Need some help on a Win32/Olmarik Infection

zbad2000 · January 2, 2012

Hey there

I'm kind of a novice when it comes to computer skills and I have an infection I cant shake. I have ESET 4 and it detects the Win32/Olmarik trojans but can't clean them. Followed all the directions thus far in the "I'm infected What do I do now?" and still ESET detects the same corrupted files but can't clean them. Thanks a lot in advance. I've attached my one log (zipped) as instructed and will paste my other log below. Let me know what I did right, wrong, and what to do next. Again, thank you guys.

zbad2000

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.19170 BrowserJavaVersion: 1.6.0_26

Run by Brian at 20:48:48 on 2012-01-01

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1914.865 [GMT -5:00]

.

AV: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

SP: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe

C:\Windows\RtkAudioService.exe

C:\Windows\system32\Dwm.exe

C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe

C:\Windows\Explorer.EXE

C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\ArcSoft\Magic-i Visual Effects\uCamMonitor.exe

C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

C:\Program Files\Sony\VAIO Power Management\SPMService.exe

C:\Windows\system32\DllHost.exe

C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe

C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\igfxext.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Sony\ISB Utility\ISBMgr.exe

C:\Program Files\Sony\VAIO Wireless Wizard\AutoLaunchWLASU.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\InFocus\DisplayLink Manager\InFocusDisplayLinkManagerSetup.exe

C:\Program Files\Sony Corporation\SmartWi Connection Utility\CCP.exe

C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

C:\Program Files\Sony Corporation\SmartWi Connection Utility\PowerManager.exe

C:\Program Files\Sony Corporation\SmartWi Connection Utility\ThirdPartyAppMgr.exe

C:\Program Files\Sony Corporation\SmartWi Connection Utility\UIManager.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k HPService

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Adobe\Reader 9.0\Reader\Eula.exe

C:\Program Files\Windows Media Player\setup_wm.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.ask.com/?o=101760&l=dis

uDefault_Page_URL = hxxp://www.sony.com/vaiopeople_f08

mDefault_Page_URL = hxxp://www.sony.com/vaiopeople_f08

uURLSearchHooks: H - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No File

uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun

uRun: [Aim6]

mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [RtHDVCpl] RtHDVCpl.exe

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [iSBMgr.exe] "c:\program files\sony\isb utility\ISBMgr.exe"

mRun: [smartWiHelper] "c:\program files\sony corporation\smartwi connection utility\SmartWiHelper.exe" /WindowsStartup

mRun: [VAIOMyMemCenter] "c:\program files\sony\vaio my memory center\VAIO MyMemCenter.exe" 1

mRun: [VAIORegistration] "c:\program files\sony\first experience\WelcomeLauncher.exe"

mRun: [VAIOSurvey] "c:\program files\sony\vaio survey\VAIO Sat Survey.exe"

mRun: [VWLASU] "c:\program files\sony\vaio wireless wizard\AutoLaunchWLASU.exe"

mRun: [skytel] Skytel.exe

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

StartupFolder: c:\users\brian\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE

StartupFolder: c:\users\brian\appdata\roaming\micros~1\windows\startm~1\programs\startup\zooskm~1.lnk - c:\program files\zooskmessenger\ZooskMessenger.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\aolddi.lnk - c:\ddi\AOLICON.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\infocu~1.lnk - c:\program files\infocus\displaylink manager\InFocusDisplayLinkManagerSetup.exe

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{2BEEDDE3-9D19-4856-BC49-7AC5C8321FD5} : DhcpNameServer = 192.168.1.1

Notify: igfxcui - igfxdev.dll

Notify: VESWinlogon - VESWinlogon.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\brian\appdata\roaming\mozilla\firefox\profiles\z57s78nq.default\

FF - prefs.js: browser.search.selectedEngine - Ask

FF - prefs.js: browser.startup.homepage - espn.com

FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=

FF - component: c:\users\brian\appdata\roaming\mozilla\firefox\profiles\z57s78nq.default\extensions\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}\components\RadioWMPCoreGecko19.dll

FF - component: c:\users\brian\appdata\roaming\mozilla\firefox\profiles\z57s78nq.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

FF - plugin: c:\users\brian\appdata\roaming\move networks\plugins\071802000001\npqmp071802000001.dll

FF - plugin: c:\users\brian\appdata\roaming\move networks\plugins\npqmp071503000010.dll

FF - plugin: c:\users\brian\appdata\roaming\move networks\plugins\npqmp071705000014.dll

.

============= SERVICES / DRIVERS ===============

.

R0 dlkmdldr;dlkmdldr;c:\windows\system32\drivers\dlkmdldr.sys [2011-12-14 13424]

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2010-7-29 115008]

R2 DisplayLinkService;DisplayLink Service;c:\program files\displaylink core software\DisplayLinkService.exe [2009-4-6 447848]

R2 eamonm;eamonm;c:\windows\system32\drivers\eamonm.sys [2010-9-3 137144]

R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2010-11-4 810144]

R2 epfwwfpr;epfwwfpr;c:\windows\system32\drivers\epfwwfpr.sys [2010-7-29 96920]

R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-12-31 652872]

R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-17 11032]

R2 RtkAudioService;Realtek Audio Service;c:\windows\RTKAUDIOSERVICE.EXE [2008-8-1 104992]

R2 uCamMonitor;CamMonitor;c:\program files\arcsoft\magic-i visual effects\uCamMonitor.exe [2008-8-21 104960]

R2 VAIO Power Management;VAIO Power Management;c:\program files\sony\vaio power management\SPMService.exe [2008-8-1 411488]

R2 VCFw;VAIO Content Folder Watcher;c:\program files\common files\sony shared\vaio content folder watcher\VCFw.exe [2008-6-20 415744]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-1-7 24652]

R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\drivers\ArcSoftKsUFilter.sys [2008-8-21 17408]

R3 dlkmd;dlkmd;c:\windows\system32\drivers\dlkmd.sys [2011-12-14 367728]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-31 20464]

R3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys [2008-8-1 9344]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 DisplayLinkUsbPort;DisplayLink USB Device;c:\windows\system32\drivers\DisplayLinkUsbPort.sys [2009-4-6 20992]

S3 SOHCImp;VAIO Media plus Content Importer;c:\program files\sony\vaio media plus\SOHCImp.exe [2008-8-21 103712]

S3 SOHDms;VAIO Media plus Digital Media Server;c:\program files\sony\vaio media plus\SOHDms.exe [2008-8-21 353568]

S3 SOHDs;VAIO Media plus Device Searcher;c:\program files\sony\vaio media plus\SOHDs.exe [2008-8-21 62752]

S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\sony\vcm intelligent analyzing manager\VcmIAlzMgr.exe [2008-8-21 337184]

S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\common files\sony shared\vcmxml\VcmXmlIfHelper.exe [2008-8-21 83232]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2012-01-01 16:21:00 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{da5502df-d77f-4eed-8bb1-79dc3533b569}\offreg.dll

2012-01-01 00:18:57 -------- d-----w- c:\users\brian\appdata\roaming\Malwarebytes

2012-01-01 00:18:45 -------- d-----w- c:\programdata\Malwarebytes

2012-01-01 00:18:43 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-01-01 00:18:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-12-31 21:13:04 -------- d-----w- c:\program files\PC Tools

2011-12-31 21:08:06 185560 ----a-w- c:\windows\system32\drivers\PCTSD.sys

2011-12-31 21:08:04 -------- d-----w- c:\program files\common files\PC Tools

2011-12-31 21:06:51 -------- d-----w- c:\programdata\PC Tools

2011-12-31 21:06:50 -------- d-----w- c:\users\brian\appdata\roaming\TestApp

2011-12-31 06:25:56 6823496 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{da5502df-d77f-4eed-8bb1-79dc3533b569}\mpengine.dll

2011-12-26 04:54:47 -------- d-----w- c:\windows\Intuit

2011-12-15 00:08:32 -------- d-----w- c:\users\brian\appdata\local\InFocus_Corporation

2011-12-15 00:06:38 -------- d-----w- c:\program files\InFocus

2011-12-15 00:06:24 -------- d--h--w- c:\program files\DisplayLink InFocus Support

2011-12-15 00:05:54 367728 ----a-w- c:\windows\system32\drivers\dlkmd.sys

2011-12-15 00:05:53 13424 ----a-w- c:\windows\system32\drivers\dlkmdldr.sys

2011-12-15 00:05:00 -------- d-----w- c:\program files\DisplayLink Core Software

2011-12-14 02:29:59 71680 ----a-w- c:\windows\system32\iesetup.dll

2011-12-14 02:28:48 49152 ----a-w- c:\windows\system32\csrsrv.dll

2011-12-08 23:05:05 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

.

==================== Find3M ====================

.

2011-11-23 13:37:27 2043904 ----a-w- c:\windows\system32\win32k.sys

2011-11-15 19:29:56 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-11-08 14:42:19 2048 ----a-w- c:\windows\system32\tzres.dll

2011-11-03 06:22:04 916992 ----a-w- c:\windows\system32\wininet.dll

2011-11-03 06:17:38 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-11-03 06:17:23 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2011-11-03 06:17:08 109056 ----a-w- c:\windows\system32\iesysprep.dll

2011-11-03 05:22:43 385024 ----a-w- c:\windows\system32\html.iec

2011-11-03 04:45:39 133632 ----a-w- c:\windows\system32\ieUnatt.exe

2011-11-03 04:43:59 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2011-10-27 08:01:53 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe

2011-10-27 08:01:53 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe

2011-10-14 16:02:19 429056 ----a-w- c:\windows\system32\EncDec.dll

.

============= FINISH: 20:50:48.66 ===============

D-FRED-BROWN · January 3, 2012

Hello zbad2000 and welcome to Malwarebytes! :welcome:

I apologize for the delay.

I am D-FRED-BROWN and I will be helping you.

Please print or save this topic: it will make it easier for you to follow the instructions and complete all of the necessary steps.

-------------

Next,

Please download to your Desktop:

TDSSKiller.zip from here and extract it (right click on it => "Extract here").

>>> TDSSKiller: Double-click on TDSSKiller.exe to run the application.

Click on the Start Scan button and wait for the scan and disinfection process to be over.
If an infected file is detected, the default action will be Cure, click on Continue
If a suspicious file is detected, the default action will be Skip, click on Continue
If you are asked to reboot the computer to complete the process, click on the Reboot Now button. A report will be automatically saved at the root of the System drive ((usually C:\) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt" (for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt). Please copy and paste the contents of that file here.
If no reboot is required, click on Report. A log file will appear. Please copy and paste the contents of that file in your next reply.

