Inkwax

Jeff, I want to thank you for all your help. I have finished the last few things you suggested. Other than the hardware issue I ran into last night, the computer is back to its good old self. Your services are greatly appreciated and I will be sure to donate. Thanks again. Kevin

Oh and I forgot, the computer is running much, much better than when we started.

Jeff, I ran the CFScript.txt via ComboFix and it rebooted my computer but did not produce a logfile. I reran ComboFix without the CFScript and I am posting that log here. ComboFix 12-12-01.02 - Jolly Household 12/02/2012 14:31:10.8.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1406 [GMT -5:00] Running from: c:\documents and settings\Jolly Household\Desktop\ComboFix.exe AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll c:\documents and settings\All Users\Application Data\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Chrome\User Data\Default\Default\aagbdcdadfgegbdfdhgedjdbdedcdgdg\background.html . . ((((((((((((((((((((((((( Files Created from 2012-11-02 to 2012-12-02 ))))))))))))))))))))))))))))))) . . 2012-12-02 04:08 . 2012-12-02 04:08 -------- d-----w- c:\program files\ESET 2012-12-02 02:25 . 2012-12-02 02:25 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\Sun 2012-12-02 02:24 . 2012-12-02 02:24 -------- d-----w- c:\program files\Common Files\Java 2012-12-02 02:24 . 2012-12-02 02:24 143872 ----a-w- c:\windows\system32\javacpl.cpl 2012-12-02 02:24 . 2012-12-02 02:24 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2012-12-02 02:18 . 2012-12-02 02:18 -------- d-----w- c:\program files\iPod 2012-12-02 02:18 . 2012-12-02 02:19 -------- d-----w- c:\program files\iTunes 2012-12-02 02:18 . 2012-12-02 02:19 -------- d-----w- c:\documents and settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1 2012-12-02 02:11 . 2012-12-02 02:11 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin7.dll 2012-12-02 02:11 . 2012-12-02 02:11 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin6.dll 2012-12-02 02:11 . 2012-12-02 02:11 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin5.dll 2012-12-02 02:11 . 2012-12-02 02:11 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin4.dll 2012-12-02 02:11 . 2012-12-02 02:11 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin3.dll 2012-12-02 02:11 . 2012-12-02 02:11 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin2.dll 2012-12-02 02:11 . 2012-12-02 02:11 159744 ----a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin.dll 2012-12-02 02:11 . 2012-12-02 02:11 -------- d-----w- c:\program files\QuickTime 2012-12-01 15:26 . 2012-12-01 15:26 -------- d-----w- c:\documents and settings\Jolly Household\Application Data\AVG2013 2012-12-01 15:24 . 2012-12-01 15:24 -------- d-----w- c:\documents and settings\Jolly Household\Application Data\TuneUp Software 2012-12-01 15:23 . 2012-12-01 15:23 -------- d-----w- C:\$AVG 2012-12-01 15:23 . 2012-12-01 15:25 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG2013 2012-12-01 15:21 . 2012-12-01 15:59 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\Avg2013 2012-12-01 15:21 . 2012-12-01 15:21 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\MFAData 2012-11-30 20:39 . 2012-11-30 20:39 -------- d-----w- C:\TDSSKiller_Quarantine 2012-11-27 00:35 . 2012-12-01 00:55 -------- d-----w- c:\windows\system32\NtmsData 2012-11-26 19:23 . 2012-11-26 19:23 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\PCHealth 2012-11-19 22:29 . 2012-12-02 02:24 821736 ----a-w- c:\windows\system32\npdeployJava1.dll 2012-11-19 22:27 . 2012-11-19 22:27 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee 2012-11-18 23:03 . 2012-11-18 23:03 -------- d-----w- c:\documents and settings\Administrator . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-12-02 02:24 . 2012-01-25 23:55 746984 ----a-w- c:\windows\system32\deployJava1.dll 2012-11-26 19:40 . 2012-04-08 13:24 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-11-26 19:40 . 2012-01-24 23:18 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-10-25 08:12 . 2012-10-25 08:12 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx 2012-10-25 08:12 . 2012-10-25 08:12 69632 ----a-w- c:\windows\system32\QuickTime.qts 2012-10-22 18:02 . 2012-10-22 18:02 179936 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys 2012-10-22 08:37 . 2004-08-04 03:17 1866368 ----a-w- c:\windows\system32\win32k.sys 2012-10-15 08:48 . 2012-10-15 08:48 55776 ----a-w- c:\windows\system32\drivers\avgidshx.sys 2012-10-05 08:32 . 2012-10-05 08:32 93536 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2012-10-02 18:04 . 2004-08-04 04:56 58368 ----a-w- c:\windows\system32\synceng.dll 2012-10-02 08:30 . 2012-10-02 08:30 159712 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2012-09-29 23:54 . 2012-01-15 01:12 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-09-21 08:46 . 2012-09-21 08:46 164832 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2012-09-21 08:46 . 2012-09-21 08:46 177376 ----a-w- c:\windows\system32\drivers\avglogx.sys 2012-09-21 08:45 . 2012-09-21 08:45 19936 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys 2012-09-14 08:05 . 2012-09-14 08:05 35552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Photosmart 6510 series (NET)"="c:\program files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe" [2011-05-25 1801064] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-27 39408] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-10 7311360] "nwiz"="nwiz.exe" [2006-05-10 1519616] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-05-10 86016] "RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888] "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280] "Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-11-07 3143800] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-11-29 151952] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472] HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\FrostWire 5\\FrostWire.exe"= "c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"= "c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"= "c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"= "c:\\Program Files\\AVG\\AVG2013\\avgemcx.exe"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management . R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [10/15/2012 3:48 AM 55776] R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [9/21/2012 3:46 AM 177376] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/14/2012 3:05 AM 35552] R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [10/22/2012 1:02 PM 179936] R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [9/21/2012 3:45 AM 19936] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [10/2/2012 3:30 AM 159712] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [9/21/2012 3:46 AM 164832] R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [10/22/2012 1:05 PM 196664] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [11/6/2012 7:00 PM 5814392] . Contents of the 'Scheduled Tasks' folder . 2012-12-02 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 19:40] . 2012-12-02 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57] . 2012-12-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21] . 2012-12-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21] . 2012-12-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003Core.job - c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47] . 2012-12-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003UA.job - c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47] . 2012-12-02 c:\windows\Tasks\HP Photo Creations Messager.job - c:\documents and settings\All Users\Application Data\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11] . 2012-12-02 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-651377827-725345543-1003.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27] . 2012-11-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-651377827-725345543-1003.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.comcast.net/ uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.0.1 . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-12-02 14:38 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @DACL=(02 0010) @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] @DACL=(02 0010) "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @DACL=(02 0010) @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @DACL=(02 0010) @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'explorer.exe'(1832) c:\windows\system32\WININET.dll c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Completion time: 2012-12-02 14:39:55 ComboFix-quarantined-files.txt 2012-12-02 19:39 ComboFix2.txt 2012-12-01 15:53 ComboFix3.txt 2012-11-30 21:00 ComboFix4.txt 2012-11-30 18:50 ComboFix5.txt 2012-12-02 19:04 . Pre-Run: 146,280,235,008 bytes free Post-Run: 146,267,893,760 bytes free . - - End Of File - - 9C8460320101A04501468814886E2B89

Jeff, Here are the results from the two scans you asked for. I also updated Java and cleaned its cache as requested. MBAM log Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Database version: v2012.12.01.11 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Jolly Household :: JOLLY-DESKTOP [administrator] 12/1/2012 9:26:19 PM mbam-log-2012-12-01 (21-26-19).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 225455 Time elapsed: 9 minute(s), 32 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) ESET log C:\Documents and Settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application C:\Documents and Settings\All Users\Application Data\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application C:\Documents and Settings\Jolly Household\Local Settings\Application Data\Google\Chrome\User Data\Default\Default\aagbdcdadfgegbdfdhgedjdbdedcdgdg\background.html Win32/BHO.OEI trojan C:\TDSSKiller_Quarantine\30.11.2012_15.38.56\mbr0000\tdlfs0000\tsk0001.dta a variant of Win32/Olmarik.AYI trojan C:\TDSSKiller_Quarantine\30.11.2012_15.38.56\mbr0000\tdlfs0000\tsk0002.dta a variant of Win64/Olmarik.AM trojan C:\TDSSKiller_Quarantine\30.11.2012_15.38.56\mbr0000\tdlfs0000\tsk0003.dta a variant of Win32/Rootkit.Kryptik.PR trojan C:\TDSSKiller_Quarantine\30.11.2012_15.38.56\mbr0000\tdlfs0000\tsk0004.dta Win64/Olmarik.AN trojan C:\TDSSKiller_Quarantine\30.11.2012_15.38.56\mbr0000\tdlfs0000\tsk0008.dta Win32/Olmarik.AFK trojan C:\TDSSKiller_Quarantine\30.11.2012_15.38.56\mbr0000\tdlfs0000\tsk0009.dta Win64/Olmarik.AK trojan

Also, Do you have recommendations as to which antispyware, antivirus, etc... to run? Thanks

Jeff, I had to reinstall AVG and uninstall Avira. It appears they had attempted to uninstall AVG in the past and it did not uninstall cleanly. The computer is running much smoother now, here is the log you requested. Thanks for all of your help. ComboFix 12-12-01.01 - Jolly Household 12/01/2012 10:40:16.6.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1362 [GMT -5:00] Running from: c:\documents and settings\Jolly Household\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Jolly Household\Desktop\CFScript.txt AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . FILE :: "c:\docume~1\JOLLYH~1\LOCALS~1\Temp\GALKNJKE.exe" "c:\docume~1\JOLLYH~1\LOCALS~1\Temp\HVGAA.exe" "c:\docume~1\JOLLYH~1\LOCALS~1\Temp\RDFYUATO.exe" "c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe" . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe c:\windows\Tasks\At1.job c:\windows\Tasks\At2.job c:\windows\Tasks\At3.job c:\windows\Tasks\At4.job . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Legacy_GALKNJKE -------\Legacy_HVGAA -------\Legacy_RDFYUATO -------\Service_GALKNJKE -------\Service_HVGAA -------\Service_RDFYUATO . . ((((((((((((((((((((((((( Files Created from 2012-11-01 to 2012-12-01 ))))))))))))))))))))))))))))))) . . 2012-12-01 15:26 . 2012-12-01 15:26 -------- d-----w- c:\documents and settings\Jolly Household\Application Data\AVG2013 2012-12-01 15:24 . 2012-12-01 15:24 -------- d-----w- c:\documents and settings\Jolly Household\Application Data\TuneUp Software 2012-12-01 15:23 . 2012-12-01 15:23 -------- d-----w- C:\$AVG 2012-12-01 15:23 . 2012-12-01 15:25 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG2013 2012-12-01 15:21 . 2012-12-01 15:21 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\MFAData 2012-12-01 15:21 . 2012-12-01 15:21 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\Avg2013 2012-11-30 20:39 . 2012-11-30 20:39 -------- d-----w- C:\TDSSKiller_Quarantine 2012-11-27 00:35 . 2012-12-01 00:55 -------- d-----w- c:\windows\system32\NtmsData 2012-11-26 19:23 . 2012-11-26 19:23 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\PCHealth 2012-11-19 22:30 . 2012-11-19 22:30 -------- d-----w- c:\program files\Common Files\Java 2012-11-19 22:29 . 2012-11-19 22:28 73728 ----a-w- c:\windows\system32\javacpl.cpl 2012-11-19 22:29 . 2012-11-19 22:28 477168 ----a-w- c:\windows\system32\npdeployJava1.dll 2012-11-19 22:27 . 2012-11-19 22:27 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee 2012-11-18 23:03 . 2012-11-18 23:03 -------- d-----w- c:\documents and settings\Administrator . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-11-26 19:40 . 2012-04-08 13:24 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-11-26 19:40 . 2012-01-24 23:18 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-11-19 22:28 . 2012-01-25 23:55 473072 ----a-w- c:\windows\system32\deployJava1.dll 2012-10-22 18:02 . 2012-10-22 18:02 179936 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys 2012-10-22 08:37 . 2004-08-04 03:17 1866368 ----a-w- c:\windows\system32\win32k.sys 2012-10-15 08:48 . 2012-10-15 08:48 55776 ----a-w- c:\windows\system32\drivers\avgidshx.sys 2012-10-05 08:32 . 2012-10-05 08:32 93536 ----a-w- c:\windows\system32\drivers\avgmfx86.sys 2012-10-02 18:04 . 2004-08-04 04:56 58368 ----a-w- c:\windows\system32\synceng.dll 2012-10-02 08:30 . 2012-10-02 08:30 159712 ----a-w- c:\windows\system32\drivers\avgldx86.sys 2012-09-29 23:54 . 2012-01-15 01:12 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-09-21 08:46 . 2012-09-21 08:46 164832 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2012-09-21 08:46 . 2012-09-21 08:46 177376 ----a-w- c:\windows\system32\drivers\avglogx.sys 2012-09-21 08:45 . 2012-09-21 08:45 19936 ----a-w- c:\windows\system32\drivers\avgidsshimx.sys 2012-09-14 08:05 . 2012-09-14 08:05 35552 ----a-w- c:\windows\system32\drivers\avgrkx86.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Photosmart 6510 series (NET)"="c:\program files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe" [2011-05-25 1801064] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-27 39408] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-10 7311360] "nwiz"="nwiz.exe" [2006-05-10 1519616] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-05-10 86016] "RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888] "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280] "Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-04-19 421888] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896] "AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-11-07 3143800] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472] HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\FrostWire 5\\FrostWire.exe"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"= "c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"= "c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"= "c:\\Program Files\\AVG\\AVG2013\\avgemcx.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management . R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [10/15/2012 3:48 AM 55776] R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [9/21/2012 3:46 AM 177376] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [9/14/2012 3:05 AM 35552] R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [10/22/2012 1:02 PM 179936] R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [9/21/2012 3:45 AM 19936] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [10/2/2012 3:30 AM 159712] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [9/21/2012 3:46 AM 164832] R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [11/6/2012 7:00 PM 5814392] R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [10/22/2012 1:05 PM 196664] . Contents of the 'Scheduled Tasks' folder . 2012-12-01 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 19:40] . 2012-11-18 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57] . 2012-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21] . 2012-12-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21] . 2012-12-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003Core.job - c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47] . 2012-12-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003UA.job - c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47] . 2012-12-01 c:\windows\Tasks\HP Photo Creations Messager.job - c:\documents and settings\All Users\Application Data\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11] . 2012-12-01 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-651377827-725345543-1003.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27] . 2012-11-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-651377827-725345543-1003.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.comcast.net/ uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.0.1 . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-12-01 10:50 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @DACL=(02 0010) @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] @DACL=(02 0010) "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @DACL=(02 0010) @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @DACL=(02 0010) @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'explorer.exe'(148) c:\windows\system32\WININET.dll c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\RUNDLL32.EXE c:\windows\RTHDCPL.EXE c:\windows\system32\SearchIndexer.exe c:\program files\HP\Digital Imaging\bin\hpqimzone.exe c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2012-12-01 10:53:36 - machine was rebooted ComboFix-quarantined-files.txt 2012-12-01 15:53 ComboFix2.txt 2012-11-30 21:00 ComboFix3.txt 2012-11-30 18:50 ComboFix4.txt 2012-11-30 03:38 . Pre-Run: 147,083,939,840 bytes free Post-Run: 146,947,272,704 bytes free . - - End Of File - - 71951F2666F432DF1B17E3229D15C35B

