DBF7BD5 ] Dot4Print C:\Windows\system32\DRIVERS\Dot4Prt.sys 07:53:39.0708 1896 Dot4Print - ok 07:53:39.0754 1896 [ C55004CA6B419B6695970DFE849B122F ] dot4usb C:\Windows\system32\DRIVERS\dot4usb.sys 07:53:39.0754 1896 dot4usb - ok 07:53:39.0801 1896 [ A622E888F8AA2F6B49E9BC466F0E5DEF ] DPS C:\Windows\system32\dps.dll 07:53:39.0801 1896 DPS - ok 07:53:39.0864 1896 [ 97FEF831AB90BEE128C9AF390E243F80 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys 07:53:39.0864 1896 drmkaud - ok 07:53:39.0926 1896 [ C68AC676B0EF30CFBB1080ADCE49EB1F ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys 07:53:39.0942 1896 DXGKrnl - ok 07:53:39.0973 1896 [ 5425F74AC0C1DBD96A1E04F17D63F94C ] E1G60 C:\Windows\system32\DRIVERS\E1G60I32.sys 07:53:39.0973 1896 E1G60 - ok 07:53:40.0020 1896 [ C0B95E40D85CD807D614E264248A45B9 ] EapHost C:\Windows\System32\eapsvc.dll 07:53:40.0020 1896 EapHost - ok 07:53:40.0066 1896 [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371 ] Ecache C:\Windows\system32\drivers\ecache.sys 07:53:40.0082 1896 Ecache - ok 07:53:40.0191 1896 [ 85B8B4032A895A746D46A288A9B30DED ] eeCtrl C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 07:53:40.0191 1896 eeCtrl - ok 07:53:40.0254 1896 [ 9BE3744D295A7701EB425332014F0797 ] ehRecvr C:\Windows\ehome\ehRecvr.exe 07:53:40.0254 1896 ehRecvr - ok 07:53:40.0269 1896 [ AD1870C8E5D6DD340C829E6074BF3C3F ] ehSched C:\Windows\ehome\ehsched.exe 07:53:40.0269 1896 ehSched - ok 07:53:40.0285 1896 [ C27C4EE8926E74AA72EFCAB24C5242C3 ] ehstart C:\Windows\ehome\ehstart.dll 07:53:40.0285 1896 ehstart - ok 07:53:40.0347 1896 [ 23B62471681A124889978F6295B3F4C6 ] elxstor C:\Windows\system32\drivers\elxstor.sys 07:53:40.0363 1896 elxstor - ok 07:53:40.0441 1896 [ 4E6B23DFC917EA39306B529B773950F4 ] EMDMgmt C:\Windows\system32\emdmgmt.dll 07:53:40.0456 1896 EMDMgmt - ok 07:53:40.0488 1896 [ B5A8A04A6E5B4E86B95B1553AA918F5F ] EraserUtilRebootDrv C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 07:53:40.0503 1896 EraserUtilRebootDrv - ok 07:53:40.0519 1896 [ 3DB974F3935483555D7148663F726C61 ] ErrDev C:\Windows\system32\drivers\errdev.sys 07:53:40.0519 1896 ErrDev - ok 07:53:40.0566 1896 [ 67058C46504BC12D821F38CF99B7B28F ] EventSystem C:\Windows\system32\es.dll 07:53:40.0581 1896 EventSystem - ok 07:53:40.0628 1896 [ 22B408651F9123527BCEE54B4F6C5CAE ] exfat C:\Windows\system32\drivers\exfat.sys 07:53:40.0628 1896 exfat - ok 07:53:40.0675 1896 [ 1E9B9A70D332103C52995E957DC09EF8 ] fastfat C:\Windows\system32\drivers\fastfat.sys 07:53:40.0675 1896 fastfat - ok 07:53:40.0737 1896 [ AFE1E8B9782A0DD7FB46BBD88E43F89A ] fdc C:\Windows\system32\DRIVERS\fdc.sys 07:53:40.0737 1896 fdc - ok 07:53:40.0784 1896 [ 6629B5F0E98151F4AFDD87567EA32BA3 ] fdPHost C:\Windows\system32\fdPHost.dll 07:53:40.0784 1896 fdPHost - ok 07:53:40.0815 1896 [ 89ED56DCE8E47AF40892778A5BD31FD2 ] FDResPub C:\Windows\system32\fdrespub.dll 07:53:40.0831 1896 FDResPub - ok 07:53:40.0846 1896 [ A8C0139A884861E3AAE9CFE73B208A9F ] FileInfo C:\Windows\system32\drivers\fileinfo.sys 07:53:40.0846 1896 FileInfo - ok 07:53:40.0893 1896 [ 0AE429A696AECBC5970E3CF2C62635AE ] Filetrace C:\Windows\system32\drivers\filetrace.sys 07:53:40.0909 1896 Filetrace - ok 07:53:40.0924 1896 [ 85B7CF99D532820495D68D747FDA9EBD ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys 07:53:40.0924 1896 flpydisk - ok 07:53:41.0002 1896 [ 01334F9EA68E6877C4EF05D3EA8ABB05 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys 07:53:41.0002 1896 FltMgr - ok 07:53:41.0112 1896 [ 8CE364388C8ECA59B14B539179276D44 ] FontCache C:\Windows\system32\FntCache.dll 07:53:41.0127 1896 FontCache - ok 07:53:41.0205 1896 [ C7FBDD1ED42F82BFA35167A5C9803EA3 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe 07:53:41.0205 1896 FontCache3.0.0.0 - ok 07:53:41.0221 1896 [ B972A66758577E0BFD1DE0F91AAA27B5 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys 07:53:41.0221 1896 Fs_Rec - ok 07:53:41.0252 1896 [ 34582A6E6573D54A07ECE5FE24A126B5 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys 07:53:41.0268 1896 gagp30kx - ok 07:53:41.0314 1896 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 07:53:41.0314 1896 GEARAspiWDM - ok 07:53:41.0392 1896 [ 9F5F2F0FB0A7F5AA9F16B9A7B6DAD89F ] GoogleDesktopManager-051210-111108 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe 07:53:41.0392 1896 GoogleDesktopManager-051210-111108 - ok 07:53:41.0455 1896 [ CD5D0AEEE35DFD4E986A5AA1500A6E66 ] gpsvc C:\Windows\System32\gpsvc.dll 07:53:41.0470 1896 gpsvc - ok 07:53:41.0548 1896 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe 07:53:41.0548 1896 gupdate - ok 07:53:41.0564 1896 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe 07:53:41.0564 1896 gupdatem - ok 07:53:41.0611 1896 [ 649F407A844DDE2B97BC086AF97D663B ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 07:53:41.0611 1896 gusvc - ok 07:53:41.0689 1896 [ CB04C744BE0A61B1D648FAED182C3B59 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys 07:53:41.0689 1896 HdAudAddService - ok 07:53:41.0751 1896 [ 062452B7FFD68C8C042A6261FE8DFF4A ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys 07:53:41.0751 1896 HDAudBus - ok 07:53:41.0782 1896 [ 1338520E78D90154ED6BE8F84DE5FCEB ] HidBth C:\Windows\system32\drivers\hidbth.sys 07:53:41.0798 1896 HidBth - ok 07:53:41.0829 1896 [ FF3160C3A2445128C5A6D9B076DA519E ] HidIr C:\Windows\system32\drivers\hidir.sys 07:53:41.0829 1896 HidIr - ok 07:53:41.0907 1896 [ 84067081F3318162797385E11A8F0582 ] hidserv C:\Windows\system32\hidserv.dll 07:53:41.0907 1896 hidserv - ok 07:53:41.0938 1896 [ 3C64042B95E583B366BA4E5D2450235E ] HidUsb C:\Windows\system32\drivers\hidusb.sys 07:53:41.0938 1896 HidUsb - ok 07:53:41.0970 1896 [ D8AD255B37DA92434C26E4876DB7D418 ] hkmsvc C:\Windows\system32\kmsvc.dll 07:53:41.0985 1896 hkmsvc - ok 07:53:42.0032 1896 [ 16EE7B23A009E00D835CDB79574A91A6 ] HpCISSs C:\Windows\system32\drivers\hpcisss.sys 07:53:42.0032 1896 HpCISSs - ok 07:53:42.0141 1896 [ E4E285A3766B4A57401FEEAF66CB07B5 ] hpqcxs08 C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll 07:53:42.0141 1896 hpqcxs08 - ok 07:53:42.0172 1896 [ EE4C7A4CF2316701FFDE90F404520265 ] hpqddsvc C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll 07:53:42.0172 1896 hpqddsvc - ok 07:53:42.0219 1896 [ 7AC43C38CA8FD7ED0B0A4466F753E06E ] HPZius12 C:\Windows\system32\DRIVERS\HPZius12.sys 07:53:42.0219 1896 HPZius12 - ok 07:53:42.0282 1896 [ 46D67209550973257601A533E2AC5785 ] HSFHWAZL C:\Windows\system32\DRIVERS\VSTAZL3.SYS 07:53:42.0282 1896 HSFHWAZL - ok 07:53:42.0328 1896 [ 7BC42C65B5C6281777C1A7605B253BA8 ] HSF_DPV C:\Windows\system32\DRIVERS\HSX_DPV.sys 07:53:42.0344 1896 HSF_DPV - ok 07:53:42.0360 1896 [ 9EBF2D102CCBB6BCDFBF1B7922F8BA2E ] HSXHWAZL C:\Windows\system32\DRIVERS\HSXHWAZL.sys 07:53:42.0375 1896 HSXHWAZL - ok 07:53:42.0422 1896 [ F870AA3E254628EBEAFE754108D664DE ] HTTP C:\Windows\system32\drivers\HTTP.sys 07:53:42.0438 1896 HTTP - ok 07:53:42.0469 1896 [ C6B032D69650985468160FC9937CF5B4 ] i2omp C:\Windows\system32\drivers\i2omp.sys 07:53:42.0469 1896 i2omp - ok 07:53:42.0516 1896 [ 22D56C8184586B7A1F6FA60BE5F5A2BD ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys 07:53:42.0516 1896 i8042prt - ok 07:53:42.0578 1896 [ DB0CC620B27A928D968C1A1E9CD9CB87 ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys 07:53:42.0578 1896 iaStor - ok 07:53:42.0625 1896 [ 54155EA1B0DF185878E0FC9EC3AC3A14 ] iaStorV C:\Windows\system32\drivers\iastorv.sys 07:53:42.0625 1896 iaStorV - ok 07:53:42.0734 1896 [ 98477B08E61945F974ED9FDC4CB6BDAB ] idsvc C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 07:53:42.0750 1896 idsvc - ok 07:53:42.0906 1896 [ 404FB2AAF532BC7BBACC8880BE401C74 ] IDSVix86 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\IPSDefs\20130503.001\IDSvix86.sys 07:53:42.0921 1896 IDSVix86 - ok 07:53:43.0015 1896 [ CE5FF5D5E3F4CA974E36DC24C15474D0 ] igfx C:\Windows\system32\DRIVERS\igdkmd32.sys 07:53:43.0046 1896 igfx - ok 07:53:43.0093 1896 [ 2D077BF86E843F901D8DB709C95B49A5 ] iirsp C:\Windows\system32\drivers\iirsp.sys 07:53:43.0093 1896 iirsp - ok 07:53:43.0186 1896 [ 9908D8A397B76CD8D31D0D383C5773C9 ] IKEEXT C:\Windows\System32\ikeext.dll 07:53:43.0186 1896 IKEEXT - ok 07:53:43.0311 1896 [ 4A0F260DF9A5333C07F4AB40CA9D4F4B ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys 07:53:43.0327 1896 IntcAzAudAddService - ok 07:53:43.0374 1896 [ 83AA759F3189E6370C30DE5DC5590718 ] intelide C:\Windows\system32\drivers\intelide.sys 07:53:43.0374 1896 intelide - ok 07:53:43.0405 1896 [ 224191001E78C89DFA78924C3EA595FF ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys 07:53:43.0405 1896 intelppm - ok 07:53:43.0467 1896 [ 9AC218C6E6105477484C6FDBE7D409A4 ] IPBusEnum C:\Windows\system32\ipbusenum.dll 07:53:43.0467 1896 IPBusEnum - ok 07:53:43.0530 1896 [ 62C265C38769B864CB25B4BCF62DF6C3 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys 07:53:43.0530 1896 IpFilterDriver - ok 07:53:43.0530 1896 IpInIp - ok 07:53:43.0576 1896 [ B25AAF203552B7B3491139D582B39AD1 ] IPMIDRV C:\Windows\system32\drivers\ipmidrv.sys 07:53:43.0576 1896 IPMIDRV - ok 07:53:43.0608 1896 [ 8793643A67B42CEC66490B2A0CF92D68 ] IPNAT C:\Windows\system32\DRIVERS\ipnat.sys 07:53:43.0608 1896 IPNAT - ok 07:53:43.0686 1896 [ E46B17060D3962A384AE484094614788 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 07:53:43.0686 1896 iPod Service - ok 07:53:43.0717 1896 [ 109C0DFB82C3632FBD11949B73AEEAC9 ] IRENUM C:\Windows\system32\drivers\irenum.sys 07:53:43.0717 1896 IRENUM - ok 07:53:43.0779 1896 [ 6C70698A3E5C4376C6AB5C7C17FB0614 ] isapnp C:\Windows\system32\drivers\isapnp.sys 07:53:43.0779 1896 isapnp - ok 07:53:43.0842 1896 [ 232FA340531D940AAC623B121A595034 ] iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys 07:53:43.0842 1896 iScsiPrt - ok 07:53:43.0888 1896 [ BCED60D16156E428F8DF8CF27B0DF150 ] iteatapi C:\Windows\system32\drivers\iteatapi.sys 07:53:43.0888 1896 iteatapi - ok 07:53:43.0935 1896 [ 