Persistant Mediashifting, Other Trojan?

mwnrnc · January 31, 2012

Multiple Malwarebytes scans have not managed to successfully remove this. Every so often when I'm in Firefox, a new tab appears with a mediashifting url. The page opened in the new tab never loads, but it does recur frequently. As of this morning (after updating Malwarebytes), I am getting new errors involving ROOTKIT.ZEROACCESS and TROJAN.AGENT that successive scans have not been able to remove. So far, my computer does not appear to be slowing down or otherwise having problems, but I want to get rid of these. Please help!

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_25

Run by Matt at 18:16:01 on 2012-01-31

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.8175.6367 [GMT -5:00]

.

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\DeviceVM\SmartView\SmartViewService.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Program Files (x86)\DeviceVM\SmartView Software Updater\WCUService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskhost.exe

C:\Windows\Explorer.EXE

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files (x86)\Steam\steam.exe

C:\Program Files (x86)\XFastUsb\XFastUsb.exe

C:\Program Files (x86)\DeviceVM\SmartView\SmartViewAgent.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\sysWOW64\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files (x86)\Common Files\Steam\SteamService.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\system32\sppsvc.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Windows\servicing\TrustedInstaller.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\wuauclt.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: H - No File

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

uRun: [ASRockXTU]

uRun: [zASRockInstantBoot]

uRun: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent

uRun: [Desktop Software] "C:\Program Files (x86)\Common Files\SupportSoft\bin\bcont.exe" /ini "C:\Program Files (x86)\ComcastUI\Desktop Software\uinstaller.ini" /fromrun /starthidden

mRun: [XFastUsb] C:\Program Files (x86)\XFastUsb\XFastUsb.exe

mRun: [smartViewAgent] "C:\Program Files (x86)\DeviceVM\SmartView\SmartViewAgent.exe"

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

dPolicies-system: DisableTaskMgr = 1 (0x1)

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000

LSP: mswsock.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{6588F69F-60CB-4D51-8D46-5F14A0383124} : DhcpNameServer = 192.168.1.1

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2 sxssrv,4

BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO-X64: AcroIEHelperStub - No File

BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO-X64: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

BHO-X64: URLRedirectionBHO - No File

BHO-X64: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

mRun-x64: [XFastUsb] C:\Program Files (x86)\XFastUsb\XFastUsb.exe

mRun-x64: [smartViewAgent] "C:\Program Files (x86)\DeviceVM\SmartView\SmartViewAgent.exe"

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\j2rid274.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.msnbc.msn.com/

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll

FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

.

============= SERVICES / DRIVERS ===============

.

R0 mv91xx;mv91xx;C:\Windows\system32\DRIVERS\mv91xx.sys --> C:\Windows\system32\DRIVERS\mv91xx.sys [?]

R1 AsrAppCharger;AsrAppCharger;C:\Windows\system32\DRIVERS\AsrAppCharger.sys --> C:\Windows\system32\DRIVERS\AsrAppCharger.sys [?]

R1 FNETURPX;FNETURPX;C:\Windows\system32\drivers\FNETURPX.SYS --> C:\Windows\system32\drivers\FNETURPX.SYS [?]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-11-10 652360]

R2 SmartViewService;SmartView service;C:\Program Files (x86)\DeviceVM\SmartView\SmartViewService.exe [2010-9-2 125216]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-7-9 248936]

R2 WCUService;SmartView Software Updater Service;C:\Program Files (x86)\DeviceVM\SmartView Software Updater\WCUService.exe [2010-9-2 456976]

R3 FNETTBOH_305;FNETTBOH_305;C:\Windows\system32\drivers\FNETTBOH_305.SYS --> C:\Windows\system32\drivers\FNETTBOH_305.SYS [?]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

.

=============== Created Last 30 ================

.

2012-01-24 23:28:11 98816 ----a-w- C:\Windows\sed.exe

2012-01-24 23:28:11 518144 ----a-w- C:\Windows\SWREG.exe

2012-01-24 23:28:11 256000 ----a-w- C:\Windows\PEV.exe

2012-01-24 23:28:11 208896 ----a-w- C:\Windows\MBR.exe

2012-01-24 23:28:06 -------- d-s---w- C:\ComboFix

2012-01-24 02:14:50 -------- d-sh--w- C:\Windows\System32\%APPDATA%

2012-01-24 02:11:52 -------- d-----w- C:\Games

2012-01-24 02:08:56 -------- d-----w- C:\Users\Matt\AppData\Local\Black_Tree_Gaming

2012-01-24 01:07:47 -------- d-----w- C:\Program Files (x86)\Amazon

2012-01-11 19:15:50 514560 ----a-w- C:\Windows\SysWow64\qdvd.dll

2012-01-11 19:15:50 366592 ----a-w- C:\Windows\System32\qdvd.dll

2012-01-11 19:15:50 1572864 ----a-w- C:\Windows\System32\quartz.dll

2012-01-11 19:15:50 1328640 ----a-w- C:\Windows\SysWow64\quartz.dll

2012-01-11 19:15:47 1739160 ----a-w- C:\Windows\System32\ntdll.dll

2012-01-11 19:15:47 1292592 ----a-w- C:\Windows\SysWow64\ntdll.dll

2012-01-11 19:15:46 77312 ----a-w- C:\Windows\System32\packager.dll

2012-01-11 19:15:46 67072 ----a-w- C:\Windows\SysWow64\packager.dll

2012-01-10 10:18:58 626688 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcr80.dll

2012-01-10 10:18:58 548864 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcp80.dll

2012-01-10 10:18:58 479232 ----a-w- C:\Program Files (x86)\Mozilla Firefox\msvcm80.dll

2012-01-10 10:18:58 43992 ----a-w- C:\Program Files (x86)\Mozilla Firefox\mozutils.dll

.

==================== Find3M ====================

.

