Jump to content

jbjun

Members
 View Profile  See their activity

  • Posts

    10

  • Joined

  • Last visited

 Content Type 

Posts posted by jbjun

    Please Help! I have a rootkit virus!

    in Resolved Malware Removal Logs

    Posted

    MBAM:

    Malwarebytes Anti-Malware 1.65.1.1000

    www.malwarebytes.org

    Database version: v2012.11.19.10

    Windows 7 Service Pack 1 x64 NTFS

    Internet Explorer 9.0.8112.16421

    Josh Jun :: JOSHJUN-PC [administrator]

    11/19/2012 11:35:11 PM

    mbam-log-2012-11-19 (23-35-11).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 211764

    Time elapsed: 2 minute(s), 35 second(s)

    Memory Processes Detected: 0

    (No malicious items detected)

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 0

    (No malicious items detected)

    (end)

    Hijackthis:

    Logfile of Trend Micro HijackThis v2.0.4

    Scan saved at 11:43:56 PM, on 11/19/2012

    Platform: Windows 7 SP1 (WinNT 6.00.3505)

    MSIE: Internet Explorer v9.00 (9.00.8112.16455)

    Boot mode: Normal

    Running processes:

    C:\Program Files (x86)\Steam\Steam.exe

    C:\Program Files (x86)\Samsung\Kies\Kies.exe

    C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

    C:\Program Files (x86)\ASUS\EPU\EPU.exe

    C:\Program Files\ASUS\Ai Suite\QFan4\FanHelp.exe

    C:\Program Files\ASUS\TurboV EVO\TurboV_EVO.exe

    C:\Program Files\AVAST Software\Avast\AvastUI.exe

    C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE

    C:\Program Files (x86)\Internet Explorer\iexplore.exe

    C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_287_ActiveX.exe

    C:\Users\Josh Jun\Desktop\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    O2 - BHO: AMD SteadyVideo BHO - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - c:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll

    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

    O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

    O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

    O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

    O4 - HKLM\..\Run: [six Engine] "C:\Program Files (x86)\ASUS\EPU\EPU.exe" -b

    O4 - HKLM\..\Run: [QFan Help] "C:\Program Files\ASUS\Ai Suite\QFan4\FanHelp.exe"

    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    O4 - HKLM\..\Run: [TurboV EVO] "C:\Program Files\ASUS\TurboV EVO\TurboV_EVO.exe" -b

    O4 - HKLM\..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSPanel.exe /S

    O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

    O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

    O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe

    O4 - HKLM\..\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

    O4 - HKCU\..\Run: [steam] "C:\Program Files (x86)\Steam\steam.exe" -silent

    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

    O4 - HKCU\..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload

    O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000

    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll

    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL

    O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

    O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

    O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

    O18 - Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - c:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll

    O18 - Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - c:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll

    O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

    O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

    O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)

    O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

    O23 - Service: AMD RAIDXpert (AMD_RAIDXpert) - AMD - C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

    O23 - Service: ASUS System Control Service (AsSysCtrlService) - Unknown owner - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.05\AsSysCtrlService.exe

    O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe

    O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

    O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

    O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe

    O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

    O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files (x86)\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

    O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

    O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\AVLib\SsBeSvc.exe

    O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\AVLib\SPTISRV.exe

    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\AVLib\SSScsiSV.exe

    O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

    O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

    O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

    O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

    O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

    O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

    O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

    --

    End of file - 10618 bytes

    Please Help! I have a rootkit virus!

    in Resolved Malware Removal Logs

    Posted

    That is strange considering that last night avast was freaking out telling me about what seemed to be a persistent rootkit, notifying me every 20 seconds. Also I saw signs of a rootkit from running malwarebyte. Maybe I managed to delete it somehow in the process. Anyways my computer seems to be running fine and here is the data.

    ComboFix 12-11-19.03 - Josh Jun 11/19/2012 22:51:31.2.6 - x64

    Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8191.5747 [GMT -8:00]

    Running from: c:\users\Josh Jun\Desktop\ComboFix.exe

    Command switches used :: c:\users\Josh Jun\Desktop\CFScript.txt

    AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

    AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

    SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

    SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    * Created a new restore point

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    c:\users\Josh Jun\AppData\Local\Temp\fbe2808e-2380-4f14-a1fa-3fa9c3a364e8\CliSecureRT.dll

    c:\users\JOSHJU~1\AppData\Local\Temp\fbe2808e-2380-4f14-a1fa-3fa9c3a364e8\CliSecureRT.dll

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-10-20 to 2012-11-20 )))))))))))))))))))))))))))))))

    .

    .

    2012-11-20 06:57 . 2012-11-20 06:57 -------- d-----w- c:\users\Default\AppData\Local\temp

    2012-11-20 04:03 . 2012-11-20 04:03 -------- d-----w- c:\windows\SysWow64\wbem\Logs

    2012-11-20 02:33 . 2012-11-20 02:33 -------- d-----w- c:\users\Josh Jun\AppData\Roaming\Malwarebytes

    2012-11-20 02:33 . 2012-11-20 02:33 -------- d-----w- c:\programdata\Malwarebytes

    2012-11-20 02:33 . 2012-11-20 02:33 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

    2012-11-20 02:33 . 2012-09-30 03:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

    2012-11-19 10:09 . 2012-11-19 10:09 208216 ----a-w- c:\windows\system32\drivers\54425057.sys

    2012-11-19 09:25 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{481AAF01-2DFB-40F7-9138-445D8A5A2320}\mpengine.dll

    2012-11-19 08:35 . 2012-11-20 02:20 -------- d-sh--w- c:\users\Josh Jun\Drivers

    2012-11-18 02:13 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

    2012-11-15 07:27 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

    2012-11-15 07:27 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys

    2012-11-15 07:27 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui

    2012-11-15 07:27 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll

    2012-11-15 07:19 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys

    2012-11-15 07:19 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys

    2012-11-15 07:19 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll

    2012-11-15 07:19 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll

    2012-11-15 07:19 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll

    2012-11-15 07:19 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe

    2012-11-15 07:19 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll

    2012-11-11 06:33 . 2012-11-11 23:51 -------- d---a-w- c:\program files (x86)\dolphin-3.0-win64

    2012-11-10 07:18 . 2012-11-10 07:18 -------- d-----w- c:\users\Josh Jun\AppData\Local\Rockstar Games

    2012-11-08 18:58 . 2012-11-10 08:50 -------- d-----w- c:\users\Josh Jun\AppData\Roaming\Bioshock

    2012-11-08 18:04 . 2012-11-08 18:04 -------- d-----w- c:\program files (x86)\GameFly

    2012-11-03 00:30 . 2012-08-24 16:57 22016 ----a-w- c:\windows\SysWow64\secur32.dll

    2012-11-03 00:30 . 2012-08-24 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll

    2012-11-02 23:54 . 2012-11-02 23:54 -------- d-----w- c:\programdata\ATI

    2012-11-02 23:54 . 2012-11-02 23:54 -------- d-----w- c:\program files (x86)\AMD AVT

    2012-11-02 23:54 . 2012-11-02 23:54 -------- d-----w- c:\program files (x86)\AMD APP

    2012-10-21 18:08 . 2012-10-21 18:08 -------- d-----w- c:\program files (x86)\Common Files\Java

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-11-19 08:51 . 2012-02-03 22:35 189248 ----a-w- c:\windows\SysWow64\PnkBstrB.exe

    2012-11-19 08:51 . 2012-02-03 22:35 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe

    2012-11-15 07:20 . 2012-02-03 17:02 66395536 ----a-w- c:\windows\system32\MRT.exe

    2012-10-30 23:51 . 2012-02-03 11:08 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys

    2012-10-30 23:51 . 2012-02-03 11:08 370288 ----a-w- c:\windows\system32\drivers\aswSP.sys

    2012-10-30 23:51 . 2012-02-03 11:08 984144 ----a-w- c:\windows\system32\drivers\aswSnx.sys

    2012-10-30 23:51 . 2012-02-03 11:08 71600 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

    2012-10-30 23:51 . 2012-02-03 11:08 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

    2012-10-30 23:51 . 2012-02-03 11:05 41224 ----a-w- c:\windows\avastSS.scr

    2012-10-30 23:50 . 2012-02-03 11:05 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe

    2012-10-30 23:50 . 2012-02-03 11:08 285328 ----a-w- c:\windows\system32\aswBoot.exe

    2012-10-28 04:05 . 2012-02-04 05:51 282696 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr

    2012-10-28 03:53 . 2012-02-03 22:35 282696 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0

    2012-10-15 16:59 . 2012-02-25 03:15 54072 ----a-w- c:\windows\system32\drivers\aswRdr2.sys

    2012-10-09 01:02 . 2012-05-10 16:23 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2012-10-09 01:02 . 2012-02-03 10:46 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-10-09 01:02 . 2012-10-09 01:02 10220472 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe

    2012-10-04 05:27 . 2012-10-20 01:08 972192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A8AA0680-B89A-4D40-B39A-B8D6D7D1D1E5}\gapaengine.dll

    2012-10-04 05:27 . 2012-02-11 03:29 972192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

    2012-09-28 22:37 . 2012-09-28 22:37 221696 ----a-w- c:\windows\system32\clinfo.exe

    2012-09-28 22:36 . 2012-09-28 22:36 75776 ----a-w- c:\windows\system32\OpenVideo64.dll

    2012-09-28 22:36 . 2012-09-28 22:36 65536 ----a-w- c:\windows\SysWow64\OpenVideo.dll

    2012-09-28 22:36 . 2012-09-28 22:36 63488 ----a-w- c:\windows\system32\OVDecode64.dll

    2012-09-28 22:36 . 2012-09-28 22:36 56320 ----a-w- c:\windows\SysWow64\OVDecode.dll

    2012-09-28 22:36 . 2012-09-28 22:36 32635904 ----a-w- c:\windows\system32\amdocl64.dll

    2012-09-28 22:32 . 2012-09-28 22:32 27341824 ----a-w- c:\windows\SysWow64\amdocl.dll

    2012-09-28 02:23 . 2011-12-06 02:33 5557928 ----a-w- c:\windows\SysWow64\atiumdag.dll

    2012-09-28 02:21 . 2012-09-28 02:21 10697216 ----a-w- c:\windows\system32\drivers\atikmdag.sys

    2012-09-28 02:05 . 2012-09-28 02:05 70144 ----a-w- c:\windows\system32\coinst_9.002.dll

    2012-09-28 02:03 . 2012-09-28 02:03 163840 ----a-w- c:\windows\system32\atiapfxx.exe

    2012-09-28 02:02 . 2012-09-28 02:02 51200 ----a-w- c:\windows\system32\aticalrt64.dll

    2012-09-28 02:02 . 2012-09-28 02:02 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll

    2012-09-28 02:02 . 2012-09-28 02:02 44544 ----a-w- c:\windows\system32\aticalcl64.dll

    2012-09-28 02:02 . 2012-09-28 02:02 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll

    2012-09-28 02:02 . 2012-09-28 02:02 16082432 ----a-w- c:\windows\system32\aticaldd64.dll

    2012-09-28 01:59 . 2012-09-28 01:59 23825920 ----a-w- c:\windows\system32\atio6axx.dll

    2012-09-28 01:57 . 2012-09-28 01:57 13703168 ----a-w- c:\windows\SysWow64\aticaldd.dll

    2012-09-28 01:43 . 2011-12-06 03:17 935424 ----a-w- c:\windows\SysWow64\aticfx32.dll

    2012-09-28 01:41 . 2011-12-06 03:16 1120768 ----a-w- c:\windows\system32\aticfx64.dll

    2012-09-28 01:41 . 2012-09-28 01:41 19624960 ----a-w- c:\windows\SysWow64\atioglxx.dll

    2012-09-28 01:39 . 2012-09-28 01:39 6536192 ----a-w- c:\windows\SysWow64\atidxx32.dll

    2012-09-28 01:39 . 2012-09-28 01:39 442368 ----a-w- c:\windows\system32\atidemgy.dll

    2012-09-28 01:39 . 2012-09-28 01:39 538112 ----a-w- c:\windows\system32\atieclxx.exe

    2012-09-28 01:38 . 2012-09-28 01:38 239616 ----a-w- c:\windows\system32\atiesrxx.exe

    2012-09-28 01:36 . 2012-09-28 01:36 120320 ----a-w- c:\windows\system32\atitmm64.dll

    2012-09-28 01:36 . 2012-09-28 01:36 21504 ----a-w- c:\windows\system32\atimuixx.dll

    2012-09-28 01:36 . 2012-09-28 01:36 59392 ----a-w- c:\windows\system32\atiedu64.dll

    2012-09-28 01:36 . 2012-09-28 01:36 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll

    2012-09-28 01:31 . 2012-09-28 01:31 3127296 ----a-w- c:\windows\system32\atiumd6a.dll

    2012-09-28 01:25 . 2012-09-28 01:25 6704640 ----a-w- c:\windows\system32\atiumd64.dll

    2012-09-28 01:22 . 2011-12-06 02:51 7167488 ----a-w- c:\windows\system32\atidxx64.dll

    2012-09-28 01:22 . 2011-12-06 02:28 2691584 ----a-w- c:\windows\SysWow64\atiumdva.dll

    2012-09-28 01:13 . 2012-09-28 01:13 595456 ----a-w- c:\windows\system32\atiadlxx.dll