In your next reply, please include the following (you may need to use two posts to get it all in):

TDSSKiller_log.txt

how the PC is running now?
-------------
Please print out these instructions or copy them to a Notepad file for an easier reading and download MBRCheck by a_d_13 to your Desktop from one of these locations:
http://ad13.geekstogo.com/MBRCheck.exe
http://download.bleepingcomputer.com/rootrepeal/MBRCheck.exe
http://www.kernelmode.info/MBRCheck.exe
Close all opened programs/ windows and double-click on MBRCheck.exe.
It will produce a log file saved automatically on your Desktop as "MBRCheck_[Date]_[Time].txt".
Press the "Enter" key to close the MBRCheck window and post the contents of the log file.
-------------
Please do the following:

Please download aswMBR.exe from here and save it to your Desktop.
Double click aswMBR.exe to start the tool. (Vista - Win 7 Rt click to run as Administrator)
Click Scan
Upon completion of the scan, click Save log and save it to your Desktop, and post that log in your next reply. Do NOT attempt any Fix at this time!
This will also create a file on your Desktop named MBR.dat. Right click that file and select Send To->Compressed (zipped) folder. Attach that zipped folder in your next reply as well.

NOTE: The Avast! scan is not necessary .

-------------

Please download ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

***IMPORTANT: save ComboFix to your Desktop***

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please go here to see a list of programs that should be disabled.

**Note: Do not mouseclick ComboFix's window while it's running. That may cause it to stall**

Please include the C:\ComboFix.txt in your next reply for further review.

Also, please let me know if any problems still remain.

-------------

Please download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-------------

In your next reply, please include:

TDSSKiller report
MBRCheck report
aswMBR log & MBR.dat zip file
C:\ComboFix.txt
checkup.txt

How is your computer running now?

zbad2000 · January 4, 2012

No worries. I thought your response was pretty prompt. Anyway, I'm just happy to get your help with this so its good to have this in your hands. So I followed all the directions and the computer is so much faster now, thank you. It's not up to the regular speed at which it was running before all the nastiness of the virus hit, but it is significantly better. None of the Windows host processes have been sporadically shutting down, so thats a marked improvement. So anyway, here are the logs:

16:54:05.0196 2940 TDSS rootkit removing tool 2.6.25.0 Dec 23 2011 14:51:16

16:54:05.0711 2940 ============================================================

16:54:05.0711 2940 Current date / time: 2012/01/03 16:54:05.0711

16:54:05.0711 2940 SystemInfo:

16:54:05.0711 2940

16:54:05.0712 2940 OS Version: 6.0.6002 ServicePack: 2.0

16:54:05.0712 2940 Product type: Workstation

16:54:05.0712 2940 ComputerName: BRIANS-VAIO

16:54:05.0712 2940 UserName: Brian

16:54:05.0712 2940 Windows directory: C:\Windows

16:54:05.0712 2940 System windows directory: C:\Windows

16:54:05.0712 2940 Processor architecture: Intel x86

16:54:05.0712 2940 Number of processors: 2

16:54:05.0712 2940 Page size: 0x1000

16:54:05.0712 2940 Boot type: Normal boot

16:54:05.0712 2940 ============================================================

16:54:07.0249 2940 Initialize success

16:54:11.0698 0536 ============================================================

16:54:11.0698 0536 Scan started

16:54:11.0698 0536 Mode: Manual;

16:54:11.0698 0536 ============================================================

16:54:14.0059 0536 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

16:54:14.0074 0536 ACPI - ok

16:54:14.0207 0536 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys

16:54:14.0274 0536 adp94xx - ok

16:54:14.0390 0536 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys

16:54:14.0436 0536 adpahci - ok

16:54:14.0508 0536 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys

16:54:14.0544 0536 adpu160m - ok

16:54:14.0616 0536 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys

16:54:14.0651 0536 adpu320 - ok

16:54:14.0807 0536 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys

16:54:14.0861 0536 AFD - ok

16:54:14.0944 0536 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys

16:54:14.0994 0536 agp440 - ok

16:54:15.0109 0536 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

16:54:15.0156 0536 aic78xx - ok

16:54:15.0219 0536 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys

16:54:15.0263 0536 aliide - ok

16:54:15.0341 0536 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys

16:54:15.0434 0536 amdagp - ok

16:54:15.0497 0536 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys

16:54:15.0541 0536 amdide - ok

16:54:15.0631 0536 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys

16:54:15.0674 0536 AmdK7 - ok

16:54:15.0695 0536 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys

16:54:15.0746 0536 AmdK8 - ok

16:54:15.0885 0536 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys

16:54:15.0930 0536 arc - ok

16:54:16.0031 0536 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys

16:54:16.0076 0536 arcsas - ok

16:54:16.0150 0536 ArcSoftKsUFilter (6b3ab8f67b37402a4174caa45002903e) C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys

16:54:16.0193 0536 ArcSoftKsUFilter - ok

16:54:16.0298 0536 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

16:54:16.0341 0536 AsyncMac - ok

16:54:16.0445 0536 atapi (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys

16:54:16.0492 0536 atapi - ok

16:54:16.0619 0536 athr (600efe56f37adbd65a0fb076b50d1b8d) C:\Windows\system32\DRIVERS\athr.sys

16:54:16.0687 0536 athr - ok

16:54:16.0857 0536 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

16:54:16.0903 0536 Beep - ok

16:54:16.0985 0536 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys

16:54:17.0075 0536 blbdrive - ok

16:54:17.0124 0536 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

16:54:17.0204 0536 bowser - ok

16:54:17.0343 0536 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

16:54:17.0349 0536 BrFiltLo - ok

16:54:17.0381 0536 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

16:54:17.0388 0536 BrFiltUp - ok

16:54:17.0470 0536 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

16:54:17.0478 0536 Brserid - ok

16:54:17.0591 0536 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

16:54:17.0597 0536 BrSerWdm - ok

16:54:17.0625 0536 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

16:54:17.0631 0536 BrUsbMdm - ok

16:54:17.0659 0536 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

16:54:17.0665 0536 BrUsbSer - ok

16:54:17.0815 0536 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

16:54:17.0874 0536 BTHMODEM - ok

16:54:18.0000 0536 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

16:54:18.0048 0536 cdfs - ok

16:54:18.0169 0536 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

16:54:18.0240 0536 cdrom - ok

16:54:18.0294 0536 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys

16:54:18.0376 0536 circlass - ok

16:54:18.0441 0536 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

16:54:18.0455 0536 CLFS - ok

16:54:18.0615 0536 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys

16:54:18.0620 0536 CmBatt - ok

16:54:18.0648 0536 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys

16:54:18.0692 0536 cmdide - ok

16:54:18.0769 0536 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys

16:54:18.0777 0536 Compbatt - ok

16:54:18.0915 0536 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys

16:54:18.0974 0536 crcdisk - ok

16:54:19.0000 0536 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys

16:54:19.0023 0536 Crusoe - ok

16:54:19.0183 0536 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys

16:54:19.0226 0536 DfsC - ok

16:54:19.0413 0536 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

16:54:19.0458 0536 disk - ok

16:54:19.0643 0536 DisplayLinkUsbPort (ff89f759d42e3a0e44a123e45827b20b) C:\Windows\system32\DRIVERS\DisplayLinkUsbPort.sys

16:54:19.0649 0536 DisplayLinkUsbPort - ok

16:54:19.0704 0536 dlkmd (8848d551df911702b242bcaf4fb63731) C:\Windows\system32\drivers\dlkmd.sys

16:54:19.0757 0536 dlkmd - ok

16:54:19.0918 0536 dlkmdldr (01f34117bed8865b5dac7f3f4c99e3ab) C:\Windows\system32\drivers\dlkmdldr.sys

16:54:19.0960 0536 dlkmdldr - ok

16:54:20.0037 0536 DMICall (f206e28ed74c491fd5d7c0a1119ce37f) C:\Windows\system32\DRIVERS\DMICall.sys

16:54:20.0079 0536 DMICall - ok

16:54:20.0256 0536 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

16:54:20.0298 0536 drmkaud - ok

16:54:20.0375 0536 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

16:54:20.0391 0536 DXGKrnl - ok

16:54:20.0511 0536 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys

16:54:20.0521 0536 E1G60 - ok

16:54:20.0568 0536 eamon - ok

16:54:20.0623 0536 eamonm (bf14fbabd52e9522456d3a2f6e7e76e4) C:\Windows\system32\DRIVERS\eamonm.sys

16:54:20.0632 0536 eamonm - ok

16:54:20.0788 0536 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

16:54:20.0798 0536 Ecache - ok

16:54:20.0877 0536 ehdrv (7d300a43a7bd8769e0f901bf9e1ae367) C:\Windows\system32\DRIVERS\ehdrv.sys

16:54:20.0932 0536 ehdrv - ok

16:54:21.0112 0536 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys

16:54:21.0161 0536 elxstor - ok

16:54:21.0219 0536 epfwwfpr (96f9030ca15a8d2e8d44e53c1f0e842d) C:\Windows\system32\DRIVERS\epfwwfpr.sys

16:54:21.0265 0536 epfwwfpr - ok

16:54:21.0398 0536 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys

16:54:21.0439 0536 ErrDev - ok

16:54:21.0522 0536 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

16:54:21.0611 0536 exfat - ok

16:54:21.0721 0536 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

16:54:21.0767 0536 fastfat - ok

16:54:21.0904 0536 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys

16:54:21.0984 0536 fdc - ok

16:54:22.0094 0536 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

16:54:22.0174 0536 FileInfo - ok

16:54:22.0236 0536 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

16:54:22.0279 0536 Filetrace - ok

16:54:22.0311 0536 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys

16:54:22.0352 0536 flpydisk - ok

16:54:22.0422 0536 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

16:54:22.0506 0536 FltMgr - ok

16:54:22.0608 0536 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

16:54:22.0650 0536 Fs_Rec - ok

16:54:22.0726 0536 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys

16:54:22.0770 0536 gagp30kx - ok

16:54:22.0859 0536 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys

16:54:22.0871 0536 HdAudAddService - ok

16:54:22.0965 0536 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

16:54:22.0977 0536 HDAudBus - ok

16:54:23.0073 0536 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

16:54:23.0116 0536 HidBth - ok

16:54:23.0150 0536 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

16:54:23.0211 0536 HidIr - ok

16:54:23.0309 0536 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

16:54:23.0351 0536 HidUsb - ok

16:54:23.0423 0536 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys

16:54:23.0502 0536 HpCISSs - ok

16:54:23.0663 0536 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS

16:54:23.0746 0536 HSFHWAZL - ok

16:54:23.0846 0536 HSF_DPV (7bc42c65b5c6281777c1a7605b253ba8) C:\Windows\system32\DRIVERS\HSX_DPV.sys