2012-01-24 02:47:06 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2011-12-10 20:24:08 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys

2011-11-24 05:00:47 3141632 ----a-w- C:\Windows\System32\win32k.sys

2011-11-17 07:17:03 152432 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys

2011-11-17 07:17:02 95088 ----a-w- C:\Windows\System32\drivers\ksecdd.sys

2011-11-17 07:15:08 460296 ----a-w- C:\Windows\System32\drivers\cng.sys

2011-11-17 07:12:02 395776 ----a-w- C:\Windows\System32\webio.dll

2011-11-17 07:11:33 28672 ----a-w- C:\Windows\System32\sspisrv.dll

2011-11-17 07:11:33 136192 ----a-w- C:\Windows\System32\sspicli.dll

2011-11-17 07:11:02 28160 ----a-w- C:\Windows\System32\secur32.dll

2011-11-17 07:10:58 340992 ----a-w- C:\Windows\System32\schannel.dll

2011-11-17 07:08:18 1446912 ----a-w- C:\Windows\System32\lsasrv.dll

2011-11-17 07:05:16 31232 ----a-w- C:\Windows\System32\lsass.exe

2011-11-17 05:39:28 314368 ----a-w- C:\Windows\SysWow64\webio.dll

2011-11-17 05:39:21 224768 ----a-w- C:\Windows\SysWow64\schannel.dll

2011-11-17 05:39:21 22016 ----a-w- C:\Windows\SysWow64\secur32.dll

2011-11-17 05:35:13 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll

2011-11-05 05:26:29 1197568 ----a-w- C:\Windows\System32\wininet.dll

2011-11-05 05:23:10 57856 ----a-w- C:\Windows\System32\licmgr10.dll

2011-11-05 05:17:42 2048 ----a-w- C:\Windows\System32\tzres.dll

2011-11-05 04:35:50 981504 ----a-w- C:\Windows\SysWow64\wininet.dll

2011-11-05 04:34:15 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll

2011-11-05 04:30:11 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2011-11-05 04:07:32 482816 ----a-w- C:\Windows\System32\html.iec

2011-11-05 03:28:41 386048 ----a-w- C:\Windows\SysWow64\html.iec

2011-11-05 03:25:44 1638912 ----a-w- C:\Windows\System32\mshtml.tlb

2011-11-05 02:55:38 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb

.

============= FINISH: 18:17:17.49 ===============

Attach.txt

Larusso · February 1, 2012

:welcome:

Hy

my name is Daniel and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.

First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

I see you ran ComboFix without being instructed to. I would like to quote a section of the ComboFix tutorial located here: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

You should not run ComboFix unless you are specifically asked to by a helper. Also, due to the power of this tool it is strongly advised that you do not attempt to act upon any of the information displayed by ComboFix without supervision from someone who has been properly trained. If you do so, it may lead to problems with the normal functionality of your computer.

Please read and follow these instructions carefully. We do not want it to fix anything yet (if found), we need to see a report first.

Download TDSSKiller.exe and save it to your desktop

Execute TDSSKiller.exe by doubleclicking on it.
Press Start Scan
If Malicious objects are found, do NOT select Cure. Change the action to Skip, and save the log.
Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt

Please post the contents of that log in your next reply.

Please download aswMBR.exe and save it to your desktop.

Double click aswMBR.exe to start the tool.
Vista/Windows 7 users: Right click to "Run as Administrator"
The tool may ask you
This application can use AVAST! Free Antivirus to scanning
Would you like to download latest AVAST! virus definitions ?
Please click No
Click Scan
Upon completion of the scan, click Save log and save it to your desktop, and post the aswmbr.txt in your next reply for review. Note - do NOT attempt any Fix yet.
You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.

Please post in your next reply

TDSSKiller Log

aswMBR.txt

mwnrnc · February 1, 2012

No problems from TDSSKiller

18:23:33.0257 2472 TDSS rootkit removing tool 2.7.9.0 Feb 1 2012 09:28:49

18:23:33.0616 2472 ============================================================

18:23:33.0616 2472 Current date / time: 2012/02/01 18:23:33.0616

18:23:33.0616 2472 SystemInfo:

18:23:33.0616 2472

18:23:33.0617 2472 OS Version: 6.1.7600 ServicePack: 0.0

18:23:33.0617 2472 Product type: Workstation

18:23:33.0617 2472 ComputerName: ICARUS

18:23:33.0617 2472 UserName: Matt

18:23:33.0617 2472 Windows directory: C:\Windows

18:23:33.0617 2472 System windows directory: C:\Windows

18:23:33.0617 2472 Running under WOW64

18:23:33.0617 2472 Processor architecture: Intel x64

18:23:33.0617 2472 Number of processors: 8

18:23:33.0617 2472 Page size: 0x1000

18:23:33.0617 2472 Boot type: Normal boot

18:23:33.0617 2472 ============================================================

18:23:34.0350 2472 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

18:23:34.0354 2472 Drive \Device\Harddisk1\DR1 - Size: 0xE8B6F00000 (930.86 Gb), SectorSize: 0x200, Cylinders: 0x1DAAB, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'

18:23:34.0379 2472 \Device\Harddisk0\DR0:

18:23:34.0379 2472 MBR used

18:23:34.0379 2472 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000

18:23:34.0379 2472 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x746D3800

18:23:34.0379 2472 \Device\Harddisk1\DR1:

18:23:34.0379 2472 MBR used

18:23:34.0379 2472 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x745B77C0

18:23:34.0440 2472 Initialize success

18:23:34.0440 2472 ============================================================

18:23:35.0934 3308 ============================================================

18:23:35.0934 3308 Scan started

18:23:35.0934 3308 Mode: Manual;

18:23:35.0934 3308 ============================================================

18:23:37.0175 3308 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys

18:23:37.0178 3308 1394ohci - ok

18:23:37.0199 3308 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys

18:23:37.0203 3308 ACPI - ok

18:23:37.0225 3308 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys

18:23:37.0226 3308 AcpiPmi - ok

18:23:37.0248 3308 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys

18:23:37.0255 3308 adp94xx - ok

18:23:37.0266 3308 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys

18:23:37.0271 3308 adpahci - ok

18:23:37.0289 3308 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys

18:23:37.0292 3308 adpu320 - ok

18:23:37.0350 3308 AFD (6ef20ddf3172e97d69f596fb90602f29) C:\Windows\system32\drivers\afd.sys

18:23:37.0357 3308 AFD - ok

18:23:37.0377 3308 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys

18:23:37.0379 3308 agp440 - ok

18:23:37.0399 3308 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys

18:23:37.0400 3308 aliide - ok

18:23:37.0413 3308 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys

18:23:37.0414 3308 amdide - ok

18:23:37.0436 3308 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys

18:23:37.0437 3308 AmdK8 - ok

18:23:37.0453 3308 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys

18:23:37.0455 3308 AmdPPM - ok

18:23:37.0493 3308 amdsata (ec7ebab00a4d8448bab68d1e49b4beb9) C:\Windows\system32\drivers\amdsata.sys