    2012-09-28 01:13 . 2012-09-28 01:13 405504 ----a-w- c:\windows\SysWow64\atiadlxy.dll

    2012-09-28 01:13 . 2012-09-28 01:13 17920 ----a-w- c:\windows\system32\atig6pxx.dll

    2012-09-28 01:13 . 2012-09-28 01:13 14848 ----a-w- c:\windows\SysWow64\atiglpxx.dll

    2012-09-28 01:13 . 2012-09-28 01:13 14848 ----a-w- c:\windows\system32\atiglpxx.dll

    2012-09-28 01:13 . 2012-09-28 01:13 41984 ----a-w- c:\windows\system32\atig6txx.dll

    2012-09-28 01:13 . 2012-09-28 01:13 33280 ----a-w- c:\windows\SysWow64\atigktxx.dll

    2012-09-28 01:12 . 2012-09-28 01:12 56320 ----a-w- c:\windows\system32\atimpc64.dll

    2012-09-28 01:12 . 2012-09-28 01:12 56320 ----a-w- c:\windows\system32\amdpcom64.dll

    2012-09-28 01:12 . 2012-09-28 01:12 460288 ----a-w- c:\windows\system32\drivers\atikmpag.sys

    2012-09-28 01:12 . 2012-09-28 01:12 56832 ----a-w- c:\windows\SysWow64\atimpc32.dll

    2012-09-28 01:12 . 2012-09-28 01:12 56832 ----a-w- c:\windows\SysWow64\amdpcom32.dll

    2012-09-28 01:11 . 2011-12-06 02:11 129536 ----a-w- c:\windows\system32\atiuxp64.dll

    2012-09-28 01:11 . 2012-09-28 01:11 109568 ----a-w- c:\windows\SysWow64\atiuxpag.dll

    2012-09-28 01:11 . 2012-09-28 01:11 103424 ----a-w- c:\windows\system32\atiu9p64.dll

    2012-09-28 01:10 . 2011-12-06 02:11 82944 ----a-w- c:\windows\SysWow64\atiu9pag.dll

    2012-09-28 01:09 . 2012-09-28 01:09 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll

    2012-09-24 22:32 . 2012-09-03 04:40 477168 ----a-w- c:\windows\SysWow64\npdeployJava1.dll

    2012-09-24 22:32 . 2012-02-06 06:57 473072 ----a-w- c:\windows\SysWow64\deployJava1.dll

    2012-09-19 17:02 . 2012-09-19 17:02 102368 ----a-w- c:\windows\system32\drivers\ssudbus.sys

    2012-09-19 17:02 . 2012-09-19 17:02 203104 ----a-w- c:\windows\system32\drivers\ssudmdm.sys

    2012-09-14 19:19 . 2012-10-11 07:21 2048 ----a-w- c:\windows\system32\tzres.dll

    2012-09-14 18:28 . 2012-10-11 07:21 2048 ----a-w- c:\windows\SysWow64\tzres.dll

    2012-08-31 18:19 . 2012-10-11 07:22 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys

    2012-08-31 05:03 . 2012-08-31 05:03 228768 ----a-w- c:\windows\system32\drivers\MpFilter.sys

    2012-08-31 05:03 . 2011-04-27 23:25 128456 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys

    2012-08-30 18:03 . 2012-10-11 07:22 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe

    2012-08-30 17:12 . 2012-10-11 07:22 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

    2012-08-30 17:12 . 2012-10-11 07:22 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

    2012-08-24 18:05 . 2012-10-11 07:21 220160 ----a-w- c:\windows\system32\wintrust.dll

    2012-08-24 16:57 . 2012-10-11 07:21 172544 ----a-w- c:\windows\SysWow64\wintrust.dll

    2012-08-22 18:12 . 2012-09-12 16:41 950128 ----a-w- c:\windows\system32\drivers\ndis.sys

    2012-08-22 18:12 . 2012-09-12 16:41 376688 ----a-w- c:\windows\system32\drivers\netio.sys

    2012-08-22 18:12 . 2012-09-12 16:41 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "Steam"="c:\program files (x86)\Steam\steam.exe" [2012-08-15 1353080]

    "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-02-13 3481408]

    "KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2012-08-31 964024]

    "KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-08-31 21432]

    "HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-12-06 393216]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "Six Engine"="c:\program files (x86)\ASUS\EPU\EPU.exe" [2011-04-12 5402752]

    "QFan Help"="c:\program files\ASUS\Ai Suite\QFan4\FanHelp.exe" [2010-03-25 888960]

    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-07-27 35768]

    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

    "TurboV EVO"="c:\program files\ASUS\TurboV EVO\TurboV_EVO.exe" [2010-11-12 10007168]

    "ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSPanel.exe" [2011-04-11 734544]

    "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]

    "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-27 30040]

    "KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-08-31 3524536]

    "amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]

    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]

    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-09-28 642728]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    "PromptOnSecureDesktop"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

    @="Service"

    .

    R2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-04-09 57472]

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

    R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-09-19 102368]

    R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [2012-02-04 21712]

    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 128456]

    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-13 368896]

    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

    R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2010-01-14 48416]

    R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [2010-01-14 29472]

    R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-09-19 203104]

    R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2010-01-14 48416]

    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-02-03 1255736]

    S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2006-10-18 52760]

    S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys [x]

    S1 aswSnx;aswSnx; [x]

    S1 aswSP;aswSP; [x]

    S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-03-17 283200]

    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-09-28 239616]

    S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-09-28 361984]

    S2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [2009-12-16 122880]

    S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-04-09 57472]

    S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.05\AsSysCtrlService.exe [2010-06-24 109056]

    S2 aswFsBlk;aswFsBlk; [x]

    S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 71600]

    S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2010-01-14 32544]

    S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]

    S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2011-06-02 128488]

    S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2011-06-02 401896]

    S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-05-14 96896]

    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]

    S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys [2010-12-03 1105000]

    S3 SaiK0CCB;SaiK0CCB;c:\windows\system32\DRIVERS\SaiK0CCB.sys [2010-08-10 171016]

    S3 SaiU0CCB;SaiU0CCB;c:\windows\system32\DRIVERS\SaiU0CCB.sys [2010-04-22 41096]

    .

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2012-11-20 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-10 01:02]

    .

    2012-11-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-03 10:45]

    .

    2012-11-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-03 10:45]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

    @="{472083B0-C522-11CF-8763-00608CC02F24}"

    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

    2012-10-30 23:50 133400 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

    @="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"

    [HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]

    2011-04-11 03:35 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

    @="{64174815-8D98-4CE6-8646-4C039977D808}"

    [HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]

    2011-04-11 03:35 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-06-28 11905128]

    "ProfilerU"="c:\program files\Saitek\SD6\Software\ProfilerU.exe" [2010-07-29 310272]

    "SaiMfd"="c:\program files\Saitek\SD6\Software\SaiMfd.exe" [2010-07-29 158208]

    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 1289704]

    .

    ------- Supplementary Scan -------

    .

    uLocal Page = c:\windows\system32\blank.htm

    uStart Page = hxxp://www.google.com

    mStart Page = hxxp://www.google.com

    mLocal Page = c:\windows\SysWOW64\blank.htm

    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000

    TCP: DhcpNameServer = 192.168.2.1

    .

    - - - - ORPHANS REMOVED - - - -

    .

    AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

    AddRemove-DVD5_DIGOTY - c:\program files (x86)\Dead Island GOTY\_Installer\unins000.exe

    AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe

    AddRemove-Uplay - c:\program files (x86)\Ubisoft\Ubisoft Game Launcher\Uninstall.exe

    .

    .

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_USERS\S-1-5-21-2077868140-2434586206-2512631317-1000\Software\SecuROM\License information*]

    "datasecu"=hex:66,38,1d,81,49,67,72,62,0a,a0,b0,0f,c2,1f,a0,eb,3f,72,ad,04,a6,

    a6,58,bc,e2,00,1e,19,ab,c2,d4,11,31,59,cb,aa,31,34,97,4d,71,e5,99,df,0c,95,\

    "rkeysecu"=hex:e6,0b,cf,9d,d3,83,e9,01,cc,63,28,ed,52,3a,aa,95

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Shockwave Flash Object"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

    @="0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

    @="ShockwaveFlash.ShockwaveFlash.11"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="ShockwaveFlash.ShockwaveFlash"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Macromedia Flash Factory Object"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

    @="FlashFactory.FlashFactory.1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="FlashFactory.FlashFactory"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]

    @="?????????????????? v1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

    @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]

    @="?????????????????? v2"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

    @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    ------------------------ Other Running Processes ------------------------

    .

    c:\program files\AVAST Software\Avast\AvastSvc.exe

    c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

    c:\program files (x86)\Cisco Systems\VPN Client\cvpnd.exe

    c:\windows\SysWOW64\PnkBstrA.exe

    c:\program files\ASUS\GPU Boost Driver\GpuBoostServer.exe

    c:\program files\ASUS\TurboV EVO\TurboVHELP.exe

    .

    **************************************************************************

    .

    Completion time: 2012-11-19 23:04:02 - machine was rebooted

    ComboFix-quarantined-files.txt 2012-11-20 07:04

    ComboFix2.txt 2012-11-20 05:56

    .

    Pre-Run: 579,250,020,352 bytes free

    Post-Run: 579,189,264,384 bytes free

    .

    - - End Of File - - B1B7EBE8577404B879E8D18DC5732B37

    Please Help! I have a rootkit virus!

    in Resolved Malware Removal Logs

    Posted

    Hi. This is the TDSSKiller

    22:25:04.0180 1556 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35

    22:25:04.0732 1556 ============================================================

    22:25:04.0732 1556 Current date / time: 2012/11/19 22:25:04.0732

    22:25:04.0732 1556 SystemInfo:

    22:25:04.0732 1556

    22:25:04.0732 1556 OS Version: 6.1.7601 ServicePack: 1.0

    22:25:04.0732 1556 Product type: Workstation

    22:25:04.0733 1556 ComputerName: JOSHJUN-PC

    22:25:04.0733 1556 UserName: Josh Jun

    22:25:04.0733 1556 Windows directory: C:\Windows

    22:25:04.0733 1556 System windows directory: C:\Windows

    22:25:04.0733 1556 Running under WOW64

    22:25:04.0733 1556 Processor architecture: Intel x64

    22:25:04.0733 1556 Number of processors: 6

    22:25:04.0733 1556 Page size: 0x1000

    22:25:04.0734 1556 Boot type: Normal boot

    22:25:04.0734 1556 ============================================================

    22:25:05.0782 1556 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

    22:25:05.0798 1556 ============================================================

    22:25:05.0798 1556 \Device\Harddisk0\DR0:

    22:25:05.0798 1556 MBR partitions:

    22:25:05.0798 1556 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x6, StartLBA 0x800, BlocksNum 0x64000

    22:25:05.0798 1556 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x64800, BlocksNum 0x746A1800

    22:25:05.0798 1556 ============================================================

    22:25:05.0843 1556 C: <-> \Device\Harddisk0\DR0\Partition2

    22:25:05.0846 1556 ============================================================

    22:25:05.0846 1556 Initialize success

    22:25:05.0846 1556 ============================================================

    22:25:07.0095 1208 ============================================================

    22:25:07.0095 1208 Scan started

    22:25:07.0095 1208 Mode: Manual;

    22:25:07.0096 1208 ============================================================

    22:25:08.0023 1208 ================ Scan system memory ========================

    22:25:08.0023 1208 System memory - ok

    22:25:08.0024 1208 ================ Scan services =============================

    22:25:08.0512 1208 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys

    22:25:08.0518 1208 1394ohci - ok

    22:25:08.0589 1208 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys

    22:25:08.0596 1208 ACPI - ok

    22:25:08.0653 1208 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys

    22:25:08.0654 1208 AcpiPmi - ok

    22:25:08.0829 1208 [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    22:25:08.0832 1208 AdobeARMservice - ok

    22:25:08.0959 1208 [ 44C00A385CA9DBC1D5CF3781F8C26AEA ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

    22:25:08.0965 1208 AdobeFlashPlayerUpdateSvc - ok

    22:25:09.0042 1208 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys

    22:25:09.0052 1208 adp94xx - ok

    22:25:09.0070 1208 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys

    22:25:09.0074 1208 adpahci - ok

    22:25:09.0126 1208 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys

    22:25:09.0129 1208 adpu320 - ok

    22:25:09.0157 1208 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll

    22:25:09.0159 1208 AeLookupSvc - ok

    22:25:09.0242 1208 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys

    22:25:09.0248 1208 AFD - ok

    22:25:09.0260 1208 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys

    22:25:09.0262 1208 agp440 - ok

    22:25:09.0306 1208 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe

    22:25:09.0309 1208 ALG - ok

    22:25:09.0360 1208 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys

    22:25:09.0362 1208 aliide - ok

    22:25:09.0436 1208 [ 4C1E3649C89C7D542CD18ECC5210099D ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe

    22:25:09.0441 1208 AMD External Events Utility - ok

    22:25:09.0556 1208 AMD FUEL Service - ok

    22:25:09.0566 1208 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys

    22:25:09.0568 1208 amdide - ok

    22:25:09.0621 1208 [ 6A2EEB0C4133B20773BB3DD0B7B377B4 ] amdiox64 C:\Windows\system32\DRIVERS\amdiox64.sys