ComboFix 12-11-30.02 - Jolly Household 11/30/2012 15:52:12.5.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1361 [GMT -5:00] Running from: c:\documents and settings\Jolly Household\Desktop\ComboFix.exe AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7} . . ((((((((((((((((((((((((( Files Created from 2012-10-28 to 2012-11-30 ))))))))))))))))))))))))))))))) . . 2012-11-30 20:39 . 2012-11-30 20:39 -------- d-----w- C:\TDSSKiller_Quarantine 2012-11-27 00:35 . 2012-11-28 20:40 -------- d-----w- c:\windows\system32\NtmsData 2012-11-26 20:38 . 2012-11-26 20:38 -------- d-----w- c:\documents and settings\Jolly Household\Application Data\Avira 2012-11-26 20:37 . 2012-11-17 01:17 36552 ----a-w- c:\windows\system32\drivers\avkmgr.sys 2012-11-26 20:37 . 2012-11-17 01:17 133824 ----a-w- c:\windows\system32\drivers\avipbb.sys 2012-11-26 20:37 . 2012-11-17 01:17 83432 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2012-11-26 20:37 . 2012-11-26 20:37 -------- d-----w- c:\program files\Avira 2012-11-26 20:37 . 2012-11-26 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira 2012-11-26 19:23 . 2012-11-26 19:23 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\PCHealth 2012-11-19 22:30 . 2012-11-19 22:30 -------- d-----w- c:\program files\Common Files\Java 2012-11-19 22:29 . 2012-11-19 22:28 73728 ----a-w- c:\windows\system32\javacpl.cpl 2012-11-19 22:29 . 2012-11-19 22:28 477168 ----a-w- c:\windows\system32\npdeployJava1.dll 2012-11-19 22:27 . 2012-11-19 22:27 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee 2012-11-18 23:03 . 2012-11-18 23:03 -------- d-----w- c:\documents and settings\Administrator . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-11-26 19:40 . 2012-04-08 13:24 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-11-26 19:40 . 2012-01-24 23:18 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-11-19 22:28 . 2012-01-25 23:55 473072 ----a-w- c:\windows\system32\deployJava1.dll 2012-09-29 23:54 . 2012-01-15 01:12 22856 ----a-w- c:\windows\system32\drivers\mbam.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Photosmart 6510 series (NET)"="c:\program files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe" [2011-05-25 1801064] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-27 39408] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-10 7311360] "nwiz"="nwiz.exe" [2006-05-10 1519616] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-05-10 86016] "RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888] "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280] "Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-04-19 421888] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-11-16 384800] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472] HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\FrostWire 5\\FrostWire.exe"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management . R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [11/26/2012 3:37 PM 36552] R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/26/2012 3:37 PM 85280] S4 GALKNJKE;GALKNJKE;c:\docume~1\JOLLYH~1\LOCALS~1\Temp\GALKNJKE.exe --> c:\docume~1\JOLLYH~1\LOCALS~1\Temp\GALKNJKE.exe [?] S4 HVGAA;HVGAA;c:\docume~1\JOLLYH~1\LOCALS~1\Temp\HVGAA.exe --> c:\docume~1\JOLLYH~1\LOCALS~1\Temp\HVGAA.exe [?] S4 RDFYUATO;RDFYUATO;c:\docume~1\JOLLYH~1\LOCALS~1\Temp\RDFYUATO.exe --> c:\docume~1\JOLLYH~1\LOCALS~1\Temp\RDFYUATO.exe [?] . --- Other Services/Drivers In Memory --- . *NewlyCreated* - 59211306 *NewlyCreated* - 79973197 *Deregistered* - 59211306 *Deregistered* - 79973197 . Contents of the 'Scheduled Tasks' folder . 2012-11-30 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 19:40] . 2012-11-18 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57] . 2012-11-27 c:\windows\Tasks\At1.job - c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13] . 2012-11-27 c:\windows\Tasks\At2.job - c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13] . 2012-11-27 c:\windows\Tasks\At3.job - c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13] . 2012-11-30 c:\windows\Tasks\At4.job - c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13] . 2012-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21] . 2012-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21] . 2012-11-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003Core.job - c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47] . 2012-11-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003UA.job - c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47] . 2012-11-30 c:\windows\Tasks\HP Photo Creations Messager.job - c:\documents and settings\All Users\Application Data\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11] . 2012-11-30 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-651377827-725345543-1003.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27] . 2012-11-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-651377827-725345543-1003.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.comcast.net/ uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.0.1 . - - - - ORPHANS REMOVED - - - - . SafeBoot-79973197.sys . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-11-30 15:58 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @DACL=(02 0010) @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] @DACL=(02 0010) "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @DACL=(02 0010) @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @DACL=(02 0010) @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'explorer.exe'(1496) c:\windows\system32\WININET.dll c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Completion time: 2012-11-30 16:00:17 ComboFix-quarantined-files.txt 2012-11-30 21:00 ComboFix2.txt 2012-11-30 18:50 ComboFix3.txt 2012-11-30 03:38 . Pre-Run: 147,148,849,152 bytes free Post-Run: 147,141,197,824 bytes free . - - End Of File - - C40118B6E1086BAA834A8BB13A5DF42A

Jeff, I have two logs for you. 1 from when I "cured" the system and one from after the reboot. TDSSKiller auto-started on the reboot so I figured it couldnt hurt to run it again. 15:38:56.0515 1248 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35 15:38:56.0796 1248 ============================================================ 15:38:56.0796 1248 Current date / time: 2012/11/30 15:38:56.0796 15:38:56.0796 1248 SystemInfo: 15:38:56.0796 1248 15:38:56.0796 1248 OS Version: 5.1.2600 ServicePack: 3.0 15:38:56.0796 1248 Product type: Workstation 15:38:56.0796 1248 ComputerName: JOLLY-DESKTOP 15:38:56.0796 1248 UserName: Jolly Household 15:38:56.0796 1248 Windows directory: C:\WINDOWS 15:38:56.0796 1248 System windows directory: C:\WINDOWS 15:38:56.0796 1248 Processor architecture: Intel x86 15:38:56.0796 1248 Number of processors: 2 15:38:56.0796 1248 Page size: 0x1000 15:38:56.0796 1248 Boot type: Normal boot 15:38:56.0796 1248 ============================================================ 15:38:59.0140 1248 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x7E2D, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000054 15:38:59.0156 1248 ============================================================ 15:38:59.0156 1248 \Device\Harddisk0\DR0: 15:38:59.0156 1248 MBR partitions: 15:38:59.0156 1248 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1D1C0681 15:38:59.0156 1248 ============================================================ 15:38:59.0187 1248 C: <-> \Device\Harddisk0\DR0\Partition1 15:38:59.0187 1248 ============================================================ 15:38:59.0187 1248 Initialize success 15:38:59.0187 1248 ============================================================ 15:39:13.0265 2416 ============================================================ 15:39:13.0265 2416 Scan started 15:39:13.0265 2416 Mode: Manual; 15:39:13.0265 2416 ============================================================ 15:39:13.0968 2416 ================ Scan system memory ======================== 15:39:13.0968 2416 System memory - ok 15:39:13.0968 2416 ================ Scan services ============================= 15:39:14.0015 2416 Abiosdsk - ok 15:39:14.0031 2416 abp480n5 - ok 15:39:14.0093 2416 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys 15:39:14.0093 2416 ACPI - ok 15:39:14.0156 2416 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys 15:39:14.0156 2416 ACPIEC - ok 15:39:14.0234 2416 [ 0CB0AA071C7B86A64F361DCFDF357329 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 15:39:14.0250 2416 AdobeFlashPlayerUpdateSvc - ok 15:39:14.0265 2416 adpu160m - ok 15:39:14.0312 2416 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys 15:39:14.0343 2416 aec - ok 15:39:14.0390 2416 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys 15:39:14.0406 2416 AFD - ok 15:39:14.0406 2416 Aha154x - ok 15:39:14.0421 2416 aic78u2 - ok 15:39:14.0421 2416 aic78xx - ok 15:39:14.0484 2416 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll 15:39:14.0484 2416 Alerter - ok 15:39:14.0531 2416 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe 15:39:14.0531 2416 ALG - ok 15:39:14.0531 2416 AliIde - ok 15:39:14.0625 2416 [ 033448D435E65C4BD72E70521FD05C76 ] AmdPPM C:\WINDOWS\system32\DRIVERS\AmdPPM.sys 15:39:14.0640 2416 AmdPPM - ok 15:39:14.0640 2416 amsint - ok 15:39:14.0828 2416 [ 99EEA1B057FA11CF069A4870D218A003 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe 15:39:14.0875 2416 AntiVirSchedulerService - ok 15:39:14.0953 2416 [ 4C040249F009A4807B2955D5E5210104 ] AntiVirService C:\Program Files\Avira\AntiVir Desktop\avguard.exe 15:39:14.0968 2416 AntiVirService - ok 15:39:15.0062 2416 [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 15:39:15.0062 2416 Apple Mobile Device - ok 15:39:15.0109 2416 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll 15:39:15.0109 2416 AppMgmt - ok 15:39:15.0187 2416 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys 15:39:15.0187 2416 Arp1394 - ok 15:39:15.0187 2416 asc - ok 15:39:15.0203 2416 asc3350p - ok 15:39:15.0203 2416 asc3550 - ok 15:39:15.0359 2416 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 15:39:15.0375 2416 aspnet_state - ok 15:39:15.0421 2416 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys 15:39:15.0421 2416 AsyncMac - ok 15:39:15.0484 2416 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys 15:39:15.0484 2416 atapi - ok 15:39:15.0484 2416 Atdisk - ok 15:39:15.0500 2416 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys 15:39:15.0500 2416 Atmarpc - ok 15:39:15.0562 2416 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll 15:39:15.0640 2416 AudioSrv - ok 15:39:15.0703 2416 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys 15:39:15.0843 2416 audstub - ok 15:39:15.0843 2416 [ 680B3A1BE559B5D5AAC04C7949469DD6 ] avgntflt C:\WINDOWS\system32\DRIVERS\avgntflt.sys 15:39:15.0859 2416 avgntflt - ok 15:39:15.0906 2416 [ 6B289080B9752DAD39C1C2B98B479DCE ] avipbb C:\WINDOWS\system32\DRIVERS\avipbb.sys 15:39:15.0921 2416 avipbb - ok 15:39:15.0953 2416 [ FFB78D74E1EA5F811341A6E7AC547A46 ] avkmgr C:\WINDOWS\system32\DRIVERS\avkmgr.sys 15:39:15.0968 2416 avkmgr - ok 15:39:16.0000 2416 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys 15:39:16.0000 2416 Beep - ok 15:39:16.0062 2416 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll 15:39:16.0125 2416 BITS - ok 15:39:16.0140 2416 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe 15:39:16.0156 2416 Bonjour Service - ok 15:39:16.0218 2416 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll 15:39:16.0218 2416 Browser - ok 15:39:16.0375 2416 catchme - ok 15:39:16.0437 2416 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys 15:39:16.0453 2416 cbidf2k - ok 15:39:16.0453 2416 cd20xrnt - ok 15:39:16.0484 2416 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys 15:39:16.0484 2416 Cdaudio - ok 15:39:16.0515 2416 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys 15:39:16.0515 2416 Cdfs - ok 15:39:16.0546 2416 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys 15:39:16.0562 2416 Cdrom - ok 15:39:16.0562 2416 Changer - ok 15:39:16.0625 2416 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe 15:39:16.0625 2416 CiSvc - ok 15:39:16.0671 2416 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe 15:39:16.0687 2416 ClipSrv - ok 15:39:16.0734 2416 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 15:39:16.0765 2416 clr_optimization_v2.0.50727_32 - ok 15:39:16.0890 2416 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 15:39:16.0890 2416 clr_optimization_v4.0.30319_32 - ok 15:39:16.0890 2416 CmdIde - ok 15:39:16.0890 2416 COMSysApp - ok 15:39:16.0906 2416 Cpqarray - ok 15:39:16.0921 2416 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll 15:39:16.0937 2416 CryptSvc - ok 15:39:16.0937 2416 dac2w2k - ok 15:39:16.0953 2416 dac960nt - ok 15:39:17.0015 2416 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll 15:39:17.0015 2416 DcomLaunch - ok 15:39:17.0078 2416 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll 15:39:17.0078 2416 Dhcp - ok 15:39:17.0125 2416 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys 15:39:17.0140 2416 Disk - ok 15:39:17.0140 2416 dmadmin - ok 15:39:17.0265 2416 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys 15:39:17.0343 2416 dmboot - ok 15:39:17.0375 2416 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys 15:39:17.0453 2416 dmio - ok 15:39:17.0468 2416 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys 15:39:17.0468 2416 dmload - ok 15:39:17.0500 2416 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll 15:39:17.0515 2416 dmserver - ok 15:39:17.0562 2416 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys 15:39:17.0562 2416 DMusic - ok 15:39:17.0640 2416 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll 15:39:17.0640 2416 Dnscache - ok 15:39:17.0781 2416 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll 15:39:17.0812 2416 Dot3svc - ok 15:39:17.0812 2416 dpti2o - ok 15:39:17.0875 2416 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys 15:39:17.0875 2416 drmkaud - ok 15:39:17.0921 2416 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll 15:39:17.0921 2416 EapHost - ok 15:39:18.0015 2416 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll 15:39:18.0015 2416 ERSvc - ok 15:39:18.0078 2416 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe 15:39:18.0093 2416 Eventlog - ok 15:39:18.0156 2416 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll 15:39:18.0171 2416 EventSystem - ok 15:39:18.0218 2416 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys 15:39:18.0218 2416 Fastfat - ok 15:39:18.0265 2416 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll 15:39:18.0281 2416 FastUserSwitchingCompatibility - ok 15:39:18.0281 2416 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys 15:39:18.0296 2416 Fdc - ok 15:39:18.0312 2416 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys 15:39:18.0312 2416 Fips - ok 15:39:18.0359 2416 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys 15:39:18.0390 2416 Flpydisk - ok 15:39:18.0468 2416 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys 15:39:18.0515 2416 FltMgr - ok 15:39:18.0625 2416 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 15:39:18.0640 2416 FontCache3.0.0.0 - ok 15:39:18.0703 2416 [ E0087225B137E57239FF40F8AE82059B ] fssfltr C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys 15:39:18.0703 2416 fssfltr - ok 15:39:18.0843 2416 [ 45B52394F9624237F33A8A3D73C0B221 ] fsssvc C:\Program Files\Windows Live\Family Safety\fsssvc.exe 15:39:18.0937 2416 fsssvc - ok 15:39:18.0937 2416 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys 15:39:18.0953 2416 Fs_Rec - ok 15:39:18.0984 2416 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys 15:39:19.0000 2416 Ftdisk - ok 15:39:19.0000 2416 GALKNJKE - ok 15:39:19.0062 2416 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 15:39:19.0062 2416 GEARAspiWDM - ok 15:39:19.0078 2416 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys 15:39:19.0078 2416 Gpc - ok 15:39:19.0187 2416 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe 15:39:19.0187 2416 gupdate - ok 15:39:19.0187 2416 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe 15:39:19.0187 2416 gupdatem - ok 15:39:19.0265 2416 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 15:39:19.0265 2416 gusvc - ok 15:39:19.0328 2416 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 15:39:19.0328 2416 HDAudBus - ok 15:39:19.0656 2416 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 15:39:19.0671 2416 helpsvc - ok 15:39:19.0718 2416 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll 15:39:19.0718 2416 HidServ - ok 15:39:19.0875 2416 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys 15:39:19.0953 2416 HidUsb - ok 15:39:20.0015 2416 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll 15:39:20.0062 2416 hkmsvc - ok 15:39:20.0296 2416 [ C5F00D15AA15CB7F55A027FF75E44BB7 ] HP Port Resolver C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE 15:39:20.0296 2416 HP Port Resolver - ok 15:39:20.0468 2416 [ C5A288E4CEEF5A26D105117BAA3763AB ] HP Status Server C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE 15:39:20.0531 2416 HP Status Server - ok 15:39:20.0546 2416 hpn - ok 15:39:20.0562 2416 [ 30CA91E657CEDE2F95359D6EF186F650 ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys 15:39:20.0578 2416 HPZid412 - ok 15:39:20.0609 2416 [ EFD31AFA752AA7C7BBB57BCBE2B01C78 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 15:39:20.0609 2416 HPZipr12 - ok 15:39:20.0656 2416 [ 7AC43C38CA8FD7ED0B0A4466F753E06E ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys 15:39:20.0875 2416 HPZius12 - ok 15:39:20.0937 2416 [ 5DF616ADDB75C1AD36C1F9E4DE0F7654 ] HSFHWBS2 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 15:39:20.0953 2416 HSFHWBS2 - ok 15:39:20.0984 2416 [ DFA8F86C0DBCA7DB948043AA3BE6793B ] HSF_DP C:\WINDOWS\system32\DRIVERS\HSF_DP.sys 15:39:21.0046 2416 HSF_DP - ok 15:39:21.0109 2416 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys 15:39:21.0109 2416 HTTP - ok 15:39:21.0156 2416 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll 15:39:21.0187 2416 HTTPFilter - ok 15:39:21.0187 2416 HVGAA - ok 15:39:21.0203 2416 i2omgmt - ok 15:39:21.0203 2416 i2omp - ok 15:39:21.0265 2416 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys 15:39:21.0281 2416 i8042prt - ok 15:39:21.0421 2416 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 15:39:21.0500 2416 idsvc - ok 15:39:21.0546 2416 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys 15:39:21.0562 2416 Imapi - ok 15:39:21.0625 2416 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe 15:39:21.0625 2416 ImapiService - ok 15:39:21.0640 2416 ini910u - ok 15:39:21.0828 2416 [ 14B48553BE78472D2BD3A518658A1710 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys 15:39:21.0875 2416 IntcAzAudAddService - ok 15:39:21.0890 2416 IntelIde - ok 15:39:21.0937 2416 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys 15:39:21.0953 2416 Ip6Fw - ok 15:39:21.0984 2416 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 15:39:22.0000 2416 IpFilterDriver - ok 15:39:22.0031 2416 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys 15:39:22.0031 2416 IpInIp - ok 15:39:22.0046 2416 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys 15:39:22.0062 2416 IpNat - ok 15:39:22.0140 2416 [ E6BE7A41A28D8F2DB174957454D32448 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 15:39:22.0156 2416 iPod Service - ok 15:39:22.0171 2416 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys 15:39:22.0203 2416 IPSec - ok 15:39:22.0218 2416 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys 15:39:22.0312 2416 IRENUM - ok 15:39:22.0343 2416 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys 15:39:22.0343 2416 isapnp - ok 15:39:22.0500 2416 [ 691B9B7C0CC1653732717D292D6B305D ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe 15:39:22.0515 2416 JavaQuickStarterService - ok 15:39:22.0578 2416 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys 15:39:22.0578 2416 Kbdclass - ok 15:39:22.0578 2416 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys 15:39:22.0593 2416 kbdhid - ok 15:39:22.0625 2416 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys 15:39:22.0625 2416 kmixer - ok 15:39:22.0656 2416 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys 15:39:22.0671 2416 KSecDD - ok 15:39:22.0750 2416 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll 15:39:22.0765 2416 lanmanserver - ok 15:39:22.0843 2416 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll 15:39:22.0875 2416 lanmanworkstation - ok 15:39:22.0890 2416 lbrtfdc - ok 15:39:22.0953 2416 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll 15:39:22.0953 2416 LmHosts - ok 15:39:23.0015 2416 [ 3C318B9CD391371BED62126581EE9961 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 15:39:23.0015 2416 mdmxsdk - ok 15:39:23.0062 2416 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll 15:39:23.0062 2416 Messenger - ok 15:39:23.0187 2416 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe 15:39:23.0203 2416 Microsoft Office Groove Audit Service - ok 15:39:23.0265 2416 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys 15:39:23.0281 2416 mnmdd - ok 15:39:23.0328 2416 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe 15:39:23.0328 2416 mnmsrvc - ok 15:39:23.0390 2416 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys 15:39:23.0406 2416 Modem - ok 15:39:23.0453 2416 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys 15:39:23.0453 2416 Mouclass - ok 15:39:23.0531 2416 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys 15:39:23.0546 2416 mouhid - ok 15:39:23.0546 2416 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys 15:39:23.0562 2416 MountMgr - ok 15:39:23.0562 2416 mraid35x - ok 15:39:23.0609 2416 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys 15:39:23.0625 2416 MRxDAV - ok 15:39:23.0687 2416 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 15:39:23.0718 2416 MRxSmb - ok 15:39:23.0765 2416 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe 15:39:23.0765 2416 MSDTC - ok 15:39:23.0796 2416 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys 15:39:23.0796 2416 Msfs - ok 15:39:23.0812 2416 MSIServer - ok 15:39:23.0843 2416 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys 15:39:23.0843 2416 MSKSSRV - ok 15:39:23.0875 2416 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys 15:39:23.0890 2416 MSPCLOCK - ok 15:39:23.0906 2416 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys 15:39:23.0921 2416 MSPQM - ok 15:39:23.0953 2416 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys 15:39:23.0953 2416 mssmbios - ok 15:39:23.0984 2416 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys 15:39:24.0000 2416 Mup - ok 15:39:24.0031 2416 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll 15:39:24.0078 2416 napagent - ok 15:39:24.0078 2416 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys 15:39:24.0093 2416 NDIS - ok 15:39:24.0125 2416 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys 15:39:24.0125 2416 NdisTapi - ok 15:39:24.0140 2416 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys 15:39:24.0140 2416 Ndisuio - ok 15:39:24.0156 2416 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys 15:39:24.0156 2416 NdisWan - ok 15:39:24.0187 2416 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys 15:39:24.0203 2416 NDProxy - ok 15:39:24.0203 2416 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys 15:39:24.0203 2416 NetBIOS - ok 15:39:24.0296 2416 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys 15:39:24.0343 2416 NetBT - ok 15:39:24.0406 2416 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe 15:39:24.0406 2416 NetDDE - ok 15:39:24.0421 2416 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe 15:39:24.0421 2416 NetDDEdsdm - ok 15:39:24.0468 2416 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe 15:39:24.0484 2416 Netlogon - ok 15:39:24.0531 2416 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll 15:39:24.0531 2416 Netman - ok 15:39:24.0625 2416 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 15:39:24.0640 2416 NetTcpPortSharing - ok 15:39:24.0687 2416 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys 15:39:24.0687 2416 NIC1394 - ok 15:39:24.0718 2416 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll 15:39:24.0718 2416 Nla - ok 15:39:24.0734 2416 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys 15:39:24.0734 2416 Npfs - ok 15:39:24.0812 2416 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys 15:39:24.0828 2416 Ntfs - ok 15:39:24.0828 2416 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe 15:39:24.0828 2416 NtLmSsp - ok 15:39:24.0906 2416 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll 15:39:24.0984 2416 NtmsSvc - ok 15:39:25.0031 2416 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys 15:39:25.0031 2416 Null - ok 15:39:25.0171 2416 [ 642A87877F83313EB5302749CD479024 ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 15:39:25.0343 2416 nv - ok 15:39:25.0406 2416 [ 22EEDB34C4D7613A25B10C347C6C4C21 ] NVENETFD C:\WINDOWS\system32\DRIVERS\NVENETFD.sys 15:39:25.0421 2416 NVENETFD - ok 15:39:25.0468 2416 [ 5E3F6AD5CAD0F12D3CCCD06FD964087A ] nvnetbus C:\WINDOWS\system32\DRIVERS\nvnetbus.sys 15:39:25.0468 2416 nvnetbus - ok 15:39:25.0484 2416 [ B0903C021BFCD6055C053A569EF98AEF ] NVSvc C:\WINDOWS\system32\nvsvc32.exe 15:39:25.0500 2416 NVSvc - ok 15:39:25.0546 2416 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 15:39:25.0546 2416 NwlnkFlt - ok 15:39:25.0578 2416 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 15:39:25.0593 2416 NwlnkFwd - ok 15:39:25.0718 2416 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 15:39:25.0765 2416 odserv - ok 15:39:25.0796 2416 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys 15:39:25.0812 2416 ohci1394 - ok 15:39:25.0906 2416 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 15:39:25.0921 2416 ose - ok 15:39:25.0968 2416 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\drivers\Parport.sys 15:39:25.0968 2416 Parport - ok 15:39:25.0984 2416 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys 15:39:25.0984 2416 PartMgr - ok 15:39:26.0031 2416 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys 15:39:26.0031 2416 ParVdm - ok 15:39:26.0031 2416 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys 15:39:26.0046 2416 PCI - ok 15:39:26.0078 2416 PCIDump - ok 15:39:26.0109 2416 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys 15:39:26.0109 2416 PCIIde - ok 15:39:26.0140 2416 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys 15:39:26.0156 2416 Pcmcia - ok 15:39:26.0156 2416 PDCOMP - ok 15:39:26.0171 2416 PDFRAME - ok 15:39:26.0171 2416 PDRELI - ok 15:39:26.0171 2416 PDRFRAME - ok 15:39:26.0187 2416 perc2 - ok 15:39:26.0187 2416 perc2hib - ok 15:39:26.0234 2416 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe 15:39:26.0234 2416 PlugPlay - ok 15:39:26.0281 2416 [ D31F88C5F19EEFA366A415D6BC5F2ABC ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.exe 15:39:26.0281 2416 Pml Driver HPZ12 - ok 15:39:26.0281 2416 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe 15:39:26.0296 2416 PolicyAgent - ok 15:39:26.0296 2416 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys 15:39:26.0312 2416 PptpMiniport - ok 15:39:26.0312 2416 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys 15:39:26.0328 2416 Processor - ok 15:39:26.0328 2416 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe 15:39:26.0328 2416 ProtectedStorage - ok 15:39:26.0390 2416 [ 390C204CED3785609AB24E9C52054A84 ] Ps2 C:\WINDOWS\system32\DRIVERS\PS2.sys 15:39:26.0421 2416 Ps2 - ok 15:39:26.0421 2416 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys 15:39:26.0421 2416 PSched - ok 15:39:26.0437 2416 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys 15:39:26.0453 2416 Ptilink - ok 15:39:26.0484 2416 [ 0457E25BB122B854E267CF552DCDC370 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys 15:39:26.0500 2416 PxHelp20 - ok 15:39:26.0500 2416 ql1080 - ok 15:39:26.0515 2416 Ql10wnt - ok 15:39:26.0515 2416 ql12160 - ok 15:39:26.0531 2416 ql1240 - ok 15:39:26.0531 2416 ql1280 - ok 15:39:26.0546 2416 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys 15:39:26.0546 2416 RasAcd - ok 15:39:26.0609 2416 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll 15:39:26.0625 2416 RasAuto - ok 15:39:26.0671 2416 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 15:39:26.0671 2416 Rasl2tp - ok 15:39:26.0734 2416 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll 15:39:26.0750 2416 RasMan - ok 15:39:26.0796 2416 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys 15:39:26.0796 2416 RasPppoe - ok 15:39:26.0796 2416 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys 15:39:26.0812 2416 Raspti - ok 15:39:26.0828 2416 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys 15:39:26.0828 2416 Rdbss - ok 15:39:26.0843 2416 RDFYUATO - ok 15:39:26.0859 2416 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 15:39:26.0859 2416 RDPCDD - ok 15:39:26.0875 2416 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys 15:39:26.0890 2416 rdpdr - ok 15:39:26.0937 2416 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys 15:39:26.0937 2416 RDPWD - ok 15:39:26.0984 2416 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe 15:39:27.0000 2416 RDSessMgr - ok 15:39:27.0015 2416 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys 15:39:27.0031 2416 redbook - ok 15:39:27.0062 2416 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll 15:39:27.0078 2416 RemoteAccess - ok 15:39:27.0109 2416 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll 15:39:27.0125 2416 RemoteRegistry - ok 15:39:27.0125 2416 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe 15:39:27.0140 2416 RpcLocator - ok 15:39:27.0156 2416 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll 15:39:27.0156 2416 RpcSs - ok 15:39:27.0218 2416 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe 15:39:27.0218 2416 RSVP - ok 15:39:27.0234 2416 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe 15:39:27.0234 2416 SamSs - ok 15:39:27.0250 2416 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe 15:39:27.0265 2416 SCardSvr - ok 15:39:27.0328 2416 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll 15:39:27.0343 2416 Schedule - ok 15:39:27.0406 2416 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys 15:39:27.0406 2416 Secdrv - ok 15:39:27.0468 2416 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll 15:39:27.0468 2416 seclogon - ok 15:39:27.0500 2416 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll 15:39:27.0500 2416 SENS - ok 15:39:27.0531 2416 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\drivers\Serial.sys 15:39:27.0531 2416 Serial - ok 15:39:27.0609 2416 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys 15:39:27.0609 2416 Sfloppy - ok 15:39:27.0687 2416 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll 15:39:27.0687 2416 SharedAccess - ok 15:39:27.0703 2416 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll 15:39:27.0703 2416 ShellHWDetection - ok 15:39:27.0718 2416 Simbad - ok 15:39:27.0718 2416 Sparrow - ok 15:39:27.0796 2416 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys 15:39:27.0796 2416 splitter - ok 15:39:27.0859 2416 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe 15:39:27.0859 2416 Spooler - ok 15:39:27.0875 2416 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys 15:39:27.0890 2416 sr - ok 15:39:27.0937 2416 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll 15:39:28.0234 2416 srservice - ok 15:39:28.0343 2416 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys 15:39:28.0390 2416 Srv - ok 15:39:28.0453 2416 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll 15:39:28.0453 2416 SSDPSRV - ok 15:39:28.0500 2416 [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv C:\WINDOWS\system32\DRIVERS\ssmdrv.sys 15:39:28.0500 2416 ssmdrv - ok 15:39:28.0562 2416 [ A9573045BAA16EAB9B1085205B82F1ED ] StillCam C:\WINDOWS\system32\DRIVERS\serscan.sys 15:39:28.0562 2416 StillCam - ok 15:39:28.0640 2416 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll 15:39:28.0687 2416 stisvc - ok 15:39:28.0734 2416 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys 15:39:28.0734 2416 swenum - ok 15:39:28.0781 2416 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys 15:39:28.0781 2416 swmidi - ok 15:39:28.0796 2416 SwPrv - ok 15:39:28.0796 2416 symc810 - ok 15:39:28.0812 2416 symc8xx - ok 15:39:28.0812 2416 sym_hi - ok 15:39:28.0812 2416 sym_u3 - ok 15:39:28.0843 2416 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys 15:39:28.0843 2416 sysaudio - ok 15:39:28.0859 2416 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe 15:39:28.0859 2416 SysmonLog - ok 15:39:28.0921 2416 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll 15:39:28.0937 2416 TapiSrv - ok 15:39:28.0968 2416 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys 15:39:29.0015 2416 Tcpip - ok 15:39:29.0062 2416 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys 15:39:29.0062 2416 TDPIPE - ok 15:39:29.0062 2416 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys 15:39:29.0078 2416 TDTCP - ok 15:39:29.0125 2416 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys 15:39:29.0125 2416 TermDD - ok 15:39:29.0203 2416 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll 15:39:29.0218 2416 TermService - ok 15:39:29.0250 2416 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll 15:39:29.0250 2416 Themes - ok 15:39:29.0312 2416 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe 15:39:29.0312 2416 TlntSvr - ok 15:39:29.0328 2416 TosIde - ok 15:39:29.0375 2416 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll 15:39:29.0390 2416 TrkWks - ok 15:39:29.0421 2416 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys 15:39:29.0421 2416 Udfs - ok 15:39:29.0437 2416 ultra - ok 15:39:29.0500 2416 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys 15:39:29.0515 2416 Update - ok 15:39:29.0546 2416 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll 15:39:29.0562 2416 upnphost - ok 15:39:29.0562 2416 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe 15:39:29.0578 2416 UPS - ok 15:39:29.0625 2416 [ EAFE1E00739AFE6C51487A050E772E17 ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys 15:39:29.0625 2416 USBAAPL - ok 15:39:29.0687 2416 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys 15:39:29.0687 2416 usbccgp - ok 15:39:29.0750 2416 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys 15:39:29.0750 2416 usbehci - ok 15:39:29.0796 2416 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys 15:39:29.0796 2416 usbhub - ok 15:39:29.0843 2416 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys 15:39:29.0843 2416 usbohci - ok 15:39:29.0875 2416 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys 15:39:29.0890 2416 usbprint - ok 15:39:29.0921 2416 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 15:39:29.0921 2416 usbscan - ok 15:39:29.0968 2416 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 15:39:29.0968 2416 usbstor - ok 15:39:30.0031 2416 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys 15:39:30.0031 2416 VgaSave - ok 15:39:30.0046 2416 ViaIde - ok 15:39:30.0093 2416 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys 15:39:30.0109 2416 VolSnap - ok 15:39:30.0171 2416 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe 15:39:30.0203 2416 VSS - ok 15:39:30.0234 2416 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll 15:39:30.0250 2416 W32Time - ok 15:39:30.0296 2416 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys 15:39:30.0312 2416 Wanarp - ok 15:39:30.0312 2416 WDICA - ok 15:39:30.0328 2416 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys 15:39:30.0343 2416 wdmaud - ok 15:39:30.0343 2416 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll 15:39:30.0359 2416 WebClient - ok 15:39:30.0390 2416 [ 473EE64C368CE2EED110376C11960259 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 15:39:30.0484 2416 winachsf - ok 15:39:30.0593 2416 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll 15:39:30.0609 2416 winmgmt - ok 15:39:30.0687 2416 [ 18F347402DA544A780949B8FDF83351B ] WinRM C:\WINDOWS\system32\WsmSvc.dll 15:39:30.0765 2416 WinRM - ok 15:39:30.0828 2416 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll 15:39:30.0828 2416 WmdmPmSN - ok 15:39:30.0859 2416 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll 15:39:30.0890 2416 Wmi - ok 15:39:30.0906 2416 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe 15:39:30.0921 2416 WmiApSrv - ok 15:39:31.0031 2416 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe 15:39:31.0109 2416 WMPNetworkSvc - ok 15:39:31.0218 2416 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe 15:39:31.0265 2416 WPFFontCache_v0400 - ok 15:39:31.0312 2416 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys 15:39:31.0312 2416 WS2IFSL - ok 15:39:31.0375 2416 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll 15:39:31.0406 2416 wscsvc - ok 15:39:31.0421 2416 WSearch - ok 15:39:31.0484 2416 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll 15:39:31.0484 2416 wuauserv - ok 15:39:31.0546 2416 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys 15:39:31.0546 2416 WudfPf - ok 15:39:31.0578 2416 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys 15:39:31.0593 2416 WudfRd - ok 15:39:31.0625 2416 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll 15:39:31.0640 2416 WudfSvc - ok 15:39:31.0718 2416 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll 15:39:31.0734 2416 WZCSVC - ok 15:39:31.0781 2416 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll 15:39:31.0796 2416 xmlprov - ok 15:39:31.0796 2416 ================ Scan global =============================== 15:39:31.0843 2416 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll 15:39:31.0921 2416 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll 15:39:31.0953 2416 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll 15:39:31.0984 2416 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe 15:39:31.0984 2416 [Global] - ok 15:39:31.0984 2416 ================ Scan MBR ================================== 15:39:32.0015 2416 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0 15:39:32.0015 2416 Suspicious mbr (Forged): \Device\Harddisk0\DR0 15:39:32.0046 2416 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected 15:39:32.0046 2416 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0) 15:39:32.0046 2416 ================ Scan VBR ================================== 15:39:32.0078 2416 [ 2B94AFEE9341CC63EE629935CF7ECE74 ] \Device\Harddisk0\DR0\Partition1 15:39:32.0078 2416 \Device\Harddisk0\DR0\Partition1 - ok 15:39:32.0078 2416 ============================================================ 15:39:32.0078 2416 Scan finished 15:39:32.0078 2416 ============================================================ 15:39:32.0078 1816 Detected object count: 1 15:39:32.0078 1816 Actual detected object count: 1 15:39:41.0046 1816 \Device\Harddisk0\DR0\# - copied to quarantine 15:39:41.0046 1816 \Device\Harddisk0\DR0 - copied to quarantine 15:39:41.0062 1816 \Device\Harddisk0\DR0\TDLFS\ldrm - copied to quarantine 15:39:41.0078 1816 \Device\Harddisk0\DR0\TDLFS\cmd.dll - copied to quarantine 15:39:41.0078 1816 \Device\Harddisk0\DR0\TDLFS\cmd64.dll - copied to quarantine 15:39:41.0078 1816 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine 15:39:41.0093 1816 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine 15:39:41.0125 1816 \Device\Harddisk0\DR0\TDLFS\servers.dat - copied to quarantine 15:39:41.0125 1816 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine 15:39:41.0125 1816 \Device\Harddisk0\DR0\TDLFS\ldr16 - copied to quarantine 15:39:41.0171 1816 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine 15:39:41.0171 1816 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine 15:39:41.0171 1816 \Device\Harddisk0\DR0\TDLFS\s - copied to quarantine 15:39:41.0171 1816 \Device\Harddisk0\DR0\TDLFS\u - copied to quarantine 15:39:41.0187 1816 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - will be cured on reboot 15:39:41.0187 1816 \Device\Harddisk0\DR0 - ok 15:39:41.0218 1816 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Cure 15:40:01.0562 1212 Deinitialize success Now after reboot..... 15:41:49.0906 2192 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35 15:41:51.0031 2192 ============================================================ 15:41:51.0031 2192 Current date / time: 2012/11/30 15:41:51.0031 15:41:51.0031 2192 SystemInfo: 15:41:51.0031 2192 15:41:51.0031 2192 OS Version: 5.1.2600 ServicePack: 3.0 15:41:51.0031 2192 Product type: Workstation 15:41:51.0031 2192 ComputerName: JOLLY-DESKTOP 15:41:51.0125 2192 UserName: Jolly Household 15:41:51.0125 2192 Windows directory: C:\WINDOWS 15:41:51.0125 2192 System windows directory: C:\WINDOWS 15:41:51.0140 2192 Processor architecture: Intel x86 15:41:51.0140 2192 Number of processors: 2 15:41:51.0140 2192 Page size: 0x1000 15:41:51.0140 2192 Boot type: Normal boot 15:41:51.0140 2192 ============================================================ 15:41:55.0375 2192 BG loaded 15:41:57.0484 2192 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x7E2D, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000054 15:41:57.0500 2192 ============================================================ 15:41:57.0500 2192 \Device\Harddisk0\DR0: 15:41:57.0515 2192 MBR partitions: 15:41:57.0515 2192 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1D1C0681 15:41:57.0515 2192 ============================================================ 15:41:57.0578 2192 C: <-> \Device\Harddisk0\DR0\Partition1 15:41:57.0593 2192 ============================================================ 15:41:57.0593 2192 Initialize success 15:41:57.0593 2192 ============================================================ 15:43:44.0125 2908 ============================================================ 15:43:44.0125 2908 Scan started 15:43:44.0125 2908 Mode: Manual; 15:43:44.0125 2908 ============================================================ 15:43:44.0828 2908 ================ Scan system memory ======================== 15:43:44.0828 2908 System memory - ok 15:43:44.0828 2908 ================ Scan services ============================= 15:43:44.0906 2908 Abiosdsk - ok 15:43:44.0906 2908 abp480n5 - ok 15:43:44.0968 2908 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys 15:43:44.0984 2908 ACPI - ok 15:43:45.0015 2908 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys 15:43:45.0015 2908 ACPIEC - ok 15:43:45.0156 2908 [ 0CB0AA071C7B86A64F361DCFDF357329 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 15:43:45.0156 2908 AdobeFlashPlayerUpdateSvc - ok 15:43:45.0156 2908 adpu160m - ok 15:43:45.0234 2908 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys 15:43:45.0250 2908 aec - ok 15:43:45.0328 2908 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys 15:43:45.0328 2908 AFD - ok 15:43:45.0343 2908 Aha154x - ok 15:43:45.0343 2908 aic78u2 - ok 15:43:45.0343 2908 aic78xx - ok 15:43:45.0406 2908 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll 15:43:45.0406 2908 Alerter - ok 15:43:45.0453 2908 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe 15:43:45.0453 2908 ALG - ok 15:43:45.0468 2908 AliIde - ok 15:43:45.0531 2908 [ 033448D435E65C4BD72E70521FD05C76 ] AmdPPM C:\WINDOWS\system32\DRIVERS\AmdPPM.sys 15:43:45.0531 2908 AmdPPM - ok 15:43:45.0546 2908 amsint - ok 15:43:45.0656 2908 [ 99EEA1B057FA11CF069A4870D218A003 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe 15:43:45.0703 2908 AntiVirSchedulerService - ok 15:43:45.0781 2908 [ 4C040249F009A4807B2955D5E5210104 ] AntiVirService C:\Program Files\Avira\AntiVir Desktop\avguard.exe 15:43:45.0796 2908 AntiVirService - ok 15:43:45.0828 2908 [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 15:43:45.0828 2908 Apple Mobile Device - ok 15:43:45.0906 2908 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll 15:43:45.0921 2908 AppMgmt - ok 15:43:45.0953 2908 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys 15:43:45.0953 2908 Arp1394 - ok 15:43:45.0968 2908 asc - ok 15:43:45.0968 2908 asc3350p - ok 15:43:45.0968 2908 asc3550 - ok 15:43:46.0156 2908 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 15:43:46.0203 2908 aspnet_state - ok 15:43:46.0218 2908 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys 15:43:46.0250 2908 AsyncMac - ok 15:43:46.0296 2908 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys 15:43:46.0296 2908 atapi - ok 15:43:46.0296 2908 Atdisk - ok 15:43:46.0312 2908 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys 15:43:46.0328 2908 Atmarpc - ok 15:43:46.0375 2908 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll 15:43:46.0375 2908 AudioSrv - ok 15:43:46.0437 2908 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys 15:43:46.0437 2908 audstub - ok 15:43:46.0437 2908 [ 680B3A1BE559B5D5AAC04C7949469DD6 ] avgntflt C:\WINDOWS\system32\DRIVERS\avgntflt.sys 15:43:46.0453 2908 avgntflt - ok 15:43:46.0500 2908 [ 6B289080B9752DAD39C1C2B98B479DCE ] avipbb C:\WINDOWS\system32\DRIVERS\avipbb.sys 15:43:46.0515 2908 avipbb - ok 15:43:46.0578 2908 [ FFB78D74E1EA5F811341A6E7AC547A46 ] avkmgr C:\WINDOWS\system32\DRIVERS\avkmgr.sys 15:43:46.0578 2908 avkmgr - ok 15:43:46.0640 2908 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys 15:43:46.0640 2908 Beep - ok 15:43:46.0703 2908 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll 15:43:46.0796 2908 BITS - ok 15:43:46.0828 2908 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe 15:43:46.0843 2908 Bonjour Service - ok 15:43:46.0890 2908 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll 15:43:46.0906 2908 Browser - ok 15:43:47.0046 2908 catchme - ok 15:43:47.0093 2908 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys 15:43:47.0093 2908 cbidf2k - ok 15:43:47.0093 2908 cd20xrnt - ok 15:43:47.0140 2908 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys 15:43:47.0156 2908 Cdaudio - ok 15:43:47.0187 2908 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys 15:43:47.0203 2908 Cdfs - ok 15:43:47.0218 2908 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys 15:43:47.0234 2908 Cdrom - ok 15:43:47.0234 2908 Changer - ok 15:43:47.0296 2908 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe 15:43:47.0296 2908 CiSvc - ok 15:43:47.0312 2908 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe 15:43:47.0328 2908 ClipSrv - ok 15:43:47.0375 2908 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 15:43:47.0390 2908 clr_optimization_v2.0.50727_32 - ok 15:43:47.0500 2908 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 15:43:47.0500 2908 clr_optimization_v4.0.30319_32 - ok 15:43:47.0515 2908 CmdIde - ok 15:43:47.0515 2908 COMSysApp - ok 15:43:47.0531 2908 Cpqarray - ok 15:43:47.0531 2908 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll 15:43:47.0546 2908 CryptSvc - ok 15:43:47.0546 2908 dac2w2k - ok 15:43:47.0562 2908 dac960nt - ok 15:43:47.0625 2908 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll 15:43:47.0625 2908 DcomLaunch - ok 15:43:47.0687 2908 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll 15:43:47.0687 2908 Dhcp - ok 15:43:47.0734 2908 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys 15:43:47.0750 2908 Disk - ok 15:43:47.0750 2908 dmadmin - ok 15:43:47.0812 2908 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys 15:43:47.0890 2908 dmboot - ok 15:43:47.0921 2908 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys 15:43:47.0937 2908 dmio - ok 15:43:47.0968 2908 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys 15:43:47.0968 2908 dmload - ok 15:43:48.0031 2908 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll 15:43:48.0046 2908 dmserver - ok 15:43:48.0093 2908 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys 15:43:48.0109 2908 DMusic - ok 15:43:48.0156 2908 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll 15:43:48.0171 2908 Dnscache - ok 15:43:48.0218 2908 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll 15:43:48.0234 2908 Dot3svc - ok 15:43:48.0234 2908 dpti2o - ok 15:43:48.0281 2908 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys 15:43:48.0281 2908 drmkaud - ok 15:43:48.0328 2908 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll 15:43:48.0343 2908 EapHost - ok 15:43:48.0390 2908 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll 15:43:48.0390 2908 ERSvc - ok 15:43:48.0453 2908 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe 15:43:48.0468 2908 Eventlog - ok 15:43:48.0531 2908 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll 15:43:48.0531 2908 EventSystem - ok 15:43:48.0593 2908 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys 15:43:48.0593 2908 Fastfat - ok 15:43:48.0640 2908 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll 15:43:48.0656 2908 FastUserSwitchingCompatibility - ok 15:43:48.0703 2908 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys 15:43:48.0718 2908 Fdc - ok 15:43:48.0718 2908 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys 15:43:48.0734 2908 Fips - ok 15:43:48.0750 2908 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys 15:43:48.0765 2908 Flpydisk - ok 15:43:48.0796 2908 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys 15:43:48.0812 2908 FltMgr - ok 15:43:48.0906 2908 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 15:43:48.0921 2908 FontCache3.0.0.0 - ok 15:43:48.0968 2908 [ E0087225B137E57239FF40F8AE82059B ] fssfltr C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys 15:43:48.0968 2908 fssfltr - ok 15:43:49.0109 2908 [ 45B52394F9624237F33A8A3D73C0B221 ] fsssvc C:\Program Files\Windows Live\Family Safety\fsssvc.exe 15:43:49.0156 2908 fsssvc - ok 15:43:49.0171 2908 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys 15:43:49.0171 2908 Fs_Rec - ok 15:43:49.0171 2908 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys 15:43:49.0187 2908 Ftdisk - ok 15:43:49.0187 2908 GALKNJKE - ok 15:43:49.0250 2908 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 15:43:49.0250 2908 GEARAspiWDM - ok 15:43:49.0296 2908 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys 15:43:49.0312 2908 Gpc - ok 15:43:49.0640 2908 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe 15:43:49.0656 2908 gupdate - ok 15:43:49.0671 2908 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe 15:43:49.0671 2908 gupdatem - ok 15:43:49.0734 2908 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 15:43:49.0750 2908 gusvc - ok 15:43:49.0796 2908 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 15:43:49.0796 2908 HDAudBus - ok 15:43:49.0906 2908 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 15:43:49.0906 2908 helpsvc - ok 15:43:49.0937 2908 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll 15:43:49.0953 2908 HidServ - ok 15:43:49.0984 2908 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys 15:43:49.0984 2908 HidUsb - ok 15:43:50.0046 2908 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll 15:43:50.0093 2908 hkmsvc - ok 15:43:50.0328 2908 [ C5F00D15AA15CB7F55A027FF75E44BB7 ] HP Port Resolver C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE 15:43:50.0406 2908 HP Port Resolver - ok 15:43:50.0421 2908 [ C5A288E4CEEF5A26D105117BAA3763AB ] HP Status Server C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE 15:43:50.0437 2908 HP Status Server - ok 15:43:50.0453 2908 hpn - ok 15:43:50.0468 2908 [ 30CA91E657CEDE2F95359D6EF186F650 ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys 15:43:50.0484 2908 HPZid412 - ok 15:43:50.0515 2908 [ EFD31AFA752AA7C7BBB57BCBE2B01C78 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 15:43:50.0515 2908 HPZipr12 - ok 15:43:50.0546 2908 [ 7AC43C38CA8FD7ED0B0A4466F753E06E ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys 15:43:50.0562 2908 HPZius12 - ok 15:43:50.0593 2908 [ 5DF616ADDB75C1AD36C1F9E4DE0F7654 ] HSFHWBS2 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 15:43:50.0609 2908 HSFHWBS2 - ok 15:43:50.0640 2908 [ DFA8F86C0DBCA7DB948043AA3BE6793B ] HSF_DP C:\WINDOWS\system32\DRIVERS\HSF_DP.sys 15:43:50.0656 2908 HSF_DP - ok 15:43:50.0734 2908 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys 15:43:50.0734 2908 HTTP - ok 15:43:50.0781 2908 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll 15:43:50.0796 2908 HTTPFilter - ok 15:43:50.0796 2908 HVGAA - ok 15:43:50.0796 2908 i2omgmt - ok 15:43:50.0812 2908 i2omp - ok 15:43:50.0859 2908 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys 15:43:50.0859 2908 i8042prt - ok 15:43:50.0968 2908 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 15:43:51.0046 2908 idsvc - ok 15:43:51.0109 2908 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys 15:43:51.0109 2908 Imapi - ok 15:43:51.0250 2908 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe 15:43:51.0250 2908 ImapiService - ok 15:43:51.0265 2908 ini910u - ok 15:43:51.0453 2908 [ 14B48553BE78472D2BD3A518658A1710 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys 15:43:51.0500 2908 IntcAzAudAddService - ok 15:43:51.0500 2908 IntelIde - ok 15:43:51.0531 2908 