18:23:37.0494 3308 amdsata - ok

18:23:37.0516 3308 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys

18:23:37.0519 3308 amdsbs - ok

18:23:37.0534 3308 amdxata (db27766102c7bf7e95140a2aa81d042e) C:\Windows\system32\drivers\amdxata.sys

18:23:37.0534 3308 amdxata - ok

18:23:37.0549 3308 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys

18:23:37.0551 3308 AppID - ok

18:23:37.0606 3308 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys

18:23:37.0608 3308 arc - ok

18:23:37.0628 3308 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys

18:23:37.0630 3308 arcsas - ok

18:23:37.0668 3308 AsrAppCharger (912a215ce180a6e7c923c662d7ec777d) C:\Windows\system32\DRIVERS\AsrAppCharger.sys

18:23:37.0668 3308 AsrAppCharger - ok

18:23:37.0682 3308 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys

18:23:37.0683 3308 AsyncMac - ok

18:23:37.0701 3308 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys

18:23:37.0701 3308 atapi - ok

18:23:37.0744 3308 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys

18:23:37.0751 3308 b06bdrv - ok

18:23:37.0810 3308 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys

18:23:37.0814 3308 b57nd60a - ok

18:23:37.0841 3308 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys

18:23:37.0842 3308 Beep - ok

18:23:37.0882 3308 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys

18:23:37.0883 3308 blbdrive - ok

18:23:37.0921 3308 bowser (19d20159708e152267e53b66677a4995) C:\Windows\system32\DRIVERS\bowser.sys

18:23:37.0922 3308 bowser - ok

18:23:37.0944 3308 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys

18:23:37.0945 3308 BrFiltLo - ok

18:23:37.0957 3308 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys

18:23:37.0958 3308 BrFiltUp - ok

18:23:37.0994 3308 BridgeMP (5c2f352a4e961d72518261257aae204b) C:\Windows\system32\DRIVERS\bridge.sys

18:23:37.0996 3308 BridgeMP - ok

18:23:38.0019 3308 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys

18:23:38.0023 3308 Brserid - ok

18:23:38.0037 3308 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys

18:23:38.0039 3308 BrSerWdm - ok

18:23:38.0056 3308 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys

18:23:38.0057 3308 BrUsbMdm - ok

18:23:38.0064 3308 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys

18:23:38.0065 3308 BrUsbSer - ok

18:23:38.0083 3308 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys

18:23:38.0085 3308 BTHMODEM - ok

18:23:38.0109 3308 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys

18:23:38.0110 3308 cdfs - ok

18:23:38.0127 3308 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys

18:23:38.0129 3308 cdrom - ok

18:23:38.0150 3308 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys

18:23:38.0152 3308 circlass - ok

18:23:38.0190 3308 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys

18:23:38.0195 3308 CLFS - ok

18:23:38.0235 3308 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys

18:23:38.0236 3308 CmBatt - ok

18:23:38.0255 3308 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys

18:23:38.0256 3308 cmdide - ok

18:23:38.0293 3308 CNG (937beb186a735aca91d717044a49d17e) C:\Windows\system32\Drivers\cng.sys

18:23:38.0299 3308 CNG - ok

18:23:38.0317 3308 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys

18:23:38.0318 3308 Compbatt - ok

18:23:38.0334 3308 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys

18:23:38.0335 3308 CompositeBus - ok

18:23:38.0358 3308 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys

18:23:38.0359 3308 crcdisk - ok

18:23:38.0410 3308 DfsC (9c253ce7311ca60fc11c774692a13208) C:\Windows\system32\Drivers\dfsc.sys

18:23:38.0411 3308 DfsC - ok

18:23:38.0424 3308 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys

18:23:38.0425 3308 discache - ok

18:23:38.0442 3308 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys

18:23:38.0443 3308 Disk - ok

18:23:38.0481 3308 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys

18:23:38.0482 3308 drmkaud - ok

18:23:38.0527 3308 DXGKrnl (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys

18:23:38.0539 3308 DXGKrnl - ok

18:23:38.0610 3308 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys

18:23:38.0667 3308 ebdrv - ok

18:23:38.0694 3308 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys

18:23:38.0700 3308 elxstor - ok

18:23:38.0717 3308 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys

18:23:38.0717 3308 ErrDev - ok

18:23:38.0739 3308 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys

18:23:38.0742 3308 exfat - ok

18:23:38.0761 3308 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys

18:23:38.0764 3308 fastfat - ok

18:23:38.0787 3308 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys

18:23:38.0788 3308 fdc - ok

18:23:38.0803 3308 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys

18:23:38.0804 3308 FileInfo - ok

18:23:38.0816 3308 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys

18:23:38.0817 3308 Filetrace - ok

18:23:38.0830 3308 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys

18:23:38.0831 3308 flpydisk - ok

18:23:38.0857 3308 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys

18:23:38.0860 3308 FltMgr - ok

18:23:38.0890 3308 FNETTBOH_305 (fe95ae537b41a7e2f4cfe353064dc4af) C:\Windows\system32\drivers\FNETTBOH_305.SYS

18:23:38.0891 3308 FNETTBOH_305 - ok

18:23:38.0923 3308 FNETURPX (7c3c4b4c951ec1bdfd4f769d05e2cc68) C:\Windows\system32\drivers\FNETURPX.SYS