    22:25:09.0623 1208 amdiox64 - ok

    22:25:09.0675 1208 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys

    22:25:09.0678 1208 AmdK8 - ok

    22:25:09.0879 1208 [ A3C0A15B39F979E8F3EABA901D72ECD7 ] amdkmdag C:\Windows\system32\DRIVERS\atikmdag.sys

    22:25:10.0008 1208 amdkmdag - ok

    22:25:10.0029 1208 [ 20F3CD38B107C1BD747C0EA37D450165 ] amdkmdap C:\Windows\system32\DRIVERS\atikmpag.sys

    22:25:10.0032 1208 amdkmdap - ok

    22:25:10.0088 1208 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys

    22:25:10.0090 1208 AmdPPM - ok

    22:25:10.0143 1208 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys

    22:25:10.0147 1208 amdsata - ok

    22:25:10.0164 1208 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys

    22:25:10.0167 1208 amdsbs - ok

    22:25:10.0220 1208 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys

    22:25:10.0222 1208 amdxata - ok

    22:25:10.0291 1208 [ B9C95291F5EA1072CEC2BA690E07F29F ] AMD_RAIDXpert C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

    22:25:10.0294 1208 AMD_RAIDXpert - ok

    22:25:10.0314 1208 [ 5A528A540B1AEE8B1C77ED65094E8CDF ] AODDriver4.01 C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys

    22:25:10.0316 1208 AODDriver4.01 - ok

    22:25:10.0374 1208 [ 5A528A540B1AEE8B1C77ED65094E8CDF ] AODDriver4.2 C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys

    22:25:10.0375 1208 AODDriver4.2 - ok

    22:25:10.0420 1208 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys

    22:25:10.0424 1208 AppID - ok

    22:25:10.0440 1208 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll

    22:25:10.0443 1208 AppIDSvc - ok

    22:25:10.0517 1208 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll

    22:25:10.0520 1208 Appinfo - ok

    22:25:10.0621 1208 [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt C:\Windows\System32\appmgmts.dll

    22:25:10.0626 1208 AppMgmt - ok

    22:25:10.0678 1208 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\DRIVERS\arc.sys

    22:25:10.0681 1208 arc - ok

    22:25:10.0735 1208 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys

    22:25:10.0738 1208 arcsas - ok

    22:25:10.0804 1208 [ FEF9DD9EA587F8886ADE43C1BEFBDAFE ] AsIO C:\Windows\syswow64\drivers\AsIO.sys

    22:25:10.0806 1208 AsIO - ok

    22:25:10.0865 1208 [ 0AA7A996792FB0287B33A57A8093AE44 ] asmthub3 C:\Windows\system32\DRIVERS\asmthub3.sys

    22:25:10.0868 1208 asmthub3 - ok

    22:25:10.0894 1208 [ 125DC3ABF5BFCCFE82AD17D078E0B9EC ] asmtxhci C:\Windows\system32\DRIVERS\asmtxhci.sys

    22:25:10.0901 1208 asmtxhci - ok

    22:25:10.0992 1208 [ 8C1FD73CC27EDD8D3344C632571C224C ] AsSysCtrlService C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.05\AsSysCtrlService.exe

    22:25:10.0995 1208 AsSysCtrlService - ok

    22:25:11.0033 1208 [ 26D66E32E78D3059715B3A17BC679CD9 ] AsUpIO C:\Windows\syswow64\drivers\AsUpIO.sys

    22:25:11.0034 1208 AsUpIO - ok

    22:25:11.0046 1208 [ 4FCAEF0C5BE7629AEB878998E0FE959B ] aswFsBlk C:\Windows\system32\drivers\aswFsBlk.sys

    22:25:11.0047 1208 aswFsBlk - ok

    22:25:11.0094 1208 [ B50CDD87772D6A11CB90924AAD399DF8 ] aswMonFlt C:\Windows\system32\drivers\aswMonFlt.sys

    22:25:11.0097 1208 aswMonFlt - ok

    22:25:11.0171 1208 [ 57768C7DB4681F2510F247F82EF31D4F ] aswRdr C:\Windows\System32\Drivers\aswrdr2.sys

    22:25:11.0172 1208 aswRdr - ok

    22:25:11.0212 1208 [ E71D826A1F3CE9C9DE3E77F2D02AFFBF ] aswSnx C:\Windows\system32\drivers\aswSnx.sys

    22:25:11.0225 1208 aswSnx - ok

    22:25:11.0256 1208 [ 538A32E2C99BF073D4CA76C30BEDAA60 ] aswSP C:\Windows\system32\drivers\aswSP.sys

    22:25:11.0260 1208 aswSP - ok

    22:25:11.0268 1208 [ 6EDC79D73745FD44C41B55B2D13D0B70 ] aswTdi C:\Windows\system32\drivers\aswTdi.sys

    22:25:11.0270 1208 aswTdi - ok

    22:25:11.0332 1208 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys

    22:25:11.0335 1208 AsyncMac - ok

    22:25:11.0348 1208 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys

    22:25:11.0350 1208 atapi - ok

    22:25:11.0468 1208 [ B0790FF0E25B7A2674296052F2162C1A ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys

    22:25:11.0471 1208 AtiHDAudioService - ok

    22:25:11.0526 1208 [ C07A040D6B5A42DD41EE386CF90974C8 ] AtiPcie C:\Windows\system32\DRIVERS\AtiPcie.sys

    22:25:11.0528 1208 AtiPcie - ok

    22:25:11.0610 1208 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll

    22:25:11.0619 1208 AudioEndpointBuilder - ok

    22:25:11.0631 1208 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll

    22:25:11.0637 1208 AudioSrv - ok

    22:25:11.0708 1208 [ 8FA553E9AE69808D99C164733A0F9590 ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe

    22:25:11.0710 1208 avast! Antivirus - ok

    22:25:11.0794 1208 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll

    22:25:11.0799 1208 AxInstSV - ok

    22:25:11.0822 1208 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys

    22:25:11.0831 1208 b06bdrv - ok

    22:25:11.0899 1208 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys

    22:25:11.0905 1208 b57nd60a - ok

    22:25:11.0937 1208 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll

    22:25:11.0941 1208 BDESVC - ok

    22:25:11.0952 1208 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys

    22:25:11.0954 1208 Beep - ok

    22:25:12.0075 1208 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll

    22:25:12.0089 1208 BFE - ok

    22:25:12.0112 1208 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\system32\qmgr.dll

    22:25:12.0122 1208 BITS - ok

    22:25:12.0171 1208 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys

    22:25:12.0176 1208 blbdrive - ok

    22:25:12.0261 1208 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys

    22:25:12.0264 1208 bowser - ok

    22:25:12.0278 1208 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys

    22:25:12.0281 1208 BrFiltLo - ok

    22:25:12.0290 1208 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys

    22:25:12.0292 1208 BrFiltUp - ok

    22:25:12.0350 1208 [ 5C2F352A4E961D72518261257AAE204B ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys

    22:25:12.0354 1208 BridgeMP - ok

    22:25:12.0411 1208 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll

    22:25:12.0413 1208 Browser - ok

    22:25:12.0431 1208 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys

    22:25:12.0435 1208 Brserid - ok

    22:25:12.0441 1208 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys

    22:25:12.0442 1208 BrSerWdm - ok

    22:25:12.0448 1208 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys

    22:25:12.0449 1208 BrUsbMdm - ok

    22:25:12.0454 1208 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys

    22:25:12.0455 1208 BrUsbSer - ok

    22:25:12.0464 1208 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys

    22:25:12.0465 1208 BTHMODEM - ok

    22:25:12.0474 1208 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll

    22:25:12.0476 1208 bthserv - ok

    22:25:12.0546 1208 catchme - ok

    22:25:12.0582 1208 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys

    22:25:12.0585 1208 cdfs - ok

    22:25:12.0595 1208 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys

    22:25:12.0597 1208 cdrom - ok

    22:25:12.0677 1208 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll

    22:25:12.0681 1208 CertPropSvc - ok

    22:25:12.0697 1208 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys

    22:25:12.0699 1208 circlass - ok

    22:25:12.0716 1208 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys

    22:25:12.0721 1208 CLFS - ok

    22:25:12.0772 1208 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

    22:25:12.0775 1208 clr_optimization_v2.0.50727_32 - ok

    22:25:12.0813 1208 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

    22:25:12.0815 1208 clr_optimization_v2.0.50727_64 - ok

    22:25:12.0905 1208 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

    22:25:12.0909 1208 clr_optimization_v4.0.30319_32 - ok

    22:25:12.0973 1208 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

    22:25:12.0978 1208 clr_optimization_v4.0.30319_64 - ok

    22:25:13.0028 1208 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys

    22:25:13.0031 1208 CmBatt - ok

    22:25:13.0040 1208 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys

    22:25:13.0042 1208 cmdide - ok

    22:25:13.0101 1208 [ AAFCB52FE0037207FB6FBEA070D25EFE ] CNG C:\Windows\system32\Drivers\cng.sys

    22:25:13.0110 1208 CNG - ok

    22:25:13.0122 1208 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys

    22:25:13.0124 1208 Compbatt - ok

    22:25:13.0179 1208 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys

    22:25:13.0182 1208 CompositeBus - ok

    22:25:13.0209 1208 COMSysApp - ok

    22:25:13.0216 1208 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys

    22:25:13.0218 1208 crcdisk - ok

    22:25:13.0291 1208 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\Windows\system32\cryptsvc.dll

    22:25:13.0297 1208 CryptSvc - ok

    22:25:13.0328 1208 [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC C:\Windows\system32\drivers\csc.sys

    22:25:13.0339 1208 CSC - ok

    22:25:13.0367 1208 [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService C:\Windows\System32\cscsvc.dll

    22:25:13.0374 1208 CscService - ok

    22:25:13.0426 1208 [ 44BDDEB03C84A1C993C992FFB5700357 ] CVirtA C:\Windows\system32\DRIVERS\CVirtA64.sys

    22:25:13.0428 1208 CVirtA - ok

    22:25:13.0524 1208 [ 66257CB4E4FB69887CDDC71663741435 ] CVPND C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe

    22:25:13.0551 1208 CVPND - ok

    22:25:13.0604 1208 [ CC8E52DAA9826064BA464DBE531F2BB5 ] CVPNDRVA C:\Windows\system32\Drivers\CVPNDRVA.sys

    22:25:13.0610 1208 CVPNDRVA - ok

    22:25:13.0672 1208 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll

    22:25:13.0686 1208 DcomLaunch - ok

    22:25:13.0716 1208 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll

    22:25:13.0721 1208 defragsvc - ok

    22:25:13.0774 1208 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys

    22:25:13.0778 1208 DfsC - ok

    22:25:13.0838 1208 [ B9430166FEB246F6070A62B3554932C9 ] dg_ssudbus C:\Windows\system32\DRIVERS\ssudbus.sys

    22:25:13.0843 1208 dg_ssudbus - ok

    22:25:13.0863 1208 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll

    22:25:13.0868 1208 Dhcp - ok

    22:25:13.0881 1208 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys

    22:25:13.0883 1208 discache - ok

    22:25:13.0910 1208 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\DRIVERS\disk.sys

    22:25:13.0911 1208 Disk - ok

    22:25:14.0043 1208 [ 05CB5910B3CA6019FC3CCA815EE06FFB ] DNE C:\Windows\system32\DRIVERS\dne64x.sys

    22:25:14.0047 1208 DNE - ok

    22:25:14.0108 1208 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll

    22:25:14.0115 1208 Dnscache - ok

    22:25:14.0185 1208 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll

    22:25:14.0192 1208 dot3svc - ok

    22:25:14.0206 1208 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll

    22:25:14.0210 1208 DPS - ok

    22:25:14.0268 1208 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys

    22:25:14.0270 1208 drmkaud - ok

    22:25:14.0351 1208 [ 1ED08A6264C5C92099D6D1DAE5E8F530 ] DrvAgent64 C:\Windows\SysWOW64\Drivers\DrvAgent64.SYS

    22:25:14.0353 1208 DrvAgent64 - ok

    22:25:14.0411 1208 [ 46571ED73AE84469DCA53081D33CF3C8 ] dtsoftbus01 C:\Windows\system32\DRIVERS\dtsoftbus01.sys

    22:25:14.0417 1208 dtsoftbus01 - ok

    22:25:14.0449 1208 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys

    22:25:14.0463 1208 DXGKrnl - ok

    22:25:14.0472 1208 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll

    22:25:14.0474 1208 EapHost - ok

    22:25:14.0519 1208 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys

    22:25:14.0560 1208 ebdrv - ok

    22:25:14.0585 1208 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe

    22:25:14.0588 1208 EFS - ok

    22:25:14.0632 1208 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe

    22:25:14.0638 1208 ehRecvr - ok

    22:25:14.0659 1208 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe

    22:25:14.0661 1208 ehSched - ok

    22:25:14.0716 1208 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys

    22:25:14.0723 1208 elxstor - ok

    22:25:14.0778 1208 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys

    22:25:14.0781 1208 ErrDev - ok

    22:25:14.0850 1208 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll

    22:25:14.0857 1208 EventSystem - ok

    22:25:14.0872 1208 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys

    22:25:14.0876 1208 exfat - ok

    22:25:14.0892 1208 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys

    22:25:14.0895 1208 fastfat - ok

    22:25:14.0917 1208 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe

    22:25:14.0927 1208 Fax - ok

    22:25:14.0938 1208 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\DRIVERS\fdc.sys