16:54:23.0947 0536 HSF_DPV - ok

16:54:24.0098 0536 HSXHWAZL (9ebf2d102ccbb6bcdfbf1b7922f8ba2e) C:\Windows\system32\DRIVERS\HSXHWAZL.sys

16:54:24.0108 0536 HSXHWAZL - ok

16:54:24.0182 0536 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys

16:54:24.0235 0536 HTTP - ok

16:54:24.0327 0536 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys

16:54:24.0409 0536 i2omp - ok

16:54:24.0504 0536 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

16:54:24.0549 0536 i8042prt - ok

16:54:24.0701 0536 iaStor (db0cc620b27a928d968c1a1e9cd9cb87) C:\Windows\system32\DRIVERS\iaStor.sys

16:54:24.0705 0536 iaStor - ok

16:54:24.0767 0536 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys

16:54:24.0779 0536 iaStorV - ok

16:54:24.0957 0536 igfx (ce5ff5d5e3f4ca974e36dc24c15474d0) C:\Windows\system32\DRIVERS\igdkmd32.sys

16:54:25.0071 0536 igfx - ok

16:54:25.0181 0536 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

16:54:25.0225 0536 iirsp - ok

16:54:25.0385 0536 IntcAzAudAddService (4a0f260df9a5333c07f4ab40ca9d4f4b) C:\Windows\system32\drivers\RTKVHDA.sys

16:54:25.0511 0536 IntcAzAudAddService - ok

16:54:25.0659 0536 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys

16:54:25.0701 0536 intelide - ok

16:54:25.0729 0536 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys

16:54:25.0732 0536 intelppm - ok

16:54:25.0834 0536 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

16:54:25.0877 0536 IpFilterDriver - ok

16:54:25.0916 0536 IpInIp - ok

16:54:25.0993 0536 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys

16:54:26.0074 0536 IPMIDRV - ok

16:54:26.0102 0536 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

16:54:26.0126 0536 IPNAT - ok

16:54:26.0160 0536 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

16:54:26.0181 0536 IRENUM - ok

16:54:26.0245 0536 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys

16:54:26.0278 0536 isapnp - ok

16:54:26.0349 0536 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

16:54:26.0382 0536 iScsiPrt - ok

16:54:26.0444 0536 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

16:54:26.0523 0536 iteatapi - ok

16:54:26.0614 0536 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

16:54:26.0693 0536 iteraid - ok

16:54:26.0801 0536 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

16:54:26.0881 0536 kbdclass - ok

16:54:26.0933 0536 kbdhid (ede59ec70e25c24581add1fbec7325f7) C:\Windows\system32\DRIVERS\kbdhid.sys

16:54:26.0976 0536 kbdhid - ok

16:54:27.0038 0536 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys

16:54:27.0064 0536 KSecDD - ok

16:54:27.0199 0536 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

16:54:27.0240 0536 lltdio - ok

16:54:27.0286 0536 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys

16:54:27.0336 0536 LSI_FC - ok

16:54:27.0368 0536 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys

16:54:27.0437 0536 LSI_SAS - ok

16:54:27.0548 0536 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys

16:54:27.0595 0536 LSI_SCSI - ok

16:54:27.0633 0536 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

16:54:27.0677 0536 luafv - ok

16:54:27.0813 0536 MBAMProtector (b7ca8cc3f978201856b6ab82f40953c3) C:\Windows\system32\drivers\mbam.sys

16:54:27.0821 0536 MBAMProtector - ok

16:54:27.0915 0536 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys

16:54:27.0921 0536 mdmxsdk - ok

16:54:28.0053 0536 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys

16:54:28.0104 0536 megasas - ok

16:54:28.0144 0536 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys

16:54:28.0196 0536 MegaSR - ok

16:54:28.0343 0536 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

16:54:28.0385 0536 Modem - ok

16:54:28.0410 0536 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

16:54:28.0411 0536 monitor - ok

16:54:28.0448 0536 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

16:54:28.0493 0536 mouclass - ok

16:54:28.0534 0536 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

16:54:28.0575 0536 mouhid - ok

16:54:28.0706 0536 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

16:54:28.0749 0536 MountMgr - ok

16:54:28.0845 0536 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys

16:54:28.0890 0536 mpio - ok

16:54:28.0980 0536 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

16:54:29.0101 0536 mpsdrv - ok

16:54:29.0205 0536 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

16:54:29.0248 0536 Mraid35x - ok

16:54:29.0338 0536 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

16:54:29.0391 0536 MRxDAV - ok

16:54:29.0474 0536 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys

16:54:29.0518 0536 mrxsmb - ok

16:54:29.0622 0536 mrxsmb10 (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys

16:54:29.0683 0536 mrxsmb10 - ok

16:54:29.0766 0536 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

16:54:29.0811 0536 mrxsmb20 - ok

16:54:29.0963 0536 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys

16:54:30.0005 0536 msahci - ok

16:54:30.0057 0536 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys

16:54:30.0105 0536 msdsm - ok

16:54:30.0226 0536 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

16:54:30.0269 0536 Msfs - ok

16:54:30.0357 0536 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

16:54:30.0400 0536 msisadrv - ok

16:54:30.0537 0536 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

16:54:30.0580 0536 MSKSSRV - ok

16:54:30.0631 0536 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

16:54:30.0647 0536 MSPCLOCK - ok

16:54:30.0732 0536 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

16:54:30.0737 0536 MSPQM - ok

16:54:30.0807 0536 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

16:54:30.0816 0536 MsRPC - ok

16:54:30.0900 0536 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

16:54:30.0902 0536 mssmbios - ok

16:54:30.0938 0536 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

16:54:30.0980 0536 MSTEE - ok

16:54:31.0018 0536 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

16:54:31.0062 0536 Mup - ok

16:54:31.0156 0536 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

16:54:31.0185 0536 NativeWifiP - ok

16:54:31.0296 0536 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

16:54:31.0310 0536 NDIS - ok

16:54:31.0405 0536 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

16:54:31.0411 0536 NdisTapi - ok

16:54:31.0475 0536 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

16:54:31.0516 0536 Ndisuio - ok

16:54:31.0642 0536 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

16:54:31.0706 0536 NdisWan - ok

16:54:31.0782 0536 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

16:54:31.0862 0536 NDProxy - ok

16:54:31.0977 0536 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

16:54:32.0049 0536 NetBIOS - ok

16:54:32.0134 0536 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

16:54:32.0186 0536 netbt - ok

16:54:32.0316 0536 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

16:54:32.0340 0536 nfrd960 - ok

16:54:32.0439 0536 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

16:54:32.0465 0536 Npfs - ok

16:54:32.0564 0536 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

16:54:32.0586 0536 nsiproxy - ok

16:54:32.0705 0536 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

16:54:32.0747 0536 Ntfs - ok

16:54:32.0872 0536 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

16:54:32.0915 0536 ntrigdigi - ok

16:54:33.0011 0536 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

16:54:33.0043 0536 Null - ok

16:54:33.0079 0536 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys

16:54:33.0139 0536 nvraid - ok

16:54:33.0183 0536 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys

16:54:33.0210 0536 nvstor - ok

16:54:33.0340 0536 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys

16:54:33.0402 0536 nv_agp - ok

16:54:33.0434 0536 NwlnkFlt - ok

16:54:33.0455 0536 NwlnkFwd - ok

16:54:33.0612 0536 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys

16:54:33.0615 0536 ohci1394 - ok

16:54:33.0748 0536 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

16:54:33.0799 0536 Parport - ok

16:54:33.0900 0536 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

16:54:33.0944 0536 partmgr - ok

16:54:33.0994 0536 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

16:54:34.0026 0536 Parvdm - ok

16:54:34.0131 0536 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

16:54:34.0189 0536 pci - ok

16:54:34.0248 0536 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys

16:54:34.0269 0536 pciide - ok

16:54:34.0373 0536 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

16:54:34.0438 0536 pcmcia - ok

16:54:34.0583 0536 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

16:54:34.0611 0536 PEAUTH - ok

16:54:34.0840 0536 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

16:54:34.0879 0536 PptpMiniport - ok

16:54:34.0929 0536 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys

16:54:34.0963 0536 Processor - ok

16:54:35.0052 0536 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

16:54:35.0056 0536 PSched - ok

16:54:35.0195 0536 PxHelp20 (153d02480a0a2f45785522e814c634b6) C:\Windows\system32\Drivers\PxHelp20.sys

16:54:35.0246 0536 PxHelp20 - ok

16:54:35.0456 0536 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys

16:54:35.0589 0536 ql2300 - ok

16:54:35.0731 0536 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

16:54:35.0775 0536 ql40xx - ok

16:54:35.0892 0536 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

16:54:35.0924 0536 QWAVEdrv - ok

16:54:36.0013 0536 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

16:54:36.0054 0536 RasAcd - ok

16:54:36.0177 0536 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

16:54:36.0271 0536 Rasl2tp - ok

16:54:36.0385 0536 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

16:54:36.0411 0536 RasPppoe - ok

16:54:36.0517 0536 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

16:54:36.0540 0536 RasSstp - ok

16:54:36.0664 0536 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

16:54:36.0674 0536 rdbss - ok

16:54:36.0796 0536 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

16:54:36.0820 0536 RDPCDD - ok

16:54:36.0954 0536 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys

16:54:36.0957 0536 rdpdr - ok

16:54:37.0035 0536 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

16:54:37.0063 0536 RDPENCDD - ok

16:54:37.0152 0536 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys

16:54:37.0190 0536 RDPWD - ok

16:54:37.0269 0536 regi (001b4278407f4303efc902a2b16f2453) C:\Windows\system32\drivers\regi.sys