18:23:38.0924 3308 FNETURPX - ok

18:23:38.0957 3308 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys

18:23:38.0959 3308 FsDepends - ok

18:23:38.0978 3308 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys

18:23:38.0979 3308 Fs_Rec - ok

18:23:39.0003 3308 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys

18:23:39.0006 3308 fvevol - ok

18:23:39.0025 3308 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys

18:23:39.0026 3308 gagp30kx - ok

18:23:39.0064 3308 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys

18:23:39.0065 3308 GEARAspiWDM - ok

18:23:39.0068 3308 GMSIPCI - ok

18:23:39.0090 3308 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys

18:23:39.0091 3308 hcw85cir - ok

18:23:39.0122 3308 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys

18:23:39.0127 3308 HdAudAddService - ok

18:23:39.0151 3308 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys

18:23:39.0153 3308 HDAudBus - ok

18:23:39.0175 3308 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys

18:23:39.0176 3308 HidBatt - ok

18:23:39.0201 3308 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys

18:23:39.0203 3308 HidBth - ok

18:23:39.0230 3308 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys

18:23:39.0232 3308 HidIr - ok

18:23:39.0253 3308 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys

18:23:39.0254 3308 HidUsb - ok

18:23:39.0278 3308 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys

18:23:39.0279 3308 HpSAMD - ok

18:23:39.0314 3308 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys

18:23:39.0323 3308 HTTP - ok

18:23:39.0339 3308 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys

18:23:39.0339 3308 hwpolicy - ok

18:23:39.0363 3308 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys

18:23:39.0365 3308 i8042prt - ok

18:23:39.0403 3308 iaStorV (b75e45c564e944a2657167d197ab29da) C:\Windows\system32\drivers\iaStorV.sys

18:23:39.0408 3308 iaStorV - ok

18:23:39.0425 3308 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys

18:23:39.0427 3308 iirsp - ok

18:23:39.0514 3308 IntcAzAudAddService (e8017f1662d9142f45ceab694d013c00) C:\Windows\system32\drivers\RTKVHD64.sys

18:23:39.0560 3308 IntcAzAudAddService - ok

18:23:39.0590 3308 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys

18:23:39.0591 3308 intelide - ok

18:23:39.0615 3308 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys

18:23:39.0616 3308 intelppm - ok

18:23:39.0632 3308 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys

18:23:39.0634 3308 IpFilterDriver - ok

18:23:39.0876 3308 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys

18:23:39.0898 3308 IPMIDRV - ok

18:23:39.0944 3308 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys

18:23:39.0946 3308 IPNAT - ok

18:23:39.0977 3308 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys

18:23:39.0978 3308 IRENUM - ok

18:23:39.0998 3308 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys

18:23:39.0999 3308 isapnp - ok

18:23:40.0019 3308 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys

18:23:40.0023 3308 iScsiPrt - ok

18:23:40.0037 3308 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys

18:23:40.0038 3308 kbdclass - ok

18:23:40.0055 3308 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys

18:23:40.0056 3308 kbdhid - ok

18:23:40.0105 3308 KSecDD (16c1b906fc5ead84769f90b736b6bf0e) C:\Windows\system32\Drivers\ksecdd.sys

18:23:40.0107 3308 KSecDD - ok

18:23:40.0129 3308 KSecPkg (0b711550c56444879d71c7daabda6c83) C:\Windows\system32\Drivers\ksecpkg.sys

18:23:40.0131 3308 KSecPkg - ok

18:23:40.0156 3308 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys

18:23:40.0157 3308 ksthunk - ok

18:23:40.0214 3308 LHidFilt (b6552d382ff070b4ed34cbd6737277c0) C:\Windows\system32\DRIVERS\LHidFilt.Sys

18:23:40.0215 3308 LHidFilt - ok

18:23:40.0249 3308 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys

18:23:40.0251 3308 lltdio - ok

18:23:40.0275 3308 LMouFilt (73c1f563ab73d459dffe682d66476558) C:\Windows\system32\DRIVERS\LMouFilt.Sys

18:23:40.0277 3308 LMouFilt - ok

18:23:40.0302 3308 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys

18:23:40.0304 3308 LSI_FC - ok

18:23:40.0312 3308 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys

18:23:40.0314 3308 LSI_SAS - ok

18:23:40.0328 3308 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys

18:23:40.0330 3308 LSI_SAS2 - ok

18:23:40.0351 3308 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys

18:23:40.0353 3308 LSI_SCSI - ok

18:23:40.0384 3308 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys

18:23:40.0386 3308 luafv - ok

18:23:40.0419 3308 LUsbFilt (9d9714e78eac9e5368208649489c920e) C:\Windows\system32\Drivers\LUsbFilt.Sys

18:23:40.0421 3308 LUsbFilt - ok

18:23:40.0469 3308 MBAMProtector (79da94b35371b9e7104460c7693dcb2c) C:\Windows\system32\drivers\mbam.sys

18:23:40.0470 3308 MBAMProtector - ok

18:23:40.0495 3308 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys

18:23:40.0496 3308 megasas - ok

18:23:40.0536 3308 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys

18:23:40.0540 3308 MegaSR - ok

18:23:40.0567 3308 MEIx64 (1c6e73fc46b509eff9d0086aa37132df) C:\Windows\system32\DRIVERS\HECIx64.sys

18:23:40.0568 3308 MEIx64 - ok

18:23:40.0584 3308 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys

18:23:40.0586 3308 Modem - ok

18:23:40.0598 3308 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys

18:23:40.0599 3308 monitor - ok

18:23:40.0645 3308 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys

18:23:40.0646 3308 mouclass - ok

18:23:40.0669 3308 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys

18:23:40.0671 3308 mouhid - ok

18:23:40.0693 3308 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys

18:23:40.0695 3308 mountmgr - ok

18:23:40.0714 3308 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys

18:23:40.0717 3308 mpio - ok

18:23:40.0733 3308 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys

18:23:40.0735 3308 mpsdrv - ok

18:23:40.0758 3308 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys

18:23:40.0760 3308 MRxDAV - ok

18:23:40.0798 3308 mrxsmb (040d62a9d8ad28922632137acdd984f2) C:\Windows\system32\DRIVERS\mrxsmb.sys

18:23:40.0800 3308 mrxsmb - ok

18:23:40.0840 3308 mrxsmb10 (f0067552f8f9b33d7c59403ab808a3cb) C:\Windows\system32\DRIVERS\mrxsmb10.sys

18:23:40.0844 3308 mrxsmb10 - ok

18:23:40.0863 3308 mrxsmb20 (3c142d31de9f2f193218a53fe2632051) C:\Windows\system32\DRIVERS\mrxsmb20.sys