    22:25:14.0940 1208 fdc - ok

    22:25:14.0947 1208 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll

    22:25:14.0949 1208 fdPHost - ok

    22:25:14.0960 1208 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll

    22:25:14.0962 1208 FDResPub - ok

    22:25:14.0965 1208 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys

    22:25:14.0966 1208 FileInfo - ok

    22:25:14.0975 1208 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys

    22:25:14.0976 1208 Filetrace - ok

    22:25:14.0988 1208 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys

    22:25:14.0989 1208 flpydisk - ok

    22:25:15.0036 1208 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys

    22:25:15.0042 1208 FltMgr - ok

    22:25:15.0073 1208 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\Windows\system32\FntCache.dll

    22:25:15.0100 1208 FontCache - ok

    22:25:15.0132 1208 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

    22:25:15.0134 1208 FontCache3.0.0.0 - ok

    22:25:15.0151 1208 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys

    22:25:15.0157 1208 FsDepends - ok

    22:25:15.0207 1208 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys

    22:25:15.0208 1208 Fs_Rec - ok

    22:25:15.0230 1208 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys

    22:25:15.0235 1208 fvevol - ok

    22:25:15.0251 1208 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys

    22:25:15.0255 1208 gagp30kx - ok

    22:25:15.0325 1208 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll

    22:25:15.0338 1208 gpsvc - ok

    22:25:15.0402 1208 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    22:25:15.0405 1208 gupdate - ok

    22:25:15.0410 1208 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

    22:25:15.0412 1208 gupdatem - ok

    22:25:15.0427 1208 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys

    22:25:15.0429 1208 hcw85cir - ok

    22:25:15.0490 1208 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys

    22:25:15.0498 1208 HdAudAddService - ok

    22:25:15.0552 1208 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys

    22:25:15.0556 1208 HDAudBus - ok

    22:25:15.0570 1208 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys

    22:25:15.0573 1208 HidBatt - ok

    22:25:15.0586 1208 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys

    22:25:15.0589 1208 HidBth - ok

    22:25:15.0602 1208 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys

    22:25:15.0604 1208 HidIr - ok

    22:25:15.0614 1208 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\System32\hidserv.dll

    22:25:15.0617 1208 hidserv - ok

    22:25:15.0649 1208 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys

    22:25:15.0649 1208 HidUsb - ok

    22:25:15.0686 1208 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll

    22:25:15.0689 1208 hkmsvc - ok

    22:25:15.0749 1208 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll

    22:25:15.0759 1208 HomeGroupListener - ok

    22:25:15.0779 1208 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll

    22:25:15.0789 1208 HomeGroupProvider - ok

    22:25:15.0843 1208 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys

    22:25:15.0847 1208 HpSAMD - ok

    22:25:16.0078 1208 [ 5ECEC779312AD35B1B19951A4B53FAC1 ] HPSLPSVC C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL

    22:25:16.0095 1208 HPSLPSVC - ok

    22:25:16.0180 1208 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys

    22:25:16.0195 1208 HTTP - ok

    22:25:16.0246 1208 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys

    22:25:16.0247 1208 hwpolicy - ok

    22:25:16.0303 1208 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys

    22:25:16.0307 1208 i8042prt - ok

    22:25:16.0330 1208 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys

    22:25:16.0339 1208 iaStorV - ok

    22:25:16.0474 1208 [ DAF66902F08796F9C694901660E5A64A ] IDriverT C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

    22:25:16.0479 1208 IDriverT - ok

    22:25:16.0528 1208 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

    22:25:16.0545 1208 idsvc - ok

    22:25:16.0573 1208 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys

    22:25:16.0576 1208 iirsp - ok

    22:25:16.0608 1208 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll

    22:25:16.0620 1208 IKEEXT - ok

    22:25:16.0683 1208 [ EB5FA493A4B6EA290200AE39EBA2FBC6 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys

    22:25:16.0697 1208 IntcAzAudAddService - ok

    22:25:16.0707 1208 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys

    22:25:16.0708 1208 intelide - ok

    22:25:16.0758 1208 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys

    22:25:16.0761 1208 intelppm - ok

    22:25:16.0777 1208 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll

    22:25:16.0785 1208 IPBusEnum - ok

    22:25:16.0803 1208 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys

    22:25:16.0807 1208 IpFilterDriver - ok

    22:25:16.0873 1208 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll

    22:25:16.0886 1208 iphlpsvc - ok

    22:25:16.0900 1208 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys

    22:25:16.0901 1208 IPMIDRV - ok

    22:25:16.0908 1208 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys

    22:25:16.0910 1208 IPNAT - ok

    22:25:16.0919 1208 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys

    22:25:16.0920 1208 IRENUM - ok

    22:25:16.0933 1208 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys

    22:25:16.0935 1208 isapnp - ok

    22:25:16.0951 1208 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys

    22:25:16.0954 1208 iScsiPrt - ok

    22:25:16.0961 1208 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys

    22:25:16.0962 1208 kbdclass - ok

    22:25:16.0971 1208 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys

    22:25:16.0972 1208 kbdhid - ok

    22:25:16.0978 1208 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe

    22:25:16.0980 1208 KeyIso - ok

    22:25:17.0027 1208 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys

    22:25:17.0031 1208 KSecDD - ok

    22:25:17.0092 1208 [ 7EFB9333E4ECCE6AE4AE9D777D9E553E ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys

    22:25:17.0096 1208 KSecPkg - ok

    22:25:17.0108 1208 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys

    22:25:17.0110 1208 ksthunk - ok

    22:25:17.0142 1208 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll

    22:25:17.0154 1208 KtmRm - ok

    22:25:17.0206 1208 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\System32\srvsvc.dll

    22:25:17.0220 1208 LanmanServer - ok

    22:25:17.0273 1208 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll

    22:25:17.0286 1208 LanmanWorkstation - ok

    22:25:17.0345 1208 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys

    22:25:17.0348 1208 lltdio - ok

    22:25:17.0386 1208 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll

    22:25:17.0392 1208 lltdsvc - ok

    22:25:17.0407 1208 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll

    22:25:17.0411 1208 lmhosts - ok

    22:25:17.0429 1208 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys

    22:25:17.0431 1208 LSI_FC - ok

    22:25:17.0441 1208 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys

    22:25:17.0444 1208 LSI_SAS - ok

    22:25:17.0458 1208 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys

    22:25:17.0461 1208 LSI_SAS2 - ok

    22:25:17.0474 1208 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys

    22:25:17.0477 1208 LSI_SCSI - ok

    22:25:17.0531 1208 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys

    22:25:17.0535 1208 luafv - ok

    22:25:17.0594 1208 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll

    22:25:17.0602 1208 Mcx2Svc - ok

    22:25:17.0627 1208 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\DRIVERS\megasas.sys

    22:25:17.0629 1208 megasas - ok

    22:25:17.0641 1208 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys

    22:25:17.0645 1208 MegaSR - ok

    22:25:17.0710 1208 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe

    22:25:17.0715 1208 Microsoft Office Groove Audit Service - ok

    22:25:17.0773 1208 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll

    22:25:17.0777 1208 MMCSS - ok

    22:25:17.0792 1208 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys

    22:25:17.0794 1208 Modem - ok

    22:25:17.0842 1208 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys

    22:25:17.0843 1208 monitor - ok

    22:25:17.0893 1208 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys

    22:25:17.0895 1208 mouclass - ok

    22:25:17.0911 1208 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys

    22:25:17.0914 1208 mouhid - ok

    22:25:17.0969 1208 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys

    22:25:17.0973 1208 mountmgr - ok

    22:25:18.0009 1208 [ 05BF204EC0E82CC4A054DB189C8A3D84 ] MpFilter C:\Windows\system32\DRIVERS\MpFilter.sys

    22:25:18.0014 1208 MpFilter - ok

    22:25:18.0046 1208 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys

    22:25:18.0051 1208 mpio - ok

    22:25:18.0072 1208 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys

    22:25:18.0075 1208 mpsdrv - ok

    22:25:18.0144 1208 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll

    22:25:18.0160 1208 MpsSvc - ok

    22:25:18.0175 1208 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys

    22:25:18.0177 1208 MRxDAV - ok

    22:25:18.0207 1208 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys

    22:25:18.0209 1208 mrxsmb - ok

    22:25:18.0228 1208 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys

    22:25:18.0232 1208 mrxsmb10 - ok

    22:25:18.0249 1208 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys

    22:25:18.0251 1208 mrxsmb20 - ok

    22:25:18.0262 1208 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys

    22:25:18.0264 1208 msahci - ok

    22:25:18.0365 1208 [ 8E46A7BAC823DD82D4FB2A34C3DF4C1D ] MSCSPTISRV C:\Program Files (x86)\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe

    22:25:18.0369 1208 MSCSPTISRV - ok

    22:25:18.0391 1208 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys

    22:25:18.0394 1208 msdsm - ok

    22:25:18.0414 1208 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe

    22:25:18.0419 1208 MSDTC - ok

    22:25:18.0453 1208 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys

    22:25:18.0454 1208 Msfs - ok

    22:25:18.0480 1208 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys

    22:25:18.0482 1208 mshidkmdf - ok

    22:25:18.0495 1208 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys

    22:25:18.0496 1208 msisadrv - ok

    22:25:18.0517 1208 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll

    22:25:18.0521 1208 MSiSCSI - ok

    22:25:18.0526 1208 msiserver - ok

    22:25:18.0553 1208 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys

    22:25:18.0554 1208 MSKSSRV - ok

    22:25:18.0656 1208 [ CC8E4F72F21340A4D3A3D4DB50313EF5 ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe

    22:25:18.0658 1208 MsMpSvc - ok

    22:25:18.0709 1208 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys

    22:25:18.0712 1208 MSPCLOCK - ok

    22:25:18.0721 1208 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys

    22:25:18.0723 1208 MSPQM - ok

    22:25:18.0780 1208 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys

    22:25:18.0789 1208 MsRPC - ok

    22:25:18.0810 1208 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys

    22:25:18.0812 1208 mssmbios - ok

    22:25:18.0821 1208 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys

    22:25:18.0824 1208 MSTEE - ok

    22:25:18.0837 1208 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys

    22:25:18.0839 1208 MTConfig - ok

    22:25:18.0901 1208 [ 19B006B181E3875FD254F7B67ACF1E7C ] MTsensor C:\Windows\system32\DRIVERS\ASACPI.sys

    22:25:18.0901 1208 MTsensor - ok

    22:25:18.0950 1208 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys

    22:25:18.0953 1208 Mup - ok

    22:25:18.0980 1208 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll

    22:25:18.0995 1208 napagent - ok

    22:25:19.0046 1208 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys

    22:25:19.0050 1208 NativeWifiP - ok

    22:25:19.0111 1208 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys

    22:25:19.0122 1208 NDIS - ok

    22:25:19.0135 1208 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys

    22:25:19.0138 1208 NdisCap - ok

    22:25:19.0170 1208 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys

    22:25:19.0171 1208 NdisTapi - ok

    22:25:19.0208 1208 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys

    22:25:19.0211 1208 Ndisuio - ok

    22:25:19.0234 1208 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys

    22:25:19.0237 1208 NdisWan - ok

    22:25:19.0292 1208 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys

    22:25:19.0294 1208 NDProxy - ok

    22:25:19.0394 1208 [ DC6530A291D4BDF6DF399F1F128E7F8F ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll

    22:25:19.0402 1208 Net Driver HPZ12 - ok

    22:25:19.0431 1208 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys

    22:25:19.0435 1208 NetBIOS - ok

    22:25:19.0494 1208 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys

    22:25:19.0498 1208 NetBT - ok

    22:25:19.0505 1208 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe

    22:25:19.0511 1208 Netlogon - ok

    22:25:19.0599 1208 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll

    22:25:19.0613 1208 Netman - ok

    22:25:19.0627 1208 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll

    22:25:19.0634 1208 netprofm - ok

    22:25:19.0690 1208 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

    22:25:19.0694 1208 NetTcpPortSharing - ok

    22:25:19.0753 1208 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys

    22:25:19.0756 1208 nfrd960 - ok

    22:25:19.0816 1208 [ 5FF89F20317309D28AC1EDEB0CD1BA72 ] NisDrv C:\Windows\system32\DRIVERS\NisDrvWFP.sys

    22:25:19.0821 1208 NisDrv - ok

    22:25:19.0884 1208 [ 79E80B10FE8F6662E0C9162A68C43444 ] NisSrv c:\Program Files\Microsoft Security Client\NisSrv.exe

    22:25:19.0892 1208 NisSrv - ok

    22:25:19.0923 1208 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\Windows\System32\nlasvc.dll