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys 15:43:51.0531 2908 Ip6Fw - ok 15:43:51.0578 2908 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 15:43:51.0593 2908 IpFilterDriver - ok 15:43:51.0609 2908 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys 15:43:51.0625 2908 IpInIp - ok 15:43:51.0640 2908 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys 15:43:51.0656 2908 IpNat - ok 15:43:51.0718 2908 [ E6BE7A41A28D8F2DB174957454D32448 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 15:43:51.0734 2908 iPod Service - ok 15:43:51.0781 2908 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys 15:43:51.0781 2908 IPSec - ok 15:43:51.0828 2908 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys 15:43:51.0828 2908 IRENUM - ok 15:43:51.0859 2908 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys 15:43:51.0875 2908 isapnp - ok 15:43:52.0015 2908 [ 691B9B7C0CC1653732717D292D6B305D ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe 15:43:52.0031 2908 JavaQuickStarterService - ok 15:43:52.0062 2908 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys 15:43:52.0078 2908 Kbdclass - ok 15:43:52.0078 2908 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys 15:43:52.0078 2908 kbdhid - ok 15:43:52.0125 2908 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys 15:43:52.0156 2908 kmixer - ok 15:43:52.0203 2908 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys 15:43:52.0234 2908 KSecDD - ok 15:43:52.0359 2908 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll 15:43:52.0375 2908 lanmanserver - ok 15:43:52.0468 2908 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll 15:43:52.0484 2908 lanmanworkstation - ok 15:43:52.0484 2908 lbrtfdc - ok 15:43:52.0515 2908 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll 15:43:52.0515 2908 LmHosts - ok 15:43:52.0578 2908 [ 3C318B9CD391371BED62126581EE9961 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 15:43:52.0578 2908 mdmxsdk - ok 15:43:52.0609 2908 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll 15:43:52.0625 2908 Messenger - ok 15:43:52.0765 2908 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe 15:43:52.0765 2908 Microsoft Office Groove Audit Service - ok 15:43:52.0843 2908 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys 15:43:52.0843 2908 mnmdd - ok 15:43:52.0875 2908 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe 15:43:52.0875 2908 mnmsrvc - ok 15:43:52.0921 2908 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys 15:43:52.0921 2908 Modem - ok 15:43:52.0937 2908 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys 15:43:52.0937 2908 Mouclass - ok 15:43:53.0000 2908 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys 15:43:53.0000 2908 mouhid - ok 15:43:53.0000 2908 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys 15:43:53.0015 2908 MountMgr - ok 15:43:53.0015 2908 mraid35x - ok 15:43:53.0046 2908 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys 15:43:53.0062 2908 MRxDAV - ok 15:43:53.0093 2908 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 15:43:53.0109 2908 MRxSmb - ok 15:43:53.0140 2908 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe 15:43:53.0156 2908 MSDTC - ok 15:43:53.0171 2908 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys 15:43:53.0187 2908 Msfs - ok 15:43:53.0187 2908 MSIServer - ok 15:43:53.0218 2908 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys 15:43:53.0250 2908 MSKSSRV - ok 15:43:53.0312 2908 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys 15:43:53.0343 2908 MSPCLOCK - ok 15:43:53.0359 2908 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys 15:43:53.0359 2908 MSPQM - ok 15:43:53.0390 2908 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys 15:43:53.0406 2908 mssmbios - ok 15:43:53.0453 2908 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys 15:43:53.0468 2908 Mup - ok 15:43:53.0515 2908 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll 15:43:53.0562 2908 napagent - ok 15:43:53.0562 2908 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys 15:43:53.0593 2908 NDIS - ok 15:43:53.0609 2908 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys 15:43:53.0609 2908 NdisTapi - ok 15:43:53.0656 2908 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys 15:43:53.0671 2908 Ndisuio - ok 15:43:53.0671 2908 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys 15:43:53.0687 2908 NdisWan - ok 15:43:53.0718 2908 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys 15:43:53.0718 2908 NDProxy - ok 15:43:53.0734 2908 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys 15:43:53.0734 2908 NetBIOS - ok 15:43:53.0765 2908 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys 15:43:53.0781 2908 NetBT - ok 15:43:53.0843 2908 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe 15:43:53.0843 2908 NetDDE - ok 15:43:53.0859 2908 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe 15:43:53.0859 2908 NetDDEdsdm - ok 15:43:53.0875 2908 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe 15:43:53.0875 2908 Netlogon - ok 15:43:53.0937 2908 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll 15:43:53.0937 2908 Netman - ok 15:43:54.0015 2908 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 15:43:54.0031 2908 NetTcpPortSharing - ok 15:43:54.0078 2908 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys 15:43:54.0093 2908 NIC1394 - ok 15:43:54.0109 2908 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll 15:43:54.0109 2908 Nla - ok 15:43:54.0109 2908 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys 15:43:54.0125 2908 Npfs - ok 15:43:54.0187 2908 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys 15:43:54.0250 2908 Ntfs - ok 15:43:54.0265 2908 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe 15:43:54.0265 2908 NtLmSsp - ok 15:43:54.0375 2908 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll 15:43:54.0468 2908 NtmsSvc - ok 15:43:54.0484 2908 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys 15:43:54.0484 2908 Null - ok 15:43:54.0625 2908 [ 642A87877F83313EB5302749CD479024 ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 15:43:54.0671 2908 nv - ok 15:43:54.0734 2908 [ 22EEDB34C4D7613A25B10C347C6C4C21 ] NVENETFD C:\WINDOWS\system32\DRIVERS\NVENETFD.sys 15:43:54.0750 2908 NVENETFD - ok 15:43:54.0796 2908 [ 5E3F6AD5CAD0F12D3CCCD06FD964087A ] nvnetbus C:\WINDOWS\system32\DRIVERS\nvnetbus.sys 15:43:54.0812 2908 nvnetbus - ok 15:43:54.0828 2908 [ B0903C021BFCD6055C053A569EF98AEF ] NVSvc C:\WINDOWS\system32\nvsvc32.exe 15:43:54.0828 2908 NVSvc - ok 15:43:54.0875 2908 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 15:43:54.0875 2908 NwlnkFlt - ok 15:43:54.0921 2908 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 15:43:54.0937 2908 NwlnkFwd - ok 15:43:55.0218 2908 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 15:43:55.0265 2908 odserv - ok 15:43:55.0265 2908 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys 15:43:55.0281 2908 ohci1394 - ok 15:43:55.0359 2908 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 15:43:55.0359 2908 ose - ok 15:43:55.0406 2908 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\drivers\Parport.sys 15:43:55.0421 2908 Parport - ok 15:43:55.0453 2908 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys 15:43:55.0453 2908 PartMgr - ok 15:43:55.0500 2908 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys 15:43:55.0531 2908 ParVdm - ok 15:43:55.0562 2908 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys 15:43:55.0640 2908 PCI - ok 15:43:55.0640 2908 PCIDump - ok 15:43:55.0703 2908 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys 15:43:55.0734 2908 PCIIde - ok 15:43:55.0796 2908 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys 15:43:55.0796 2908 Pcmcia - ok 15:43:55.0812 2908 PDCOMP - ok 15:43:55.0812 2908 PDFRAME - ok 15:43:55.0812 2908 PDRELI - ok 15:43:55.0828 2908 PDRFRAME - ok 15:43:55.0828 2908 perc2 - ok 15:43:55.0828 2908 perc2hib - ok 15:43:55.0875 2908 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe 15:43:55.0875 2908 PlugPlay - ok 15:43:55.0921 2908 [ D31F88C5F19EEFA366A415D6BC5F2ABC ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.exe 15:43:55.0937 2908 Pml Driver HPZ12 - ok 15:43:55.0937 2908 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe 15:43:55.0937 2908 PolicyAgent - ok 15:43:56.0000 2908 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys 15:43:56.0000 2908 PptpMiniport - ok 15:43:56.0046 2908 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys 15:43:56.0062 2908 Processor - ok 15:43:56.0062 2908 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe 15:43:56.0062 2908 ProtectedStorage - ok 15:43:56.0109 2908 [ 390C204CED3785609AB24E9C52054A84 ] Ps2 C:\WINDOWS\system32\DRIVERS\PS2.sys 15:43:56.0125 2908 Ps2 - ok 15:43:56.0140 2908 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys 15:43:56.0156 2908 PSched - ok 15:43:56.0156 2908 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys 15:43:56.0156 2908 Ptilink - ok 15:43:56.0187 2908 [ 0457E25BB122B854E267CF552DCDC370 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys 15:43:56.0218 2908 PxHelp20 - ok 15:43:56.0218 2908 ql1080 - ok 15:43:56.0234 2908 Ql10wnt - ok 15:43:56.0234 2908 ql12160 - ok 15:43:56.0250 2908 ql1240 - ok 15:43:56.0250 2908 ql1280 - ok 15:43:56.0312 2908 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys 15:43:56.0312 2908 RasAcd - ok 15:43:56.0375 2908 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll 15:43:56.0390 2908 RasAuto - ok 15:43:56.0421 2908 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 15:43:56.0421 2908 Rasl2tp - ok 15:43:56.0500 2908 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll 15:43:56.0500 2908 RasMan - ok 15:43:56.0515 2908 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys 15:43:56.0531 2908 RasPppoe - ok 15:43:56.0531 2908 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys 15:43:56.0531 2908 Raspti - ok 15:43:56.0546 2908 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys 15:43:56.0562 2908 Rdbss - ok 15:43:56.0562 2908 RDFYUATO - ok 15:43:56.0578 2908 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 15:43:56.0578 2908 RDPCDD - ok 15:43:56.0609 2908 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys 15:43:56.0609 2908 rdpdr - ok 15:43:56.0656 2908 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys 15:43:56.0671 2908 RDPWD - ok 15:43:56.0750 2908 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe 15:43:56.0765 2908 RDSessMgr - ok 15:43:56.0812 2908 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys 15:43:56.0828 2908 redbook - ok 15:43:56.0859 2908 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll 15:43:56.0875 2908 RemoteAccess - ok 15:43:56.0906 2908 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll 15:43:56.0921 2908 RemoteRegistry - ok 15:43:56.0921 2908 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe 15:43:56.0937 2908 RpcLocator - ok 15:43:56.0953 2908 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll 15:43:56.0953 2908 RpcSs - ok 15:43:57.0015 2908 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe 15:43:57.0015 2908 RSVP - ok 15:43:57.0062 2908 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe 15:43:57.0062 2908 SamSs - ok 15:43:57.0093 2908 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe 15:43:57.0109 2908 SCardSvr - ok 15:43:57.0156 2908 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll 15:43:57.0171 2908 Schedule - ok 15:43:57.0218 2908 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys 15:43:57.0250 2908 Secdrv - ok 15:43:57.0281 2908 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll 15:43:57.0296 2908 seclogon - ok 15:43:57.0312 2908 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll 15:43:57.0312 2908 SENS - ok 15:43:57.0359 2908 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\drivers\Serial.sys 15:43:57.0359 2908 Serial - ok 15:43:57.0421 2908 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys 15:43:57.0421 2908 Sfloppy - ok 15:43:57.0484 2908 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll 15:43:57.0500 2908 SharedAccess - ok 15:43:57.0515 2908 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll 15:43:57.0515 2908 ShellHWDetection - ok 15:43:57.0515 2908 Simbad - ok 15:43:57.0531 2908 Sparrow - ok 15:43:57.0593 2908 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys 15:43:57.0593 2908 splitter - ok 15:43:57.0640 2908 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe 15:43:57.0656 2908 Spooler - ok 15:43:57.0671 2908 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys 15:43:57.0671 2908 sr - ok 15:43:57.0750 2908 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll 15:43:57.0750 2908 srservice - ok 15:43:57.0828 2908 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys 15:43:57.0843 2908 Srv - ok 15:43:57.0890 2908 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll 15:43:57.0906 2908 SSDPSRV - ok 15:43:57.0953 2908 [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv C:\WINDOWS\system32\DRIVERS\ssmdrv.sys 15:43:57.0968 2908 ssmdrv - ok 15:43:58.0031 2908 [ A9573045BAA16EAB9B1085205B82F1ED ] StillCam C:\WINDOWS\system32\DRIVERS\serscan.sys 15:43:58.0031 2908 StillCam - ok 15:43:58.0093 2908 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll 15:43:58.0109 2908 stisvc - ok 15:43:58.0140 2908 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys 15:43:58.0140 2908 swenum - ok 15:43:58.0187 2908 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys 15:43:58.0187 2908 swmidi - ok 15:43:58.0187 2908 SwPrv - ok 15:43:58.0203 2908 symc810 - ok 15:43:58.0203 2908 symc8xx - ok 15:43:58.0218 2908 sym_hi - ok 15:43:58.0218 2908 sym_u3 - ok 15:43:58.0234 2908 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys 15:43:58.0250 2908 sysaudio - ok 15:43:58.0250 2908 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe 15:43:58.0281 2908 SysmonLog - ok 15:43:58.0375 2908 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll 15:43:58.0390 2908 TapiSrv - ok 15:43:58.0421 2908 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys 15:43:58.0437 2908 Tcpip - ok 15:43:58.0468 2908 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys 15:43:58.0468 2908 TDPIPE - ok 15:43:58.0500 2908 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys 15:43:58.0500 2908 TDTCP - ok 15:43:58.0531 2908 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys 15:43:58.0531 2908 TermDD - ok 15:43:58.0609 2908 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll 15:43:58.0625 2908 TermService - ok 15:43:58.0640 2908 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll 15:43:58.0640 2908 Themes - ok 15:43:58.0703 2908 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe 15:43:58.0718 2908 TlntSvr - ok 15:43:58.0718 2908 TosIde - ok 15:43:58.0781 2908 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll 15:43:58.0796 2908 TrkWks - ok 15:43:58.0812 2908 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys 15:43:58.0828 2908 Udfs - ok 15:43:58.0828 2908 ultra - ok 15:43:58.0890 2908 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys 15:43:58.0906 2908 Update - ok 15:43:58.0937 2908 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll 15:43:58.0953 2908 upnphost - ok 15:43:58.0953 2908 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe 15:43:58.0968 2908 UPS - ok 15:43:59.0031 2908 [ EAFE1E00739AFE6C51487A050E772E17 ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys 15:43:59.0031 2908 USBAAPL - ok 15:43:59.0109 2908 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys 15:43:59.0109 2908 usbccgp - ok 15:43:59.0156 2908 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys 15:43:59.0156 2908 usbehci - ok 15:43:59.0171 2908 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys 15:43:59.0171 2908 usbhub - ok 15:43:59.0234 2908 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys 15:43:59.0234 2908 usbohci - ok 15:43:59.0250 2908 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys 15:43:59.0265 2908 usbprint - ok 15:43:59.0281 2908 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 15:43:59.0296 2908 usbscan - ok 15:43:59.0328 2908 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 15:43:59.0328 2908 usbstor - ok 15:43:59.0390 2908 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys 15:43:59.0406 2908 VgaSave - ok 15:43:59.0406 2908 ViaIde - ok 15:43:59.0468 2908 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys 15:43:59.0468 2908 VolSnap - ok 15:43:59.0531 2908 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe 15:43:59.0562 2908 VSS - ok 15:43:59.0625 2908 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll 15:43:59.0640 2908 W32Time - ok 15:43:59.0687 2908 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys 15:43:59.0687 2908 Wanarp - ok 15:43:59.0703 2908 WDICA - ok 15:43:59.0734 2908 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys 15:43:59.0734 2908 wdmaud - ok 15:43:59.0796 2908 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll 15:43:59.0796 2908 WebClient - ok 15:43:59.0828 2908 [ 473EE64C368CE2EED110376C11960259 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 15:43:59.0843 2908 winachsf - ok 15:44:00.0171 2908 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll 15:44:00.0171 2908 winmgmt - ok 15:44:00.0406 2908 [ 18F347402DA544A780949B8FDF83351B ] WinRM C:\WINDOWS\system32\WsmSvc.dll 15:44:00.0437 2908 WinRM - ok 15:44:00.0500 2908 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll 15:44:00.0500 2908 WmdmPmSN - ok 15:44:00.0531 2908 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll 15:44:00.0546 2908 Wmi - ok 15:44:00.0578 2908 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe 15:44:00.0578 2908 WmiApSrv - ok 15:44:00.0703 2908 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe 15:44:00.0812 2908 WMPNetworkSvc - ok 15:44:00.0921 2908 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe 15:44:01.0046 2908 WPFFontCache_v0400 - ok 15:44:01.0093 2908 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys 15:44:01.0109 2908 WS2IFSL - ok 15:44:01.0171 2908 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll 15:44:01.0187 2908 wscsvc - ok 15:44:01.0187 2908 WSearch - ok 15:44:01.0234 2908 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll 15:44:01.0234 2908 wuauserv - ok 15:44:01.0281 2908 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys 15:44:01.0296 2908 WudfPf - ok 15:44:01.0343 2908 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys 15:44:01.0343 2908 WudfRd - ok 15:44:01.0390 2908 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll 15:44:01.0406 2908 WudfSvc - ok 15:44:01.0468 2908 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll 15:44:01.0468 2908 WZCSVC - ok 15:44:01.0515 2908 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll 15:44:01.0531 2908 xmlprov - ok 15:44:01.0546 2908 ================ Scan global =============================== 15:44:01.0578 2908 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll 15:44:01.0656 2908 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll 15:44:01.0687 2908 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll 15:44:01.0734 2908 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe 15:44:01.0734 2908 [Global] - ok 15:44:01.0734 2908 ================ Scan MBR ================================== 15:44:01.0765 2908 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0 15:44:01.0953 2908 \Device\Harddisk0\DR0 - ok 15:44:01.0953 2908 ================ Scan VBR ================================== 15:44:01.0953 2908 [ 2B94AFEE9341CC63EE629935CF7ECE74 ] \Device\Harddisk0\DR0\Partition1 15:44:01.0953 2908 \Device\Harddisk0\DR0\Partition1 - ok 15:44:01.0953 2908 ============================================================ 15:44:01.0953 2908 Scan finished 15:44:01.0953 2908 ============================================================ 15:44:01.0968 2900 Detected object count: 0 15:44:01.0968 2900 Actual detected object count: 0 15:44:05.0000 2144 Deinitialize success