06FA654504A498C30ADCA8BEC4E87E7E ] iteraid C:\Windows\system32\drivers\iteraid.sys 07:53:43.0935 1896 iteraid - ok 07:53:43.0998 1896 [ 213822072085B5BBAD9AF30AB577D817 ] IviRegMgr c:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe 07:53:43.0998 1896 IviRegMgr - ok 07:53:44.0029 1896 [ 37605E0A8CF00CBBA538E753E4344C6E ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys 07:53:44.0029 1896 kbdclass - ok 07:53:44.0060 1896 [ 18247836959BA67E3511B62846B9C2E0 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys 07:53:44.0060 1896 kbdhid - ok 07:53:44.0107 1896 [ A3E186B4B935905B829219502557314E ] KeyIso C:\Windows\system32\lsass.exe 07:53:44.0107 1896 KeyIso - ok 07:53:44.0169 1896 [ 4A1445EFA932A3BAF5BDB02D7131EE20 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys 07:53:44.0169 1896 KSecDD - ok 07:53:44.0263 1896 [ 8078F8F8F7A79E2E6B494523A828C585 ] KtmRm C:\Windows\system32\msdtckrm.dll 07:53:44.0278 1896 KtmRm - ok 07:53:44.0325 1896 [ 1BF5EEBFD518DD7298434D8C862F825D ] LanmanServer C:\Windows\system32\srvsvc.dll 07:53:44.0325 1896 LanmanServer - ok 07:53:44.0372 1896 [ 1DB69705B695B987082C8BAEC0C6B34F ] LanmanWorkstation C:\Windows\System32\wkssvc.dll 07:53:44.0388 1896 LanmanWorkstation - ok 07:53:44.0434 1896 [ D1C5883087A0C3F1344D9D55A44901F6 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys 07:53:44.0434 1896 lltdio - ok 07:53:44.0481 1896 [ 2D5A428872F1442631D0959A34ABFF63 ] lltdsvc C:\Windows\System32\lltdsvc.dll 07:53:44.0497 1896 lltdsvc - ok 07:53:44.0528 1896 [ 35D40113E4A5B961B6CE5C5857702518 ] lmhosts C:\Windows\System32\lmhsvc.dll 07:53:44.0528 1896 lmhosts - ok 07:53:44.0575 1896 [ C7E15E82879BF3235B559563D4185365 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys 07:53:44.0575 1896 LSI_FC - ok 07:53:44.0606 1896 [ EE01EBAE8C9BF0FA072E0FF68718920A ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys 07:53:44.0606 1896 LSI_SAS - ok 07:53:44.0653 1896 [ 912A04696E9CA30146A62AFA1463DD5C ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys 07:53:44.0653 1896 LSI_SCSI - ok 07:53:44.0684 1896 [ 8F5C7426567798E62A3B3614965D62CC ] luafv C:\Windows\system32\drivers\luafv.sys 07:53:44.0684 1896 luafv - ok 07:53:44.0715 1896 [ AEF9BABB8A506BC4CE0451A64AADED46 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll 07:53:44.0715 1896 Mcx2Svc - ok 07:53:44.0762 1896 [ 0CEA2D0D3FA284B85ED5B68365114F76 ] mdmxsdk C:\Windows\system32\DRIVERS\mdmxsdk.sys 07:53:44.0762 1896 mdmxsdk - ok 07:53:44.0809 1896 [ 0001CE609D66632FA17B84705F658879 ] megasas C:\Windows\system32\drivers\megasas.sys 07:53:44.0809 1896 megasas - ok 07:53:44.0871 1896 [ C252F32CD9A49DBFC25ECF26EBD51A99 ] MegaSR C:\Windows\system32\drivers\megasr.sys 07:53:44.0887 1896 MegaSR - ok 07:53:44.0996 1896 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe 07:53:44.0996 1896 Microsoft Office Groove Audit Service - ok 07:53:45.0027 1896 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] MMCSS C:\Windows\system32\mmcss.dll 07:53:45.0027 1896 MMCSS - ok 07:53:45.0058 1896 [ E13B5EA0F51BA5B1512EC671393D09BA ] Modem C:\Windows\system32\drivers\modem.sys 07:53:45.0058 1896 Modem - ok 07:53:45.0090 1896 [ 0A9BB33B56E294F686ABB7C1E4E2D8A8 ] monitor C:\Windows\system32\DRIVERS\monitor.sys 07:53:45.0090 1896 monitor - ok 07:53:45.0121 1896 [ 5BF6A1326A335C5298477754A506D263 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys 07:53:45.0121 1896 mouclass - ok 07:53:45.0152 1896 [ 93B8D4869E12CFBE663915502900876F ] mouhid C:\Windows\system32\drivers\mouhid.sys 07:53:45.0152 1896 mouhid - ok 07:53:45.0183 1896 [ BDAFC88AA6B92F7842416EA6A48E1600 ] MountMgr C:\Windows\system32\drivers\mountmgr.sys 07:53:45.0183 1896 MountMgr - ok 07:53:45.0230 1896 [ 511D011289755DD9F9A7579FB0B064E6 ] mpio C:\Windows\system32\drivers\mpio.sys 07:53:45.0230 1896 mpio - ok 07:53:45.0261 1896 [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys 07:53:45.0261 1896 mpsdrv - ok 07:53:45.0292 1896 [ 4FBBB70D30FD20EC51F80061703B001E ] Mraid35x C:\Windows\system32\drivers\mraid35x.sys 07:53:45.0292 1896 Mraid35x - ok 07:53:45.0339 1896 [ 82CEA0395524AACFEB58BA1448E8325C ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys 07:53:45.0339 1896 MRxDAV - ok 07:53:45.0386 1896 [ 1E94971C4B446AB2290DEB71D01CF0C2 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys 07:53:45.0386 1896 mrxsmb - ok 07:53:45.0417 1896 [ 4FCCB34D793B116423209C0F8B7A3B03 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys 07:53:45.0433 1896 mrxsmb10 - ok 07:53:45.0448 1896 [ C3CB1B40AD4A0124D617A1199B0B9D7C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys 07:53:45.0448 1896 mrxsmb20 - ok 07:53:45.0511 1896 [ 28023E86F17001F7CD9B15A5BC9AE07D ] msahci C:\Windows\system32\drivers\msahci.sys 07:53:45.0511 1896 msahci - ok 07:53:45.0620 1896 [ A99D2C7E30AD63EF920A894131CAF5F7 ] MSCSPTISRV C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe 07:53:45.0620 1896 MSCSPTISRV - ok 07:53:45.0651 1896 [ 4468B0F385A86ECDDAF8D3CA662EC0E7 ] msdsm C:\Windows\system32\drivers\msdsm.sys 07:53:45.0651 1896 msdsm - ok 07:53:45.0698 1896 [ FD7520CC3A80C5FC8C48852BB24C6DED ] MSDTC C:\Windows\System32\msdtc.exe 07:53:45.0698 1896 MSDTC - ok 07:53:45.0729 1896 [ A9927F4A46B816C92F461ACB90CF8515 ] Msfs C:\Windows\system32\drivers\Msfs.sys 07:53:45.0729 1896 Msfs - ok 07:53:45.0792 1896 [ 0F400E306F385C56317357D6DEA56F62 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys 07:53:45.0792 1896 msisadrv - ok 07:53:45.0823 1896 [ 85466C0757A23D9A9AECDC0755203CB2 ] MSiSCSI C:\Windows\system32\iscsiexe.dll 07:53:45.0823 1896 MSiSCSI - ok 07:53:45.0823 1896 msiserver - ok 07:53:45.0854 1896 [ D8C63D34D9C9E56C059E24EC7185CC07 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys 07:53:45.0854 1896 MSKSSRV - ok 07:53:45.0885 1896 [ 1D373C90D62DDB641D50E55B9E78D65E ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys 07:53:45.0885 1896 MSPCLOCK - ok 07:53:45.0932 1896 [ B572DA05BF4E098D4BBA3A4734FB505B ] MSPQM C:\Windows\system32\drivers\MSPQM.sys 07:53:45.0932 1896 MSPQM - ok 07:53:45.0979 1896 [ B49456D70555DE905C311BCDA6EC6ADB ] MsRPC C:\Windows\system32\drivers\MsRPC.sys 07:53:45.0979 1896 MsRPC - ok 07:53:46.0026 1896 [ E384487CB84BE41D09711C30CA79646C ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys 07:53:46.0026 1896 mssmbios - ok 07:53:46.0088 1896 MSSQL$MSSMLBIZ - ok 07:53:46.0150 1896 [ 1D89EB4E2A99CABD4E81225F4F4C4B25 ] MSSQLServerADHelper c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe 07:53:46.0150 1896 MSSQLServerADHelper - ok 07:53:46.0197 1896 [ 7199C1EEC1E4993CAF96B8C0A26BD58A ] MSTEE C:\Windows\system32\drivers\MSTEE.sys 07:53:46.0197 1896 MSTEE - ok 07:53:46.0244 1896 [ 6A57B5733D4CB702C8EA4542E836B96C ] Mup C:\Windows\system32\Drivers\mup.sys 07:53:46.0244 1896 Mup - ok 07:53:46.0306 1896 [ E4EAF0C5C1B41B5C83386CF212CA9584 ] napagent C:\Windows\system32\qagentRT.dll 07:53:46.0306 1896 napagent - ok 07:53:46.0353 1896 [ 85C44FDFF9CF7E72A40DCB7EC06A4416 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys 07:53:46.0353 1896 NativeWifiP - ok 07:53:46.0462 1896 [ 7D7A3BC6640C1A0D1442816B30856928 ] NAVENG C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\VirusDefs\20130504.007\NAVENG.SYS 07:53:46.0462 1896 NAVENG - ok 07:53:46.0587 1896 [ 28494C43D62AA7584BDCA2FADFBC4D11 ] NAVEX15 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\VirusDefs\20130504.007\NAVEX15.SYS 07:53:46.0603 1896 NAVEX15 - ok 07:53:46.0665 1896 [ 1357274D1883F68300AEADD15D7BBB42 ] NDIS C:\Windows\system32\drivers\ndis.sys 07:53:46.0665 1896 NDIS - ok 07:53:46.0712 1896 [ 0E186E90404980569FB449BA7519AE61 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys 07:53:46.0712 1896 NdisTapi - ok 07:53:46.0728 1896 [ D6973AA34C4D5D76C0430B181C3CD389 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys 07:53:46.0728 1896 Ndisuio - ok 07:53:46.0790 1896 [ 818F648618AE34F729FDB47EC68345C3 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys 07:53:46.0790 1896 NdisWan - ok 07:53:46.0821 1896 [ 71DAB552B41936358F3B541AE5997FB3 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys 07:53:46.0821 1896 NDProxy - ok 07:53:46.0868 1896 [ A081CB6FB9A12668F233EB5414BE3A0E ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll 07:53:46.0868 1896 Net Driver HPZ12 - ok 07:53:46.0899 1896 [ BCD093A5A6777CF626434568DC7DBA78 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys 07:53:46.0899 1896 NetBIOS - ok 07:53:46.0946 1896 [ ECD64230A59CBD93C85F1CD1CAB9F3F6 ] netbt C:\Windows\system32\DRIVERS\netbt.sys 07:53:46.0946 1896 netbt - ok 07:53:46.0962 1896 [ A3E186B4B935905B829219502557314E ] Netlogon C:\Windows\system32\lsass.exe 07:53:46.0977 1896 Netlogon - ok 07:53:47.0008 1896 [ C8052711DAECC48B982434C5116CA401 ] Netman C:\Windows\System32\netman.dll 07:53:47.0024 1896 Netman - ok 07:53:47.0040 1896 [ 2EF3BBE22E5A5ACD1428EE387A0D0172 ] netprofm C:\Windows\System32\netprofm.dll 07:53:47.0040 1896 netprofm - ok 07:53:47.0102 1896 [ D6C4E4A39A36029AC0813D476FBD0248 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 07:53:47.0118 1896 NetTcpPortSharing - ok 07:53:47.0180 1896 [ 2E7FB731D4790A1BC6270ACCEFACB36E ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys 07:53:47.0180 1896 nfrd960 - ok 07:53:47.0274 1896 [ F2840DBFE9322F35557219AE82CC4597 ] NIS C:\Program Files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe 07:53:47.0274 1896 NIS - ok 07:53:47.0320 1896 [ 2997B15415F9BBE05B5A4C1C85E0C6A2 ] NlaSvc C:\Windows\System32\nlasvc.dll 07:53:47.0320 1896 NlaSvc - ok 07:53:47.0367 1896 [ D36F239D7CCE1931598E8FB90A0DBC26 ] Npfs C:\Windows\system32\drivers\Npfs.sys 07:53:47.0367 1896 Npfs - ok 07:53:47.0383 1896 [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD ] nsi C:\Windows\system32\nsisvc.dll 07:53:47.0398 1896 nsi - ok 07:53:47.0414 1896 [ 609773E344A97410CE4EBF74A8914FCF ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys 07:53:47.0414 1896 nsiproxy - ok 07:53:47.0476 1896 [ E127420B7FEB65C7F279EAAC183BBC0E ] NSL C:\Program Files\Norton Safe Web Lite\Engine\2.0.0.16\ccSvcHst.exe 07:53:47.0476 1896 NSL - ok 07:53:47.0523 1896 [ D7443616495851EC5B94574822773E80 ] NSUService C:\Program Files\sony\Network Utility\NSUService.exe 07:53:47.0539 1896 NSUService - ok 07:53:47.0632 1896 [ 2C1121F2B87E9A6B12485DF53CD848C7 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys 07:53:47.0648 1896 Ntfs - ok 07:53:47.0695 1896 [ E875C093AEC0C978A90F30C9E0DFBB72 ] ntrigdigi C:\Windows\system32\drivers\ntrigdigi.sys 07:53:47.0695 1896 ntrigdigi - ok 07:53:47.0726 1896 [ C5DBBCDA07D780BDA9B685DF333BB41E ] Null C:\Windows\system32\drivers\Null.sys 07:53:47.0726 1896 Null - ok 07:53:47.0757 1896 [ 2EDF9E7751554B42CBB60116DE727101 ] nvraid C:\Windows\system32\drivers\nvraid.sys 07:53:47.0757 1896 nvraid - ok 07:53:47.0773 1896 [ ABED0C09758D1D97DB0042DBB2688177 ] nvstor C:\Windows\system32\drivers\nvstor.sys 07:53:47.0773 1896 nvstor - ok 07:53:47.0820 1896 [ 18BBDF913916B71BD54575BDB6EEAC0B ] nv_agp C:\Windows\system32\drivers\nv_agp.sys 07:53:47.0820 1896 nv_agp - ok 07:53:47.0820 1896 NwlnkFlt - ok 07:53:47.0835 1896 NwlnkFwd - ok 07:53:47.0944 1896 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 07:53:47.0960 1896 odserv - ok 07:53:48.0022 1896 [ 6F310E890D46E246E0E261A63D9B36B4 ] ohci1394 C:\Windows\system32\DRIVERS\ohci1394.sys 07:53:48.0022 1896 ohci1394 - ok 07:53:48.0054 1896 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 07:53:48.0069 1896 ose - ok 07:53:48.0116 1896 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2pimsvc C:\Windows\system32\p2psvc.dll 07:53:48.0132 1896 p2pimsvc - ok 07:53:48.0163 1896 [ 0C8E8E61AD1EB0B250B846712C917506 ] p2psvc C:\Windows\system32\p2psvc.dll 07:53:48.0163 1896 p2psvc - ok 07:53:48.0225 1896 [ 41C33FB4FD929FED732A00D2DAEF5BE0 ] PACSPTISVR C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe 07:53:48.0225 1896 PACSPTISVR - ok 07:53:48.0272 1896 [ 0FA9B5055484649D63C303FE404E5F4D ] Parport C:\Windows\system32\drivers\parport.sys 07:53:48.0272 1896 Parport - ok 07:53:48.0319 1896 [ B9C2B89F08670E159F7181891E449CD9 ] partmgr C:\Windows\system32\drivers\partmgr.sys 07:53:48.0319 1896 partmgr - ok 07:53:48.0350 1896 [ 4F9A6A8A31413180D0FCB279AD5D8112 ] Parvdm C:\Windows\system32\drivers\parvdm.sys 07:53:48.0350 1896 Parvdm - ok 07:53:48.0381 1896 [ C6276AD11F4BB49B58AA1ED88537F14A ] PcaSvc C:\Windows\System32\pcasvc.dll 07:53:48.0397 1896 PcaSvc - ok 07:53:48.0428 1896 [ 941DC1D19E7E8620F40BBC206981EFDB ] pci C:\Windows\system32\drivers\pci.sys 07:53:48.0428 1896 pci - ok 07:53:48.0459 1896 [ FC175F5DDAB666D7F4D17449A547626F ] pciide C:\Windows\system32\drivers\pciide.sys 07:53:48.0459 1896 pciide - ok 07:53:48.0490 1896 [ E6F3FB1B86AA519E7698AD05E58B04E5 ] pcmcia C:\Windows\system32\drivers\pcmcia.sys 07:53:48.0506 1896 pcmcia - ok 07:53:48.0553 1896 [ 6349F6ED9C623B44B52EA3C63C831A92 ] PEAUTH C:\Windows\system32\drivers\peauth.sys 07:53:48.0568 1896 PEAUTH - ok 07:53:48.0678 1896 [ B1689DF169143F57053F795390C99DB3 ] pla C:\Windows\system32\pla.dll 07:53:48.0709 1896 pla - ok 07:53:48.0740 1896 [ C5E7F8A996EC0A82D508FD9064A5569E ] PlugPlay C:\Windows\system32\umpnpmgr.dll 07:53:48.0756 1896 PlugPlay - ok 07:53:48.0818 1896 [ 65BC271F337637731D3C71455AE1F476 ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll 07:53:48.0818 1896 Pml Driver HPZ12 - ok 07:53:48.0849 1896 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPAutoReg C:\Windows\system32\p2psvc.dll 07:53:48.0849 1896 PNRPAutoReg - ok 07:53:48.0880 1896 [ 0C8E8E61AD1EB0B250B846712C917506 ] PNRPsvc C:\Windows\system32\p2psvc.dll 07:53:48.0896 1896 PNRPsvc - ok 07:53:48.0958 1896 [ D0494460421A03CD5225CCA0059AA146 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll 07:53:48.0958 1896 PolicyAgent - ok 07:53:48.0990 1896 [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys 07:53:48.0990 1896 PptpMiniport - ok 07:53:49.0021 1896 [ 2027293619DD0F047C584CF2E7DF4FFD ] Processor C:\Windows\system32\drivers\processr.sys 07:53:49.0021 1896 Processor - ok 07:53:49.0068 1896 [ 0508FAA222D28835310B7BFCA7A77346 ] ProfSvc C:\Windows\system32\profsvc.dll 07:53:49.0068 1896 ProfSvc - ok 07:53:49.0099 1896 [ A3E186B4B935905B829219502557314E ] ProtectedStorage C:\Windows\system32\lsass.exe 07:53:49.0099 1896 ProtectedStorage - ok 07:53:49.0161 1896 [ 99514FAA8DF93D34B5589187DB3AA0BA ] PSched C:\Windows\system32\DRIVERS\pacer.sys 07:53:49.0161 1896 PSched - ok 07:53:49.0208 1896 [ 153D02480A0A2F45785522E814C634B6 ] PxHelp20 C:\Windows\system32\Drivers\PxHelp20.sys 07:53:49.0208 1896 PxHelp20 - ok 07:53:49.0286 1896 [ 0A6DB55AFB7820C99AA1F3A1D270F4F6 ] ql2300 C:\Windows\system32\drivers\ql2300.sys 07:53:49.0302 1896 ql2300 - ok 07:53:49.0333 1896 [ 81A7E5C076E59995D54BC1ED3A16E60B ] ql40xx C:\Windows\system32\drivers\ql40xx.sys 07:53:49.0333 1896 ql40xx - ok 07:53:49.0380 1896 [ E9ECAE663F47E6CB43962D18AB18890F ] QWAVE C:\Windows\system32\qwave.dll 07:53:49.0380 1896 QWAVE - ok 07:53:49.0411 1896 [ 9F5E0E1926014D17486901C88ECA2DB7 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys 07:53:49.0411 1896 QWAVEdrv - ok 07:53:49.0426 1896 [ 147D7F9C556D259924351FEB0DE606C3 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys 07:53:49.0426 1896 RasAcd - ok 07:53:49.0458 1896 [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F ] RasAuto C:\Windows\System32\rasauto.dll 07:53:49.0458 1896 RasAuto - ok 07:53:49.0489 1896 [ A214ADBAF4CB47DD2728859EF31F26B0 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys 07:53:49.0489 1896 Rasl2tp - ok 07:53:49.0551 1896 [ 75D47445D70CA6F9F894B032FBC64FCF ] RasMan C:\Windows\System32\rasmans.dll 07:53:49.0551 1896 RasMan - ok 07:53:49.0614 1896 [ 509A98DD18AF4375E1FC40BC175F1DEF ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys 07:53:49.0614 1896 RasPppoe - ok 07:53:49.0676 1896 [ 2005F4A1E05FA09389AC85840F0A9E4D ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys 07:53:49.0676 1896 RasSstp - ok 07:53:49.0723 1896 [ B14C9D5B9ADD2F84F70570BBBFAA7935 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys 07:53:49.0723 1896 rdbss - ok 07:53:49.0770 1896 [ 89E59BE9A564262A3FB6C4F4F1CD9899 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys 07:53:49.0770 1896 RDPCDD - ok 07:53:49.0816 1896 [ FBC0BACD9C3D7F6956853F64A66E252D ] rdpdr C:\Windows\system32\drivers\rdpdr.sys 07:53:49.0816 1896 rdpdr - ok 07:53:49.0832 1896 [ 9D91FE5286F748862ECFFA05F8A0710C ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys 07:53:49.0832 1896 RDPENCDD - ok 07:53:49.0879 1896 [ C127EBD5AFAB31524662C48DFCEB773A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys 07:53:49.0879 1896 RDPWD - ok 07:53:49.0926 1896 [ 001B4278407F4303EFC902A2B16F2453 ] regi C:\Windows\system32\drivers\regi.sys 07:53:49.0926 1896 regi - ok 07:53:49.0957 1896 [ BCDD6B4804D06B1F7EBF29E53A57ECE9 ] RemoteAccess C:\Windows\System32\mprdim.dll 07:53:49.0972 1896 RemoteAccess - ok 07:53:50.0004 1896 [ 9E6894EA18DAFF37B63E1005F83AE4AB ] RemoteRegistry C:\Windows\system32\regsvc.dll 07:53:50.0019 1896 RemoteRegistry - ok 07:53:50.0035 1896 [ D0C2A0CE1091E08EFB7CCBA6CEA4C3F9 ] rimsptsk C:\Windows\system32\DRIVERS\rimsptsk.sys 07:53:50.0035 1896 rimsptsk - ok 07:53:50.0066 1896 [ 53EA7C7D1D3C4B11AE0EA7C8D75C4E82 ] risdptsk C:\Windows\system32\DRIVERS\risdptsk.sys 07:53:50.0066 1896 risdptsk - ok 07:53:50.0097 1896 [ 5123F83CBC4349D065534EEB6BBDC42B ] RpcLocator C:\Windows\system32\locator.exe 07:53:50.0097 1896 RpcLocator - ok 07:53:50.0175 1896 [ 3B5B4D53FEC14F7476CA29A20CC31AC9 ] RpcSs C:\Windows\system32\rpcss.dll 07:53:50.0191 1896 RpcSs - ok 07:53:50.0222 1896 [ 9C508F4074A39E8B4B31D27198146FAD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys 07:53:50.0222 1896 rspndr - ok 07:53:50.0269 1896 [ 65330E78C17DB8A99A7FF1BA3C8824B6 ] RtkAudioService C:\Windows\RtkAudioService.exe 07:53:50.0269 1896 RtkAudioService - ok 07:53:50.0284 1896 [ A3E186B4B935905B829219502557314E ] SamSs C:\Windows\system32\lsass.exe 07:53:50.0300 1896 SamSs - ok 07:53:50.0347 1896 [ 3CE8F073A557E172B330109436984E30 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys 07:53:50.0347 1896 sbp2port - ok 07:53:50.0378 1896 [ 77B7A11A0C3D78D3386398FBBEA1B632 ] SCardSvr C:\Windows\System32\SCardSvr.dll 07:53:50.0394 1896 SCardSvr - ok 07:53:50.0440 1896 [ 1A58069DB21D05EB2AB58EE5753EBE8D ] Schedule C:\Windows\system32\schedsvc.dll 07:53:50.0456 1896 Schedule - ok 07:53:50.0487 1896 [ 312EC3E37A0A1F2006534913E37B4423 ] SCPolicySvc C:\Windows\System32\certprop.dll 07:53:50.0503 1896 SCPolicySvc - ok 07:53:50.0550 1896 [ 126EA89BCC413EE45E3004FB0764888F ] sdbus C:\Windows\system32\DRIVERS\sdbus.sys 07:53:50.0550 1896 sdbus - ok 07:53:50.0596 1896 [ 716313D9F6B0529D03F726D5AAF6F191 ] SDRSVC C:\Windows\System32\SDRSVC.dll 07:53:50.0596 1896 SDRSVC - ok 07:53:50.0628 1896 [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv C:\Windows\system32\drivers\secdrv.sys 07:53:50.0628 1896 secdrv - ok 07:53:50.0643 1896 [ FD5199D4D8A521005E4B5EE7FE00FA9B ] seclogon C:\Windows\system32\seclogon.dll 07:53:50.0659 1896 seclogon - ok 07:53:50.0690 1896 [ A9BBAB5759771E523F55563D6CBE140F ] SENS C:\Windows\System32\sens.dll 07:53:50.0690 1896 SENS - ok 07:53:50.0706 1896 [ 68E44E331D46F0FB38F0863A84CD1A31 ] Serenum C:\Windows\system32\drivers\serenum.sys 07:53:50.0721 1896 Serenum - ok 07:53:50.0752 1896 [ C70D69A918B178D3C3B06339B40C2E1B ] Serial C:\Windows\system32\drivers\serial.sys 07:53:50.0752 1896 Serial - ok 07:53:50.0768 1896 [ 8AF3D28A879BF75DB53A0EE7A4289624 ] sermouse C:\Windows\system32\drivers\sermouse.sys 07:53:50.0784 1896 sermouse - ok 07:53:50.0830 1896 [ D2193326F729B163125610DBF3E17D57 ] SessionEnv C:\Windows\system32\sessenv.dll 07:53:50.0846 1896 SessionEnv - ok 07:53:50.0908 1896 [ 8B7C1768D2CDE2E02E09A66563DDFD16 ] SFEP C:\Windows\system32\DRIVERS\SFEP.sys 07:53:50.0908 1896 SFEP - ok 07:53:50.0940 1896 [ 3EFA810BDCA87F6ECC24F9832243FE86 