    22:25:19.0936 1208 NlaSvc - ok

    22:25:19.0946 1208 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys

    22:25:19.0948 1208 Npfs - ok

    22:25:19.0965 1208 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll

    22:25:19.0969 1208 nsi - ok

    22:25:19.0980 1208 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys

    22:25:19.0982 1208 nsiproxy - ok

    22:25:20.0061 1208 [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys

    22:25:20.0084 1208 Ntfs - ok

    22:25:20.0094 1208 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys

    22:25:20.0095 1208 Null - ok

    22:25:20.0142 1208 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys

    22:25:20.0147 1208 nvraid - ok

    22:25:20.0161 1208 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys

    22:25:20.0163 1208 nvstor - ok

    22:25:20.0174 1208 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys

    22:25:20.0177 1208 nv_agp - ok

    22:25:20.0252 1208 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

    22:25:20.0261 1208 odserv - ok

    22:25:20.0281 1208 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys

    22:25:20.0284 1208 ohci1394 - ok

    22:25:20.0314 1208 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

    22:25:20.0318 1208 ose - ok

    22:25:20.0352 1208 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll

    22:25:20.0360 1208 p2pimsvc - ok

    22:25:20.0377 1208 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll

    22:25:20.0386 1208 p2psvc - ok

    22:25:20.0434 1208 [ 753A8F339F231D2B857E2CCD51A6E6CA ] PACSPTISVR C:\Program Files (x86)\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

    22:25:20.0436 1208 PACSPTISVR - ok

    22:25:20.0479 1208 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys

    22:25:20.0481 1208 Parport - ok

    22:25:20.0535 1208 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys

    22:25:20.0538 1208 partmgr - ok

    22:25:20.0554 1208 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll

    22:25:20.0560 1208 PcaSvc - ok

    22:25:20.0574 1208 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys

    22:25:20.0577 1208 pci - ok

    22:25:20.0585 1208 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys

    22:25:20.0586 1208 pciide - ok

    22:25:20.0601 1208 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys

    22:25:20.0605 1208 pcmcia - ok

    22:25:20.0616 1208 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys

    22:25:20.0618 1208 pcw - ok

    22:25:20.0633 1208 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys

    22:25:20.0641 1208 PEAUTH - ok

    22:25:20.0678 1208 [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll

    22:25:20.0704 1208 PeerDistSvc - ok

    22:25:20.0756 1208 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe

    22:25:20.0759 1208 PerfHost - ok

    22:25:20.0842 1208 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll

    22:25:20.0874 1208 pla - ok

    22:25:20.0942 1208 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll

    22:25:20.0959 1208 PlugPlay - ok

    22:25:21.0040 1208 [ 71F62C51DFDFBC04C83C5C64B2B8058E ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll

    22:25:21.0047 1208 Pml Driver HPZ12 - ok

    22:25:21.0080 1208 PnkBstrA - ok

    22:25:21.0105 1208 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll

    22:25:21.0110 1208 PNRPAutoReg - ok

    22:25:21.0119 1208 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll

    22:25:21.0125 1208 PNRPsvc - ok

    22:25:21.0156 1208 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll

    22:25:21.0165 1208 PolicyAgent - ok

    22:25:21.0194 1208 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll

    22:25:21.0201 1208 Power - ok

    22:25:21.0249 1208 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys

    22:25:21.0254 1208 PptpMiniport - ok

    22:25:21.0277 1208 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\DRIVERS\processr.sys

    22:25:21.0279 1208 Processor - ok

    22:25:21.0338 1208 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll

    22:25:21.0350 1208 ProfSvc - ok

    22:25:21.0369 1208 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe

    22:25:21.0371 1208 ProtectedStorage - ok

    22:25:21.0431 1208 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys

    22:25:21.0435 1208 Psched - ok

    22:25:21.0495 1208 [ 5D6C8E778F0218FCD2CCA0EFBC9766CA ] PxHlpa64 C:\Windows\system32\Drivers\PxHlpa64.sys

    22:25:21.0497 1208 PxHlpa64 - ok

    22:25:21.0545 1208 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys

    22:25:21.0574 1208 ql2300 - ok

    22:25:21.0591 1208 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys

    22:25:21.0595 1208 ql40xx - ok

    22:25:21.0606 1208 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll

    22:25:21.0613 1208 QWAVE - ok

    22:25:21.0626 1208 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys

    22:25:21.0629 1208 QWAVEdrv - ok

    22:25:21.0638 1208 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys

    22:25:21.0639 1208 RasAcd - ok

    22:25:21.0707 1208 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys

    22:25:21.0708 1208 RasAgileVpn - ok

    22:25:21.0717 1208 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll

    22:25:21.0723 1208 RasAuto - ok

    22:25:21.0776 1208 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys

    22:25:21.0779 1208 Rasl2tp - ok

    22:25:21.0796 1208 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll

    22:25:21.0811 1208 RasMan - ok

    22:25:21.0869 1208 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys

    22:25:21.0871 1208 RasPppoe - ok

    22:25:21.0925 1208 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys

    22:25:21.0929 1208 RasSstp - ok

    22:25:21.0950 1208 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys

    22:25:21.0958 1208 rdbss - ok

    22:25:21.0966 1208 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys

    22:25:21.0967 1208 rdpbus - ok

    22:25:21.0979 1208 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys

    22:25:21.0980 1208 RDPCDD - ok

    22:25:22.0030 1208 [ 1B6163C503398B23FF8B939C67747683 ] RDPDR C:\Windows\system32\drivers\rdpdr.sys

    22:25:22.0035 1208 RDPDR - ok

    22:25:22.0067 1208 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys

    22:25:22.0069 1208 RDPENCDD - ok

    22:25:22.0083 1208 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys

    22:25:22.0084 1208 RDPREFMP - ok

    22:25:22.0146 1208 [ 313F68E1A3E6345A4F47A36B07062F34 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys

    22:25:22.0150 1208 RdpVideoMiniport - ok

    22:25:22.0170 1208 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys

    22:25:22.0176 1208 RDPWD - ok

    22:25:22.0241 1208 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys

    22:25:22.0246 1208 rdyboost - ok

    22:25:22.0274 1208 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll

    22:25:22.0282 1208 RemoteAccess - ok

    22:25:22.0303 1208 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll

    22:25:22.0315 1208 RemoteRegistry - ok

    22:25:22.0327 1208 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll

    22:25:22.0333 1208 RpcEptMapper - ok

    22:25:22.0352 1208 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe

    22:25:22.0355 1208 RpcLocator - ok

    22:25:22.0411 1208 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll

    22:25:22.0420 1208 RpcSs - ok

    22:25:22.0466 1208 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys

    22:25:22.0469 1208 rspndr - ok

    22:25:22.0547 1208 [ EE082E06A82FF630351D1E0EBBD3D8D0 ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys

    22:25:22.0557 1208 RTL8167 - ok

    22:25:22.0636 1208 [ 09A8BA290DB61D2D5C419A06A2E54D20 ] RTL8192Ce C:\Windows\system32\DRIVERS\rtl8192Ce.sys

    22:25:22.0653 1208 RTL8192Ce - ok

    22:25:22.0666 1208 [ E16B7C030A05EF649B18FAB0A93D871F ] RtNdPt60 C:\Windows\system32\DRIVERS\RtNdPt60.sys

    22:25:22.0667 1208 RtNdPt60 - ok

    22:25:22.0680 1208 [ 1DE78F5008120CD79B34C12394DCD493 ] RTTEAMPT C:\Windows\system32\DRIVERS\RtTeam60.sys

    22:25:22.0682 1208 RTTEAMPT - ok

    22:25:22.0691 1208 [ B1018AA1B5735F5FA89FD4DADF4BEA7A ] RTVLANPT C:\Windows\system32\DRIVERS\RtVlan60.sys

    22:25:22.0693 1208 RTVLANPT - ok

    22:25:22.0741 1208 [ E60C0A09F997826C7627B244195AB581 ] s3cap C:\Windows\system32\drivers\vms3cap.sys

    22:25:22.0743 1208 s3cap - ok

    22:25:22.0808 1208 [ F6D3E9793F22C92CEF9B96BF47DA01F1 ] SaiK0CCB C:\Windows\system32\DRIVERS\SaiK0CCB.sys

    22:25:22.0812 1208 SaiK0CCB - ok

    22:25:22.0862 1208 [ 9E7E53891D1747A01F491AB25B95135D ] SaiMini C:\Windows\system32\DRIVERS\SaiMini.sys

    22:25:22.0864 1208 SaiMini - ok

    22:25:22.0931 1208 [ B3B86BE19A0CAF025F679C39FD21E735 ] SaiNtBus C:\Windows\system32\drivers\SaiBus.sys

    22:25:22.0934 1208 SaiNtBus - ok

    22:25:22.0991 1208 [ FF2D7435C79B273752F0912FEAB839C0 ] SaiU0CCB C:\Windows\system32\DRIVERS\SaiU0CCB.sys

    22:25:22.0993 1208 SaiU0CCB - ok

    22:25:23.0010 1208 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe

    22:25:23.0017 1208 SamSs - ok

    22:25:23.0034 1208 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys

    22:25:23.0039 1208 sbp2port - ok

    22:25:23.0052 1208 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll

    22:25:23.0064 1208 SCardSvr - ok

    22:25:23.0119 1208 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys

    22:25:23.0122 1208 scfilter - ok

    22:25:23.0193 1208 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll

    22:25:23.0216 1208 Schedule - ok

    22:25:23.0267 1208 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll

    22:25:23.0268 1208 SCPolicySvc - ok

    22:25:23.0283 1208 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll

    22:25:23.0287 1208 SDRSVC - ok

    22:25:23.0313 1208 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys

    22:25:23.0314 1208 secdrv - ok

    22:25:23.0389 1208 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll

    22:25:23.0398 1208 seclogon - ok

    22:25:23.0415 1208 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\system32\sens.dll

    22:25:23.0426 1208 SENS - ok

    22:25:23.0438 1208 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll

    22:25:23.0448 1208 SensrSvc - ok

    22:25:23.0461 1208 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys

    22:25:23.0464 1208 Serenum - ok

    22:25:23.0517 1208 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys

    22:25:23.0521 1208 Serial - ok

    22:25:23.0551 1208 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys

    22:25:23.0554 1208 sermouse - ok

    22:25:23.0625 1208 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll

    22:25:23.0632 1208 SessionEnv - ok

    22:25:23.0638 1208 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys

    22:25:23.0639 1208 sffdisk - ok

    22:25:23.0651 1208 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys

    22:25:23.0654 1208 sffp_mmc - ok

    22:25:23.0658 1208 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys

    22:25:23.0660 1208 sffp_sd - ok

    22:25:23.0670 1208 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys

    22:25:23.0672 1208 sfloppy - ok

    22:25:23.0701 1208 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll

    22:25:23.0708 1208 SharedAccess - ok

    22:25:23.0720 1208 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll

    22:25:23.0729 1208 ShellHWDetection - ok

    22:25:23.0777 1208 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys

    22:25:23.0781 1208 SiSRaid2 - ok

    22:25:23.0800 1208 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys

    22:25:23.0802 1208 SiSRaid4 - ok

    22:25:23.0855 1208 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys

    22:25:23.0859 1208 Smb - ok

    22:25:23.0919 1208 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe

    22:25:23.0925 1208 SNMPTRAP - ok

    22:25:23.0975 1208 [ 977AAA4398D7D6FA65D973F5B3F54E40 ] SonicStage Back-End Service C:\Program Files (x86)\Common Files\Sony Shared\AVLib\SsBeSvc.exe

    22:25:23.0979 1208 SonicStage Back-End Service - ok

    22:25:24.0054 1208 [ 12583AF6CBE0050651EAF2723B3AD7B3 ] speedfan C:\Windows\syswow64\speedfan.sys

    22:25:24.0062 1208 speedfan - ok

    22:25:24.0078 1208 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys

    22:25:24.0080 1208 spldr - ok

    22:25:24.0143 1208 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe

    22:25:24.0157 1208 Spooler - ok

    22:25:24.0206 1208 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe

    22:25:24.0278 1208 sppsvc - ok

    22:25:24.0283 1208 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll

    22:25:24.0288 1208 sppuinotify - ok

    22:25:24.0335 1208 [ E3E6C96B0EF4492C3C8FD0DEEF4E35A1 ] SPTISRV C:\Program Files (x86)\Common Files\Sony Shared\AVLib\SPTISRV.exe

    22:25:24.0339 1208 SPTISRV - ok

    22:25:24.0381 1208 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys

    22:25:24.0391 1208 srv - ok

    22:25:24.0413 1208 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys

    22:25:24.0418 1208 srv2 - ok

    22:25:24.0435 1208 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys

    22:25:24.0438 1208 srvnet - ok

    22:25:24.0494 1208 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll

    22:25:24.0507 1208 SSDPSRV - ok

    22:25:24.0530 1208 [ 756E371B3B86A3D3039926D32EAC0E8D ] SSScsiSV C:\Program Files (x86)\Common Files\Sony Shared\AVLib\SSScsiSV.exe

    22:25:24.0533 1208 SSScsiSV - ok

    22:25:24.0552 1208 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll

    22:25:24.0559 1208 SstpSvc - ok

    22:25:24.0617 1208 [ C692C94FE55CAD0633440236022C27B3 ] ssudmdm C:\Windows\system32\DRIVERS\ssudmdm.sys

    22:25:24.0623 1208 ssudmdm - ok

    22:25:24.0673 1208 Steam Client Service - ok

    22:25:24.0685 1208 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys

    22:25:24.0687 1208 stexstor - ok

    22:25:24.0715 1208 [ DECACB6921DED1A38642642685D77DAC ] StillCam C:\Windows\system32\DRIVERS\serscan.sys