16:54:37.0273 0536 regi - ok

16:54:37.0344 0536 rimsptsk (d0c2a0ce1091e08efb7ccba6cea4c3f9) C:\Windows\system32\DRIVERS\rimsptsk.sys

16:54:37.0346 0536 rimsptsk - ok

16:54:37.0452 0536 risdptsk (c22e4e27ccdf9aa5fe8143104f28cde3) C:\Windows\system32\DRIVERS\risdptsk.sys

16:54:37.0453 0536 risdptsk - ok

16:54:37.0524 0536 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

16:54:37.0549 0536 rspndr - ok

16:54:37.0717 0536 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

16:54:37.0749 0536 sbp2port - ok

16:54:37.0879 0536 sdbus (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys

16:54:37.0936 0536 sdbus - ok

16:54:37.0986 0536 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

16:54:38.0024 0536 secdrv - ok

16:54:38.0115 0536 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys

16:54:38.0139 0536 Serenum - ok

16:54:38.0214 0536 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

16:54:38.0248 0536 Serial - ok

16:54:38.0288 0536 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

16:54:38.0341 0536 sermouse - ok

16:54:38.0491 0536 SFEP (8b7c1768d2cde2e02e09a66563ddfd16) C:\Windows\system32\DRIVERS\SFEP.sys

16:54:38.0507 0536 SFEP - ok

16:54:38.0688 0536 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys

16:54:38.0729 0536 sffdisk - ok

16:54:38.0773 0536 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys

16:54:38.0796 0536 sffp_mmc - ok

16:54:38.0915 0536 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys

16:54:38.0946 0536 sffp_sd - ok

16:54:39.0003 0536 sfloppy (c33bfbd6e9e41fcd9ffef9729e9faed6) C:\Windows\system32\DRIVERS\sfloppy.sys

16:54:39.0048 0536 sfloppy - ok

16:54:39.0130 0536 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys

16:54:39.0185 0536 sisagp - ok

16:54:39.0248 0536 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys

16:54:39.0276 0536 SiSRaid2 - ok

16:54:39.0318 0536 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys

16:54:39.0366 0536 SiSRaid4 - ok

16:54:39.0433 0536 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys

16:54:39.0471 0536 Smb - ok

16:54:39.0649 0536 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

16:54:39.0682 0536 spldr - ok

16:54:39.0790 0536 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

16:54:39.0873 0536 srv - ok

16:54:40.0017 0536 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys

16:54:40.0053 0536 srv2 - ok

16:54:40.0142 0536 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys

16:54:40.0178 0536 srvnet - ok

16:54:40.0351 0536 StillCam (ef70b3d22b4bffda6ea851ecb063efaa) C:\Windows\system32\DRIVERS\serscan.sys

16:54:40.0374 0536 StillCam - ok

16:54:40.0517 0536 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

16:54:40.0526 0536 swenum - ok

16:54:40.0638 0536 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

16:54:40.0670 0536 Symc8xx - ok

16:54:40.0761 0536 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

16:54:40.0789 0536 Sym_hi - ok

16:54:40.0843 0536 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

16:54:40.0875 0536 Sym_u3 - ok

16:54:41.0023 0536 SynTP (99da94793332aadbb17bbb521ae56e21) C:\Windows\system32\DRIVERS\SynTP.sys

16:54:41.0049 0536 SynTP - ok

16:54:41.0203 0536 Tcpip (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys

16:54:41.0360 0536 Tcpip - ok

16:54:41.0581 0536 Tcpip6 (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys

16:54:41.0589 0536 Tcpip6 - ok

16:54:41.0687 0536 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys

16:54:41.0715 0536 tcpipreg - ok

16:54:41.0777 0536 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

16:54:41.0811 0536 TDPIPE - ok

16:54:41.0877 0536 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

16:54:41.0930 0536 TDTCP - ok

16:54:42.0065 0536 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

16:54:42.0094 0536 tdx - ok

16:54:42.0160 0536 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

16:54:42.0193 0536 TermDD - ok

16:54:42.0443 0536 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

16:54:42.0470 0536 tssecsrv - ok

16:54:42.0589 0536 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

16:54:42.0615 0536 tunmp - ok

16:54:42.0678 0536 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

16:54:42.0737 0536 tunnel - ok

16:54:42.0783 0536 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys

16:54:42.0817 0536 uagp35 - ok

16:54:42.0877 0536 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

16:54:42.0924 0536 udfs - ok

16:54:43.0037 0536 UIUSys - ok

16:54:43.0092 0536 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys

16:54:43.0136 0536 uliagpkx - ok

16:54:43.0232 0536 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys

16:54:43.0322 0536 uliahci - ok

16:54:43.0439 0536 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

16:54:43.0493 0536 UlSata - ok

16:54:43.0560 0536 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

16:54:43.0589 0536 ulsata2 - ok

16:54:43.0630 0536 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

16:54:43.0634 0536 umbus - ok

16:54:43.0773 0536 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

16:54:43.0824 0536 usbccgp - ok

16:54:43.0883 0536 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

16:54:43.0886 0536 usbcir - ok

16:54:44.0040 0536 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

16:54:44.0083 0536 usbehci - ok

16:54:44.0185 0536 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

16:54:44.0233 0536 usbhub - ok

16:54:44.0296 0536 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys

16:54:44.0354 0536 usbohci - ok

16:54:44.0455 0536 usbprint (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys

16:54:44.0497 0536 usbprint - ok

16:54:44.0584 0536 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

16:54:44.0638 0536 USBSTOR - ok

16:54:44.0704 0536 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys

16:54:44.0747 0536 usbuhci - ok

16:54:44.0847 0536 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys

16:54:44.0866 0536 usbvideo - ok

16:54:45.0049 0536 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys

16:54:45.0091 0536 vga - ok

16:54:45.0177 0536 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

16:54:45.0311 0536 VgaSave - ok

16:54:45.0389 0536 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys

16:54:45.0414 0536 viaagp - ok

16:54:45.0456 0536 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys

16:54:45.0481 0536 ViaC7 - ok

16:54:45.0531 0536 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys

16:54:45.0532 0536 viaide - ok

16:54:45.0648 0536 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

16:54:45.0700 0536 volmgr - ok

16:54:45.0847 0536 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

16:54:45.0888 0536 volmgrx - ok

16:54:46.0061 0536 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

16:54:46.0120 0536 volsnap - ok

16:54:46.0234 0536 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys

16:54:46.0308 0536 vsmraid - ok

16:54:47.0032 0536 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

16:54:47.0082 0536 WacomPen - ok

16:54:47.0192 0536 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

16:54:47.0274 0536 Wanarp - ok

16:54:47.0382 0536 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

16:54:47.0384 0536 Wanarpv6 - ok

16:54:47.0525 0536 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys

16:54:47.0568 0536 Wd - ok

16:54:47.0617 0536 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys

16:54:47.0709 0536 Wdf01000 - ok

16:54:47.0902 0536 WimFltr (090a2b8f055343815556a01f725f6c35) C:\Windows\system32\DRIVERS\wimfltr.sys

16:54:47.0918 0536 WimFltr - ok

16:54:48.0042 0536 winachsf (5a77ac34a0ffb70ce8b35b524fede9ba) C:\Windows\system32\DRIVERS\HSX_CNXT.sys

16:54:48.0127 0536 winachsf - ok

16:54:48.0270 0536 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\drivers\wmiacpi.sys

16:54:48.0292 0536 WmiAcpi - ok

16:54:48.0377 0536 WpdUsb (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys

16:54:48.0412 0536 WpdUsb - ok

16:54:48.0576 0536 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

16:54:48.0618 0536 ws2ifsl - ok

16:54:48.0717 0536 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

16:54:48.0725 0536 WUDFRd - ok

16:54:48.0799 0536 XAudio (88af537264f2b818da15479ceeaf5d7c) C:\Windows\system32\DRIVERS\xaudio.sys

16:54:48.0847 0536 XAudio - ok

16:54:49.0007 0536 yukonwlh (7d4cca3659fa0780603206e3d12a993f) C:\Windows\system32\DRIVERS\yk60x86.sys

16:54:49.0069 0536 yukonwlh - ok

16:54:49.0113 0536 MBR (0x1B8) (4bf077b4df3f4f5483a79d4ce511c7f3) \Device\Harddisk0\DR0

16:54:49.0136 0536 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected

16:54:49.0136 0536 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0)

16:54:49.0176 0536 Boot (0x1200) (4ce68c2eae6619693b40f1292ba3d928) \Device\Harddisk0\DR0\Partition0

16:54:49.0178 0536 \Device\Harddisk0\DR0\Partition0 - ok

16:54:49.0179 0536 ============================================================

16:54:49.0180 0536 Scan finished

16:54:49.0180 0536 ============================================================

16:54:49.0209 1964 Detected object count: 1

16:54:49.0209 1964 Actual detected object count: 1

16:56:26.0320 1964 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - will be cured on reboot

16:56:26.0321 1964 \Device\Harddisk0\DR0 - ok

16:56:26.0323 1964 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Cure

16:56:36.0200 4876 Deinitialize success

MBRCheck, version 1.2.3

Command-line:

Windows Version: Windows Vista Home Premium Edition

Windows Information: Service Pack 2 (build 6002), 32-bit

Base Board Manufacturer: Sony Corporation

BIOS Manufacturer: American Megatrends Inc.