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys 07:53:50.0940 1896 sffdisk - ok 07:53:50.0971 1896 [ E95D451F7EA3E583AEC75F3B3EE42DC5 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys 07:53:50.0971 1896 sffp_mmc - ok 07:53:50.0986 1896 [ 3D0EA348784B7AC9EA9BD9F317980979 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys 07:53:50.0986 1896 sffp_sd - ok 07:53:51.0033 1896 [ 46ED8E91793B2E6F848015445A0AC188 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys 07:53:51.0033 1896 sfloppy - ok 07:53:51.0080 1896 [ C7230FBEE14437716701C15BE02C27B8 ] ShellHWDetection C:\Windows\System32\shsvcs.dll 07:53:51.0096 1896 ShellHWDetection - ok 07:53:51.0111 1896 [ 1D76624A09A054F682D746B924E2DBC3 ] sisagp C:\Windows\system32\drivers\sisagp.sys 07:53:51.0111 1896 sisagp - ok 07:53:51.0142 1896 [ 43CB7AA756C7DB280D01DA9B676CFDE2 ] SiSRaid2 C:\Windows\system32\drivers\sisraid2.sys 07:53:51.0142 1896 SiSRaid2 - ok 07:53:51.0158 1896 [ A99C6C8B0BAA970D8AA59DDC50B57F94 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys 07:53:51.0174 1896 SiSRaid4 - ok 07:53:51.0236 1896 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe 07:53:51.0236 1896 SkypeUpdate - ok 07:53:51.0392 1896 [ 862BB4CBC05D80C5B45BE430E5EF872F ] slsvc C:\Windows\system32\SLsvc.exe 07:53:51.0423 1896 slsvc - ok 07:53:51.0470 1896 [ 6EDC422215CD78AA8A9CDE6B30ABBD35 ] SLUINotify C:\Windows\system32\SLUINotify.dll 07:53:51.0470 1896 SLUINotify - ok 07:53:51.0532 1896 [ 7B75299A4D201D6A6533603D6914AB04 ] Smb C:\Windows\system32\DRIVERS\smb.sys 07:53:51.0532 1896 Smb - ok 07:53:51.0579 1896 [ 2A146A055B4401C16EE62D18B8E2A032 ] SNMPTRAP C:\Windows\System32\snmptrap.exe 07:53:51.0595 1896 SNMPTRAP - ok 07:53:51.0688 1896 [ 1A9DD46C547646A54CDB4065C1996A07 ] SOHCImp C:\Program Files\Sony\VAIO Media plus\SOHCImp.exe 07:53:51.0688 1896 SOHCImp - ok 07:53:51.0720 1896 [ 2E1B0D8278BB616148DDCA13DAE87544 ] SOHDms C:\Program Files\Sony\VAIO Media plus\SOHDms.exe 07:53:51.0720 1896 SOHDms - ok 07:53:51.0766 1896 [ 892529EE03211C35AEA7132E119F4862 ] SOHDs C:\Program Files\Sony\VAIO Media plus\SOHDs.exe 07:53:51.0766 1896 SOHDs - ok 07:53:51.0813 1896 [ 7AEBDEEF071FE28B0EEF2CDD69102BFF ] spldr C:\Windows\system32\drivers\spldr.sys 07:53:51.0813 1896 spldr - ok 07:53:51.0844 1896 [ 8554097E5136C3BF9F69FE578A1B35F4 ] Spooler C:\Windows\System32\spoolsv.exe 07:53:51.0860 1896 Spooler - ok 07:53:51.0907 1896 [ F63102F289AE2039940B22E9B2A8E0BD ] SPTISRV C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe 07:53:51.0907 1896 SPTISRV - ok 07:53:51.0938 1896 [ 86EBD8B1F23E743AAD21F4D5B4D40985 ] SQLBrowser c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe 07:53:51.0938 1896 SQLBrowser - ok 07:53:51.0969 1896 [ D89083C4EB02DACA8F944B0E05E57F9D ] SQLWriter c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe 07:53:51.0969 1896 SQLWriter - ok 07:53:52.0063 1896 [ 7BB297CADA42903328E92425D9761DA6 ] SRTSP C:\Windows\System32\Drivers\NIS\1309010.00E\SRTSP.SYS 07:53:52.0063 1896 SRTSP - ok 07:53:52.0078 1896 [ 475FCF0F28D845BF1C8ABAC27F19003E ] SRTSPX C:\Windows\system32\drivers\NIS\1309010.00E\SRTSPX.SYS 07:53:52.0078 1896 SRTSPX - ok 07:53:52.0125 1896 [ 41987F9FC0E61ADF54F581E15029AD91 ] srv C:\Windows\system32\DRIVERS\srv.sys 07:53:52.0141 1896 srv - ok 07:53:52.0188 1896 [ FF33AFF99564B1AA534F58868CBE41EF ] srv2 C:\Windows\system32\DRIVERS\srv2.sys 07:53:52.0188 1896 srv2 - ok 07:53:52.0203 1896 [ 7605C0E1D01A08F3ECD743F38B834A44 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys 07:53:52.0203 1896 srvnet - ok 07:53:52.0250 1896 [ 03D50B37234967433A5EA5BA72BC0B62 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll 07:53:52.0250 1896 SSDPSRV - ok 07:53:52.0281 1896 [ 6F1A32E7B7B30F004D9A20AFADB14944 ] SstpSvc C:\Windows\system32\sstpsvc.dll 07:53:52.0297 1896 SstpSvc - ok 07:53:52.0359 1896 [ 5DE7D67E49B88F5F07F3E53C4B92A352 ] stisvc C:\Windows\System32\wiaservc.dll 07:53:52.0375 1896 stisvc - ok 07:53:52.0406 1896 [ 7BA58ECF0C0A9A69D44B3DCA62BECF56 ] swenum C:\Windows\system32\DRIVERS\swenum.sys 07:53:52.0406 1896 swenum - ok 07:53:52.0453 1896 [ F21FD248040681CCA1FB6C9A03AAA93D ] swprv C:\Windows\System32\swprv.dll 07:53:52.0453 1896 swprv - ok 07:53:52.0484 1896 [ 192AA3AC01DF071B541094F251DEED10 ] Symc8xx C:\Windows\system32\drivers\symc8xx.sys 07:53:52.0484 1896 Symc8xx - ok 07:53:52.0562 1896 [ 690FA0E61B90084C4D9A721BD4F3D779 ] SymDS C:\Windows\system32\drivers\NIS\1309010.00E\SYMDS.SYS 07:53:52.0562 1896 SymDS - ok 07:53:52.0609 1896 [ 8F88EDB211B12537D2DC2A6D73D6067C ] SymEFA C:\Windows\system32\drivers\NIS\1309010.00E\SYMEFA.SYS 07:53:52.0624 1896 SymEFA - ok 07:53:52.0671 1896 [ 74E2521E96176A4449570E50BE91954D ] SymEvent C:\Windows\system32\Drivers\SYMEVENT.SYS 07:53:52.0671 1896 SymEvent - ok 07:53:52.0702 1896 [ 2C356CCA706505CF63CBE39D532B9236 ] SymIRON C:\Windows\system32\drivers\NIS\1309010.00E\Ironx86.SYS 07:53:52.0702 1896 SymIRON - ok 07:53:52.0765 1896 [ 40C6E6417C8B7D7FCF82CFBE71525795 ] SYMTDIv C:\Windows\System32\Drivers\NIS\1309010.00E\SYMTDIV.SYS 07:53:52.0765 1896 SYMTDIv - ok 07:53:52.0796 1896 [ 8C8EB8C76736EBAF3B13B633B2E64125 ] Sym_hi C:\Windows\system32\drivers\sym_hi.sys 07:53:52.0796 1896 Sym_hi - ok 07:53:52.0843 1896 [ 8072AF52B5FD103BBBA387A1E49F62CB ] Sym_u3 C:\Windows\system32\drivers\sym_u3.sys 07:53:52.0843 1896 Sym_u3 - ok 07:53:52.0905 1896 [ 99DA94793332AADBB17BBB521AE56E21 ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys 07:53:52.0905 1896 SynTP - ok 07:53:52.0983 1896 [ 9A51B04E9886AA4EE90093586B0BA88D ] SysMain C:\Windows\system32\sysmain.dll 07:53:52.0999 1896 SysMain - ok 07:53:53.0030 1896 [ 2DCA225EAE15F42C0933E998EE0231C3 ] TabletInputService C:\Windows\System32\TabSvc.dll 07:53:53.0046 1896 TabletInputService - ok 07:53:53.0092 1896 [ D7673E4B38CE21EE54C59EEEB65E2483 ] TapiSrv C:\Windows\System32\tapisrv.dll 07:53:53.0108 1896 TapiSrv - ok 07:53:53.0139 1896 [ CB05822CD9CC6C688168E113C603DBE7 ] TBS C:\Windows\System32\tbssvc.dll 07:53:53.0139 1896 TBS - ok 07:53:53.0202 1896 [ 74E2D020C47BB2B2FCCBA29A518A7EB4 ] Tcpip C:\Windows\system32\drivers\tcpip.sys 07:53:53.0217 1896 Tcpip - ok 07:53:53.0264 1896 [ 74E2D020C47BB2B2FCCBA29A518A7EB4 ] Tcpip6 C:\Windows\system32\DRIVERS\tcpip.sys 07:53:53.0264 1896 Tcpip6 - ok 07:53:53.0311 1896 [ 608C345A255D82A6289C2D468EB41FD7 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys 07:53:53.0311 1896 tcpipreg - ok 07:53:53.0358 1896 [ 5DCF5E267BE67A1AE926F2DF77FBCC56 ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys 07:53:53.0358 1896 TDPIPE - ok 07:53:53.0389 1896 [ 389C63E32B3CEFED425B61ED92D3F021 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys 07:53:53.0389 1896 TDTCP - ok 07:53:53.0451 1896 [ 76B06EB8A01FC8624D699E7045303E54 ] tdx C:\Windows\system32\DRIVERS\tdx.sys 07:53:53.0451 1896 tdx - ok 07:53:53.0467 1896 [ 3CAD38910468EAB9A6479E2F01DB43C7 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys 07:53:53.0467 1896 TermDD - ok 07:53:53.0529 1896 [ BB95DA09BEF6E7A131BFF3BA5032090D ] TermService C:\Windows\System32\termsrv.dll 07:53:53.0529 1896 TermService - ok 07:53:53.0560 1896 [ C7230FBEE14437716701C15BE02C27B8 ] Themes C:\Windows\system32\shsvcs.dll 07:53:53.0560 1896 Themes - ok 07:53:53.0592 1896 [ 1076FFCFFAAE8385FD62DFCB25AC4708 ] THREADORDER C:\Windows\system32\mmcss.dll 07:53:53.0592 1896 THREADORDER - ok 07:53:53.0701 1896 [ EFEF22B9577E5051057FDE1AE381B50C ] TomTomHOMEService C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe 07:53:53.0701 1896 TomTomHOMEService - ok 07:53:53.0732 1896 [ EC74E77D0EB004BD3A809B5F8FB8C2CE ] TrkWks C:\Windows\System32\trkwks.dll 07:53:53.0748 1896 TrkWks - ok 07:53:53.0779 1896 [ 81532F3628F8ACC80FD1264095960C3A ] TrueSight C:\Windows\system32\drivers\TrueSight.sys 07:53:53.0779 1896 TrueSight - ok 07:53:53.0888 1896 [ 97D9D6A04E3AD9B6C626B9931DB78DBA ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe 07:53:53.0888 1896 TrustedInstaller - ok 07:53:53.0935 1896 [ DCF0F056A2E4F52287264F5AB29CF206 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys 07:53:53.0935 1896 tssecsrv - ok 07:53:53.0982 1896 [ 300DB877AC094FEAB0BE7688C3454A9C ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys 07:53:53.0982 1896 tunnel - ok 07:53:54.0028 1896 [ 7D33C4DB2CE363C8518D2DFCF533941F ] uagp35 C:\Windows\system32\drivers\uagp35.sys 07:53:54.0028 1896 uagp35 - ok 07:53:54.0106 1896 [ 63F6D08C54D5B3C1B12A6172032055C7 ] uCamMonitor C:\Program Files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe 07:53:54.0106 1896 uCamMonitor - ok 07:53:54.0169 1896 [ D9728AF68C4C7693CB100B8441CBDEC6 ] udfs C:\Windows\system32\DRIVERS\udfs.sys 07:53:54.0169 1896 udfs - ok 07:53:54.0216 1896 [ ECEF404F62863755951E09C802C94AD5 ] UI0Detect C:\Windows\system32\UI0Detect.exe 07:53:54.0216 1896 UI0Detect - ok 07:53:54.0247 1896 UIUSys - ok 07:53:54.0278 1896 [ B0ACFDC9E4AF279E9116C03E014B2B27 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys 07:53:54.0278 1896 uliagpkx - ok 07:53:54.0309 1896 [ 9224BB254F591DE4CA8D572A5F0D635C ] uliahci C:\Windows\system32\drivers\uliahci.sys 07:53:54.0309 1896 uliahci - ok 07:53:54.0340 1896 [ 8514D0E5CD0534467C5FC61BE94A569F ] UlSata C:\Windows\system32\drivers\ulsata.sys 07:53:54.0340 1896 UlSata - ok 07:53:54.0372 1896 [ 38C3C6E62B157A6BC46594FADA45C62B ] ulsata2 C:\Windows\system32\drivers\ulsata2.sys 07:53:54.0372 1896 ulsata2 - ok 07:53:54.0387 1896 [ 32CFF9F809AE9AED85464492BF3E32D2 ] umbus C:\Windows\system32\DRIVERS\umbus.sys 07:53:54.0403 1896 umbus - ok 07:53:54.0418 1896 [ 68308183F4AE0BE7BF8ECD07CB297999 ] upnphost C:\Windows\System32\upnphost.dll 07:53:54.0434 1896 upnphost - ok 07:53:54.0512 1896 [ 6E421CCC57059B0186C6259CA3B6DFC9 ] USBAAPL C:\Windows\system32\Drivers\usbaapl.sys 07:53:54.0512 1896 USBAAPL - ok 07:53:54.0574 1896 [ CAF811AE4C147FFCD5B51750C7F09142 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys 07:53:54.0574 1896 usbccgp - ok 07:53:54.0606 1896 [ E9476E6C486E76BC4898074768FB7131 ] usbcir C:\Windows\system32\drivers\usbcir.sys 07:53:54.0621 1896 usbcir - ok 07:53:54.0668 1896 [ 79E96C23A97CE7B8F14D310DA2DB0C9B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys 07:53:54.0668 1896 usbehci - ok 07:53:54.0715 1896 [ 4673BBCB006AF60E7ABDDBE7A130BA42 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys 07:53:54.0715 1896 usbhub - ok 07:53:54.0762 1896 [ 38DBC7DD6CC5A72011F187425384388B ] usbohci C:\Windows\system32\drivers\usbohci.sys 07:53:54.0762 1896 usbohci - ok 07:53:54.0808 1896 [ E75C4B5269091D15A2E7DC0B6D35F2F5 ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys 07:53:54.0808 1896 usbprint - ok 07:53:54.0855 1896 [ A508C9BD8724980512136B039BBA65E9 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys 07:53:54.0855 1896 usbscan - ok 07:53:54.0886 1896 [ BE3DA31C191BC222D9AD503C5224F2AD ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS 07:53:54.0886 1896 USBSTOR - ok 07:53:54.0933 1896 [ 814D653EFC4D48BE3B04A307ECEFF56F ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys 07:53:54.0933 1896 usbuhci - ok 07:53:54.0980 1896 [ E67998E8F14CB0627A769F6530BCB352 ] usbvideo C:\Windows\system32\Drivers\usbvideo.sys 07:53:54.0980 1896 usbvideo - ok 07:53:55.0027 1896 [ 1509E705F3AC1D474C92454A5C2DD81F ] UxSms C:\Windows\System32\uxsms.dll 07:53:55.0042 1896 UxSms - ok 07:53:55.0105 1896 [ 2A640DC735CB0112AC1DCD1E1549B27E ] VAIO Entertainment TV Device Arbitration Service C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe 07:53:55.0105 1896 VAIO Entertainment TV Device Arbitration Service - ok 07:53:55.0167 1896 [ 2C3DBB9B671AB95245DED1EFC5276CE9 ] VAIO Event Service C:\Program Files\sony\VAIO Event Service\VESMgr.exe 07:53:55.0167 1896 VAIO Event Service - ok 07:53:55.0245 1896 [ DDD94D264CDA81B90580E2D41F295575 ] VAIO Power Management C:\Program Files\Sony\VAIO Power Management\SPMService.exe 07:53:55.0245 1896 VAIO Power Management - ok 07:53:55.0276 1896 [ 7773EB681E99217FD92E5E8A5A199AE5 ] VCFw C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe 07:53:55.0276 1896 VCFw - ok 07:53:55.0339 1896 [ 27888F132D2EE0B72B28093A5F5F20EB ] VcmIAlzMgr C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe 07:53:55.0339 1896 VcmIAlzMgr - ok 07:53:55.0417 1896 [ EE9ABFC2F8F2DCDC624B6A9D5CF3B19D ] VcmXmlIfHelper C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe 07:53:55.0417 1896 VcmXmlIfHelper - ok 07:53:55.0432 1896 Vcsw - ok 07:53:55.0479 1896 [ CD88D1B7776DC17A119049742EC07EB4 ] vds C:\Windows\System32\vds.exe 07:53:55.0495 1896 vds - ok 07:53:55.0526 1896 [ 87B06E1F30B749A114F74622D013F8D4 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys 07:53:55.0542 1896 vga - ok 07:53:55.0573 1896 [ 2E93AC0A1D8C79D019DB6C51F036636C ] VgaSave C:\Windows\System32\drivers\vga.sys 07:53:55.0573 1896 VgaSave - ok 07:53:55.0620 1896 [ 5D7159DEF58A800D5781BA3A879627BC ] viaagp C:\Windows\system32\drivers\viaagp.sys 07:53:55.0620 1896 viaagp - ok 07:53:55.0651 1896 [ C4F3A691B5BAD343E6249BD8C2D45DEE ] ViaC7 C:\Windows\system32\drivers\viac7.sys 07:53:55.0666 1896 ViaC7 - ok 07:53:55.0713 1896 [ AADF5587A4063F52C2C3FED7887426FC ] viaide C:\Windows\system32\drivers\viaide.sys 07:53:55.0713 1896 viaide - ok 07:53:55.0744 1896 [ 69503668AC66C77C6CD7AF86FBDF8C43 ] volmgr C:\Windows\system32\drivers\volmgr.sys 07:53:55.0744 1896 volmgr - ok 07:53:55.0791 1896 [ 23E41B834759917BFD6B9A0D625D0C28 ] volmgrx C:\Windows\system32\drivers\volmgrx.sys 07:53:55.0791 1896 volmgrx - ok 07:53:55.0838 1896 [ 786DB5771F05EF300390399F626BF30A ] volsnap C:\Windows\system32\drivers\volsnap.sys 07:53:55.0854 1896 volsnap - ok 07:53:55.0900 1896 [ 587253E09325E6BF226B299774B728A9 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys 07:53:55.0900 1896 vsmraid - ok 07:53:55.0978 1896 [ DB3D19F850C6EB32BDCB9BC0836ACDDB ] VSS C:\Windows\system32\vssvc.exe 07:53:55.0994 1896 VSS - ok 07:53:56.0041 1896 [ 071634532066C2E29350D450C3412837 ] VzCdbSvc C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe 07:53:56.0056 1896 VzCdbSvc - ok 07:53:56.0103 1896 [ 96EA68B9EB310A69C25EBB0282B2B9DE ] W32Time C:\Windows\system32\w32time.dll 07:53:56.0103 1896 W32Time - ok 07:53:56.0150 1896 [ 48DFEE8F1AF7C8235D4E626F0C4FE031 ] WacomPen C:\Windows\system32\drivers\wacompen.sys 07:53:56.0150 1896 WacomPen - ok 07:53:56.0197 1896 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarp C:\Windows\system32\DRIVERS\wanarp.sys 07:53:56.0197 1896 Wanarp - ok 07:53:56.0197 1896 [ 55201897378CCA7AF8B5EFD874374A26 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys 07:53:56.0212 1896 Wanarpv6 - ok 07:53:56.0244 1896 [ A3CD60FD826381B49F03832590E069AF ] wcncsvc C:\Windows\System32\wcncsvc.dll 07:53:56.0244 1896 wcncsvc - ok 07:53:56.0290 1896 [ 11BCB7AFCDD7AADACB5746F544D3A9C7 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll 07:53:56.0290 1896 WcsPlugInService - ok 07:53:56.0322 1896 [ 78FE9542363F297B18C027B2D7E7C07F ] Wd C:\Windows\system32\drivers\wd.sys 07:53:56.0337 1896 Wd - ok 07:53:56.0384 1896 [ A840213F1ACDCC175B4D1D5AAEAC0D7A ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys 07:53:56.0400 1896 Wdf01000 - ok 07:53:56.0415 1896 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiServiceHost C:\Windows\system32\wdi.dll 07:53:56.0431 1896 WdiServiceHost - ok 07:53:56.0431 1896 [ ABFC76B48BB6C96E3338D8943C5D93B5 ] WdiSystemHost C:\Windows\system32\wdi.dll 07:53:56.0431 1896 WdiSystemHost - ok 07:53:56.0478 1896 [ 04C37D8107320312FBAE09926103D5E2 ] WebClient C:\Windows\System32\webclnt.dll 07:53:56.0493 1896 WebClient - ok 07:53:56.0540 1896 [ AE3736E7E8892241C23E4EBBB7453B60 ] Wecsvc C:\Windows\system32\wecsvc.dll 07:53:56.0556 1896 Wecsvc - ok 07:53:56.0587 1896 [ 670FF720071ED741206D69BD995EA453 ] wercplsupport C:\Windows\System32\wercplsupport.dll 07:53:56.0587 1896 wercplsupport - ok 07:53:56.0634 1896 [ 32B88481D3B326DA6DEB07B1D03481E7 ] WerSvc C:\Windows\System32\WerSvc.dll 07:53:56.0634 1896 WerSvc - ok 07:53:56.0696 1896 [ 090A2B8F055343815556A01F725F6C35 ] WimFltr C:\Windows\system32\DRIVERS\wimfltr.sys 07:53:56.0696 1896 WimFltr - ok 07:53:56.0743 1896 [ 5A77AC34A0FFB70CE8B35B524FEDE9BA ] winachsf C:\Windows\system32\DRIVERS\HSX_CNXT.sys 07:53:56.0758 1896 winachsf - ok 07:53:56.0758 1896 WinHttpAutoProxySvc - ok 07:53:56.0836 1896 [ 6B2A1D0E80110E3D04E6863C6E62FD8A ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll 07:53:56.0836 1896 Winmgmt - ok 07:53:56.0930 1896 [ 7CFE68BDC065E55AA5E8421607037511 ] WinRM C:\Windows\system32\WsmSvc.dll 07:53:56.0961 1896 WinRM - ok 07:53:57.0039 1896 [ C008405E4FEEB069E30DA1D823910234 ] Wlansvc C:\Windows\System32\wlansvc.dll 07:53:57.0055 1896 Wlansvc - ok 07:53:57.0086 1896 [ 2E7255D172DF0B8283CDFB7B433B864E ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys 07:53:57.0086 1896 WmiAcpi - ok 07:53:57.0148 1896 [ 43BE3875207DCB62A85C8C49970B66CC ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe 07:53:57.0148 1896 wmiApSrv - ok 07:53:57.0211 1896 [ 3978704576A121A9204F8CC49A301A9B ] WMPNetworkSvc C:\Program Files\Windows Media Player\wmpnetwk.exe 07:53:57.0226 1896 WMPNetworkSvc - ok 07:53:57.0258 1896 [ CFC5A04558F5070CEE3E3A7809F3FF52 ] WPCSvc C:\Windows\System32\wpcsvc.dll 07:53:57.0258 1896 WPCSvc - ok 07:53:57.0320 1896 [ 801FBDB89D472B3C467EB112A0FC9246 ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll 07:53:57.0320 1896 WPDBusEnum - ok 07:53:57.0351 1896 [ DE9D36F91A4DF3D911626643DEBF11EA ] WpdUsb C:\Windows\system32\DRIVERS\wpdusb.sys 07:53:57.0367 1896 WpdUsb - ok 07:53:57.0523 1896 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe 07:53:57.0538 1896 WPFFontCache_v0400 - ok 07:53:57.0570 1896 [ E3A3CB253C0EC2494D4A61F5E43A389C ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys 07:53:57.0570 1896 ws2ifsl - ok 07:53:57.0570 1896 WSearch - ok 07:53:57.0679 1896 [ FC3EC24FCE372C89423E015A2AC1A31E ] wuauserv C:\Windows\system32\wuaueng.dll 07:53:57.0757 1896 wuauserv - ok 07:53:57.0788 1896 [ 06E6F32C8D0A3F66D956F57B43A2E070 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys 07:53:57.0804 1896 WudfPf - ok 07:53:57.0819 1896 [ 867C301E8B790040AE9CF6486E8041DF ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys 07:53:57.0819 1896 WUDFRd - ok 07:53:57.0866 1896 [ FE47B7BC8EA320C2D9B5E5BF6E303765 ] wudfsvc C:\Windows\System32\WUDFSvc.dll 07:53:57.0866 1896 wudfsvc - ok 07:53:57.0913 1896 [ 88AF537264F2B818DA15479CEEAF5D7C ] XAudio C:\Windows\system32\DRIVERS\xaudio.sys 07:53:57.0913 1896 XAudio - ok 07:53:57.0944 1896 [ 15A317674A08DF26BE65164D959E9203 ] XAudioService C:\Windows\system32\DRIVERS\xaudio.exe 07:53:57.0944 1896 XAudioService - ok 07:53:57.0975 1896 [ 7D4CCA3659FA0780603206E3D12A993F ] yukonwlh C:\Windows\system32\DRIVERS\yk60x86.sys 07:53:57.0975 1896 yukonwlh - ok 07:53:57.0991 1896 ================ Scan global =============================== 07:53:58.0022 1896 [ F31EEBC1A1C81FD04005489CC3DCDFE7 ] C:\Windows\system32\basesrv.dll 07:53:58.0069 1896 [ A508314231C49AEE86987CEA3EAECAD1 ] C:\Windows\system32\winsrv.dll 07:53:58.0100 1896 [ A508314231C49AEE86987CEA3EAECAD1 ] C:\Windows\system32\winsrv.dll 07:53:58.0147 1896 [ D4E6D91C1349B7BFB3599A6ADA56851B ] C:\Windows\system32\services.exe 07:53:58.0162 1896 [Global] - ok 07:53:58.0162 1896 ================ Scan MBR ================================== 07:53:58.0178 1896 [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0 07:53:58.0771 1896 \Device\Harddisk0\DR0 - ok 07:53:58.0771 1896 ================ Scan VBR ================================== 07:53:58.0771 1896 [ E3254C9207608B38A31FF3E4EA4FC12E ] \Device\Harddisk0\DR0\Partition1 07:53:58.0771 1896 \Device\Harddisk0\DR0\Partition1 - ok 07:53:58.0771 1896 ============================================================ 07:53:58.0771 1896 Scan finished 07:53:58.0771 1896 ============================================================ 07:53:58.0818 1184 Detected object count: 0 07:53:58.0818 1184 Actual detected object count: 0