    22:25:24.0716 1208 StillCam - ok

    22:25:24.0768 1208 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll

    22:25:24.0785 1208 stisvc - ok

    22:25:24.0835 1208 [ 7785DC213270D2FC066538DAF94087E7 ] storflt C:\Windows\system32\drivers\vmstorfl.sys

    22:25:24.0836 1208 storflt - ok

    22:25:24.0857 1208 [ C40841817EF57D491F22EB103DA587CC ] StorSvc C:\Windows\system32\storsvc.dll

    22:25:24.0862 1208 StorSvc - ok

    22:25:24.0874 1208 [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc C:\Windows\system32\drivers\storvsc.sys

    22:25:24.0876 1208 storvsc - ok

    22:25:24.0885 1208 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\drivers\swenum.sys

    22:25:24.0885 1208 swenum - ok

    22:25:24.0912 1208 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll

    22:25:24.0920 1208 swprv - ok

    22:25:24.0998 1208 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll

    22:25:25.0028 1208 SysMain - ok

    22:25:25.0075 1208 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll

    22:25:25.0080 1208 TabletInputService - ok

    22:25:25.0087 1208 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll

    22:25:25.0094 1208 TapiSrv - ok

    22:25:25.0103 1208 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll

    22:25:25.0107 1208 TBS - ok

    22:25:25.0193 1208 [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip C:\Windows\system32\drivers\tcpip.sys

    22:25:25.0220 1208 Tcpip - ok

    22:25:25.0297 1208 [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys

    22:25:25.0313 1208 TCPIP6 - ok

    22:25:25.0348 1208 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys

    22:25:25.0350 1208 tcpipreg - ok

    22:25:25.0375 1208 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys

    22:25:25.0378 1208 TDPIPE - ok

    22:25:25.0426 1208 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys

    22:25:25.0429 1208 TDTCP - ok

    22:25:25.0501 1208 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys

    22:25:25.0506 1208 tdx - ok

    22:25:25.0521 1208 [ 1DE78F5008120CD79B34C12394DCD493 ] TEAM C:\Windows\system32\DRIVERS\RtTeam60.sys

    22:25:25.0524 1208 TEAM - ok

    22:25:25.0533 1208 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\drivers\termdd.sys

    22:25:25.0535 1208 TermDD - ok

    22:25:25.0559 1208 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll

    22:25:25.0572 1208 TermService - ok

    22:25:25.0583 1208 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll

    22:25:25.0590 1208 Themes - ok

    22:25:25.0613 1208 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll

    22:25:25.0615 1208 THREADORDER - ok

    22:25:25.0628 1208 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll

    22:25:25.0632 1208 TrkWks - ok

    22:25:25.0666 1208 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe

    22:25:25.0671 1208 TrustedInstaller - ok

    22:25:25.0734 1208 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys

    22:25:25.0738 1208 tssecsrv - ok

    22:25:25.0793 1208 [ 17C6B51CBCCDED95B3CC14E22791F85E ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys

    22:25:25.0796 1208 TsUsbFlt - ok

    22:25:25.0868 1208 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys

    22:25:25.0873 1208 tunnel - ok

    22:25:25.0893 1208 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys

    22:25:25.0895 1208 uagp35 - ok

    22:25:25.0910 1208 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys

    22:25:25.0915 1208 udfs - ok

    22:25:25.0939 1208 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe

    22:25:25.0946 1208 UI0Detect - ok

    22:25:25.0967 1208 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys

    22:25:25.0969 1208 uliagpkx - ok

    22:25:25.0994 1208 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\drivers\umbus.sys

    22:25:25.0997 1208 umbus - ok

    22:25:26.0028 1208 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\DRIVERS\umpass.sys

    22:25:26.0030 1208 UmPass - ok

    22:25:26.0049 1208 [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService C:\Windows\System32\umrdp.dll

    22:25:26.0057 1208 UmRdpService - ok

    22:25:26.0072 1208 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll

    22:25:26.0081 1208 upnphost - ok

    22:25:26.0156 1208 [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio C:\Windows\system32\drivers\usbaudio.sys

    22:25:26.0162 1208 usbaudio - ok

    22:25:26.0175 1208 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys

    22:25:26.0179 1208 usbccgp - ok

    22:25:26.0204 1208 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys

    22:25:26.0206 1208 usbcir - ok

    22:25:26.0224 1208 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys

    22:25:26.0226 1208 usbehci - ok

    22:25:26.0239 1208 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys

    22:25:26.0242 1208 usbhub - ok

    22:25:26.0246 1208 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\DRIVERS\usbohci.sys

    22:25:26.0247 1208 usbohci - ok

    22:25:26.0261 1208 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys

    22:25:26.0263 1208 usbprint - ok

    22:25:26.0278 1208 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS

    22:25:26.0280 1208 USBSTOR - ok

    22:25:26.0296 1208 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys

    22:25:26.0298 1208 usbuhci - ok

    22:25:26.0309 1208 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll

    22:25:26.0314 1208 UxSms - ok

    22:25:26.0326 1208 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe

    22:25:26.0329 1208 VaultSvc - ok

    22:25:26.0358 1208 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys

    22:25:26.0359 1208 vdrvroot - ok

    22:25:26.0397 1208 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe

    22:25:26.0439 1208 vds - ok

    22:25:26.0473 1208 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys

    22:25:26.0476 1208 vga - ok

    22:25:26.0524 1208 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys

    22:25:26.0527 1208 VgaSave - ok

    22:25:26.0554 1208 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys

    22:25:26.0558 1208 vhdmp - ok

    22:25:26.0582 1208 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys

    22:25:26.0584 1208 viaide - ok

    22:25:26.0602 1208 [ 86EA3E79AE350FEA5331A1303054005F ] vmbus C:\Windows\system32\drivers\vmbus.sys

    22:25:26.0605 1208 vmbus - ok

    22:25:26.0616 1208 [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys

    22:25:26.0618 1208 VMBusHID - ok

    22:25:26.0631 1208 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys

    22:25:26.0633 1208 volmgr - ok

    22:25:26.0691 1208 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys

    22:25:26.0699 1208 volmgrx - ok

    22:25:26.0723 1208 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys

    22:25:26.0730 1208 volsnap - ok

    22:25:26.0783 1208 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys

    22:25:26.0789 1208 vsmraid - ok

    22:25:26.0843 1208 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe

    22:25:26.0873 1208 VSS - ok

    22:25:26.0887 1208 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys

    22:25:26.0888 1208 vwifibus - ok

    22:25:26.0901 1208 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys

    22:25:26.0903 1208 vwififlt - ok

    22:25:26.0912 1208 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll

    22:25:26.0919 1208 W32Time - ok

    22:25:26.0925 1208 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys

    22:25:26.0927 1208 WacomPen - ok

    22:25:26.0977 1208 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys

    22:25:26.0981 1208 WANARP - ok

    22:25:27.0012 1208 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys

    22:25:27.0015 1208 Wanarpv6 - ok

    22:25:27.0100 1208 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe

    22:25:27.0126 1208 WatAdminSvc - ok

    22:25:27.0178 1208 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe

    22:25:27.0212 1208 wbengine - ok

    22:25:27.0249 1208 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll

    22:25:27.0257 1208 WbioSrvc - ok

    22:25:27.0271 1208 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll

    22:25:27.0280 1208 wcncsvc - ok

    22:25:27.0289 1208 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll

    22:25:27.0295 1208 WcsPlugInService - ok

    22:25:27.0301 1208 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\DRIVERS\wd.sys

    22:25:27.0303 1208 Wd - ok

    22:25:27.0360 1208 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys

    22:25:27.0371 1208 Wdf01000 - ok

    22:25:27.0388 1208 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll

    22:25:27.0394 1208 WdiServiceHost - ok

    22:25:27.0399 1208 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll

    22:25:27.0406 1208 WdiSystemHost - ok

    22:25:27.0421 1208 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll

    22:25:27.0427 1208 WebClient - ok

    22:25:27.0431 1208 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll

    22:25:27.0436 1208 Wecsvc - ok

    22:25:27.0447 1208 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll

    22:25:27.0451 1208 wercplsupport - ok

    22:25:27.0505 1208 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll

    22:25:27.0516 1208 WerSvc - ok

    22:25:27.0570 1208 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys

    22:25:27.0573 1208 WfpLwf - ok

    22:25:27.0578 1208 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys

    22:25:27.0580 1208 WIMMount - ok

    22:25:27.0594 1208 WinDefend - ok

    22:25:27.0600 1208 WinHttpAutoProxySvc - ok

    22:25:27.0640 1208 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll

    22:25:27.0643 1208 Winmgmt - ok

    22:25:27.0676 1208 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll

    22:25:27.0703 1208 WinRM - ok

    22:25:27.0771 1208 [ FE88B288356E7B47B74B13372ADD906D ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys

    22:25:27.0772 1208 WinUsb - ok

    22:25:27.0802 1208 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll

    22:25:27.0820 1208 Wlansvc - ok

    22:25:28.0025 1208 [ 98F138897EF4246381D197CB81846D62 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

    22:25:28.0054 1208 wlidsvc - ok

    22:25:28.0103 1208 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys

    22:25:28.0105 1208 WmiAcpi - ok

    22:25:28.0123 1208 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe

    22:25:28.0127 1208 wmiApSrv - ok

    22:25:28.0133 1208 WMPNetworkSvc - ok

    22:25:28.0146 1208 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll

    22:25:28.0150 1208 WPCSvc - ok

    22:25:28.0161 1208 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll

    22:25:28.0164 1208 WPDBusEnum - ok

    22:25:28.0172 1208 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys

    22:25:28.0173 1208 ws2ifsl - ok

    22:25:28.0182 1208 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\system32\wscsvc.dll

    22:25:28.0186 1208 wscsvc - ok

    22:25:28.0189 1208 WSearch - ok

    22:25:28.0276 1208 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll

    22:25:28.0317 1208 wuauserv - ok

    22:25:28.0363 1208 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys

    22:25:28.0367 1208 WudfPf - ok

    22:25:28.0396 1208 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys

    22:25:28.0400 1208 WUDFRd - ok

    22:25:28.0447 1208 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll

    22:25:28.0461 1208 wudfsvc - ok

    22:25:28.0479 1208 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll

    22:25:28.0487 1208 WwanSvc - ok

    22:25:28.0558 1208 [ 2EE48CFCE7CA8E0DB4C44C7476C0943B ] xusb21 C:\Windows\system32\DRIVERS\xusb21.sys

    22:25:28.0562 1208 xusb21 - ok

    22:25:28.0600 1208 ================ Scan global ===============================

    22:25:28.0631 1208 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll

    22:25:28.0689 1208 [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\Windows\system32\winsrv.dll

    22:25:28.0712 1208 [ F46BBAAC1C4980F4D0DD463F190A42D3 ] C:\Windows\system32\winsrv.dll

    22:25:28.0732 1208 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll

    22:25:28.0764 1208 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe

    22:25:28.0771 1208 [Global] - ok

    22:25:28.0771 1208 ================ Scan MBR ==================================

    22:25:28.0780 1208 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0

    22:25:29.0224 1208 \Device\Harddisk0\DR0 - ok

    22:25:29.0224 1208 ================ Scan VBR ==================================

    22:25:29.0244 1208 [ A1A1CC4BA4AE1C51FC0245E9B1587FFB ] \Device\Harddisk0\DR0\Partition1

    22:25:29.0245 1208 \Device\Harddisk0\DR0\Partition1 - ok

    22:25:29.0247 1208 [ 2C9481E33BBF7F64C26174DF27AABD6C ] \Device\Harddisk0\DR0\Partition2

    22:25:29.0248 1208 \Device\Harddisk0\DR0\Partition2 - ok

    22:25:29.0249 1208 ============================================================

    22:25:29.0249 1208 Scan finished

    22:25:29.0249 1208 ============================================================

    22:25:29.0256 4300 Detected object count: 0

    22:25:29.0256 4300 Actual detected object count: 0

    and this is the aswMBR

    aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software

    Run date: 2012-11-19 22:27:33

    -----------------------------

    22:27:33.801 OS Version: Windows x64 6.1.7601 Service Pack 1

    22:27:33.801 Number of processors: 6 586 0xA00

    22:27:33.802 ComputerName: JOSHJUN-PC UserName: Josh Jun

    22:27:34.647 Initialize success

    22:27:34.723 AVAST engine defs: 12111901

    22:28:10.662 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

    22:28:10.668 Disk 0 Vendor: ST1000DM003-9YN162 CC9B Size: 953869MB BusType: 3

    22:28:10.689 Disk 0 MBR read successfully

    22:28:10.692 Disk 0 MBR scan

    22:28:10.696 Disk 0 Windows 7 default MBR code

    22:28:10.706 Disk 0 Partition 1 00 06 FAT16 200 MB offset 2048

    22:28:10.710 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 953667 MB offset 411648

    22:28:10.726 Disk 0 scanning C:\Windows\system32\drivers

    22:28:19.846 Service scanning

    22:28:34.307 Modules scanning

    22:28:34.325 Disk 0 trace - called modules:

    22:28:34.340 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys

    22:28:34.351 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007a48060]

    22:28:34.365 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa800798d9b0]

    22:28:34.377 5 ACPI.sys[fffff88000e0b7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8007a40060]

    22:28:35.243 AVAST engine scan C:\Windows

    22:28:38.501 AVAST engine scan C:\Windows\system32

    22:30:55.440 AVAST engine scan C:\Windows\system32\drivers

    22:31:06.264 AVAST engine scan C:\Users\Josh Jun

    22:36:59.485 AVAST engine scan C:\ProgramData

    22:37:55.431 Scan finished successfully

    22:38:07.461 Disk 0 MBR has been saved successfully to "C:\Users\Josh Jun\Desktop\MBR.dat"

    22:38:07.465 The log file has been saved successfully to "C:\Users\Josh Jun\Desktop\aswMBR.txt"

    Please Help! I have a rootkit virus!

    in Resolved Malware Removal Logs

    Posted

    Hello. So for the status of my system, my computer froze a couple times over the past day and it currently feels a little slower than usual, but the usual is pretty fast. I'd say that the visible difference so far is almost negligible.