System Manufacturer: Sony Corporation

System Product Name: VGN-NS110E

Logical Drives Mask: 0x0000003c

Kernel Drivers (total 151):

0x81E0D000 \SystemRoot\system32\ntkrnlpa.exe

0x821C7000 \SystemRoot\system32\hal.dll

0x80400000 \SystemRoot\system32\kdcom.dll

0x80407000 \SystemRoot\system32\mcupdate_GenuineIntel.dll

0x80477000 \SystemRoot\system32\PSHED.dll

0x80488000 \SystemRoot\system32\BOOTVID.dll

0x80490000 \SystemRoot\system32\CLFS.SYS

0x804D1000 \SystemRoot\system32\CI.dll

0x80609000 \SystemRoot\system32\drivers\Wdf01000.sys

0x80685000 \SystemRoot\system32\drivers\WDFLDR.SYS

0x80692000 \SystemRoot\system32\drivers\acpi.sys

0x806D8000 \SystemRoot\system32\drivers\WMILIB.SYS

0x806E1000 \SystemRoot\system32\drivers\msisadrv.sys

0x806E9000 \SystemRoot\system32\drivers\pci.sys

0x80710000 \SystemRoot\System32\drivers\partmgr.sys

0x8071F000 \SystemRoot\system32\DRIVERS\compbatt.sys

0x80722000 \SystemRoot\system32\DRIVERS\BATTC.SYS

0x8072C000 \SystemRoot\system32\drivers\volmgr.sys

0x8073B000 \SystemRoot\System32\drivers\volmgrx.sys

0x80785000 \SystemRoot\System32\drivers\mountmgr.sys

0x8740B000 \SystemRoot\system32\DRIVERS\iaStor.sys

0x874D9000 \SystemRoot\system32\drivers\fltmgr.sys

0x8750B000 \SystemRoot\system32\drivers\fileinfo.sys

0x8751B000 \SystemRoot\System32\Drivers\PxHelp20.sys

0x87525000 \SystemRoot\System32\Drivers\ksecdd.sys

0x87609000 \SystemRoot\system32\drivers\ndis.sys

0x87714000 \SystemRoot\system32\drivers\msrpc.sys

0x8773F000 \SystemRoot\system32\drivers\NETIO.SYS

0x8780B000 \SystemRoot\System32\drivers\tcpip.sys

0x878F5000 \SystemRoot\System32\drivers\fwpkclnt.sys

0x87A05000 \SystemRoot\System32\Drivers\Ntfs.sys

0x87B15000 \SystemRoot\system32\drivers\volsnap.sys

0x87B4E000 \SystemRoot\System32\Drivers\spldr.sys

0x87B56000 \SystemRoot\System32\Drivers\mup.sys

0x87B65000 \SystemRoot\System32\drivers\ecache.sys

0x87B8C000 \SystemRoot\system32\drivers\dlkmdldr.sys

0x87B93000 \SystemRoot\system32\drivers\disk.sys

0x87BA4000 \SystemRoot\system32\drivers\CLASSPNP.SYS

0x87BC5000 \SystemRoot\system32\drivers\crcdisk.sys

0x87BDB000 \SystemRoot\system32\DRIVERS\tunnel.sys

0x87BE6000 \SystemRoot\system32\DRIVERS\tunmp.sys

0x8B401000 \SystemRoot\system32\DRIVERS\igdkmd32.sys

0x8BAE4000 \SystemRoot\system32\drivers\dlkmd.sys

0x8BC00000 \SystemRoot\System32\drivers\dxgkrnl.sys

0x8BCA0000 \SystemRoot\System32\drivers\watchdog.sys

0x8BCAC000 \SystemRoot\system32\DRIVERS\usbuhci.sys

0x8BCB7000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

0x8BCF5000 \SystemRoot\system32\DRIVERS\usbehci.sys

0x8BD04000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

0x8BD91000 \SystemRoot\system32\DRIVERS\yk60x86.sys

0x8C009000 \SystemRoot\system32\DRIVERS\athr.sys

0x8C0ED000 \SystemRoot\system32\DRIVERS\ohci1394.sys

0x8C0FD000 \SystemRoot\system32\DRIVERS\1394BUS.SYS

0x8C10B000 \SystemRoot\system32\DRIVERS\risdptsk.sys

0x8C11C000 \SystemRoot\system32\DRIVERS\rimsptsk.sys

0x8C136000 \SystemRoot\system32\DRIVERS\i8042prt.sys

0x8C149000 \SystemRoot\system32\DRIVERS\kbdclass.sys

0x8C154000 \SystemRoot\system32\DRIVERS\SynTP.sys

0x8C17F000 \SystemRoot\system32\DRIVERS\USBD.SYS

0x8C181000 \SystemRoot\system32\DRIVERS\mouclass.sys

0x8C18C000 \SystemRoot\system32\DRIVERS\SFEP.sys

0x8C18F000 \SystemRoot\system32\DRIVERS\cdrom.sys

0x8C1A7000 \SystemRoot\system32\DRIVERS\intelppm.sys

0x8C1B6000 \SystemRoot\system32\DRIVERS\CmBatt.sys

0x8C1BA000 \SystemRoot\system32\DRIVERS\serscan.sys

0x8C1C2000 \SystemRoot\system32\DRIVERS\ArcSoftKsUFilter.sys

0x8C1CB000 \SystemRoot\system32\DRIVERS\msiscsi.sys

0x8BB95000 \SystemRoot\system32\DRIVERS\storport.sys

0x8BDE0000 \SystemRoot\system32\DRIVERS\TDI.SYS

0x8BBD6000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

0x8BDEB000 \SystemRoot\system32\DRIVERS\ndistapi.sys

0x8777A000 \SystemRoot\system32\DRIVERS\ndiswan.sys

0x8BBED000 \SystemRoot\system32\DRIVERS\raspppoe.sys

0x879DE000 \SystemRoot\system32\DRIVERS\raspptp.sys

0x8779D000 \SystemRoot\system32\DRIVERS\rassstp.sys

0x87BEF000 \SystemRoot\system32\DRIVERS\termdd.sys

0x8C1FA000 \SystemRoot\system32\DRIVERS\swenum.sys

0x877B2000 \SystemRoot\system32\DRIVERS\ks.sys

0x8BDF6000 \SystemRoot\system32\DRIVERS\mssmbios.sys

0x879F2000 \SystemRoot\system32\DRIVERS\umbus.sys

0x87596000 \SystemRoot\system32\DRIVERS\usbhub.sys

0x877DC000 \SystemRoot\System32\Drivers\NDProxy.SYS

0x8C802000 \SystemRoot\system32\drivers\RTKVHDA.sys

0x8CA0E000 \SystemRoot\system32\drivers\portcls.sys

0x8CA3B000 \SystemRoot\system32\drivers\drmk.sys

0x8CA60000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys

0x8CA9D000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys

0x8C401000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys

0x8C4B5000 \SystemRoot\system32\drivers\modem.sys

0x8C4C2000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

0x8C4CB000 \SystemRoot\System32\Drivers\Null.SYS

0x8C4D2000 \SystemRoot\System32\Drivers\Beep.SYS

0x8C4D9000 \SystemRoot\system32\DRIVERS\ehdrv.sys

0x8C501000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

0x8C508000 \SystemRoot\System32\drivers\vga.sys

0x8C514000 \SystemRoot\System32\drivers\VIDEOPRT.SYS

0x8C535000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

0x8C53D000 \SystemRoot\system32\drivers\rdpencdd.sys

0x8C545000 \SystemRoot\System32\Drivers\Msfs.SYS

0x8C550000 \SystemRoot\System32\Drivers\Npfs.SYS

0x8C55E000 \SystemRoot\System32\DRIVERS\rasacd.sys

0x8C567000 \SystemRoot\system32\DRIVERS\tdx.sys

0x8C57D000 \SystemRoot\system32\DRIVERS\smb.sys

0x8C591000 \SystemRoot\system32\drivers\afd.sys

0x8CBA0000 \SystemRoot\System32\DRIVERS\netbt.sys

0x8C5D9000 \SystemRoot\system32\DRIVERS\pacer.sys

0x8C5EF000 \SystemRoot\system32\DRIVERS\netbios.sys

0x8CBD2000 \SystemRoot\system32\DRIVERS\wanarp.sys

0x80795000 \SystemRoot\system32\DRIVERS\rdbss.sys

0x8CBE5000 \SystemRoot\system32\drivers\nsiproxy.sys

0x8C5FD000 \SystemRoot\system32\DRIVERS\DMICall.sys

0x875CB000 \SystemRoot\System32\Drivers\dfsc.sys

0x87910000 \SystemRoot\system32\DRIVERS\usbccgp.sys

0x87927000 \SystemRoot\System32\Drivers\usbvideo.sys

0x8CBEF000 \SystemRoot\System32\Drivers\crashdmp.sys

0x8D806000 \SystemRoot\System32\Drivers\dump_iaStor.sys

0x94CE0000 \SystemRoot\System32\win32k.sys

0x8D8D4000 \SystemRoot\System32\drivers\Dxapi.sys

0x8D8DE000 \SystemRoot\system32\DRIVERS\monitor.sys

0x94F00000 \SystemRoot\System32\TSDDD.dll

0x94F20000 \SystemRoot\System32\cdd.dll

0x8D8ED000 \SystemRoot\system32\drivers\luafv.sys

0x8D908000 \SystemRoot\system32\DRIVERS\eamonm.sys

0xA820F000 \SystemRoot\system32\drivers\spsys.sys

0xA82BF000 \SystemRoot\system32\DRIVERS\lltdio.sys

0xA82CF000 \SystemRoot\system32\DRIVERS\nwifi.sys

0xA82F9000 \SystemRoot\system32\DRIVERS\ndisuio.sys

0xA8303000 \SystemRoot\system32\DRIVERS\rspndr.sys

0xA8316000 \SystemRoot\system32\drivers\HTTP.sys

0xA8383000 \SystemRoot\System32\DRIVERS\srvnet.sys

0xA83A0000 \SystemRoot\system32\DRIVERS\bowser.sys

0xA83B9000 \SystemRoot\System32\drivers\mpsdrv.sys

0xA83CE000 \SystemRoot\system32\drivers\mrxdav.sys

0x8D9AE000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

0x87948000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys

0x8D9CD000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys

0x87981000 \SystemRoot\System32\DRIVERS\srv2.sys

0x805B1000 \SystemRoot\System32\DRIVERS\srv.sys

0x8D9E5000 \SystemRoot\system32\DRIVERS\epfwwfpr.sys

0x879A9000 \SystemRoot\system32\DRIVERS\ipfltdrv.sys

0xA83EF000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys

0xAAC00000 \SystemRoot\system32\drivers\peauth.sys

0xAACDE000 \SystemRoot\system32\drivers\regi.sys

0xAACE0000 \SystemRoot\System32\Drivers\secdrv.SYS

0xAACEA000 \SystemRoot\System32\drivers\tcpipreg.sys

0xAACF6000 \SystemRoot\system32\DRIVERS\WUDFRd.sys

0xAAD0B000 \SystemRoot\system32\DRIVERS\WUDFPf.sys

0xAAD1D000 \SystemRoot\system32\DRIVERS\xaudio.sys

0xAAD25000 \SystemRoot\system32\DRIVERS\cdfs.sys

0xAAD3B000 \??\C:\Windows\system32\drivers\mbam.sys

0x77970000 \Windows\System32\ntdll.dll

Processes (total 85):