I've had real problems running Combofix. I disabled the Norton virus from the user account which doesn't have the virus (Jane) as I couldn't do it in safe mode from the infected account (Peter). When I tried to run combofix from the infected account it said I still had virus check on. I then went to the healthy account and disabled the firewall as well. When I went back to the infected account it would no longer let me use it in safe mode. I just get the virus ecrime screen. I used the healthy user account to run combofix which was on the infected user desktop. It said a few errors about administrator access (although both user accounts are administrators).
Here is the report:

ComboFix 13-05-06.01 - Jane 06/05/2013 8:27.1.2 - x86 NETWORK
Running from: c:\users\[removed]\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\programdata\ejz6hr.pad
c:\programdata\rh6zje.dat
c:\programdata\rundll32.exe
c:\windows\Installer\{C4609419-C11E-4CE6-B369-F3F8A7DDD94C}\Shortcut_EventPlan_E2FBA8F7F7FD4C5EAA7D652BB0CAAA9D.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-04-06 to 2013-05-06 )))))))))))))))))))))))))))))))
.
.
2013-05-06 07:42 . 2013-05-06 07:42 ——– d—–w- c:\users\Peter\AppData\Local\temp
2013-05-06 07:42 . 2013-05-06 07:42 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-05-06 07:42 . 2013-05-06 07:44 ——– d—–w- c:\users\Jane\AppData\Local\temp
2013-05-06 07:09 . 2013-05-06 07:09 2634 —-a-w- c:\programdata\ejz6hr.js
2013-05-04 12:59 . 2013-05-04 12:59 ——– d—–w- c:\users\Peter\AppData\Local\ArcSoft
2013-04-10 19:44 . 2013-03-03 19:07 1082232 —-a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-10 19:44 . 2013-03-11 13:25 3603816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-04-10 19:44 . 2013-03-11 13:25 3551080 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 19:44 . 2013-03-09 03:45 49152 —-a-w- c:\windows\system32\csrsrv.dll
2013-04-10 19:44 . 2013-03-09 01:28 64000 —-a-w- c:\windows\system32\smss.exe
2013-04-10 19:44 . 2013-03-08 03:52 2067968 —-a-w- c:\windows\system32\mstscax.dll
2013-04-10 19:44 . 2013-03-05 01:40 2049024 —-a-w- c:\windows\system32\win32k.sys
2013-04-10 19:44 . 2013-03-08 03:53 376320 —-a-w- c:\windows\system32\winsrv.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-12 20:35 . 2012-07-01 09:34 693976 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-03-12 20:35 . 2011-05-17 13:56 73432 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-12 20:35 . 2013-03-12 20:35 15859416 —-a-w- c:\windows\system32\FlashPlayerInstaller.exe
2013-03-04 10:53 . 2013-03-04 10:53 94112 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-03-04 10:53 . 2013-03-04 10:54 861088 —-a-w- c:\windows\system32\npDeployJava1.dll
2013-03-04 10:53 . 2013-03-04 10:54 782240 —-a-w- c:\windows\system32\deployJava1.dll
2013-02-12 01:57 . 2013-03-12 20:55 15872 —-a-w- c:\windows\system32\drivers\usb8023.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2008-11-05 270336]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2011-04-22 247728]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"SacReminder"="c:\programdata\OfficeGuardian\reminder\SacReminder.exe" [2009-06-26 825152]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-10-17 6295552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-10 835584]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-22 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-22 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-22 145944]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-21 30192]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2008-04-04 317280]
"MarketingTools"="c:\program files\Sony\Marketing Tools\MarketingTools.exe" [2009-06-17 24576]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"Skytel"="Skytel.exe" [2008-10-17 1826816]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]
.
c:\users\Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
msconfig.lnk - c:\windows\System32\rundll32.exe [2006-11-2 44544]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Event Planner Reminder 2009.lnk - [N/A]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2008-11-06 01:32 98304 —-a-w- c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-11 07:39 1642448 —-a-w- c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-01 10:24]
.
2013-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-24 09:52]
.
2013-05-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-24 09:52]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/webhp?rlz=1W1SNYW&ie=UTF-8&oe=UTF-8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: ancestry.com
TCP: DhcpNameServer = 192.168.0.1
.
- - - - ORPHANS REMOVED - - - -
.
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-05-06 08:44
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\19.9.1.14\diMaster.dll\" /prefetch:1"
–
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NSL]
"ImagePath"="\"c:\program files\Norton Safe Web Lite\Engine\2.0.0.16\ccSvcHst.exe\" /s \"NSL\" /m \"c:\program files\Norton Safe Web Lite\Engine\2.0.0.16\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2013-05-06 08:47:24
ComboFix-quarantined-files.txt 2013-05-06 07:47
.
Pre-Run: 40,637,722,624 bytes free
Post-Run: 44,471,103,488 bytes free
.
- - End Of File - - ACC5BB5A5A9B672B1571BE4392659110