18:23:40.0865 3308 mrxsmb20 - ok

18:23:40.0886 3308 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys

18:23:40.0887 3308 msahci - ok

18:23:40.0911 3308 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys

18:23:40.0913 3308 msdsm - ok

18:23:40.0936 3308 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys

18:23:40.0936 3308 Msfs - ok

18:23:40.0955 3308 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys

18:23:40.0956 3308 mshidkmdf - ok

18:23:40.0980 3308 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys

18:23:40.0980 3308 msisadrv - ok

18:23:41.0009 3308 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys

18:23:41.0010 3308 MSKSSRV - ok

18:23:41.0029 3308 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys

18:23:41.0030 3308 MSPCLOCK - ok

18:23:41.0052 3308 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys

18:23:41.0053 3308 MSPQM - ok

18:23:41.0078 3308 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys

18:23:41.0083 3308 MsRPC - ok

18:23:41.0095 3308 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys

18:23:41.0096 3308 mssmbios - ok

18:23:41.0111 3308 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys

18:23:41.0112 3308 MSTEE - ok

18:23:41.0125 3308 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys

18:23:41.0126 3308 MTConfig - ok

18:23:41.0144 3308 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys

18:23:41.0145 3308 Mup - ok

18:23:41.0177 3308 mv91xx (4fad606c7aeb336e5aa4a005de09ca80) C:\Windows\system32\DRIVERS\mv91xx.sys

18:23:41.0181 3308 mv91xx - ok

18:23:41.0214 3308 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys

18:23:41.0218 3308 NativeWifiP - ok

18:23:41.0266 3308 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys

18:23:41.0278 3308 NDIS - ok

18:23:41.0300 3308 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys

18:23:41.0301 3308 NdisCap - ok

18:23:41.0328 3308 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys

18:23:41.0329 3308 NdisTapi - ok

18:23:41.0368 3308 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys

18:23:41.0370 3308 Ndisuio - ok

18:23:41.0394 3308 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys

18:23:41.0396 3308 NdisWan - ok

18:23:41.0404 3308 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys

18:23:41.0406 3308 NDProxy - ok

18:23:41.0419 3308 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys

18:23:41.0420 3308 NetBIOS - ok

18:23:41.0443 3308 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys

18:23:41.0446 3308 NetBT - ok

18:23:41.0520 3308 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys

18:23:41.0521 3308 nfrd960 - ok

18:23:41.0548 3308 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys

18:23:41.0549 3308 Npfs - ok

18:23:41.0569 3308 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys

18:23:41.0570 3308 nsiproxy - ok

18:23:41.0578 3308 NTACCESS - ok

18:23:41.0647 3308 Ntfs (378e0e0dfea67d98ae6ea53adbbd76bc) C:\Windows\system32\drivers\Ntfs.sys

18:23:41.0681 3308 Ntfs - ok

18:23:41.0722 3308 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys

18:23:41.0723 3308 Null - ok

18:23:41.0759 3308 NVHDA (e20abd5b229760158f753ca90b97e090) C:\Windows\system32\drivers\nvhda64v.sys

18:23:41.0762 3308 NVHDA - ok

18:23:42.0002 3308 nvlddmkm (e55cab397f77d5208db18a78b1b7c0d5) C:\Windows\system32\DRIVERS\nvlddmkm.sys

18:23:42.0201 3308 nvlddmkm - ok

18:23:42.0247 3308 nvraid (a4d9c9a608a97f59307c2f2600edc6a4) C:\Windows\system32\drivers\nvraid.sys

18:23:42.0249 3308 nvraid - ok

18:23:42.0290 3308 nvstor (6c1d5f70e7a6a3fd1c90d840edc048b9) C:\Windows\system32\drivers\nvstor.sys

18:23:42.0293 3308 nvstor - ok

18:23:42.0360 3308 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys

18:23:42.0362 3308 nv_agp - ok

18:23:42.0380 3308 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys

18:23:42.0381 3308 ohci1394 - ok

18:23:42.0415 3308 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys

18:23:42.0417 3308 Parport - ok

18:23:42.0432 3308 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys

18:23:42.0433 3308 partmgr - ok

18:23:42.0455 3308 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys

18:23:42.0457 3308 pci - ok

18:23:42.0468 3308 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys

18:23:42.0468 3308 pciide - ok

18:23:42.0485 3308 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys

18:23:42.0488 3308 pcmcia - ok

18:23:42.0506 3308 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys

18:23:42.0506 3308 pcw - ok

18:23:42.0535 3308 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys

18:23:42.0544 3308 PEAUTH - ok

18:23:42.0589 3308 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys

18:23:42.0591 3308 PptpMiniport - ok

18:23:42.0613 3308 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys

18:23:42.0614 3308 Processor - ok

18:23:42.0642 3308 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys

18:23:42.0644 3308 Psched - ok

18:23:42.0698 3308 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys

18:23:42.0730 3308 ql2300 - ok

18:23:42.0747 3308 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys

18:23:42.0749 3308 ql40xx - ok

18:23:42.0770 3308 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys

18:23:42.0771 3308 QWAVEdrv - ok

18:23:42.0793 3308 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys

18:23:42.0794 3308 RasAcd - ok

18:23:42.0817 3308 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys

18:23:42.0818 3308 RasAgileVpn - ok

18:23:42.0833 3308 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys

18:23:42.0835 3308 Rasl2tp - ok

18:23:42.0852 3308 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys

18:23:42.0854 3308 RasPppoe - ok

18:23:42.0875 3308 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys

18:23:42.0877 3308 RasSstp - ok

18:23:42.0900 3308 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys

18:23:42.0903 3308 rdbss - ok

18:23:42.0922 3308 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys

18:23:42.0924 3308 rdpbus - ok

18:23:42.0947 3308 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys

18:23:42.0947 3308 RDPCDD - ok

18:23:42.0966 3308 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys

18:23:42.0967 3308 RDPENCDD - ok

18:23:42.0987 3308 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys

18:23:42.0987 3308 RDPREFMP - ok

18:23:43.0003 3308 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys

18:23:43.0007 3308 RDPWD - ok

18:23:43.0029 3308 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys

18:23:43.0032 3308 rdyboost - ok

18:23:43.0056 3308 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys

18:23:43.0058 3308 rspndr - ok

18:23:43.0101 3308 RTL8167 (4b42bc58294e83a6a92ec8b88c14c4a3) C:\Windows\system32\DRIVERS\Rt64win7.sys