0 System Idle Process

4 System

496 C:\Windows\System32\smss.exe

636 csrss.exe

680 C:\Windows\System32\wininit.exe

692 csrss.exe

724 C:\Windows\System32\services.exe

736 C:\Windows\System32\lsass.exe

748 C:\Windows\System32\lsm.exe

788 C:\Windows\System32\winlogon.exe

920 C:\Windows\System32\svchost.exe

984 C:\Windows\System32\svchost.exe

1024 C:\Windows\System32\svchost.exe

1112 C:\Windows\System32\svchost.exe

1140 C:\Windows\System32\svchost.exe

1152 C:\Windows\System32\svchost.exe

1240 C:\Windows\System32\audiodg.exe

1276 C:\Windows\System32\svchost.exe

1292 C:\Windows\System32\SLsvc.exe

1316 C:\Windows\System32\svchost.exe

1508 C:\Program Files\DisplayLink Core Software\DisplayLinkService.exe

1572 C:\Windows\RTKAUDIOSERVICE.EXE

1804 C:\Windows\System32\dwm.exe

1832 C:\Windows\explorer.exe

1892 C:\Windows\System32\svchost.exe

364 C:\Windows\System32\spoolsv.exe

504 C:\Windows\System32\taskeng.exe

596 C:\Windows\System32\svchost.exe

1220 C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

1884 C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

2144 C:\Windows\System32\svchost.exe

2180 C:\Windows\System32\svchost.exe

2216 C:\Windows\System32\taskeng.exe

2264 C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe

2272 C:\Program Files\Sony\VAIO Care\VCsystray.exe

2336 C:\Program Files\ArcSoft\Magic-i Visual Effects\uCamMonitor.exe

2352 C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

2392 C:\Program Files\Sony\VAIO Power Management\SPMService.exe

2420 dllhost.exe

2524 C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe

2552 C:\Program Files\Viewpoint\Common\ViewpointService.exe

2564 C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

2624 C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe

2712 dllhost.exe

2796 C:\Windows\System32\svchost.exe

2844 C:\Windows\System32\SearchIndexer.exe

2972 C:\Windows\System32\drivers\XAudio.exe

3072 igfxext.exe

3152 igfxsrvc.exe

3172 C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe

3192 C:\Program Files\Sony\VAIO Power Management\SPMgr.exe

3224 WUDFHost.exe

3708 C:\Windows\System32\igfxsrvc.exe

3952 C:\Program Files\Windows Defender\MSASCui.exe

3996 C:\Windows\System32\hkcmd.exe

4012 C:\Windows\System32\igfxpers.exe

4032 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

4056 C:\Program Files\Sony\ISB Utility\ISBMgr.exe

2572 C:\Program Files\Sony\VAIO Wireless Wizard\AutoLaunchWLASU.exe

2880 C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

3044 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

2980 C:\Program Files\Sony Corporation\SmartWi Connection Utility\CCP.exe

3476 C:\Program Files\Common Files\Java\Java Update\jusched.exe

3608 C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

1444 C:\Program Files\Windows Sidebar\sidebar.exe

1664 C:\Program Files\InFocus\DisplayLink Manager\InFocusDisplayLinkManagerSetup.exe

1372 C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

4052 C:\Program Files\Sony Corporation\SmartWi Connection Utility\PowerManager.exe

4044 C:\Program Files\Sony Corporation\SmartWi Connection Utility\ThirdPartyAppMgr.exe

2256 C:\Program Files\Sony Corporation\SmartWi Connection Utility\UIManager.exe

4760 C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

5220 C:\Windows\System32\taskeng.exe

2128 C:\Program Files\Mozilla Firefox\firefox.exe

3416 C:\Windows\System32\svchost.exe

3212 C:\Windows\System32\svchost.exe

4364 C:\Program Files\Mozilla Firefox\plugin-container.exe

2400 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

5856 C:\Program Files\Mozilla Firefox\plugin-container.exe

4092 C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe

5260 C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe

5320 C:\Windows\System32\SearchProtocolHost.exe

3328 C:\Windows\System32\SearchFilterHost.exe

3716 dllhost.exe

1532 dllhost.exe

4948 C:\Users\Brian\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`39400000 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS543216L9SA00, Rev: FB2OC43C

Size Device Name MBR Status

--------------------------------------------

149 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected

SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979

Done!

Run date: 2012-01-03 22:00:04

-----------------------------

22:00:04.184 OS Version: Windows 6.0.6002 Service Pack 2

22:00:04.185 Number of processors: 2 586 0xF0D

22:00:04.188 ComputerName: BRIANS-VAIO UserName: Brian

22:00:51.202 Initialize success

22:00:51.387 write error "aswEngin.dll". The process cannot access the file because it is being used by another process.

22:01:45.712 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

22:01:45.716 Disk 0 Vendor: Hitachi_ FB2O Size: 152627MB BusType: 3

22:01:45.722 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000064

22:01:45.728 Disk 1 Vendor: RICOH 01 Size: 152627MB BusType: 0

22:01:45.735 Disk 2 \Device\Harddisk2\DR2 -> \Device\00000065

22:01:45.740 Disk 2 Vendor: RICOH 02 Size: 152627MB BusType: 0

22:01:45.773 Disk 0 MBR read successfully

22:01:45.780 Disk 0 MBR scan

22:01:45.786 Disk 0 Windows VISTA default MBR code

22:01:45.799 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 9107 MB offset 2048

22:01:45.818 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 143518 MB offset 18653184

22:01:45.829 Disk 0 scanning sectors +312579760

22:01:45.919 Disk 0 scanning C:\Windows\system32\drivers

22:02:03.472 Service scanning

22:02:06.285 Modules scanning

22:02:14.552 Disk 0 trace - called modules:

22:02:14.581 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys

22:02:14.592 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85b232e8]

22:02:14.602 3 CLASSPNP.SYS[87ba98b3] -> nt!IofCallDriver -> [0x84e9e268]

22:02:14.612 5 acpi.sys[8069a6bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x84ed3028]

22:02:14.623 Scan finished successfully

22:04:44.114 Disk 0 MBR has been saved successfully to "C:\Users\Brian\Desktop\MBR.dat"

22:04:44.133 The log file has been saved successfully to "C:\Users\Brian\Desktop\aswMBR.txt"

ComboFix 12-01-03.08 - Brian 01/03/2012 22:39:18.1.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1914.855 [GMT -5:00]

Running from: c:\users\Brian\Desktop\ComboFix.exe

AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

SP: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Brian\GoToAssistDownloadHelper.exe

c:\windows\SwSys1.bmp

c:\windows\SwSys2.bmp

.

((((((((((((((((((((((((( Files Created from 2011-12-04 to 2012-01-04 )))))))))))))))))))))))))))))))

.

2012-01-04 03:51 . 2012-01-04 03:51 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-01-03 21:45 . 2011-11-21 10:47 6823496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{90E86661-A262-4C43-8942-9C07E82ECC9A}\mpengine.dll

2012-01-01 00:18 . 2012-01-01 00:18 -------- d-----w- c:\users\Brian\AppData\Roaming\Malwarebytes

2012-01-01 00:18 . 2012-01-01 00:18 -------- d-----w- c:\programdata\Malwarebytes

2012-01-01 00:18 . 2012-01-01 00:18 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-01-01 00:18 . 2011-12-10 20:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-12-31 21:13 . 2011-12-31 21:49 -------- d-----w- c:\program files\PC Tools

2011-12-31 21:08 . 2011-11-23 00:42 185560 ----a-w- c:\windows\system32\drivers\PCTSD.sys

2011-12-31 21:08 . 2011-12-31 21:49 -------- d-----w- c:\program files\Common Files\PC Tools

2011-12-31 21:06 . 2011-12-31 21:47 -------- d-----w- c:\programdata\PC Tools

2011-12-31 21:06 . 2011-12-31 21:06 -------- d-----w- c:\users\Brian\AppData\Roaming\TestApp

2011-12-26 04:54 . 2011-12-26 04:54 -------- d-----w- c:\windows\Intuit

2011-12-24 20:32 . 2011-12-24 20:32 -------- d-----w- c:\windows\Sun

2011-12-15 00:08 . 2011-12-15 00:08 -------- d-----w- c:\users\Brian\AppData\Local\InFocus_Corporation

2011-12-15 00:06 . 2011-12-15 00:06 -------- d-----w- c:\program files\InFocus

2011-12-15 00:06 . 2011-12-15 00:06 -------- d--h--w- c:\program files\DisplayLink InFocus Support

2011-12-15 00:05 . 2009-04-06 15:57 367728 ----a-w- c:\windows\system32\drivers\dlkmd.sys

2011-12-15 00:05 . 2009-04-06 15:57 13424 ----a-w- c:\windows\system32\drivers\dlkmdldr.sys

2011-12-15 00:05 . 2011-12-25 04:39 -------- d-----w- c:\program files\DisplayLink Core Software

2011-12-14 02:28 . 2011-10-25 15:56 49152 ----a-w- c:\windows\system32\csrsrv.dll

2011-12-08 23:06 . 2011-12-11 07:01 -------- d-----w- c:\users\Brian\AppData\Roaming\Apple Computer

2011-12-08 23:05 . 2011-12-08 23:06 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2011-12-08 23:03 . 2011-12-25 04:34 -------- d-----w- c:\program files\Apple Software Update

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-15 19:29 . 2009-10-02 21:33 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-12-21 07:24 . 2011-12-26 04:56 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AOLOverlayIcon]

@="{AB0C8BE3-041C-47d6-8195-E089D32B38DD}"

[HKEY_CLASSES_ROOT\CLSID\{AB0C8BE3-041C-47d6-8195-E089D32B38DD}]

2008-06-14 00:07 303104 ----a-w- c:\ddi\OverIcon.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-04 150040]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-04 170520]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-04 145944]

"RtHDVCpl"="RtHDVCpl.exe" [2008-07-03 6295552]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-10 835584]

"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2008-04-04 317280]

"SmartWiHelper"="c:\program files\Sony Corporation\SmartWi Connection Utility\SmartWiHelper.exe" [2008-06-27 77824]

"VAIOMyMemCenter"="c:\program files\Sony\VAIO My Memory Center\VAIO MyMemCenter.exe" [2008-02-29 679936]

"VAIORegistration"="c:\program files\Sony\First Experience\WelcomeLauncher.exe" [2007-10-17 20480]

"VAIOSurvey"="c:\program files\Sony\VAIO Survey\VAIO Sat Survey.exe" [2008-07-25 385024]

"VWLASU"="c:\program files\Sony\VAIO Wireless Wizard\AutoLaunchWLASU.exe" [2008-05-20 24576]

"Skytel"="Skytel.exe" [2008-07-03 1826816]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-11-04 2219184]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]

.

c:\users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

ZooskMessenger.lnk - c:\program files\ZooskMessenger\ZooskMessenger.exe [N/A]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

AOLDDI.LNK - c:\ddi\AOLICON.exe [N/A]

InFocus DisplayLink Manager Startup.lnk - c:\program files\InFocus\DisplayLink Manager\InFocusDisplayLinkManagerSetup.exe [2011-12-14 10554008]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]

2008-07-16 01:04 98304 ----a-w- c:\windows\System32\VESWinlogon.dll

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - ASWMBR

*Deregistered* - aswMBR

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

HPService REG_MULTI_SZ HPSLPSVC

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.ask.com/?o=101760&l=dis

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\Brian\AppData\Roaming\Mozilla\Firefox\Profiles\z57s78nq.default\

FF - prefs.js: browser.search.selectedEngine - Ask

FF - prefs.js: browser.startup.homepage - espn.com

FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{88c7f2aa-f93f-432c-8f0e-b7d85967a527} - (no file)

HKCU-Run-Aim6 - (no file)

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-01-03 22:52

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Completion time: 2012-01-03 23:02:05

ComboFix-quarantined-files.txt 2012-01-04 04:01

.