I tried to disable Norton again by right clicking on the Norton icon in the system tray. I get these two options, 📎disable_norton.jpg. I disabled both firewall and auto protect. When I went in to the infected account in safe mode I ran Combofix (with the file you sent ) it said a few things I couldn't do as I wasn't administrator and also antispyware from Norton was on.


Anyway here is the resulting report:



ComboFix 13-05-06.01 - Peter 06/05/2013 20:11:17.1.2 - x86 MINIMAL
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2938.2489 [GMT 1:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Users\Peter\Desktop\CFScript.txt
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FILE ::
"c:\programdata\ejz6hr.js"


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


c:\users\Default\AppData\Local\temp
c:\users\Jane\AppData\Local\temp
c:\users\Jane\AppData\Local\temp\~DF7AB9.tmp
c:\users\Jane\AppData\Local\temp\~DF86DD.tmp
c:\users\Jane\AppData\Local\temp\hpqddusr.log
c:\users\Jane\AppData\Local\temp\Jane.bmp
c:\users\Jane\AppData\Local\temp\jusched.log
c:\users\Jane\AppData\Local\temp\MAR92CC.tmp
c:\users\Jane\AppData\Local\temp\MAR932B.tmp
c:\users\Jane\AppData\Local\temp\MARDEAA.tmp
c:\users\Jane\AppData\Local\temp\MARE10C.tmp
c:\users\Peter\AppData\Local\temp


((((((((((((((((((((((((( Files Created from 2013-04-06 to 2013-05-06 )))))))))))))))))))))))))))))))


2013-05-06 07:09:44 . 2013-05-06 07:09:44 2634 —-a-w- C:\ProgramData\ejz6hr.js
2013-05-04 12:59:47 . 2013-05-04 12:59:47 ——– d—–w- C:\Users\Peter\AppData\Local\ArcSoft
2013-04-10 19:44:45 . 2013-03-03 19:07:52 1082232 —-a-w- C:\Windows\system32\drivers\ntfs.sys
2013-04-10 19:44:42 . 2013-03-11 13:25:50 3603816 —-a-w- C:\Windows\system32\ntkrnlpa.exe
2013-04-10 19:44:42 . 2013-03-11 13:25:50 3551080 —-a-w- C:\Windows\system32\ntoskrnl.exe
2013-04-10 19:44:42 . 2013-03-09 03:45:04 49152 —-a-w- C:\Windows\system32\csrsrv.dll
2013-04-10 19:44:42 . 2013-03-09 01:28:08 64000 —-a-w- C:\Windows\system32\smss.exe
2013-04-10 19:44:39 . 2013-03-08 03:52:22 2067968 —-a-w- C:\Windows\system32\mstscax.dll
2013-04-10 19:44:38 . 2013-03-05 01:40:56 2049024 —-a-w- C:\Windows\system32\win32k.sys
2013-04-10 19:44:36 . 2013-03-08 03:53:50 376320 —-a-w- C:\Windows\system32\winsrv.dll
.


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2013-03-12 20:35:43 . 2012-07-01 09:34:04 693976 —-a-w- C:\Windows\system32\FlashPlayerApp.exe
2013-03-12 20:35:43 . 2011-05-17 13:56:55 73432 —-a-w- C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-03-12 20:35:37 . 2013-03-12 20:35:36 15859416 —-a-w- C:\Windows\system32\FlashPlayerInstaller.exe
2013-03-04 10:53:03 . 2013-03-04 10:53:40 94112 —-a-w- C:\Windows\system32\WindowsAccessBridge.dll
2013-03-04 10:53:02 . 2013-03-04 10:54:16 861088 —-a-w- C:\Windows\system32\npDeployJava1.dll
2013-03-04 10:53:02 . 2013-03-04 10:54:16 782240 —-a-w- C:\Windows\system32\deployJava1.dll
2013-02-12 01:57:27 . 2013-03-12 20:55:51 15872 —-a-w- C:\Windows\system32\drivers\usb8023.sys


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NSUFloatingUI"="C:\Program Files\Sony\Network Utility\LANUtil.exe" [2008-11-05 23:53:56 270336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-10-17 10:50:40 6295552]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-10 02:43:03 835584]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2008-08-22 00:08:15 150040]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2008-08-22 00:07:45 170520]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2008-08-22 00:08:02 145944]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 09:38:00 34672]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-21 20:09:56 30192]
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2008-04-04 03:32:48 317280]
"MarketingTools"="C:\Program Files\Sony\Marketing Tools\MarketingTools.exe" [2009-06-17 19:14:54 24576]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 20:52:38 49152]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 17:36:46 30040]
"Skytel"="Skytel.exe" [2008-10-17 10:50:47 1826816]
"APSDaemon"="C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 12:08:14 59720]
"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 09:04:54 252848]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2013-02-20 11:35:28 152392]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2012-10-25 02:12:14 421888]

C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
msconfig.lnk - C:\Windows\System32\rundll32.exe [2006-11-2 44544]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Event Planner Reminder 2009.lnk - [N/A]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2008-11-06 01:32:32 98304 —-a-w- C:\Windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"

— Other Services/Drivers In Memory —

*NewlyCreated* - ECACHE

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-11 07:39:12 1642448 —-a-w- C:\Program Files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe

Contents of the 'Scheduled Tasks' folder

2013-05-06 C:\Windows\Tasks\Adobe Flash Player Updater.job
- C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-01 09:34:04 . 2013-02-27 10:24:45]

2013-05-06 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-24 09:52:57 . 2010-01-24 09:52:41]

2013-05-06 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-24 09:52:57 . 2010-01-24 09:52:41]


——- Supplementary Scan ——-

uStart Page = hxxp://www.google.co.uk/webhp?rlz=1W1SNYW&ie=UTF-8&oe=UTF-8
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1


**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-05-06 20:28:16
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NIS]
"ImagePath"="\"C:\Program Files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe\" /s \"NIS\" /m \"C:\Program Files\Norton Internet Security\Engine\19.9.1.14\diMaster.dll\" /prefetch:1"
–

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NSL]
"ImagePath"="\"C:\Program Files\Norton Safe Web Lite\Engine\2.0.0.16\ccSvcHst.exe\" /s \"NSL\" /m \"C:\Program Files\Norton Safe Web Lite\Engine\2.0.0.16\diMaster.dll\" /prefetch:1"

——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

Completion time: 2013-05-06 20:30:50
ComboFix-quarantined-files.txt 2013-05-06 19:30:48
ComboFix2.txt 2013-05-06 07:47:24

Pre-Run: 44,296,314,880 bytes free
Post-Run: 44,270,661,632 bytes free

- - End Of File - - 0903634D44DE63F3637A7A30DF9007AE


************************

I ran Rogue Killer. Here is the report:


RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Safe mode with network support
User : Peter [Admin rights]
Mode : Scan – Date : 05/06/2013 20:55:47
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[STARTUP][BLACKLISTDLL] msconfig.lnk @Peter : C:\Windows\System32\rundll32.exe|C:\PROGRA~2\rh6zje.dat,FG00 -> FOUND
[HJPOL] HKLM\[…]\System : DisableRegistryTools (0) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: TOSHIBA MK2552GSX +++++
— User —
[MBR] 367dec5578660464628f7a7aaec92fa1
[BSP] 2beaebb1b32947c71358ab5b1c8a8ffd : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 9822 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 20117504 | Size: 228651 Mo
User = LL1 … OK!
User = LL2 … OK!