Here is the report for which you requested. 13:51:08.0703 3516 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35 13:51:09.0000 3516 ============================================================ 13:51:09.0000 3516 Current date / time: 2012/11/30 13:51:09.0000 13:51:09.0000 3516 SystemInfo: 13:51:09.0000 3516 13:51:09.0000 3516 OS Version: 5.1.2600 ServicePack: 3.0 13:51:09.0000 3516 Product type: Workstation 13:51:09.0000 3516 ComputerName: JOLLY-DESKTOP 13:51:09.0000 3516 UserName: Jolly Household 13:51:09.0000 3516 Windows directory: C:\WINDOWS 13:51:09.0000 3516 System windows directory: C:\WINDOWS 13:51:09.0000 3516 Processor architecture: Intel x86 13:51:09.0000 3516 Number of processors: 2 13:51:09.0000 3516 Page size: 0x1000 13:51:09.0000 3516 Boot type: Normal boot 13:51:09.0000 3516 ============================================================ 13:51:10.0343 3516 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x7E2D, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000054 13:51:10.0359 3516 ============================================================ 13:51:10.0359 3516 \Device\Harddisk0\DR0: 13:51:10.0359 3516 MBR partitions: 13:51:10.0359 3516 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1D1C0681 13:51:10.0359 3516 ============================================================ 13:51:10.0406 3516 C: <-> \Device\Harddisk0\DR0\Partition1 13:51:10.0406 3516 ============================================================ 13:51:10.0406 3516 Initialize success 13:51:10.0406 3516 ============================================================ 13:51:21.0265 2336 ============================================================ 13:51:21.0265 2336 Scan started 13:51:21.0265 2336 Mode: Manual; 13:51:21.0265 2336 ============================================================ 13:51:21.0828 2336 ================ Scan system memory ======================== 13:51:21.0828 2336 System memory - ok 13:51:21.0828 2336 ================ Scan services ============================= 13:51:21.0921 2336 Abiosdsk - ok 13:51:21.0921 2336 abp480n5 - ok 13:51:21.0984 2336 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys 13:51:21.0984 2336 ACPI - ok 13:51:22.0015 2336 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys 13:51:22.0015 2336 ACPIEC - ok 13:51:22.0125 2336 [ 0CB0AA071C7B86A64F361DCFDF357329 ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 13:51:22.0125 2336 AdobeFlashPlayerUpdateSvc - ok 13:51:22.0125 2336 adpu160m - ok 13:51:22.0187 2336 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys 13:51:22.0187 2336 aec - ok 13:51:22.0250 2336 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys 13:51:22.0250 2336 AFD - ok 13:51:22.0250 2336 Aha154x - ok 13:51:22.0265 2336 aic78u2 - ok 13:51:22.0265 2336 aic78xx - ok 13:51:22.0312 2336 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll 13:51:22.0312 2336 Alerter - ok 13:51:22.0343 2336 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe 13:51:22.0343 2336 ALG - ok 13:51:22.0343 2336 AliIde - ok 13:51:22.0406 2336 [ 033448D435E65C4BD72E70521FD05C76 ] AmdPPM C:\WINDOWS\system32\DRIVERS\AmdPPM.sys 13:51:22.0406 2336 AmdPPM - ok 13:51:22.0406 2336 amsint - ok 13:51:22.0562 2336 [ 99EEA1B057FA11CF069A4870D218A003 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe 13:51:22.0562 2336 AntiVirSchedulerService - ok 13:51:22.0609 2336 [ 4C040249F009A4807B2955D5E5210104 ] AntiVirService C:\Program Files\Avira\AntiVir Desktop\avguard.exe 13:51:22.0609 2336 AntiVirService - ok 13:51:22.0703 2336 [ F401929EE0CC92BFE7F15161CA535383 ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 13:51:22.0703 2336 Apple Mobile Device - ok 13:51:22.0734 2336 [ D8849F77C0B66226335A59D26CB4EDC6 ] AppMgmt C:\WINDOWS\System32\appmgmts.dll 13:51:22.0734 2336 AppMgmt - ok 13:51:22.0765 2336 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys 13:51:22.0765 2336 Arp1394 - ok 13:51:22.0765 2336 asc - ok 13:51:22.0765 2336 asc3350p - ok 13:51:22.0781 2336 asc3550 - ok 13:51:22.0921 2336 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 13:51:22.0921 2336 aspnet_state - ok 13:51:22.0937 2336 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys 13:51:22.0937 2336 AsyncMac - ok 13:51:22.0968 2336 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys 13:51:22.0968 2336 atapi - ok 13:51:22.0968 2336 Atdisk - ok 13:51:22.0984 2336 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys 13:51:22.0984 2336 Atmarpc - ok 13:51:23.0015 2336 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll 13:51:23.0015 2336 AudioSrv - ok 13:51:23.0078 2336 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys 13:51:23.0078 2336 audstub - ok 13:51:23.0093 2336 [ 680B3A1BE559B5D5AAC04C7949469DD6 ] avgntflt C:\WINDOWS\system32\DRIVERS\avgntflt.sys 13:51:23.0093 2336 avgntflt - ok 13:51:23.0140 2336 [ 6B289080B9752DAD39C1C2B98B479DCE ] avipbb C:\WINDOWS\system32\DRIVERS\avipbb.sys 13:51:23.0140 2336 avipbb - ok 13:51:23.0218 2336 [ FFB78D74E1EA5F811341A6E7AC547A46 ] avkmgr C:\WINDOWS\system32\DRIVERS\avkmgr.sys 13:51:23.0218 2336 avkmgr - ok 13:51:23.0265 2336 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys 13:51:23.0265 2336 Beep - ok 13:51:23.0343 2336 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll 13:51:23.0343 2336 BITS - ok 13:51:23.0359 2336 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe 13:51:23.0375 2336 Bonjour Service - ok 13:51:23.0421 2336 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll 13:51:23.0421 2336 Browser - ok 13:51:23.0578 2336 catchme - ok 13:51:23.0625 2336 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys 13:51:23.0625 2336 cbidf2k - ok 13:51:23.0625 2336 cd20xrnt - ok 13:51:23.0656 2336 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys 13:51:23.0656 2336 Cdaudio - ok 13:51:23.0718 2336 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys 13:51:23.0718 2336 Cdfs - ok 13:51:23.0734 2336 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys 13:51:23.0734 2336 Cdrom - ok 13:51:23.0750 2336 Changer - ok 13:51:23.0796 2336 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe 13:51:23.0796 2336 CiSvc - ok 13:51:23.0828 2336 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe 13:51:23.0828 2336 ClipSrv - ok 13:51:23.0890 2336 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 13:51:23.0890 2336 clr_optimization_v2.0.50727_32 - ok 13:51:23.0984 2336 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 13:51:23.0984 2336 clr_optimization_v4.0.30319_32 - ok 13:51:24.0000 2336 CmdIde - ok 13:51:24.0000 2336 COMSysApp - ok 13:51:24.0015 2336 Cpqarray - ok 13:51:24.0015 2336 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll 13:51:24.0015 2336 CryptSvc - ok 13:51:24.0031 2336 dac2w2k - ok 13:51:24.0031 2336 dac960nt - ok 13:51:24.0078 2336 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll 13:51:24.0093 2336 DcomLaunch - ok 13:51:24.0140 2336 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll 13:51:24.0140 2336 Dhcp - ok 13:51:24.0156 2336 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys 13:51:24.0156 2336 Disk - ok 13:51:24.0156 2336 dmadmin - ok 13:51:24.0234 2336 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys 13:51:24.0234 2336 dmboot - ok 13:51:24.0234 2336 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys 13:51:24.0234 2336 dmio - ok 13:51:24.0250 2336 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys 13:51:24.0250 2336 dmload - ok 13:51:24.0296 2336 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll 13:51:24.0296 2336 dmserver - ok 13:51:24.0343 2336 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys 13:51:24.0343 2336 DMusic - ok 13:51:24.0406 2336 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll 13:51:24.0406 2336 Dnscache - ok 13:51:24.0515 2336 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll 13:51:24.0515 2336 Dot3svc - ok 13:51:24.0515 2336 dpti2o - ok 13:51:24.0609 2336 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys 13:51:24.0609 2336 drmkaud - ok 13:51:24.0718 2336 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll 13:51:24.0718 2336 EapHost - ok 13:51:24.0781 2336 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll 13:51:24.0781 2336 ERSvc - ok 13:51:24.0796 2336 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe 13:51:24.0796 2336 Eventlog - ok 13:51:24.0843 2336 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll 13:51:24.0859 2336 EventSystem - ok 13:51:24.0890 2336 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys 13:51:24.0890 2336 Fastfat - ok 13:51:24.0937 2336 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll 13:51:24.0937 2336 FastUserSwitchingCompatibility - ok 13:51:24.0953 2336 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\drivers\Fdc.sys 13:51:24.0953 2336 Fdc - ok 13:51:24.0968 2336 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys 13:51:24.0968 2336 Fips - ok 13:51:25.0000 2336 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\drivers\Flpydisk.sys 13:51:25.0000 2336 Flpydisk - ok 13:51:25.0046 2336 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys 13:51:25.0046 2336 FltMgr - ok 13:51:25.0140 2336 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 13:51:25.0140 2336 FontCache3.0.0.0 - ok 13:51:25.0203 2336 [ E0087225B137E57239FF40F8AE82059B ] fssfltr C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys 13:51:25.0203 2336 fssfltr - ok 13:51:25.0328 2336 [ 45B52394F9624237F33A8A3D73C0B221 ] fsssvc C:\Program Files\Windows Live\Family Safety\fsssvc.exe 13:51:25.0328 2336 fsssvc - ok 13:51:25.0343 2336 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys 13:51:25.0343 2336 Fs_Rec - ok 13:51:25.0390 2336 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys 13:51:25.0390 2336 Ftdisk - ok 13:51:25.0390 2336 GALKNJKE - ok 13:51:25.0453 2336 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 13:51:25.0453 2336 GEARAspiWDM - ok 13:51:25.0500 2336 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys 13:51:25.0500 2336 Gpc - ok 13:51:25.0609 2336 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe 13:51:25.0609 2336 gupdate - ok 13:51:25.0625 2336 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe 13:51:25.0625 2336 gupdatem - ok 13:51:25.0687 2336 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 13:51:25.0687 2336 gusvc - ok 13:51:25.0703 2336 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 13:51:25.0703 2336 HDAudBus - ok 13:51:25.0812 2336 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 13:51:25.0812 2336 helpsvc - ok 13:51:25.0843 2336 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll 13:51:25.0843 2336 HidServ - ok 13:51:25.0875 2336 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys 13:51:25.0875 2336 HidUsb - ok 13:51:25.0921 2336 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll 13:51:25.0921 2336 hkmsvc - ok 13:51:26.0031 2336 [ C5F00D15AA15CB7F55A027FF75E44BB7 ] HP Port Resolver C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE 13:51:26.0031 2336 HP Port Resolver - ok 13:51:26.0093 2336 [ C5A288E4CEEF5A26D105117BAA3763AB ] HP Status Server C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE 13:51:26.0093 2336 HP Status Server - ok 13:51:26.0109 2336 hpn - ok 13:51:26.0140 2336 [ 30CA91E657CEDE2F95359D6EF186F650 ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys 13:51:26.0140 2336 HPZid412 - ok 13:51:26.0171 2336 [ EFD31AFA752AA7C7BBB57BCBE2B01C78 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 13:51:26.0171 2336 HPZipr12 - ok 13:51:26.0203 2336 [ 7AC43C38CA8FD7ED0B0A4466F753E06E ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys 13:51:26.0203 2336 HPZius12 - ok 13:51:26.0234 2336 [ 5DF616ADDB75C1AD36C1F9E4DE0F7654 ] HSFHWBS2 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 13:51:26.0250 2336 HSFHWBS2 - ok 13:51:26.0281 2336 [ DFA8F86C0DBCA7DB948043AA3BE6793B ] HSF_DP C:\WINDOWS\system32\DRIVERS\HSF_DP.sys 13:51:26.0281 2336 HSF_DP - ok 13:51:26.0343 2336 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys 13:51:26.0359 2336 HTTP - ok 13:51:26.0406 2336 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll 13:51:26.0406 2336 HTTPFilter - ok 13:51:26.0406 2336 HVGAA - ok 13:51:26.0421 2336 i2omgmt - ok 13:51:26.0421 2336 i2omp - ok 13:51:26.0484 2336 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys 13:51:26.0484 2336 i8042prt - ok 13:51:26.0593 2336 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 13:51:26.0593 2336 idsvc - ok 13:51:26.0625 2336 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys 13:51:26.0625 2336 Imapi - ok 13:51:26.0687 2336 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe 13:51:26.0687 2336 ImapiService - ok 13:51:26.0703 2336 ini910u - ok 13:51:26.0890 2336 [ 14B48553BE78472D2BD3A518658A1710 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys 13:51:26.0921 2336 IntcAzAudAddService - ok 13:51:26.0937 2336 IntelIde - ok 13:51:26.0984 2336 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys 13:51:26.0984 2336 Ip6Fw - ok 13:51:27.0015 2336 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 13:51:27.0031 2336 IpFilterDriver - ok 13:51:27.0046 2336 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys 13:51:27.0046 2336 IpInIp - ok 13:51:27.0078 2336 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys 13:51:27.0078 2336 IpNat - ok 13:51:27.0140 2336 [ E6BE7A41A28D8F2DB174957454D32448 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 13:51:27.0156 2336 iPod Service - ok 13:51:27.0218 2336 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys 13:51:27.0218 2336 IPSec - ok 13:51:27.0265 2336 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys 13:51:27.0265 2336 IRENUM - ok 13:51:27.0296 2336 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys 13:51:27.0296 2336 isapnp - ok 13:51:27.0453 2336 [ 691B9B7C0CC1653732717D292D6B305D ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe 13:51:27.0453 2336 JavaQuickStarterService - ok 13:51:27.0484 2336 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys 13:51:27.0484 2336 Kbdclass - ok 13:51:27.0484 2336 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys 13:51:27.0484 2336 kbdhid - ok 13:51:27.0531 2336 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys 13:51:27.0531 2336 kmixer - ok 13:51:27.0562 2336 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys 13:51:27.0578 2336 KSecDD - ok 13:51:27.0609 2336 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll 13:51:27.0609 2336 lanmanserver - ok 13:51:27.0671 2336 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll 13:51:27.0671 2336 lanmanworkstation - ok 13:51:27.0671 2336 lbrtfdc - ok 13:51:27.0687 2336 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll 13:51:27.0687 2336 LmHosts - ok 13:51:27.0750 2336 [ 3C318B9CD391371BED62126581EE9961 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 13:51:27.0750 2336 mdmxsdk - ok 13:51:27.0781 2336 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll 13:51:27.0781 2336 Messenger - ok 13:51:27.0859 2336 [ 123271BD5237AB991DC5C21FDF8835EB ] Microsoft Office Groove Audit Service C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe 13:51:27.0875 2336 Microsoft Office Groove Audit Service - ok 13:51:27.0906 2336 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys 13:51:27.0906 2336 mnmdd - ok 13:51:27.0906 2336 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe 13:51:27.0906 2336 mnmsrvc - ok 13:51:27.0937 2336 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys 13:51:27.0937 2336 Modem - ok 13:51:27.0953 2336 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys 13:51:27.0953 2336 Mouclass - ok 13:51:28.0015 2336 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys 13:51:28.0015 2336 mouhid - ok 13:51:28.0015 2336 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys 13:51:28.0015 2336 MountMgr - ok 13:51:28.0015 2336 mraid35x - ok 13:51:28.0046 2336 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys 13:51:28.0046 2336 MRxDAV - ok 13:51:28.0109 2336 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 13:51:28.0109 2336 MRxSmb - ok 13:51:28.0171 2336 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe 13:51:28.0171 2336 MSDTC - ok 13:51:28.0171 2336 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys 13:51:28.0171 2336 Msfs - ok 13:51:28.0187 2336 MSIServer - ok 13:51:28.0218 2336 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys 13:51:28.0218 2336 MSKSSRV - ok 13:51:28.0250 2336 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys 13:51:28.0250 2336 MSPCLOCK - ok 13:51:28.0281 2336 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys 13:51:28.0281 2336 MSPQM - ok 13:51:28.0328 2336 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys 13:51:28.0328 2336 mssmbios - ok 13:51:28.0343 2336 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys 13:51:28.0343 2336 Mup - ok 13:51:28.0375 2336 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll 13:51:28.0390 2336 napagent - ok 13:51:28.0390 2336 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys 13:51:28.0390 2336 NDIS - ok 13:51:28.0390 2336 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys 13:51:28.0390 2336 NdisTapi - ok 13:51:28.0437 2336 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys 13:51:28.0437 2336 Ndisuio - ok 13:51:28.0453 2336 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys 13:51:28.0453 2336 NdisWan - ok 13:51:28.0484 2336 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys 13:51:28.0484 2336 NDProxy - ok 13:51:28.0500 2336 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys 13:51:28.0500 2336 NetBIOS - ok 13:51:28.0531 2336 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys 13:51:28.0546 2336 NetBT - ok 13:51:28.0593 2336 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe 13:51:28.0593 2336 NetDDE - ok 13:51:28.0609 2336 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe 13:51:28.0609 2336 NetDDEdsdm - ok 13:51:28.0625 2336 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe 13:51:28.0625 2336 Netlogon - ok 13:51:28.0671 2336 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll 13:51:28.0671 2336 Netman - ok 13:51:28.0765 2336 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 13:51:28.0765 2336 NetTcpPortSharing - ok 13:51:28.0796 2336 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys 13:51:28.0796 2336 NIC1394 - ok 13:51:28.0812 2336 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll 13:51:28.0812 2336 Nla - ok 13:51:28.0812 2336 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys 13:51:28.0812 2336 Npfs - ok 13:51:28.0843 2336 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys 13:51:28.0843 2336 Ntfs - ok 13:51:28.0843 2336 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe 13:51:28.0843 2336 NtLmSsp - ok 13:51:28.0906 2336 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll 13:51:28.0921 2336 NtmsSvc - ok 13:51:28.0937 2336 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys 13:51:28.0937 2336 Null - ok 13:51:29.0093 2336 [ 642A87877F83313EB5302749CD479024 ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 13:51:29.0109 2336 nv - ok 13:51:29.0125 2336 [ 22EEDB34C4D7613A25B10C347C6C4C21 ] NVENETFD C:\WINDOWS\system32\DRIVERS\NVENETFD.sys 13:51:29.0125 2336 NVENETFD - ok 13:51:29.0156 2336 [ 5E3F6AD5CAD0F12D3CCCD06FD964087A ] nvnetbus C:\WINDOWS\system32\DRIVERS\nvnetbus.sys 13:51:29.0156 2336 nvnetbus - ok 13:51:29.0187 2336 [ B0903C021BFCD6055C053A569EF98AEF ] NVSvc C:\WINDOWS\system32\nvsvc32.exe 13:51:29.0187 2336 NVSvc - ok 13:51:29.0218 2336 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 13:51:29.0218 2336 NwlnkFlt - ok 13:51:29.0250 2336 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 13:51:29.0250 2336 NwlnkFwd - ok 13:51:29.0375 2336 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE 13:51:29.0390 2336 odserv - ok 13:51:29.0390 2336 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys 13:51:29.0390 2336 ohci1394 - ok 13:51:29.0468 2336 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 13:51:29.0468 2336 ose - ok 13:51:29.0515 2336 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\drivers\Parport.sys 13:51:29.0515 2336 Parport - ok 13:51:29.0531 2336 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys 13:51:29.0531 2336 PartMgr - ok 13:51:29.0578 2336 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys 13:51:29.0578 2336 ParVdm - ok 13:51:29.0578 2336 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys 13:51:29.0578 2336 PCI - ok 13:51:29.0578 2336 PCIDump - ok 13:51:29.0593 2336 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys 13:51:29.0593 2336 PCIIde - ok 13:51:29.0625 2336 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys 13:51:29.0640 2336 Pcmcia - ok 13:51:29.0640 2336 PDCOMP - ok 13:51:29.0640 2336 PDFRAME - ok 13:51:29.0656 2336 PDRELI - ok 13:51:29.0656 2336 PDRFRAME - ok 13:51:29.0656 2336 perc2 - ok 13:51:29.0671 2336 perc2hib - ok 13:51:29.0703 2336 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe 13:51:29.0718 2336 PlugPlay - ok 13:51:29.0765 2336 [ D31F88C5F19EEFA366A415D6BC5F2ABC ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.exe 13:51:29.0765 2336 Pml Driver HPZ12 - ok 13:51:29.0765 2336 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe 13:51:29.0765 2336 PolicyAgent - ok 13:51:29.0781 2336 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys 13:51:29.0781 2336 PptpMiniport - ok 13:51:29.0796 2336 [ A32BEBAF723557681BFC6BD93E98BD26 ] Processor C:\WINDOWS\system32\DRIVERS\processr.sys 13:51:29.0796 2336 Processor - ok 13:51:29.0796 2336 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe 13:51:29.0796 2336 ProtectedStorage - ok 13:51:29.0968 2336 [ 390C204CED3785609AB24E9C52054A84 ] Ps2 C:\WINDOWS\system32\DRIVERS\PS2.sys 13:51:29.0968 2336 Ps2 - ok 13:51:29.0968 2336 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys 13:51:29.0968 2336 PSched - ok 13:51:30.0078 2336 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys 13:51:30.0078 2336 Ptilink - ok 13:51:30.0156 2336 [ 0457E25BB122B854E267CF552DCDC370 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys 13:51:30.0156 2336 PxHelp20 - ok 13:51:30.0156 2336 ql1080 - ok 13:51:30.0171 2336 Ql10wnt - ok 13:51:30.0171 2336 ql12160 - ok 13:51:30.0187 2336 ql1240 - ok 13:51:30.0187 2336 ql1280 - ok 13:51:30.0265 2336 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys 13:51:30.0265 2336 RasAcd - ok 13:51:30.0312 2336 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll 13:51:30.0312 2336 RasAuto - ok 13:51:30.0343 2336 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 13:51:30.0343 2336 Rasl2tp - ok 13:51:30.0406 2336 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll 13:51:30.0406 2336 RasMan - ok 13:51:30.0421 2336 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys 13:51:30.0421 2336 RasPppoe - ok 13:51:30.0421 2336 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys 13:51:30.0421 2336 Raspti - ok 13:51:30.0437 2336 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys 13:51:30.0453 2336 Rdbss - ok 13:51:30.0453 2336 RDFYUATO - ok 13:51:30.0468 2336 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 13:51:30.0468 2336 RDPCDD - ok 13:51:30.0484 2336 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys 13:51:30.0484 2336 rdpdr - ok 13:51:30.0531 2336 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys 13:51:30.0546 2336 RDPWD - ok 13:51:30.0578 2336 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe 13:51:30.0578 2336 RDSessMgr - ok 13:51:30.0609 2336 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys 13:51:30.0609 2336 redbook - ok 13:51:30.0640 2336 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll 13:51:30.0640 2336 RemoteAccess - ok 13:51:30.0671 2336 [ 5B19B557B0C188210A56A6B699D90B8F ] RemoteRegistry C:\WINDOWS\system32\regsvc.dll 13:51:30.0671 2336 RemoteRegistry - ok 13:51:30.0687 2336 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe 13:51:30.0703 2336 RpcLocator - ok 13:51:30.0734 2336 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll 13:51:30.0734 2336 RpcSs - ok 13:51:30.0781 2336 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe 13:51:30.0796 2336 RSVP - ok 13:51:30.0796 2336 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe 13:51:30.0796 2336 SamSs - ok 13:51:30.0812 2336 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe 13:51:30.0812 2336 SCardSvr - ok 13:51:30.0875 2336 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll 13:51:30.0875 2336 Schedule - ok 13:51:30.0937 2336 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys 13:51:30.0937 2336 Secdrv - ok 13:51:30.0984 2336 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll 13:51:30.0984 2336 seclogon - ok 13:51:31.0015 2336 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll 13:51:31.0015 2336 SENS - ok 13:51:31.0062 2336 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\drivers\Serial.sys 13:51:31.0062 2336 Serial - ok 13:51:31.0125 2336 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys 13:51:31.0125 2336 Sfloppy - ok 13:51:31.0187 2336 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll 13:51:31.0187 2336 SharedAccess - ok 13:51:31.0203 2336 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll 13:51:31.0203 2336 ShellHWDetection - ok 13:51:31.0203 2336 Simbad - ok 13:51:31.0218 2336 Sparrow - ok 13:51:31.0281 2336 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys 13:51:31.0281 2336 splitter - ok 13:51:31.0343 2336 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe 13:51:31.0343 2336 Spooler - ok 13:51:31.0359 2336 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys 13:51:31.0359 2336 sr - ok 13:51:31.0406 2336 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll 13:51:31.0421 2336 srservice - ok 13:51:31.0484 2336 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys 13:51:31.0484 2336 Srv - ok 13:51:31.0546 2336 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll 13:51:31.0546 2336 SSDPSRV - ok 13:51:31.0593 2336 [ A36EE93698802CD899F98BFD553D8185 ] ssmdrv C:\WINDOWS\system32\DRIVERS\ssmdrv.sys 13:51:31.0593 2336 ssmdrv - ok 13:51:31.0656 2336 [ A9573045BAA16EAB9B1085205B82F1ED ] StillCam C:\WINDOWS\system32\DRIVERS\serscan.sys 13:51:31.0656 2336 StillCam - ok 13:51:31.0718 2336 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll 13:51:31.0718 2336 stisvc - ok 13:51:31.0750 2336 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys 13:51:31.0750 2336 swenum - ok 13:51:31.0781 2336 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys 13:51:31.0781 2336 swmidi - ok 13:51:31.0796 2336 SwPrv - ok 13:51:31.0796 2336 symc810 - ok 13:51:31.0796 2336 symc8xx - ok 13:51:31.0812 2336 sym_hi - ok 13:51:31.0812 2336 sym_u3 - ok 13:51:31.0843 2336 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys 13:51:31.0843 2336 sysaudio - ok 13:51:31.0875 2336 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe 13:51:31.0875 2336 SysmonLog - ok 13:51:31.0921 2336 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll 13:51:31.0921 2336 TapiSrv - ok 13:51:31.0953 2336 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys 13:51:31.0968 2336 Tcpip - ok 13:51:32.0000 2336 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys 13:51:32.0000 2336 TDPIPE - ok 13:51:32.0015 2336 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys 13:51:32.0015 2336 TDTCP - ok 13:51:32.0046 2336 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys 13:51:32.0046 2336 TermDD - ok 13:51:32.0125 2336 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll 13:51:32.0125 2336 TermService - ok 13:51:32.0140 2336 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll 13:51:32.0140 2336 Themes - ok 13:51:32.0203 2336 [ DB7205804759FF62C34E3EFD8A4CC76A ] TlntSvr C:\WINDOWS\system32\tlntsvr.exe 13:51:32.0203 2336 TlntSvr - ok 13:51:32.0218 2336 TosIde - ok 13:51:32.0250 2336 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll 13:51:32.0250 2336 TrkWks - ok 13:51:32.0281 2336 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys 13:51:32.0281 2336 Udfs - ok 13:51:32.0281 2336 ultra - ok 13:51:32.0359 2336 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys 13:51:32.0359 2336 Update - ok 13:51:32.0390 2336 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll 13:51:32.0390 2336 upnphost - ok 13:51:32.0390 2336 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe 13:51:32.0390 2336 UPS - ok 13:51:32.0453 2336 [ EAFE1E00739AFE6C51487A050E772E17 ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys 13:51:32.0453 2336 USBAAPL - ok 13:51:32.0500 2336 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys 13:51:32.0500 2336 usbccgp - ok 13:51:32.0546 2336 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys 13:51:32.0546 2336 usbehci - ok 13:51:32.0562 2336 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys 13:51:32.0562 2336 usbhub - ok 13:51:32.0609 2336 [ 0DAECCE65366EA32B162F85F07C6753B ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys 13:51:32.0609 2336 usbohci - ok 13:51:32.0625 2336 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys 13:51:32.0625 2336 usbprint - ok 13:51:32.0656 2336 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 13:51:32.0656 2336 usbscan - ok 13:51:32.0703 2336 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 13:51:32.0703 2336 usbstor - ok 13:51:32.0750 2336 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys 13:51:32.0750 2336 VgaSave - ok 13:51:32.0765 2336 ViaIde - ok 13:51:32.0828 2336 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys 13:51:32.0828 2336 VolSnap - ok 13:51:32.0890 2336 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe 13:51:32.0890 2336 VSS - ok 13:51:32.0953 2336 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll 13:51:32.0953 2336 W32Time - ok 13:51:33.0000 2336 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys 13:51:33.0000 2336 Wanarp - ok 13:51:33.0015 2336 WDICA - ok 13:51:33.0031 2336 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys 13:51:33.0031 2336 wdmaud - ok 13:51:33.0078 2336 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll 13:51:33.0078 2336 WebClient - ok 13:51:33.0156 2336 [ 473EE64C368CE2EED110376C11960259 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 13:51:33.0156 2336 winachsf - ok 13:51:33.0265 2336 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll 13:51:33.0265 2336 winmgmt - ok 13:51:33.0375 2336 [ 18F347402DA544A780949B8FDF83351B ] WinRM C:\WINDOWS\system32\WsmSvc.dll 13:51:33.0375 2336 WinRM - ok 13:51:33.0437 2336 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll 13:51:33.0437 2336 WmdmPmSN - ok 13:51:33.0484 2336 [ E76F8807070ED04E7408A86D6D3A6137 ] Wmi C:\WINDOWS\System32\advapi32.dll 13:51:33.0484 2336 Wmi - ok 13:51:33.0546 2336 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe 13:51:33.0546 2336 WmiApSrv - ok 13:51:33.0656 2336 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe 13:51:33.0656 2336 WMPNetworkSvc - ok 13:51:33.0781 2336 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe 13:51:33.0781 2336 WPFFontCache_v0400 - ok 13:51:33.0828 2336 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys 13:51:33.0828 2336 WS2IFSL - ok 13:51:33.0875 2336 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll 13:51:33.0890 2336 wscsvc - ok 13:51:33.0890 2336 WSearch - ok 13:51:33.0937 2336 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll 13:51:33.0937 2336 wuauserv - ok 13:51:34.0000 2336 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys 13:51:34.0000 2336 WudfPf - ok 13:51:34.0031 2336 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys 13:51:34.0031 2336 WudfRd - ok 13:51:34.0062 2336 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll 13:51:34.0078 2336 WudfSvc - ok 13:51:34.0140 2336 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll 13:51:34.0156 2336 WZCSVC - ok 13:51:34.0187 2336 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll 13:51:34.0187 2336 xmlprov - ok 13:51:34.0187 2336 ================ Scan global =============================== 13:51:34.0250 2336 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll 13:51:34.0296 2336 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll 13:51:34.0312 2336 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll 13:51:34.0328 2336 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe 13:51:34.0328 2336 [Global] - ok 13:51:34.0328 2336 ================ Scan MBR ================================== 13:51:34.0359 2336 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0 13:51:34.0359 2336 Suspicious mbr (Forged): \Device\Harddisk0\DR0 13:51:34.0390 2336 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - infected 13:51:34.0390 2336 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.c (0) 13:51:34.0390 2336 ================ Scan VBR ================================== 13:51:34.0390 2336 [ 2B94AFEE9341CC63EE629935CF7ECE74 ] \Device\Harddisk0\DR0\Partition1 13:51:34.0390 2336 \Device\Harddisk0\DR0\Partition1 - ok 13:51:34.0390 2336 ============================================================ 13:51:34.0390 2336 Scan finished 13:51:34.0390 2336 ============================================================ 13:51:34.0406 2520 Detected object count: 1 13:51:34.0406 2520 Actual detected object count: 1 13:55:24.0468 2520 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - skipped by user 13:55:24.0468 2520 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Skip 13:57:26.0984 2400 Deinitialize success

Also, I forgot to mention, when running Combofix, it was complaining that AVG Free 2012 was still running in the background except that AVG Free 2012 is not installed on this computer any longer. Avira is installed, that's what it came to with although I do know that at one point AVG was installed.