18:23:43.0104 3308 RTL8167 - ok

18:23:43.0149 3308 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys

18:23:43.0151 3308 sbp2port - ok

18:23:43.0168 3308 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys

18:23:43.0169 3308 scfilter - ok

18:23:43.0190 3308 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys

18:23:43.0191 3308 secdrv - ok

18:23:43.0213 3308 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys

18:23:43.0214 3308 Serenum - ok

18:23:43.0241 3308 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys

18:23:43.0243 3308 Serial - ok

18:23:43.0272 3308 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys

18:23:43.0273 3308 sermouse - ok

18:23:43.0289 3308 SetupNTGLM7X - ok

18:23:43.0311 3308 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys

18:23:43.0312 3308 sffdisk - ok

18:23:43.0330 3308 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys

18:23:43.0331 3308 sffp_mmc - ok

18:23:43.0347 3308 sffp_sd (5588b8c6193eb1522490c122eb94dffa) C:\Windows\system32\DRIVERS\sffp_sd.sys

18:23:43.0348 3308 sffp_sd - ok

18:23:43.0370 3308 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys

18:23:43.0371 3308 sfloppy - ok

18:23:43.0393 3308 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys

18:23:43.0394 3308 SiSRaid2 - ok

18:23:43.0416 3308 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys

18:23:43.0418 3308 SiSRaid4 - ok

18:23:43.0454 3308 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys

18:23:43.0455 3308 Smb - ok

18:23:43.0480 3308 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys

18:23:43.0480 3308 spldr - ok

18:23:43.0526 3308 srv (2408c0366d96bcdf63e8f1c78e4a29c5) C:\Windows\system32\DRIVERS\srv.sys

18:23:43.0532 3308 srv - ok

18:23:43.0554 3308 srv2 (76548f7b818881b47d8d1ae1be9c11f8) C:\Windows\system32\DRIVERS\srv2.sys

18:23:43.0559 3308 srv2 - ok

18:23:43.0585 3308 srvnet (0af6e19d39c70844c5caa8fb0183c36e) C:\Windows\system32\DRIVERS\srvnet.sys

18:23:43.0587 3308 srvnet - ok

18:23:43.0633 3308 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys

18:23:43.0634 3308 stexstor - ok

18:23:43.0669 3308 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys

18:23:43.0670 3308 swenum - ok

18:23:43.0765 3308 Tcpip (f18f56efc0bfb9c87ba01c37b27f4da5) C:\Windows\system32\drivers\tcpip.sys

18:23:43.0798 3308 Tcpip - ok

18:23:43.0829 3308 TCPIP6 (f18f56efc0bfb9c87ba01c37b27f4da5) C:\Windows\system32\DRIVERS\tcpip.sys

18:23:43.0843 3308 TCPIP6 - ok

18:23:43.0866 3308 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys

18:23:43.0867 3308 tcpipreg - ok

18:23:43.0890 3308 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys

18:23:43.0891 3308 TDPIPE - ok

18:23:43.0910 3308 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys

18:23:43.0911 3308 TDTCP - ok

18:23:43.0927 3308 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys

18:23:43.0929 3308 tdx - ok

18:23:43.0943 3308 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys

18:23:43.0944 3308 TermDD - ok

18:23:43.0978 3308 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys

18:23:43.0980 3308 tssecsrv - ok

18:23:44.0006 3308 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys

18:23:44.0008 3308 tunnel - ok

18:23:44.0031 3308 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys

18:23:44.0033 3308 uagp35 - ok

18:23:44.0054 3308 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys

18:23:44.0059 3308 udfs - ok

18:23:44.0083 3308 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys

18:23:44.0084 3308 uliagpkx - ok

18:23:44.0101 3308 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys

18:23:44.0102 3308 umbus - ok

18:23:44.0117 3308 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys

18:23:44.0118 3308 UmPass - ok

18:23:44.0176 3308 USBAAPL64 (f724b03c3dfaacf08d17d38bf3333583) C:\Windows\system32\Drivers\usbaapl64.sys

18:23:44.0177 3308 USBAAPL64 - ok

18:23:44.0225 3308 usbccgp (7b6a127c93ee590e4d79a5f2a76fe46f) C:\Windows\system32\DRIVERS\usbccgp.sys

18:23:44.0227 3308 usbccgp - ok

18:23:44.0258 3308 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys

18:23:44.0260 3308 usbcir - ok

18:23:44.0291 3308 usbehci (92969ba5ac44e229c55a332864f79677) C:\Windows\system32\drivers\usbehci.sys

18:23:44.0292 3308 usbehci - ok

18:23:44.0339 3308 usbhub (e7df1cfd28ca86b35ef5add0735ceef3) C:\Windows\system32\DRIVERS\usbhub.sys

18:23:44.0343 3308 usbhub - ok

18:23:44.0371 3308 usbohci (f1bb1e55f1e7a65c5839ccc7b36d773e) C:\Windows\system32\drivers\usbohci.sys

18:23:44.0372 3308 usbohci - ok

18:23:44.0388 3308 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys

18:23:44.0389 3308 usbprint - ok

18:23:44.0425 3308 USBSTOR (f39983647bc1f3e6100778ddfe9dce29) C:\Windows\system32\DRIVERS\USBSTOR.SYS

18:23:44.0427 3308 USBSTOR - ok

18:23:44.0466 3308 usbuhci (bc3070350a491d84b518d7cca9abd36f) C:\Windows\system32\drivers\usbuhci.sys