    Here is my log:

    ComboFix 12-11-19.03 - Josh Jun 11/19/2012 21:43:25.1.6 - x64

    Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8191.6076 [GMT -8:00]

    Running from: c:\users\Josh Jun\Desktop\ComboFix.exe

    AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

    AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}

    SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

    SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}

    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    * Created a new restore point

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    C:\Autorun.inf

    c:\programdata\Bc

    c:\programdata\Bc\0

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk

    c:\users\Josh Jun\AppData\Local\Temp\fbe2808e-2380-4f14-a1fa-3fa9c3a364e8\CliSecureRT.dll

    c:\users\JOSHJU~1\AppData\Local\Temp\fbe2808e-2380-4f14-a1fa-3fa9c3a364e8\CliSecureRT.dll

    c:\windows\SysWow64\muzapp.exe

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-10-20 to 2012-11-20 )))))))))))))))))))))))))))))))

    .

    .

    2012-11-20 05:49 . 2012-11-20 05:49 -------- d-----w- c:\users\Default\AppData\Local\temp

    2012-11-20 04:03 . 2012-11-20 04:03 -------- d-----w- c:\windows\SysWow64\wbem\Logs

    2012-11-20 02:33 . 2012-11-20 02:33 -------- d-----w- c:\users\Josh Jun\AppData\Roaming\Malwarebytes

    2012-11-20 02:33 . 2012-11-20 02:33 -------- d-----w- c:\programdata\Malwarebytes

    2012-11-20 02:33 . 2012-11-20 02:33 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

    2012-11-20 02:33 . 2012-09-30 03:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

    2012-11-19 10:09 . 2012-11-19 10:09 208216 ----a-w- c:\windows\system32\drivers\54425057.sys

    2012-11-19 09:25 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{481AAF01-2DFB-40F7-9138-445D8A5A2320}\mpengine.dll

    2012-11-19 08:35 . 2012-11-20 02:20 -------- d-sh--w- c:\users\Josh Jun\Drivers

    2012-11-18 02:13 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

    2012-11-15 07:27 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

    2012-11-15 07:27 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys

    2012-11-15 07:27 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui

    2012-11-15 07:27 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll

    2012-11-15 07:19 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys

    2012-11-15 07:19 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys

    2012-11-15 07:19 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll

    2012-11-15 07:19 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll

    2012-11-15 07:19 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll

    2012-11-15 07:19 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe

    2012-11-15 07:19 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll

    2012-11-11 06:33 . 2012-11-11 23:51 -------- d---a-w- c:\program files (x86)\dolphin-3.0-win64

    2012-11-10 07:18 . 2012-11-10 07:18 -------- d-----w- c:\users\Josh Jun\AppData\Local\Rockstar Games

    2012-11-08 18:58 . 2012-11-10 08:50 -------- d-----w- c:\users\Josh Jun\AppData\Roaming\Bioshock

    2012-11-08 18:04 . 2012-11-08 18:04 -------- d-----w- c:\program files (x86)\GameFly

    2012-11-03 00:30 . 2012-08-24 16:57 22016 ----a-w- c:\windows\SysWow64\secur32.dll

    2012-11-03 00:30 . 2012-08-24 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll

    2012-11-02 23:54 . 2012-11-02 23:54 -------- d-----w- c:\programdata\ATI

    2012-11-02 23:54 . 2012-11-02 23:54 -------- d-----w- c:\program files (x86)\AMD AVT

    2012-11-02 23:54 . 2012-11-02 23:54 -------- d-----w- c:\program files (x86)\AMD APP

    2012-10-21 18:08 . 2012-10-21 18:08 -------- d-----w- c:\program files (x86)\Common Files\Java

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-11-19 08:51 . 2012-02-03 22:35 189248 ----a-w- c:\windows\SysWow64\PnkBstrB.exe

    2012-11-19 08:51 . 2012-02-03 22:35 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe

    2012-11-15 07:20 . 2012-02-03 17:02 66395536 ----a-w- c:\windows\system32\MRT.exe

    2012-10-30 23:51 . 2012-02-03 11:08 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys

    2012-10-30 23:51 . 2012-02-03 11:08 370288 ----a-w- c:\windows\system32\drivers\aswSP.sys

    2012-10-30 23:51 . 2012-02-03 11:08 984144 ----a-w- c:\windows\system32\drivers\aswSnx.sys

    2012-10-30 23:51 . 2012-02-03 11:08 71600 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys

    2012-10-30 23:51 . 2012-02-03 11:08 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

    2012-10-30 23:51 . 2012-02-03 11:05 41224 ----a-w- c:\windows\avastSS.scr

    2012-10-30 23:50 . 2012-02-03 11:05 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe

    2012-10-30 23:50 . 2012-02-03 11:08 285328 ----a-w- c:\windows\system32\aswBoot.exe

    2012-10-28 04:05 . 2012-02-04 05:51 282696 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr

    2012-10-28 03:53 . 2012-02-03 22:35 282696 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0

    2012-10-15 16:59 . 2012-02-25 03:15 54072 ----a-w- c:\windows\system32\drivers\aswRdr2.sys

    2012-10-09 01:02 . 2012-05-10 16:23 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2012-10-09 01:02 . 2012-02-03 10:46 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-10-09 01:02 . 2012-10-09 01:02 10220472 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe

    2012-10-04 05:27 . 2012-10-20 01:08 972192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A8AA0680-B89A-4D40-B39A-B8D6D7D1D1E5}\gapaengine.dll

    2012-10-04 05:27 . 2012-02-11 03:29 972192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

    2012-09-28 22:37 . 2012-09-28 22:37 221696 ----a-w- c:\windows\system32\clinfo.exe

    2012-09-28 22:36 . 2012-09-28 22:36 75776 ----a-w- c:\windows\system32\OpenVideo64.dll

    2012-09-28 22:36 . 2012-09-28 22:36 65536 ----a-w- c:\windows\SysWow64\OpenVideo.dll

    2012-09-28 22:36 . 2012-09-28 22:36 63488 ----a-w- c:\windows\system32\OVDecode64.dll

    2012-09-28 22:36 . 2012-09-28 22:36 56320 ----a-w- c:\windows\SysWow64\OVDecode.dll

    2012-09-28 22:36 . 2012-09-28 22:36 32635904 ----a-w- c:\windows\system32\amdocl64.dll

    2012-09-28 22:32 . 2012-09-28 22:32 27341824 ----a-w- c:\windows\SysWow64\amdocl.dll

    2012-09-28 02:23 . 2011-12-06 02:33 5557928 ----a-w- c:\windows\SysWow64\atiumdag.dll

    2012-09-28 02:21 . 2012-09-28 02:21 10697216 ----a-w- c:\windows\system32\drivers\atikmdag.sys

    2012-09-28 02:05 . 2012-09-28 02:05 70144 ----a-w- c:\windows\system32\coinst_9.002.dll

    2012-09-28 02:03 . 2012-09-28 02:03 163840 ----a-w- c:\windows\system32\atiapfxx.exe

    2012-09-28 02:02 . 2012-09-28 02:02 51200 ----a-w- c:\windows\system32\aticalrt64.dll

    2012-09-28 02:02 . 2012-09-28 02:02 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll

    2012-09-28 02:02 . 2012-09-28 02:02 44544 ----a-w- c:\windows\system32\aticalcl64.dll

    2012-09-28 02:02 . 2012-09-28 02:02 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll

    2012-09-28 02:02 . 2012-09-28 02:02 16082432 ----a-w- c:\windows\system32\aticaldd64.dll

    2012-09-28 01:59 . 2012-09-28 01:59 23825920 ----a-w- c:\windows\system32\atio6axx.dll

    2012-09-28 01:57 . 2012-09-28 01:57 13703168 ----a-w- c:\windows\SysWow64\aticaldd.dll

    2012-09-28 01:43 . 2011-12-06 03:17 935424 ----a-w- c:\windows\SysWow64\aticfx32.dll

    2012-09-28 01:41 . 2011-12-06 03:16 1120768 ----a-w- c:\windows\system32\aticfx64.dll

    2012-09-28 01:41 . 2012-09-28 01:41 19624960 ----a-w- c:\windows\SysWow64\atioglxx.dll

    2012-09-28 01:39 . 2012-09-28 01:39 6536192 ----a-w- c:\windows\SysWow64\atidxx32.dll

    2012-09-28 01:39 . 2012-09-28 01:39 442368 ----a-w- c:\windows\system32\atidemgy.dll

    2012-09-28 01:39 . 2012-09-28 01:39 538112 ----a-w- c:\windows\system32\atieclxx.exe

    2012-09-28 01:38 . 2012-09-28 01:38 239616 ----a-w- c:\windows\system32\atiesrxx.exe

    2012-09-28 01:36 . 2012-09-28 01:36 120320 ----a-w- c:\windows\system32\atitmm64.dll

    2012-09-28 01:36 . 2012-09-28 01:36 21504 ----a-w- c:\windows\system32\atimuixx.dll

    2012-09-28 01:36 . 2012-09-28 01:36 59392 ----a-w- c:\windows\system32\atiedu64.dll

    2012-09-28 01:36 . 2012-09-28 01:36 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll

    2012-09-28 01:31 . 2012-09-28 01:31 3127296 ----a-w- c:\windows\system32\atiumd6a.dll

    2012-09-28 01:25 . 2012-09-28 01:25 6704640 ----a-w- c:\windows\system32\atiumd64.dll

    2012-09-28 01:22 . 2011-12-06 02:51 7167488 ----a-w- c:\windows\system32\atidxx64.dll

    2012-09-28 01:22 . 2011-12-06 02:28 2691584 ----a-w- c:\windows\SysWow64\atiumdva.dll

    2012-09-28 01:13 . 2012-09-28 01:13 595456 ----a-w- c:\windows\system32\atiadlxx.dll

    2012-09-28 01:13 . 2012-09-28 01:13 405504 ----a-w- c:\windows\SysWow64\atiadlxy.dll

    2012-09-28 01:13 . 2012-09-28 01:13 17920 ----a-w- c:\windows\system32\atig6pxx.dll

    2012-09-28 01:13 . 2012-09-28 01:13 14848 ----a-w- c:\windows\SysWow64\atiglpxx.dll

    2012-09-28 01:13 . 2012-09-28 01:13 14848 ----a-w- c:\windows\system32\atiglpxx.dll

    2012-09-28 01:13 . 2012-09-28 01:13 41984 ----a-w- c:\windows\system32\atig6txx.dll

    2012-09-28 01:13 . 2012-09-28 01:13 33280 ----a-w- c:\windows\SysWow64\atigktxx.dll

    2012-09-28 01:12 . 2012-09-28 01:12 56320 ----a-w- c:\windows\system32\atimpc64.dll

    2012-09-28 01:12 . 2012-09-28 01:12 56320 ----a-w- c:\windows\system32\amdpcom64.dll

    2012-09-28 01:12 . 2012-09-28 01:12 460288 ----a-w- c:\windows\system32\drivers\atikmpag.sys

    2012-09-28 01:12 . 2012-09-28 01:12 56832 ----a-w- c:\windows\SysWow64\atimpc32.dll

    2012-09-28 01:12 . 2012-09-28 01:12 56832 ----a-w- c:\windows\SysWow64\amdpcom32.dll

    2012-09-28 01:11 . 2011-12-06 02:11 129536 ----a-w- c:\windows\system32\atiuxp64.dll

    2012-09-28 01:11 . 2012-09-28 01:11 109568 ----a-w- c:\windows\SysWow64\atiuxpag.dll

    2012-09-28 01:11 . 2012-09-28 01:11 103424 ----a-w- c:\windows\system32\atiu9p64.dll

    2012-09-28 01:10 . 2011-12-06 02:11 82944 ----a-w- c:\windows\SysWow64\atiu9pag.dll

    2012-09-28 01:09 . 2012-09-28 01:09 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll

    2012-09-24 22:32 . 2012-09-03 04:40 477168 ----a-w- c:\windows\SysWow64\npdeployJava1.dll

    2012-09-24 22:32 . 2012-02-06 06:57 473072 ----a-w- c:\windows\SysWow64\deployJava1.dll

    2012-09-19 17:02 . 2012-09-19 17:02 102368 ----a-w- c:\windows\system32\drivers\ssudbus.sys

    2012-09-19 17:02 . 2012-09-19 17:02 203104 ----a-w- c:\windows\system32\drivers\ssudmdm.sys