I ran Combofix as you requested. I ended up running it twice. The first time I ran it, when it was finished it restarted the computer and I was unable to save the log file. So the text I am attaching is from the second time I ran it after the restart. ComboFix 12-11-29.02 - Jolly Household 11/29/2012 22:14:06.3.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1982.1411 [GMT -5:00] Running from: c:\documents and settings\Jolly Household\Desktop\ComboFix.exe AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7} . . ((((((((((((((((((((((((( Files Created from 2012-10-28 to 2012-11-30 ))))))))))))))))))))))))))))))) . . 2012-11-27 00:35 . 2012-11-28 20:40 -------- d-----w- c:\windows\system32\NtmsData 2012-11-26 20:38 . 2012-11-26 20:38 -------- d-----w- c:\documents and settings\Jolly Household\Application Data\Avira 2012-11-26 20:37 . 2012-11-17 01:17 36552 ----a-w- c:\windows\system32\drivers\avkmgr.sys 2012-11-26 20:37 . 2012-11-17 01:17 133824 ----a-w- c:\windows\system32\drivers\avipbb.sys 2012-11-26 20:37 . 2012-11-17 01:17 83432 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2012-11-26 20:37 . 2012-11-26 20:37 -------- d-----w- c:\program files\Avira 2012-11-26 20:37 . 2012-11-26 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira 2012-11-26 19:23 . 2012-11-26 19:23 -------- d-----w- c:\documents and settings\Jolly Household\Local Settings\Application Data\PCHealth 2012-11-19 22:30 . 2012-11-19 22:30 -------- d-----w- c:\program files\Common Files\Java 2012-11-19 22:29 . 2012-11-19 22:28 73728 ----a-w- c:\windows\system32\javacpl.cpl 2012-11-19 22:29 . 2012-11-19 22:28 477168 ----a-w- c:\windows\system32\npdeployJava1.dll 2012-11-19 22:27 . 2012-11-19 22:27 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee 2012-11-18 23:03 . 2012-11-18 23:03 -------- d-----w- c:\documents and settings\Administrator . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-11-26 19:40 . 2012-04-08 13:24 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-11-26 19:40 . 2012-01-24 23:18 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-11-19 22:28 . 2012-01-25 23:55 473072 ----a-w- c:\windows\system32\deployJava1.dll 2012-09-29 23:54 . 2012-01-15 01:12 22856 ----a-w- c:\windows\system32\drivers\mbam.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Photosmart 6510 series (NET)"="c:\program files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe" [2011-05-25 1801064] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-27 39408] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-10 7311360] "nwiz"="nwiz.exe" [2006-05-10 1519616] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-05-10 86016] "RTHDCPL"="RTHDCPL.EXE" [2009-02-03 18085888] "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280] "Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-07 421776] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-04-19 421888] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-11-16 384800] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472] HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-2-10 73728] . [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\FrostWire 5\\FrostWire.exe"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management . R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [11/26/2012 3:37 PM 36552] R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/26/2012 3:37 PM 85280] S4 GALKNJKE;GALKNJKE;c:\docume~1\JOLLYH~1\LOCALS~1\Temp\GALKNJKE.exe --> c:\docume~1\JOLLYH~1\LOCALS~1\Temp\GALKNJKE.exe [?] S4 HVGAA;HVGAA;c:\docume~1\JOLLYH~1\LOCALS~1\Temp\HVGAA.exe --> c:\docume~1\JOLLYH~1\LOCALS~1\Temp\HVGAA.exe [?] S4 RDFYUATO;RDFYUATO;c:\docume~1\JOLLYH~1\LOCALS~1\Temp\RDFYUATO.exe --> c:\docume~1\JOLLYH~1\LOCALS~1\Temp\RDFYUATO.exe [?] . Contents of the 'Scheduled Tasks' folder . 2012-11-29 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-08 19:40] . 2012-11-18 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57] . 2012-11-27 c:\windows\Tasks\At1.job - c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13] . 2012-11-27 c:\windows\Tasks\At2.job - c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13] . 2012-11-27 c:\windows\Tasks\At3.job - c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13] . 2012-11-27 c:\windows\Tasks\At4.job - c:\program files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25 22:13] . 2012-11-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21] . 2012-11-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-03-27 20:21] . 2012-11-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003Core.job - c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47] . 2012-11-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1229272821-651377827-725345543-1003UA.job - c:\documents and settings\Jolly Household\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-16 20:47] . 2012-11-30 c:\windows\Tasks\HP Photo Creations Messager.job - c:\documents and settings\All Users\Application Data\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11] . 2012-11-30 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1229272821-651377827-725345543-1003.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27] . 2012-11-27 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1229272821-651377827-725345543-1003.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-07-27 18:27] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.comcast.net/ uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.0.1 . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2012-11-29 22:32 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Windows 5.1.2600 Disk: WDC_WD2500JS-60NCB1 rev.10.02E02 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-5 . device: opened successfully user: MBR read successfully error: Read A device attached to the system is not functioning. kernel: MBR read successfully detected disk devices: detected hooks: \Driver\atapi DriverStartIo -> 0x88D212E2 user & kernel MBR OK . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @DACL=(02 0010) @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] @DACL=(02 0010) "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @DACL=(02 0010) @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @DACL=(02 0010) @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(736) c:\windows\system32\WININET.dll . - - - - - - - > 'lsass.exe'(796) c:\windows\system32\WININET.dll . Completion time: 2012-11-29 22:38:36 ComboFix-quarantined-files.txt 2012-11-30 03:38 . Pre-Run: 144,344,576,000 bytes free Post-Run: 147,267,661,824 bytes free . - - End Of File - - 772440A33E5ECD6A552C371C33A6165E

I am trying to fix my Aunt's computer but they certainly buggered it up this time. They handed the computer to me a few days ago and nothing seems to be working for me, so I thought I'd try here. It appears from MBAM logs that in the end of Oct/Beginning of Nov they had multiple attacks. Trojan.Agent.MRGGEN Trojan.Happili Trojan.0Access Trojan.Ransom.Gen Trojan.Delf Trojan.Dropper.BCMiner Rootkit.0Access Spyware.Passwords PUP.Funmoods (more of an annoyance I know, but full disclosure is best) I have no idea what they attempted to do before handing the computer to me. Here are the logs you requested from DDS. Thanks in advance for any help you guys can provide. DDS.txt DDS (Ver_2012-11-20.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 Run by Jolly Household at 16:28:11 on 2012-11-29 . ============== Running Processes ================ . C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\HP\KBD\KBD.EXE C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Documents and Settings\Jolly Household\Local Settings\Application Data\Google\Update\1.3.21.123\GoogleCrashHandler.exe C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Avira\AntiVir Desktop\avshadow.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\WINDOWS\system32\SearchFilterHost.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\svchost.exe -k DcomLaunch C:\WINDOWS\system32\svchost.exe -k rpcss C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\System32\svchost.exe -k netsvcs . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.comcast.net/ BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned> BHO: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - <orphaned> BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.7529.1424\swg.dll BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - <orphaned> BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - <orphaned> BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll uRun: [Google Update] "c:\documents and settings\jolly household\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [HP Photosmart 6510 series (NET)] "c:\program files\hp\hp photosmart 6510 series\bin\ScanToPCActivationApp.exe" -deviceID "CN1A7411H305QB:NW" -scfn "HP Photosmart 6510 series (NET)" -AutoStart 1 uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [RTHDCPL] RTHDCPL.EXE mRun: [Alcmtr] ALCMTR.EXE mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe" mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min uPolicies-Explorer: NoDriveTypeAutoRun = dword:323 uPolicies-Explorer: NoDriveAutoRun = dword:67108863 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe LSP: mswsock.dll . INFO: HKLM has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1353863602656 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1327016373125 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://www.gamehouse.com/games/zuma/popcaploader.cab TCP: NameServer = 192.168.0.1 TCP: Interfaces\{770D3A4B-D751-4560-9975-108D24CCFB9F} : DHCPNameServer = 192.168.0.1 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll . ============= SERVICES / DRIVERS =============== . R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86 R? fsssvc;Windows Live Family Safety Service R? GALKNJKE;GALKNJKE R? HVGAA;HVGAA R? RDFYUATO;RDFYUATO R? WinRM;Windows Remote Management (WS-Management) R? WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0 S? AntiVirSchedulerService;Avira Scheduler S? AntiVirService;Avira Real-Time Protection S? avgntflt;avgntflt S? avkmgr;avkmgr S? fssfltr;fssfltr . =============== Created Last 30 ================ . 2012-11-28 22:03:40 -------- d-sha-r- C:\cmdcons 2012-11-27 00:35:03 -------- d-----w- c:\windows\system32\NtmsData 2012-11-26 20:38:00 -------- d-----w- c:\documents and settings\jolly household\application data\Avira 2012-11-26 20:37:10 36552 ----a-w- c:\windows\system32\drivers\avkmgr.sys 2012-11-26 20:37:09 83432 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2012-11-26 20:37:08 -------- d-----w- c:\program files\Avira 2012-11-26 20:37:08 -------- d-----w- c:\documents and settings\all users\application data\Avira 2012-11-26 19:23:19 -------- d-----w- c:\documents and settings\jolly household\local settings\application data\PCHealth 2012-11-19 22:29:50 73728 ----a-w- c:\windows\system32\javacpl.cpl 2012-11-19 22:29:50 477168 ----a-w- c:\windows\system32\npdeployJava1.dll . ==================== Find3M ==================== . 2012-11-26 19:40:04 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-11-26 19:40:04 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-11-19 22:28:42 473072 ----a-w- c:\windows\system32\deployJava1.dll 2012-09-29 23:54:26 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-09-02 22:33:42 33958 ----a-w- c:\documents and settings\all users\application data\uninstaller.exe . =================== ROOTKIT ==================== . Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Windows 5.1.2600 Disk: WDC_WD2500JS-60NCB1 rev.10.02E02 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-5 . device: opened successfully user: MBR read successfully . Disk trace: called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x88DBC4B1]<< _asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x88dc393c]; MOV EAX, [0x88dc3ab0]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; } 1 ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\Harddisk0\DR0[0x89CB0AB8] 3 CLASSPNP[0xBA108FD7] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\0000006c[0x89CDBE98] 5 ACPI[0xB9F7F620] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> [0x89CDA940] \Driver\atapi[0x88E468F0] -> IRP_MJ_CREATE -> 0x88DBC4B1 error: Read A device attached to the system is not functioning. kernel: MBR read successfully _asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; } detected disk devices: detected hooks: \Driver\atapi DriverStartIo -> 0x88DBC2E2 user & kernel MBR OK Warning: possible TDL3 rootkit infection ! . ============= FINISH: 16:29:41.51 =============== Attach.txt . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 1/14/2012 7:17:19 PM System Uptime: 11/29/2012 3:27:55 PM (1 hours ago) . Motherboard: ASUSTek Computer INC. | | NODUSM Processor: AMD Athlon 64 X2 Dual Core Processor 4200+ | Socket AM2 | 2204/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 233 GiB total, 134.809 GiB free. D: is CDROM () E: is Removable F: is Removable G: is Removable H: is Removable . ==== Disabled Device Manager Items ============= . Class GUID: Description: Device ID: ACPI\AWY0001\2&DABA3FF&0 Manufacturer: Name: PNP Device ID: ACPI\AWY0001\2&DABA3FF&0 Service: . ==== System Restore Points =================== . No restore point in system. . ==== Installed Programs ====================== . 2570 2570_Help 2570Trb Adobe Flash Player 11 ActiveX Adobe Reader X (10.1.4) AiO_Scan_CDA AiOSoftwareNPI Apple Application Support Apple Mobile Device Support Apple Software Update ASPCA Reminder by We-Care.com v4.1.18.1 Avira Free Antivirus Bing Rewards Client Installer Bonjour BufferChm Coupon Printer for Windows CP_CalendarTemplates1 cp_OnlineProjectsConfig CP_Package_Basic1 CP_Panorama1Config cp_PosterPrintConfig CueTour CustomerResearchQFolder Data Fax SoftModem with SmartCP Destinations DeviceManagementQFolder DocProc DocProcQFolder DocumentViewer DocumentViewerQFolder Enhanced Multimedia Keyboard Solution eSupportQFolder Fax_CDA FrostWire 5.2.11 FullDPAppQFolder Google Chrome Google Toolbar for Internet Explorer Google Update Helper Hewlett-Packard ACLM.NET v1.1.0.0 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB2633952) Hotfix for Windows XP (KB915800-v4) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB954708) Hotfix for Windows XP (KB961118) HP Customer Participation Program 7.0 HP Document Viewer 7.0 HP Imaging Device Functions 7.0 HP Photo Creations HP Photosmart 6510 series Basic Device Software HP Photosmart 6510 series Help HP Photosmart 6510 series Product Improvement Study HP Photosmart Premier Software 6.5 HP Photosmart, Officejet and Deskjet 7.0.A HP Product Assistant HP Product Detection HP Solution Center 7.0 HP Update HPPhotoSmartExpress HPProductAssistant InstantShareAlert InstantShareDevices InstantShareDevicesMFC iTunes Java Auto Updater Java 6 Update 37 Junk Mail filter update Malwarebytes Anti-Malware version 1.65.1.1000 MarketResearch Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB2656353) Microsoft .NET Framework 1.1 Security Update (KB2656370) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft Application Error Reporting Microsoft Base Smart Card Cryptographic Service Provider Package Microsoft Choice Guard Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Default Manager Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office Live Add-in 1.5 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook Connector Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Silverlight Microsoft Software Update for Web Folders (English) 12 Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Sync Framework Runtime Native v1.0 (x86) Microsoft Sync Framework Services Native v1.0 (x86) Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 MSVCRT MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) NewCopy_CDA NVIDIA Drivers OCR Software by I.R.I.S 7.0 PanoStandAlone PhotoGallery ProductContextNPI QuickTime RandMap Readme RealNetworks - Microsoft Visual C++ 2008 Runtime RealPlayer Realtek High Definition Audio Driver RealUpgrade 1.1 Scan ScannerCopy Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687314) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition Security Update for Microsoft Windows (KB2564958) Security Update for Windows Internet Explorer 8 (KB2510531) Security Update for Windows Internet Explorer 8 (KB2544521) Security Update for Windows Internet Explorer 8 (KB2618444) Security Update for Windows Internet Explorer 8 (KB2647516) Security Update for Windows Internet Explorer 8 (KB2675157) Security Update for Windows Internet Explorer 8 (KB2699988) Security Update for Windows Internet Explorer 8 (KB2722913) Security Update for Windows Internet Explorer 8 (KB982381) Security Update for Windows Media Player (KB2378111) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player (KB975558) Security Update for Windows Media Player (KB978695) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Search 4 - KB963093 Security Update for Windows XP (KB2079403) Security Update for Windows XP (KB2115168) Security Update for Windows XP (KB2229593) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2347290) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB2393802) Security Update for Windows XP (KB2412687) Security Update for Windows XP (KB2419632) Security Update for Windows XP (KB2423089) Security Update for Windows XP (KB2440591) Security Update for Windows XP (KB2443105) Security Update for Windows XP (KB2476490) Security Update for Windows XP (KB2478960) Security Update for Windows XP (KB2478971) Security Update for Windows XP (KB2479943) Security Update for Windows XP (KB2481109) Security Update for Windows XP (KB2483185) Security Update for Windows XP (KB2485663) Security Update for Windows XP (KB2506212) Security Update for Windows XP (KB2507618) Security Update for Windows XP (KB2507938) Security Update for Windows XP (KB2508429) Security Update for Windows XP (KB2509553) Security Update for Windows XP (KB2510581) Security Update for Windows XP (KB2535512) Security Update for Windows XP (KB2536276-v2) Security Update for Windows XP (KB2544521) Security Update for Windows XP (KB2544893-v2) Security Update for Windows XP (KB2566454) Security Update for Windows XP (KB2570222) Security Update for Windows XP (KB2570947) Security Update for Windows XP (KB2584146) Security Update for Windows XP (KB2585542) Security Update for Windows XP (KB2592799) Security Update for Windows XP (KB2598479) Security Update for Windows XP (KB2603381) Security Update for Windows XP (KB2618444) Security Update for Windows XP (KB2618451) Security Update for Windows XP (KB2619339) Security Update for Windows XP (KB2620712) Security Update for Windows XP (KB2621440) Security Update for Windows XP (KB2624667) Security Update for Windows XP (KB2631813) Security Update for Windows XP (KB2633171) Security Update for Windows XP (KB2639417) Security Update for Windows XP (KB2641653) Security Update for Windows XP (KB2646524) Security Update for Windows XP (KB2647518) Security Update for Windows XP (KB2653956) Security Update for Windows XP (KB2655992) Security Update for Windows XP (KB2659262) Security Update for Windows XP (KB2660465) Security Update for Windows XP (KB2661637) Security Update for Windows XP (KB2676562) Security Update for Windows XP (KB2685939) Security Update for Windows XP (KB2686509) Security Update for Windows XP (KB2691442) Security Update for Windows XP (KB2695962) Security Update for Windows XP (KB2698365) Security Update for Windows XP (KB2705219) Security Update for Windows XP (KB2707511) Security Update for Windows XP (KB2709162) Security Update for Windows XP (KB2712808) Security Update for Windows XP (KB2718523) Security Update for Windows XP (KB2719985) Security Update for Windows XP (KB2723135) Security Update for Windows XP (KB2731847) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB980436) Security Update for Windows XP (KB981322) Security Update for Windows XP (KB981997) Security Update for Windows XP (KB982132) Security Update for Windows XP (KB982665) Segoe UI SkinsHP1 SlideShow SolutionCenter Sonic_PrimoSDK Spybot - Search & Destroy Status Toolbox TrayApp Unload Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office Access 2007 Help (KB963663) Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office Infopath 2007 Help (KB963662) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Outlook 2007 (KB2596598) 32-Bit Edition Update for Microsoft Office Outlook 2007 Help (KB963677) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687400) 32-Bit Edition Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Publisher 2007 Help (KB963667) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) Update for Windows Internet Explorer 8 (KB2598845) Update for Windows Internet Explorer 8 (KB2632503) Update for Windows XP (KB2345886) Update for Windows XP (KB2467659) Update for Windows XP (KB2492386) Update for Windows XP (KB2541763) Update for Windows XP (KB2641690) Update for Windows XP (KB2718704) Update for Windows XP (KB898461) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB961503) Update for Windows XP (KB968389) Update for Windows XP (KB971029) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) VLC media player 2.0.0 WebFldrs XP WebReg Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage Validation Tool (KB892130) Windows Internet Explorer 8 Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Family Safety Windows Live Mail Windows Live Messenger Windows Live Photo Gallery Windows Live Sign-in Assistant Windows Live Sync Windows Live Upload Tool Windows Live Writer Windows Management Framework Core Windows Media Format 11 runtime Windows Media Player 11 Windows Search 4.0 Windows XP Service Pack 3 Yontoo 1.10.02 Zuma Deluxe . ==== End Of File ===========================