18:23:44.0467 3308 usbuhci - ok

18:23:44.0504 3308 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys

18:23:44.0505 3308 vdrvroot - ok

18:23:44.0527 3308 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys

18:23:44.0529 3308 vga - ok

18:23:44.0545 3308 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys

18:23:44.0546 3308 VgaSave - ok

18:23:44.0565 3308 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys

18:23:44.0568 3308 vhdmp - ok

18:23:44.0594 3308 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys

18:23:44.0595 3308 viaide - ok

18:23:44.0612 3308 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys

18:23:44.0614 3308 volmgr - ok

18:23:44.0640 3308 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys

18:23:44.0645 3308 volmgrx - ok

18:23:44.0664 3308 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys

18:23:44.0668 3308 volsnap - ok

18:23:44.0697 3308 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys

18:23:44.0700 3308 vsmraid - ok

18:23:44.0720 3308 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys

18:23:44.0721 3308 vwifibus - ok

18:23:44.0750 3308 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys

18:23:44.0751 3308 WacomPen - ok

18:23:44.0784 3308 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys

18:23:44.0786 3308 WANARP - ok

18:23:44.0789 3308 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys

18:23:44.0791 3308 Wanarpv6 - ok

18:23:44.0835 3308 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys

18:23:44.0836 3308 Wd - ok

18:23:44.0860 3308 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys

18:23:44.0868 3308 Wdf01000 - ok

18:23:44.0894 3308 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys

18:23:44.0895 3308 WfpLwf - ok

18:23:44.0902 3308 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys

18:23:44.0903 3308 WIMMount - ok

18:23:44.0988 3308 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys

18:23:44.0988 3308 WmiAcpi - ok

18:23:45.0012 3308 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys

18:23:45.0013 3308 ws2ifsl - ok

18:23:45.0041 3308 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys

18:23:45.0042 3308 WudfPf - ok

18:23:45.0064 3308 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys

18:23:45.0067 3308 WUDFRd - ok

18:23:45.0083 3308 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

18:23:45.0125 3308 \Device\Harddisk0\DR0 - ok

18:23:45.0432 3308 MBR (0x1B8) (a37654aff661080bf986ebd6e9ea1ac5) \Device\Harddisk1\DR1

18:23:45.0435 3308 \Device\Harddisk1\DR1 - ok

18:23:45.0438 3308 Boot (0x1200) (f1b2bbfda9dd4006288e26f5f874a8c1) \Device\Harddisk0\DR0\Partition0

18:23:45.0438 3308 \Device\Harddisk0\DR0\Partition0 - ok

18:23:45.0451 3308 Boot (0x1200) (dd70f85db53a487712708f4fc0bcdae4) \Device\Harddisk0\DR0\Partition1

18:23:45.0452 3308 \Device\Harddisk0\DR0\Partition1 - ok

18:23:45.0455 3308 Boot (0x1200) (385fdb8cae324a00549542526b91cd2c) \Device\Harddisk1\DR1\Partition0

18:23:45.0456 3308 \Device\Harddisk1\DR1\Partition0 - ok

18:23:45.0457 3308 ============================================================

18:23:45.0457 3308 Scan finished

18:23:45.0457 3308 ============================================================

18:23:45.0465 3456 Detected object count: 0

18:23:45.0465 3456 Actual detected object count: 0

aswMBR

Run date: 2012-02-01 18:26:31

-----------------------------

18:26:31.750 OS Version: Windows x64 6.1.7600

18:26:31.750 Number of processors: 8 586 0x2A07

18:26:31.751 ComputerName: ICARUS UserName: Matt

18:26:33.731 Initialize success

18:26:41.591 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

18:26:41.594 Disk 0 Vendor: WDC_WD10EADS-00M2B0 01.00A01 Size: 953869MB BusType: 3

18:26:41.608 Disk 0 MBR read successfully

18:26:41.611 Disk 0 MBR scan

18:26:41.613 Disk 0 Windows 7 default MBR code

18:26:41.616 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048

18:26:41.631 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 953767 MB offset 206848

18:26:41.635 Service scanning

18:26:42.650 Modules scanning

18:26:42.654 Disk 0 trace - called modules:

18:26:42.664 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys

18:26:42.669 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8008005060]

18:26:42.673 3 CLASSPNP.SYS[fffff8800199443f] -> nt!IofCallDriver -> [0xfffffa800783c520]

18:26:42.677 5 ACPI.sys[fffff88000f98781] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa800783e060]

18:26:42.683 Scan finished successfully

18:26:54.443 Disk 0 MBR has been saved successfully to "C:\Users\Matt\Desktop\MBR.dat"

18:26:54.448 The log file has been saved successfully to "C:\Users\Matt\Desktop\aswMBR.txt"

It says I am not permitted to upload the .dat file.

mwnrnc · February 1, 2012

Ah sorry, forgot to compress it.

MBR.rar

Larusso · February 2, 2012

Hy there,

I see you are using peer 2 peer software. In your case eMule and BitTorrent

Refering to this sticky topic, I want you to uninstall this kind of software.

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================

Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unsure how to do this, please refer to this topic How to disable your security applications

====================================================

Double click on combofix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

*Note - if after running ComboFix you see a message similar to 'registry key marked for deletion..' rebooting the machine will resolve that.

Please post in your next reply

Combofix.txt

mwnrnc · February 2, 2012

eMule and BitTorrent removed.

Combofix.txt

ComboFix 12-02-02.01 - Matt 02/02/2012 9:23.1.8 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.8175.6266 [GMT -5:00]

Running from: c:\users\Matt\Desktop\ComboFix.exe

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\install.exe

c:\users\Matt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check

c:\users\Matt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check\System Check.lnk

c:\users\Matt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Check\Uninstall System Check.lnk

c:\windows\assembly\tmp\U

c:\windows\assembly\tmp\U\00000001.@

c:\windows\assembly\tmp\U\000000c0.@

c:\windows\assembly\tmp\U\000000cb.@

c:\windows\assembly\tmp\U\000000cf.@

c:\windows\assembly\tmp\U\80000000.@

c:\windows\assembly\tmp\U\800000c0.@

c:\windows\assembly\tmp\U\800000cb.@

c:\windows\assembly\tmp\U\800000cf.@

c:\windows\system32\consrv.dll

c:\windows\system32\MRESP50a64.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_rtl8187Se

.

((((((((((((((((((((((((( Files Created from 2012-01-02 to 2012-02-02 )))))))))))))))))))))))))))))))

.