    2012-09-14 19:19 . 2012-10-11 07:21 2048 ----a-w- c:\windows\system32\tzres.dll

    2012-09-14 18:28 . 2012-10-11 07:21 2048 ----a-w- c:\windows\SysWow64\tzres.dll

    2012-08-31 18:19 . 2012-10-11 07:22 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys

    2012-08-31 05:03 . 2012-08-31 05:03 228768 ----a-w- c:\windows\system32\drivers\MpFilter.sys

    2012-08-31 05:03 . 2011-04-27 23:25 128456 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys

    2012-08-30 18:03 . 2012-10-11 07:22 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe

    2012-08-30 17:12 . 2012-10-11 07:22 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

    2012-08-30 17:12 . 2012-10-11 07:22 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

    2012-08-24 18:05 . 2012-10-11 07:21 220160 ----a-w- c:\windows\system32\wintrust.dll

    2012-08-24 16:57 . 2012-10-11 07:21 172544 ----a-w- c:\windows\SysWow64\wintrust.dll

    2012-08-22 18:12 . 2012-09-12 16:41 950128 ----a-w- c:\windows\system32\drivers\ndis.sys

    2012-08-22 18:12 . 2012-09-12 16:41 376688 ----a-w- c:\windows\system32\drivers\netio.sys

    2012-08-22 18:12 . 2012-09-12 16:41 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "Steam"="c:\program files (x86)\Steam\steam.exe" [2012-08-15 1353080]

    "DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2012-02-13 3481408]

    "KiesPreload"="c:\program files (x86)\Samsung\Kies\Kies.exe" [2012-08-31 964024]

    "KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-08-31 21432]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "Six Engine"="c:\program files (x86)\ASUS\EPU\EPU.exe" [2011-04-12 5402752]

    "QFan Help"="c:\program files\ASUS\Ai Suite\QFan4\FanHelp.exe" [2010-03-25 888960]

    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-07-27 35768]

    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

    "TurboV EVO"="c:\program files\ASUS\TurboV EVO\TurboV_EVO.exe" [2010-11-12 10007168]

    "ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSPanel.exe" [2011-04-11 734544]

    "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]

    "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-27 30040]

    "KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-08-31 3524536]

    "amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]

    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]

    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-09-28 642728]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    "PromptOnSecureDesktop"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

    @="Service"

    .

    R2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-04-09 57472]

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

    R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-09-19 102368]

    R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [2012-02-04 21712]

    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-31 128456]

    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-13 368896]

    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

    R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2010-01-14 48416]

    R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan60.sys [2010-01-14 29472]

    R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-09-19 203104]

    R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.2);c:\windows\system32\DRIVERS\RtTeam60.sys [2010-01-14 48416]

    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-02-03 1255736]

    S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2006-10-18 52760]

    S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys [x]

    S1 aswSnx;aswSnx; [x]

    S1 aswSP;aswSP; [x]

    S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-03-17 283200]

    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-09-28 239616]

    S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-09-28 361984]

    S2 AMD_RAIDXpert;AMD RAIDXpert;c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe [2009-12-16 122880]

    S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-04-09 57472]

    S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.05\AsSysCtrlService.exe [2010-06-24 109056]

    S2 aswFsBlk;aswFsBlk; [x]

    S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-10-30 71600]

    S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys [2010-01-14 32544]

    S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]

    S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [2011-06-02 128488]

    S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [2011-06-02 401896]

    S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-05-14 96896]

    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]

    S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys [2010-12-03 1105000]

    S3 SaiK0CCB;SaiK0CCB;c:\windows\system32\DRIVERS\SaiK0CCB.sys [2010-08-10 171016]

    S3 SaiU0CCB;SaiU0CCB;c:\windows\system32\DRIVERS\SaiU0CCB.sys [2010-04-22 41096]

    .

    .

    --- Other Services/Drivers In Memory ---

    .

    *NewlyCreated* - WS2IFSL

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2012-11-20 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-10 01:02]

    .

    2012-11-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-03 10:45]

    .

    2012-11-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-03 10:45]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

    @="{472083B0-C522-11CF-8763-00608CC02F24}"

    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

    2012-10-30 23:50 133400 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

    @="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"

    [HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]

    2011-04-11 03:35 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

    @="{64174815-8D98-4CE6-8646-4C039977D808}"

    [HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]

    2011-04-11 03:35 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.94.193\AsusWSShellExt64.dll

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-06-28 11905128]

    "ProfilerU"="c:\program files\Saitek\SD6\Software\ProfilerU.exe" [2010-07-29 310272]

    "SaiMfd"="c:\program files\Saitek\SD6\Software\SaiMfd.exe" [2010-07-29 158208]

    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-13 1289704]

    .

    ------- Supplementary Scan -------

    .

    uLocal Page = c:\windows\system32\blank.htm

    uStart Page = hxxp://www.google.com

    mStart Page = hxxp://www.google.com

    mLocal Page = c:\windows\SysWOW64\blank.htm

    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000

    TCP: DhcpNameServer = 192.168.2.1

    .

    - - - - ORPHANS REMOVED - - - -

    .

    Wow6432Node-HKCU-Run-KiesAirMessage - c:\program files (x86)\Samsung\Kies\KiesAirMessage.exe

    AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

    AddRemove-DVD5_DIGOTY - c:\program files (x86)\Dead Island GOTY\_Installer\unins000.exe

    AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe

    AddRemove-Uplay - c:\program files (x86)\Ubisoft\Ubisoft Game Launcher\Uninstall.exe

    .

    .

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_USERS\S-1-5-21-2077868140-2434586206-2512631317-1000\Software\SecuROM\License information*]

    "datasecu"=hex:66,38,1d,81,49,67,72,62,0a,a0,b0,0f,c2,1f,a0,eb,3f,72,ad,04,a6,

    a6,58,bc,e2,00,1e,19,ab,c2,d4,11,31,59,cb,aa,31,34,97,4d,71,e5,99,df,0c,95,\

    "rkeysecu"=hex:e6,0b,cf,9d,d3,83,e9,01,cc,63,28,ed,52,3a,aa,95

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Shockwave Flash Object"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

    @="0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

    @="ShockwaveFlash.ShockwaveFlash.11"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="ShockwaveFlash.ShockwaveFlash"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Macromedia Flash Factory Object"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

    @="FlashFactory.FlashFactory.1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="FlashFactory.FlashFactory"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]

    @="?????????????????? v1"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

    @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]

    @="?????????????????? v2"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

    @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    ------------------------ Other Running Processes ------------------------

    .

    c:\program files\AVAST Software\Avast\AvastSvc.exe

    c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    c:\program files\ASUS\TurboV EVO\TurboVHELP.exe

    c:\program files\ASUS\GPU Boost Driver\GpuBoostServer.exe

    c:\program files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

    c:\program files (x86)\Cisco Systems\VPN Client\cvpnd.exe

    c:\windows\SysWOW64\PnkBstrA.exe

    .

    **************************************************************************

    .

    Completion time: 2012-11-19 21:56:56 - machine was rebooted

    ComboFix-quarantined-files.txt 2012-11-20 05:56

    .

    Pre-Run: 577,446,948,864 bytes free

    Post-Run: 579,192,008,704 bytes free

    .

    - - End Of File - - 6FC838B1934F0A8C53377B741E254731

    Please Help! I have a rootkit virus!

    in Resolved Malware Removal Logs

    Posted

    Hi Gringo! Thanks for helping me out. So here are the results from the logs.

    Security check:

    Results of screen317's Security Check version 0.99.54

    Windows 7 Service Pack 1 x64 (UAC is enabled)

    Internet Explorer 9

    ``````````````Antivirus/Firewall Check:``````````````

    Windows Firewall Enabled!

    avast! Antivirus

    Microsoft Security Essentials

    Antivirus up to date!

    `````````Anti-malware/Other Utilities Check:`````````

    Malwarebytes Anti-Malware version 1.65.1.1000

    Java 6 Update 37

    Java version out of Date!

    Adobe Flash Player 11.4.402.287

    Adobe Reader X (10.1.4)

    Google Chrome 21.0.1180.83

    Google Chrome 21.0.1180.89

    Google Chrome 22.0.1229.79

    Google Chrome 22.0.1229.92

    Google Chrome 22.0.1229.94

    Google Chrome 23.0.1271.64

    ````````Process Check: objlist.exe by Laurent````````

    Microsoft Security Essentials MSMpEng.exe

    Microsoft Security Essentials msseces.exe

    AVAST Software Avast AvastSvc.exe

    AVAST Software Avast AvastUI.exe

    `````````````````System Health check`````````````````

    Total Fragmentation on Drive C: 2%

    ````````````````````End of Log``````````````````````

    ADWcleaner:

    # AdwCleaner v2.008 - Logfile created 11/19/2012 at 21:09:55

    # Updated 17/11/2012 by Xplode

    # Operating system : Windows 7 Professional Service Pack 1 (64 bits)

    # User : Josh Jun - JOSHJUN-PC

    # Boot Mode : Normal

    # Running from : C:\Users\Josh Jun\Desktop\adwcleaner.exe

    # Option [Delete]

    ***** [services] *****

    ***** [Files / Folders] *****

    Folder Deleted : C:\Program Files (x86)\Common Files\Software Update Utility

    Folder Deleted : C:\ProgramData\InstallMate

    Folder Deleted : C:\ProgramData\Premium

    ***** [Registry] *****

    Key Deleted : HKCU\Software\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj

    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\dnu.EXE

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE

    Key Deleted : HKLM\SOFTWARE\Classes\dnUpdate

    Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser

    Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1

    Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController

    Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}

    Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CA17D76B-F91D-4659-A7FD-A9F7ED375CDD}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}

    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh

    Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj

    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}

    ***** [internet Browsers] *****

    -\\ Internet Explorer v9.0.8112.16421

    Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://searchfunmoods.com/?f=1&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzuyDyEtDyE0AyC0E0FyCyE0AyEzyyCtC0AtN0D0Tzu0CtAtBtAtN1L2XzutBtFtBtFtDtFtAyEyE&cr=1044853108 --> hxxp://www.google.com

    Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://searchfunmoods.com/?f=2&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzuyDyEtDyE0AyC0E0FyCyE0AyEzyyCtC0AtN0D0Tzu0CtAtBtAtN1L2XzutBtFtBtFtDtFtAyEyE&cr=1044853108 --> hxxp://www.google.com

    Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = hxxp://searchfunmoods.com/?f=1&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzuyDyEtDyE0AyC0E0FyCyE0AyEzyyCtC0AtN0D0Tzu0CtAtBtAtN1L2XzutBtFtBtFtDtFtAyEyE&cr=1044853108 --> hxxp://www.google.com

    -\\ Google Chrome v [unable to get version]

    File : C:\Users\Josh Jun\AppData\Local\Google\Chrome\User Data\Default\Preferences

    Deleted [l.20] : urls_to_restore_on_startup = [ "hxxp://searchfunmoods.com/?f=1&a=download&chnl=download&cd[...]

    Deleted [l.3386] : urls_to_restore_on_startup = [ "hxxp://searchfunmoods.com/?f=1&a=download&chnl=download&cd=2X[...]

    *************************

    AdwCleaner[s1].txt - [7584 octets] - [19/11/2012 21:09:55]

    ########## EOF - C:\AdwCleaner[s1].txt - [7644 octets] ##########

    RogueKiller:

    RogueKiller V8.3.0 [Nov 19 2012] by Tigzy

    mail: tigzyRK<at>gmail<dot>com

    Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

    Website: http://tigzy.geekstogo.com/roguekiller.php

    Blog: http://tigzyrk.blogspot.com

    Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

    Started in : Normal mode

    User : Josh Jun [Admin rights]

    Mode : Remove -- Date : 11/19/2012 21:16:38

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 0 ¤¤¤

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED] ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤

    --> C:\Windows\system32\drivers\etc\hosts

    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: ST1000DM003-9YN162 ATA Device +++++

    --- User ---

    [MBR] eccf082e6b528a8e61cbb4c1229a4770

    [bSP] 79ec0255a8a5ccbe122df8e6d957597c : Windows 7/8 MBR Code

    Partition table:

    0 - [XXXXXX] FAT16 (0x06) [VISIBLE] Offset (sectors): 2048 | Size: 200 Mo

    1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 411648 | Size: 953667 Mo

    User = LL1 ... OK!

    User = LL2 ... OK!

    +++++ PhysicalDrive1: SanDisk U3 Cruzer Micro USB Device +++++

    --- User ---

    [MBR] 4a296257b22c19f9bfb72764b330eeb0

    [bSP] df4f83c1f72e36823a12b0dfc7617313 : MBR Code unknown

    Partition table:

    0 - [XXXXXX] FAT32 (0x0b) [VISIBLE] Offset (sectors): 44 | Size: 7655 Mo

    User = LL1 ... OK!

    Error reading LL2 MBR!

    Finished : << RKreport[3]_D_11192012_02d2116.txt >>

    RKreport[1]_S_11192012_02d2003.txt ; RKreport[2]_S_11192012_02d2116.txt ; RKreport[3]_D_11192012_02d2116.txt

    Please Help! I have a rootkit virus!

    in Resolved Malware Removal Logs

    Posted

    Hello,

    My avast! antivirus caught a rootkit in my computer and I have tried deleting the infected file(s), but it just keeps on showing up. Also I have tried to do a system restore before a time that I think had infected my system. I have also used malwarebytes and it is currently showing 2 objects being detected. I have created dds and attach .txt files so if anyone could help me out I would really appreciate it. Thanks!

    attach.txt

    dds.txt

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.