Pre-Run: 89,363,705,856 bytes free

Post-Run: 90,930,143,232 bytes free

.

- - End Of File - - 494137955F7220AF9B8DF00A9FFD22A6

Results of screen317's Security Check version 0.99.30

Windows Vista Service Pack 2 x86 (UAC is enabled)

Internet Explorer 8 Out of date!

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

ESET NOD32 Antivirus

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Java 6 Update 26

Java SE Runtime Environment 6

Java version out of date!

Adobe Flash Player 10.3.183.7 Flash Player out of Date!

Adobe Reader 9 Adobe Reader out of date!

Mozilla Firefox (9.0.1)

````````````````````````````````

Process Check:

objlist.exe by Laurent

Windows Defender MSASCui.exe

Malwarebytes' Anti-Malware mbamservice.exe

Windows Defender MSASCui.exe

``````````End of Log````````````

So, what do you think? Thank you for all the great help up to this point and please advise me what to do next.

zbad2000

MBR.zip

D-FRED-BROWN · January 4, 2012

Glad to hear things are running better

Thank you for all the great help up to this point and please advise me what to do next.

No problem!

We need to do some further deep scanning. Please do the following:

Download Rootkit Unhooker and save it to your Desktop.

Close all open programs and browsers, then double-click RKUnhookerLE.exe to run it.

Vista/Windows 7 users right-click and select Run As Administrator.

Click the Report tab, then click Scan
Check Drivers, Stealth Code, Files, and Code Hooks
UNcheck the rest, then click OK
When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
Wait until the scanner has finished then go File > Save Report
Save the report somewhere you can find it. Click Close
Copy the entire contents of the report and paste it in your next reply.
Note: You may get the following warning---just ignore it, click OK and continue. Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?

----------

Please close all anti virus, anti malware and any other open programs/windows so they do not interfere with the running of RootRepeal.

Please download RootRepeal.zip from here.
Extract the program file to your Desktop.
Run the program RootRepeal.exe and go to the Report tab and click on the Scan button.
Select ALL of the checkboxes and then click OK and it will start scanning your system.
If you have multiple drives you only need to check the C: drive or the one Windows is installed on.
When done, click on Save Report
Save it to the Desktop.
Please copy/paste the contents of the report in your next reply.

NOTE! Please remove any e-mail address in the RootRepeal report (if present).

----------

Please post both the RootkitUnhooker & RootRepeal reports in your next reply. Let me know how things go .

zbad2000 · January 5, 2012

Thanks for all your help so far. It's been great to have a place like this to go for some honest help. So I ran both programs, and it went ok. RootKit took about 4 hours to run; I don't mind but I hope its normal, or at least somewhat normal. :unsure: Anyway, here are the logs. Look forward to hearing back from you.

zbad 2000

RkU Version: 3.8.389.593, Type LE (SR2)

==============================================

OS Name: Windows Vista

Version 6.0.6002 (Service Pack 2)

Number of processors #2

==============================================

>Drivers

==============================================

0x8B401000 C:\Windows\system32\DRIVERS\igdkmd32.sys 7221248 bytes (Intel Corporation, Intel Graphics Kernel Mode Driver)

0x81E0D000 C:\Windows\system32\ntkrnlpa.exe 3907584 bytes (Microsoft Corporation, NT Kernel & System)

0x81E0D000 PnpManager 3907584 bytes

0x81E0D000 RAW 3907584 bytes

0x81E0D000 WMIxWDM 3907584 bytes

0x8C802000 C:\Windows\system32\drivers\RTKVHDA.sys 2146304 bytes (Realtek Semiconductor Corp., Realtek® High Definition Audio Function Driver)

0x94CE0000 Win32k 2113536 bytes

0x94CE0000 C:\Windows\System32\win32k.sys 2113536 bytes (Microsoft Corporation, Multi-User Win32 Driver)

0x87A05000 C:\Windows\System32\Drivers\Ntfs.sys 1114112 bytes (Microsoft Corporation, NT File System Driver)

0x87609000 C:\Windows\system32\drivers\ndis.sys 1093632 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver)

0x8CA9D000 C:\Windows\system32\DRIVERS\HSX_DPV.sys 1060864 bytes (Conexant Systems, Inc., HSF_DP driver)

0x8780B000 C:\Windows\System32\drivers\tcpip.sys 958464 bytes (Microsoft Corporation, TCP/IP Driver)

0x8C009000 C:\Windows\system32\DRIVERS\athr.sys 933888 bytes (Atheros Communications, Inc., Atheros Extensible Wireless LAN device driver)

0x804D1000 C:\Windows\system32\CI.dll 917504 bytes (Microsoft Corporation, Code Integrity Module)

0xAAC00000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)

0x8D806000 C:\Windows\System32\Drivers\dump_iaStor.sys 843776 bytes

0x8740B000 C:\Windows\system32\DRIVERS\iaStor.sys 843776 bytes (Intel Corporation, Intel Matrix Storage Manager driver - ia32)

0x8C401000 C:\Windows\system32\DRIVERS\HSX_CNXT.sys 737280 bytes (Conexant Systems, Inc., HSF_CNXT driver)

0x8BAE4000 C:\Windows\system32\drivers\dlkmd.sys 724992 bytes (DisplayLink Corp., DisplayLink WDDM KMD)

0xA820F000 C:\Windows\system32\drivers\spsys.sys 720896 bytes (Microsoft Corporation, security processor)

0x8D908000 C:\Windows\system32\DRIVERS\eamonm.sys 679936 bytes (ESET, Amon monitor)

0x8BC00000 C:\Windows\System32\drivers\dxgkrnl.sys 655360 bytes (Microsoft Corporation, DirectX Graphics Kernel)

0x8BD04000 C:\Windows\system32\DRIVERS\HDAudBus.sys 577536 bytes (Microsoft Corporation, High Definition Audio Bus Driver)

0x80609000 C:\Windows\system32\drivers\Wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic)

0x87525000 C:\Windows\System32\Drivers\ksecdd.sys 462848 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)

0x80407000 C:\Windows\system32\mcupdate_GenuineIntel.dll 458752 bytes (Microsoft Corporation, Intel Microcode Update Library)

0xA8316000 C:\Windows\system32\drivers\HTTP.sys 446464 bytes (Microsoft Corporation, HTTP Protocol Stack)

0x805B1000 C:\Windows\System32\DRIVERS\srv.sys 323584 bytes (Microsoft Corporation, Server driver)

0x8BD91000 C:\Windows\system32\DRIVERS\yk60x86.sys 323584 bytes (Marvell, Miniport Driver for Marvell Yukon Ethernet Controller.)

0x8073B000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver)

0x8C591000 C:\Windows\system32\drivers\afd.sys 294912 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)

0x80692000 C:\Windows\system32\drivers\acpi.sys 286720 bytes (Microsoft Corporation, ACPI Driver for NT)

0x80490000 C:\Windows\system32\CLFS.SYS 266240 bytes (Microsoft Corporation, Common Log File System Driver)

0x8BB95000 C:\Windows\system32\DRIVERS\storport.sys 266240 bytes (Microsoft Corporation, Microsoft Storage Port Driver)

0x8BCB7000 C:\Windows\system32\DRIVERS\USBPORT.SYS 253952 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)

0x8CA60000 C:\Windows\system32\DRIVERS\HSXHWAZL.sys 249856 bytes (Conexant Systems, Inc., HSF_HWAZL WDM driver)

0x80795000 C:\Windows\system32\DRIVERS\rdbss.sys 245760 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)

0x8773F000 C:\Windows\system32\drivers\NETIO.SYS 241664 bytes (Microsoft Corporation, Network I/O Subsystem)

0x87948000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)

0x87B15000 C:\Windows\system32\drivers\volsnap.sys 233472 bytes (Microsoft Corporation, Volume Shadow Copy Driver)

0x87596000 C:\Windows\system32\DRIVERS\usbhub.sys 217088 bytes (Microsoft Corporation, Default Hub Driver for USB)

0x821C7000 ACPI_HAL 208896 bytes

0x821C7000 C:\Windows\system32\hal.dll 208896 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)

0x874D9000 C:\Windows\system32\drivers\fltmgr.sys 204800 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)

0x8CBA0000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)

0x8C1CB000 C:\Windows\system32\DRIVERS\msiscsi.sys 192512 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver)

0x8CA0E000 C:\Windows\system32\drivers\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))

0x87714000 C:\Windows\system32\drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)

0x8C154000 C:\Windows\system32\DRIVERS\SynTP.sys 176128 bytes (Synaptics, Inc., Synaptics Touchpad Driver)

0x877B2000 C:\Windows\system32\DRIVERS\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library)

0xA82CF000 C:\Windows\system32\DRIVERS\nwifi.sys 172032 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)

0x87981000 C:\Windows\System32\DRIVERS\srv2.sys 163840 bytes (Microsoft Corporation, Smb 2.0 Server driver)

0x87B65000 C:\Windows\System32\drivers\ecache.sys 159744 bytes (Microsoft Corporation, Special Memory Device Cache)