Finished : << RKreport[1]_S_05062013_02d2055.txt >>
RKreport[1]_S_05062013_02d2055.txt

I ran rogue killer. I had to do a full scan rather than a prescan to see the file in the registry tab.
Here is the report:

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Safe mode with network support
User : Peter [Admin rights]
Mode : Remove – Date : 05/07/2013 15:43:47
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[STARTUP][BLACKLISTDLL] msconfig.lnk @Peter : C:\Windows\System32\rundll32.exe|C:\PROGRA~2\rh6zje.dat,FG00 -> DELETED
[HJPOL] HKLM\[…]\System : DisableRegistryTools (0) -> NOT SELECTED
[HJ DESK] HKLM\[…]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> NOT SELECTED
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NOT SELECTED

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: TOSHIBA MK2552GSX +++++
— User —
[MBR] 367dec5578660464628f7a7aaec92fa1
[BSP] 2beaebb1b32947c71358ab5b1c8a8ffd : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 9822 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 20117504 | Size: 228651 Mo
User = LL1 … OK!
User = LL2 … OK!

Finished : << RKreport[2]_D_05072013_02d1543.txt >>
RKreport[1]_S_05072013_02d1541.txt ; RKreport[2]_D_05072013_02d1543.txt



**********************************************
When I ran combofix it says I have norton on still. The only way I can disable it is to use the healthy account in normal mode. I then have to reboot in safe mode and use the infected account. I can't disable it in safe mode. Anyway here is the report:

ComboFix 13-05-06.01 - Peter 07/05/2013 15:54:27.1.2 - x86 NETWORK
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2938.2453 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Peter\Desktop\CFScript.txt
AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\programdata\ejz6hr.js"
.
.
((((((((((((((((((((((((( Files Created from 2013-04-07 to 2013-05-07 )))))))))))))))))))))))))))))))
.
.
2013-05-07 15:10 . 2013-05-07 15:10 ——– d—–w- c:\users\Peter\AppData\Local\temp
2013-05-07 15:10 . 2013-05-07 15:10 ——– d—–w- c:\users\Jane\AppData\Local\temp
2013-05-07 15:10 . 2013-05-07 15:10 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-05-06 07:09 . 2013-05-06 07:09 2634 —-a-w- c:\programdata\ejz6hr.js
2013-05-04 12:59 . 2013-05-04 12:59 ——– d—–w- c:\users\Peter\AppData\Local\ArcSoft
2013-04-10 19:44 . 2013-03-03 19:07 1082232 —-a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-10 19:44 . 2013-03-11 13:25 3603816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-04-10 19:44 . 2013-03-11 13:25 3551080 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 19:44 . 2013-03-09 03:45 49152 —-a-w- c:\windows\system32\csrsrv.dll
2013-04-10 19:44 . 2013-03-09 01:28 64000 —-a-w- c:\windows\system32\smss.exe
2013-04-10 19:44 . 2013-03-08 03:52 2067968 —-a-w- c:\windows\system32\mstscax.dll
2013-04-10 19:44 . 2013-03-05 01:40 2049024 —-a-w- c:\windows\system32\win32k.sys
2013-04-10 19:44 . 2013-03-08 03:53 376320 —-a-w- c:\windows\system32\winsrv.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-12 20:35 . 2012-07-01 09:34 693976 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-03-12 20:35 . 2011-05-17 13:56 73432 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-12 20:35 . 2013-03-12 20:35 15859416 —-a-w- c:\windows\system32\FlashPlayerInstaller.exe
2013-03-04 10:53 . 2013-03-04 10:53 94112 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-03-04 10:53 . 2013-03-04 10:54 861088 —-a-w- c:\windows\system32\npDeployJava1.dll
2013-03-04 10:53 . 2013-03-04 10:54 782240 —-a-w- c:\windows\system32\deployJava1.dll
2013-02-12 01:57 . 2013-03-12 20:55 15872 —-a-w- c:\windows\system32\drivers\usb8023.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2008-11-05 270336]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-10-17 6295552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-10 835584]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-22 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-22 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-22 145944]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-21 30192]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2008-04-04 317280]
"MarketingTools"="c:\program files\Sony\Marketing Tools\MarketingTools.exe" [2009-06-17 24576]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"Skytel"="Skytel.exe" [2008-10-17 1826816]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Event Planner Reminder 2009.lnk - [N/A]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2008-11-06 01:32 98304 —-a-w- c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - ECACHE
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-11 07:39 1642448 —-a-w- c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-01 10:24]
.
2013-05-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-24 09:52]
.
2013-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-24 09:52]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/webhp?rlz=1W1SNYW&ie=UTF-8&oe=UTF-8
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-05-07 16:10
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\19.9.1.14\diMaster.dll\" /prefetch:1"
–
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NSL]
"ImagePath"="\"c:\program files\Norton Safe Web Lite\Engine\2.0.0.16\ccSvcHst.exe\" /s \"NSL\" /m \"c:\program files\Norton Safe Web Lite\Engine\2.0.0.16\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2013-05-07 16:13:28
ComboFix-quarantined-files.txt 2013-05-07 15:13
ComboFix2.txt 2013-05-06 19:30
ComboFix3.txt 2013-05-06 07:47
.
Pre-Run: 44,214,792,192 bytes free
Post-Run: 44,194,811,904 bytes free
.
- - End Of File - - 3832B48F8E854F10F5034893A4CFD11C

Hi
I managed to get into the infected account now. I disabled all norton and ran combofix. Here is the report:

ComboFix 13-05-06.01 - Peter 07/05/2013 16:30:53.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2938.812 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2013-04-07 to 2013-05-07 )))))))))))))))))))))))))))))))
.
.
2013-05-07 15:46 . 2013-05-07 15:46 ——– d—–w- c:\users\Default\AppData\Local\temp
2013-05-07 15:13 . 2013-05-07 15:51 ——– d—–w- c:\users\Peter\AppData\Local\temp
2013-05-07 15:13 . 2013-05-07 15:46 ——– d—–w- c:\users\Jane\AppData\Local\temp
2013-05-06 07:09 . 2013-05-06 07:09 2634 —-a-w- c:\programdata\ejz6hr.js
2013-05-04 12:59 . 2013-05-04 12:59 ——– d—–w- c:\users\Peter\AppData\Local\ArcSoft
2013-04-10 19:44 . 2013-03-03 19:07 1082232 —-a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-10 19:44 . 2013-03-11 13:25 3603816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-04-10 19:44 . 2013-03-11 13:25 3551080 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-04-10 19:44 . 2013-03-09 03:45 49152 —-a-w- c:\windows\system32\csrsrv.dll
2013-04-10 19:44 . 2013-03-09 01:28 64000 —-a-w- c:\windows\system32\smss.exe
2013-04-10 19:44 . 2013-03-08 03:52 2067968 —-a-w- c:\windows\system32\mstscax.dll
2013-04-10 19:44 . 2013-03-05 01:40 2049024 —-a-w- c:\windows\system32\win32k.sys
2013-04-10 19:44 . 2013-03-08 03:53 376320 —-a-w- c:\windows\system32\winsrv.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-12 20:35 . 2012-07-01 09:34 693976 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-03-12 20:35 . 2011-05-17 13:56 73432 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-03-12 20:35 . 2013-03-12 20:35 15859416 —-a-w- c:\windows\system32\FlashPlayerInstaller.exe
2013-03-04 10:53 . 2013-03-04 10:53 94112 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-03-04 10:53 . 2013-03-04 10:54 861088 —-a-w- c:\windows\system32\npDeployJava1.dll
2013-03-04 10:53 . 2013-03-04 10:54 782240 —-a-w- c:\windows\system32\deployJava1.dll
2013-02-12 01:57 . 2013-03-12 20:55 15872 —-a-w- c:\windows\system32\drivers\usb8023.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2008-11-05 270336]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-10-17 6295552]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-10 835584]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-22 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-22 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-22 145944]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-07-21 30192]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2008-04-04 317280]
"MarketingTools"="c:\program files\Sony\Marketing Tools\MarketingTools.exe" [2009-06-17 24576]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"Skytel"="Skytel.exe" [2008-10-17 1826816]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Event Planner Reminder 2009.lnk - [N/A]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2008-11-06 01:32 98304 —-a-w- c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-11 07:39 1642448 —-a-w- c:\program files\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-05-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-01 10:24]
.
2013-05-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-24 09:52]
.
2013-05-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-24 09:52]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/webhp?rlz=1W1SNYW&ie=UTF-8&oe=UTF-8
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-05-07 16:53
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\19.9.1.14\diMaster.dll\" /prefetch:1"
–
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\NSL]
"ImagePath"="\"c:\program files\Norton Safe Web Lite\Engine\2.0.0.16\ccSvcHst.exe\" /s \"NSL\" /m \"c:\program files\Norton Safe Web Lite\Engine\2.0.0.16\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
———————— Other Running Processes ————————
.
c:\windows\RtkAudioService.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Sony\VAIO Update 4\VAIOUpdt.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
c:\program files\Norton Safe Web Lite\Engine\2.0.0.16\ccSvcHst.exe
c:\program files\sony\Network Utility\NSUService.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\TomTom HOME 2\TomTomHOMEService.exe
c:\program files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
c:\program files\sony\VAIO Event Service\VESMgr.exe
c:\program files\Sony\VAIO Power Management\SPMService.exe
c:\windows\system32\DllHost.exe
c:\program files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\windows\System32\WUDFHost.exe
c:\program files\sony\VAIO Event Service\VESMgrSub.exe
c:\windows\system32\DllHost.exe
c:\windows\system32\igfxext.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
c:\program files\Sony\VAIO Power Management\SPMgr.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2013-05-07 16:57:46 - machine was rebooted
ComboFix-quarantined-files.txt 2013-05-07 15:57
ComboFix2.txt 2013-05-07 15:13
ComboFix3.txt 2013-05-06 19:30
ComboFix4.txt 2013-05-06 07:47
.
Pre-Run: 41,127,620,608 bytes free
Post-Run: 41,101,414,400 bytes free
.
- - End Of File - - 2E059DCAF13B2F78E3107B260F580D97
****************************



All appears now to be fixed. Is it??????????????????????