2012-02-02 14:26 . 2012-02-02 14:26 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-01-24 02:47 . 2012-01-24 02:47 -------- d-----w- c:\windows\system32\Macromed

2012-01-24 02:14 . 2012-01-24 02:14 -------- d-sh--w- c:\windows\system32\%APPDATA%

2012-01-24 02:11 . 2012-01-24 02:12 -------- d-----w- C:\Games

2012-01-24 02:08 . 2012-01-24 02:11 -------- d-----w- c:\users\Matt\AppData\Local\Black_Tree_Gaming

2012-01-24 01:08 . 2012-01-24 01:08 -------- d-----w- c:\users\Matt\AppData\Roaming\Amazon

2012-01-24 01:07 . 2012-01-24 01:07 -------- d-----w- c:\program files (x86)\Amazon

2012-01-11 19:15 . 2011-10-26 05:22 366592 ----a-w- c:\windows\system32\qdvd.dll

2012-01-11 19:15 . 2011-10-26 05:22 1572864 ----a-w- c:\windows\system32\quartz.dll

2012-01-11 19:15 . 2011-10-26 04:28 1328640 ----a-w- c:\windows\SysWow64\quartz.dll

2012-01-11 19:15 . 2011-10-26 04:28 514560 ----a-w- c:\windows\SysWow64\qdvd.dll

2012-01-11 19:15 . 2011-11-17 07:14 1739160 ----a-w- c:\windows\system32\ntdll.dll

2012-01-11 19:15 . 2011-11-17 05:41 1292592 ----a-w- c:\windows\SysWow64\ntdll.dll

2012-01-11 19:15 . 2011-11-19 15:07 77312 ----a-w- c:\windows\system32\packager.dll

2012-01-11 19:15 . 2011-11-19 14:06 67072 ----a-w- c:\windows\SysWow64\packager.dll

2012-01-10 10:18 . 2012-01-10 10:18 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll

2012-01-10 10:18 . 2012-01-10 10:18 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll

2012-01-10 10:18 . 2012-01-10 10:18 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll

2012-01-10 10:18 . 2012-01-10 10:18 43992 ----a-w- c:\program files (x86)\Mozilla Firefox\mozutils.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-01-24 02:47 . 2011-06-25 14:23 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-12-10 20:24 . 2011-11-11 04:16 23152 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-24 05:00 . 2011-12-15 04:21 3141632 ----a-w- c:\windows\system32\win32k.sys

2011-11-05 05:26 . 2011-12-15 04:21 1197568 ----a-w- c:\windows\system32\wininet.dll

2011-11-05 05:23 . 2011-12-15 04:21 57856 ----a-w- c:\windows\system32\licmgr10.dll

2011-11-05 05:17 . 2011-12-15 04:21 2048 ----a-w- c:\windows\system32\tzres.dll

2011-11-05 04:35 . 2011-12-15 04:21 981504 ----a-w- c:\windows\SysWow64\wininet.dll

2011-11-05 04:34 . 2011-12-15 04:21 44544 ----a-w- c:\windows\SysWow64\licmgr10.dll

2011-11-05 04:30 . 2011-12-15 04:21 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2011-11-05 04:07 . 2011-12-15 04:21 482816 ----a-w- c:\windows\system32\html.iec

2011-11-05 03:28 . 2011-12-15 04:21 386048 ----a-w- c:\windows\SysWow64\html.iec

2011-11-05 03:25 . 2011-12-15 04:21 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2011-11-05 02:55 . 2011-12-15 04:21 1638912 ----a-w- c:\windows\SysWow64\mshtml.tlb

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ASRockXTU"="" [bU]

"zASRockInstantBoot"="" [bU]

"Steam"="c:\program files (x86)\Steam\Steam.exe" [2011-08-11 1242448]

"Desktop Software"="c:\program files (x86)\Common Files\SupportSoft\bin\bcont.exe" [2009-04-24 1025320]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"XFastUsb"="c:\program files (x86)\XFastUsb\XFastUsb.exe" [2011-01-23 4942336]

"SmartViewAgent"="c:\program files (x86)\DeviceVM\SmartView\SmartViewAgent.exe" [2010-09-02 948504]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-01-25 421160]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]

R3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys [x]

S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys [x]

S1 FNETURPX;FNETURPX;c:\windows\system32\drivers\FNETURPX.SYS [x]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]

S2 SmartViewService;SmartView service;c:\program files (x86)\DeviceVM\SmartView\SmartViewService.exe [2010-09-02 125216]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-07-09 248936]

S2 WCUService;SmartView Software Updater Service;c:\program files (x86)\DeviceVM\SmartView Software Updater\WCUService.exe [2010-09-02 456976]

S3 FNETTBOH_305;FNETTBOH_305;c:\windows\system32\drivers\FNETTBOH_305.SYS [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 MEIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

.

--------- x86-64 -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 130576]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-28 11101800]

"combofix"="c:\combofix\CF14479.3XE" [2009-07-14 344576]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

rtl8187Se

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\Matt\AppData\Roaming\Mozilla\Firefox\Profiles\j2rid274.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.msnbc.msn.com/

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{0F3DC9E0-C459-4a40-BCF8-747BD9322E10} - (no file)

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Bonjour\mDNSResponder.exe

.

**************************************************************************

.

Completion time: 2012-02-02 09:34:26 - machine was rebooted

ComboFix-quarantined-files.txt 2012-02-02 14:34

ComboFix2.txt 2012-01-24 23:40

.

Pre-Run: 586,046,558,208 bytes free

Post-Run: 585,857,327,104 bytes free

.

- - End Of File - - 06C8B17552026F5695484B2F3C8C5237

Larusso · February 2, 2012

How is your system behaving now ?

Open notepad and copy/paste the text in the Code-box below into it:


NetSvc::
rtl8187Se

ClearJavaCache::

Save this as CFScript.txt, in the same location as ComboFix.exe.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Refering to the picture above, drag CFScript into ComboFix.exe.
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
I notice you have Malwarebytes' Anti-Malware installed on your machine. Please launch the program and select the update tab, then click on the check for updates button.

If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform Quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Save it to your desktop.

Note: Malwarebytes' Anti-Malware may require a reboot to complete removals. After a reboot, if required, post that saved log in your next reply.

Please post in your next reply

Combofix.txt

MBAM Log

Note any open issues

mwnrnc · February 3, 2012

It seems to be running alright now, none of my previously listed issues have recurred. Malwarebytes did not detect any problems.

ComboFix 12-02-02.01 - Matt 02/02/2012 20:34:44.2.8 - x64

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.8175.6571 [GMT -5:00]

Running from: c:\users\Matt\Desktop\ComboFix.exe

Command switches used :: c:\users\Matt\Desktop\CFScript.txt

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\assembly\tmp\U

.

((((((((((((((((((((((((( Files Created from 2012-01-03 to 2012-02-03 )))))))))))))))))))))))))))))))

.

2012-02-03 01:38 . 2012-02-03 01:38 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-01-25 20:32 . 2011-11-17 07:17 152432 ----a-w- c:\windows\system32\drivers\ksecpkg.sys