0x806E9000 C:\Windows\system32\drivers\pci.sys 159744 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)

0x8CA3B000 C:\Windows\system32\drivers\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)

0x8777A000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))

0x87BA4000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll)

0xA83CE000 C:\Windows\system32\drivers\mrxdav.sys 135168 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)

0x87927000 C:\Windows\System32\Drivers\usbvideo.sys 135168 bytes (Microsoft Corporation, USB Video Class Driver)

0x8C514000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)

0x8C4D9000 C:\Windows\system32\DRIVERS\ehdrv.sys 126976 bytes (ESET, ESET Helper driver)

0x8D9AE000 C:\Windows\system32\DRIVERS\mrxsmb.sys 126976 bytes (Microsoft Corporation, Windows NT SMB Minirdr)

0xA8383000 C:\Windows\System32\DRIVERS\srvnet.sys 118784 bytes (Microsoft Corporation, Server Network driver)

0x878F5000 C:\Windows\System32\drivers\fwpkclnt.sys 110592 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)

0x8D8ED000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver)

0x8C11C000 C:\Windows\system32\DRIVERS\rimsptsk.sys 106496 bytes (REDC, RICOH MS Driver)

0xA83A0000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)

0x8D9E5000 C:\Windows\system32\DRIVERS\epfwwfpr.sys 102400 bytes (ESET, ESET Personal Firewall driver)

0x8C18F000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver)

0x8D9CD000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 98304 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)

0x875CB000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Namespace Client Driver)

0x8BBD6000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)

0x87910000 C:\Windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)

0xAAD25000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver)

0x8C5D9000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS Packet Scheduler)

0x8C567000 C:\Windows\system32\DRIVERS\tdx.sys 90112 bytes (Microsoft Corporation, TDI Translation Driver)

0xA83B9000 C:\Windows\System32\drivers\mpsdrv.sys 86016 bytes (Microsoft Corporation, Microsoft Protection Service Driver)

0x8779D000 C:\Windows\system32\DRIVERS\rassstp.sys 86016 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager)

0xAACF6000 C:\Windows\system32\DRIVERS\WUDFRd.sys 86016 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Reflector)

0x879DE000 C:\Windows\system32\DRIVERS\raspptp.sys 81920 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)

0x8C57D000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver)

0x8C136000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042 Port Driver)

0xA8303000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)

0x8CBD2000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)

0x879A9000 C:\Windows\system32\DRIVERS\ipfltdrv.sys 73728 bytes (Microsoft Corporation, IP FILTER DRIVER)

0xAAD0B000 C:\Windows\system32\DRIVERS\WUDFPf.sys 73728 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)

0x87B93000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)

0x877DC000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy)

0x80477000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver)

0x8C10B000 C:\Windows\system32\DRIVERS\risdptsk.sys 69632 bytes (REDC, RICOH SD/MMC Driver)

0x8750B000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver)

0xA82BF000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)

0x80785000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager)

0x8C0ED000 C:\Windows\system32\DRIVERS\ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)

0x87BEF000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Terminal Server Driver)

0x8C1A7000 C:\Windows\system32\DRIVERS\intelppm.sys 61440 bytes (Microsoft Corporation, Processor Device Driver)

0x8D8DE000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver)

0x87B56000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver)

0x80710000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver)

0x8BBED000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)

0x8BCF5000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)

0x8072C000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver)

0x8C0FD000 C:\Windows\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)

0x94F20000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver)

0x8C5EF000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)

0x8C550000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)

0x8CBEF000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)

0x8C4B5000 C:\Windows\system32\drivers\modem.sys 53248 bytes (Microsoft Corporation, Modem Device Driver)

0x879F2000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator)

0x80685000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)

0xAACEA000 C:\Windows\System32\drivers\tcpipreg.sys 49152 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)

0x8C508000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)

0x8BCA0000 C:\Windows\System32\drivers\watchdog.sys 49152 bytes (Microsoft Corporation, Watchdog Driver)

0xAAD3F000 C:\Users\Brian\AppData\Local\Temp\aswMBR.sys 45056 bytes

0x8C149000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Keyboard Class Driver)

0x8C181000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mouse Class Driver)

0x8C545000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)

0x8BDEB000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)

0x8BDE0000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)

0x87BDB000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)

0x8BCAC000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver)

0x80722000 C:\Windows\system32\DRIVERS\BATTC.SYS 40960 bytes (Microsoft Corporation, Battery Class Driver)

0x8D8D4000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)

0x8BDF6000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)

0xA82F9000 C:\Windows\system32\DRIVERS\ndisuio.sys 40960 bytes (Microsoft Corporation, NDIS User mode I/O driver)

0x8CBE5000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)

0x8751B000 C:\Windows\System32\Drivers\PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)

0xAACE0000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)

0x8C1C2000 C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys 36864 bytes (ArcSoft, Inc., -)

0xAAD63000 C:\Windows\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)

0x87BC5000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver)

0x8C4C2000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver)

0x8C55E000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver)

0x94F00000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)

0x87BE6000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)

0x806D8000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)

0x80488000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)

0xAAD4C000 C:\Users\Brian\AppData\Local\Temp\catchme.sys 32768 bytes

0x806E1000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)

0x8C535000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)

0x8C53D000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport)

0xAAD5B000 C:\Windows\system32\DRIVERS\serscan.sys 32768 bytes (Microsoft Corporation, Serial Imaging Device Driver)

0x87B4E000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)

0xAAD1D000 C:\Windows\system32\DRIVERS\xaudio.sys 32768 bytes (Conexant Systems, Inc., Modem Audio Device Driver)

0x8C4D2000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)

0x87B8C000 C:\Windows\system32\drivers\dlkmdldr.sys 28672 bytes (DisplayLink Corp., DisplayLink WDDM KMD Loader)

0x8C501000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)

0x80400000 C:\Windows\system32\kdcom.dll 28672 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)

0x8C4CB000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)

0x8C1B6000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)

0xAAD3B000 C:\Windows\system32\drivers\mbam.sys 16384 bytes (Malwarebytes Corporation, Malwarebytes' Anti-Malware)

0xA83EF000 C:\Windows\system32\DRIVERS\mdmxsdk.sys 16384 bytes (Conexant, Diagnostic Interface x86 Driver)

0x8071F000 C:\Windows\system32\DRIVERS\compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver)

0x8C18C000 C:\Windows\system32\DRIVERS\SFEP.sys 12288 bytes (Sony Corporation, Sony Firmware Extension Parser driver)

0xAAD4A000 C:\Windows\system32\Drivers\PROCEXP113.SYS 8192 bytes

0xAACDE000 C:\Windows\system32\drivers\regi.sys 8192 bytes (InterVideo, regi driver)

0x8C1FA000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)

0x8C17F000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)

0x8C5FD000 C:\Windows\system32\DRIVERS\DMICall.sys 4096 bytes (Sony Corporation, Windows 2000 DMI Call Kernel Driver)

==============================================

>Stealth

==============================================

0x86D5CBE4 Unknown page with executable code, 1052 bytes

0x86D1FF13 Unknown page with executable code, 237 bytes

0x86D64E96 Unknown page with executable code, 362 bytes

==============================================

>Files

==============================================

!-->[Hidden] C:\Qoobox\BackEnv\AppData.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\Cache.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\Cookies.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\Desktop.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\Favorites.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\History.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\LocalAppData.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\LocalSettings.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\Music.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\NetHood.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\Personal.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\Pictures.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\PrintHood.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\Profiles.Folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\Profiles.Folder.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\Programs.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\Recent.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\SendTo.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\SetPath.bat

!-->[Hidden] C:\Qoobox\BackEnv\StartMenu.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\StartUp.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\SysPath.dat

!-->[Hidden] C:\Qoobox\BackEnv\Templates.folder.dat

!-->[Hidden] C:\Qoobox\BackEnv\VikPev00

==============================================

>Hooks

==============================================

ntkrnlpa.exe+0x000A87AA, Type: Inline - RelativeJump 0x81EB57AA-->81EB57B1 [ntkrnlpa.exe]

ntkrnlpa.exe-->TmInitSystem, Type: Inline - RelativeJump 0x821671DE-->821671E4 [ntkrnlpa.exe]

[1220]ekrn.exe-->kernel32.dll-->SetUnhandledExceptionFilter, Type: Inline - PushRet 0x77AFA8C5-->EC000004 [unknown_code_page]

[1220]ekrn.exe-->kernel32.dll-->SetUnhandledExceptionFilter, Type: Code Mismatch 0x77AFA8C5 + 3 [00]

[2572]AutoLaunchWLASU.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77C814BC-->74514618 [shimeng.dll]

[2572]AutoLaunchWLASU.exe-->crypt32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x73C01288-->74514618 [shimeng.dll]

[2572]AutoLaunchWLASU.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77B61170-->74514618 [shimeng.dll]

[2572]AutoLaunchWLASU.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x768E1414-->74514618 [shimeng.dll]

[2572]AutoLaunchWLASU.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77D51300-->74514618 [shimeng.dll]

[2572]AutoLaunchWLASU.exe-->ws2_32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x4B0D11E8-->74514618 [shimeng.dll]

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2012/01/04 20:15

Program Version: Version 1.3.5.0

Windows Version: Windows Vista SP2

==================================================

Drivers

-------------------

Name: aswMBR.sys

Image Path: C:\Users\Brian\AppData\Local\Temp\aswMBR.sys

Address: 0xAAD3F000 Size: 44544 File Visible: No Signed: -

Status: -

Name: catchme.sys

Image Path: C:\Users\Brian\AppData\Local\Temp\catchme.sys

Address: 0xAAD4C000 Size: 31744 File Visible: No Signed: -

Status: -

Name: dump_iaStor.sys

Image Path: C:\Windows\System32\Drivers\dump_iaStor.sys

Address: 0x8D806000 Size: 843776 File Visible: No Signed: -

Status: -

Name: PROCEXP113.SYS

Image Path: C:\Windows\system32\Drivers\PROCEXP113.SYS

Address: 0xAAD4A000 Size: 7872 File Visible: No Signed: -

Status: -

Name: rootrepeal.sys

Image Path: C:\Windows\system32\drivers\rootrepeal.sys

Address: 0xAAD6C000 Size: 49152 File Visible: No Signed: -

Status: -

Hidden/Locked Files

-------------------

Path: C:\hiberfil.sys